As always, a Spring configuration namespace brings a specific syntax that suits the needs and uses for a module. It lightens the overall Spring configuration with a better readability. Namespaces often come with configuration by default or auto configuration tools.

The Spring Security namespace comes with the spring-security-config dependency and can be defined as follows in a Spring configuration file:

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi=http://www.w3.org/2001/XMLSchema-instance xsi:schemaLocation"="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.0.0.xsd">
    ...
</beans>

The namespace stages three top-level components: <http> (about web and HTTP security), <authentication-manager>, and <global-method-security> (service or controller restriction).

Then, other concepts are referenced by those top-level components as attribute or as child element: <authentication-provider>, <access-decision-manager> (provides access decisions for web and security methods), and <user-service> (as UserDetailsService implementations).

  <http>
    <form-login />
    <http-basic />
    <logout />
  </http>

  <filter>
    <filter-name>springSecurityFilterChain</filter-name>
  <filter-class>org.sfw.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
  <filter-name>springSecurityFilterChain</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

<security:custom-filter ref="myFilter" after="BASIC_AUTH_FILTER"/>

<security:http create-session="stateless" entry-point-ref="authenticationEntryPoint" authentication-manager- ref="authenticationManager">
  <security:custom-filter ref="basicAuthenticationFilter" after="BASIC_AUTH_FILTER" />
  <security:csrf disabled="true"/>
</security:http>
<bean id="basicAuthenticationFilter" class="org.sfw.security.web.authentication.www.BasicAuthenticationFilter">
  <constructor-arg name="authenticationManager" ref="authenticationManager" />
  <constructor-arg name="authenticationEntryPoint" ref="authenticationEntryPoint" />
</bean>
<bean id="authenticationEntryPoint" class="edu.zc.csm.api. authentication.CustomBasicAuthenticationEntryPoint">
  <property name="realmName" value="${realm.name}" />
</bean>

First of all, AuthenticationManager is a single-method interface:

public interface AuthenticationManager {
  Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

Spring Security provides one implementation: ProviderManager. This implementation allows us to plug in several AuthenticationProviders. The ProviderManager tries all the AuthenticationProviders in order, calling their authenticate method. The code is as follows:

public interface AuthenticationProvider {
  Authentication authenticate(Authentication authentication)
    throws AuthenticationException;
  boolean supports(Class<?> authentication);
}

The ProviderManager stops its iteration when it finds a non-null Authentication object. Alternatively, it fails the Authentication when an AuthenticationException is thrown.

Using the namespace, a specific AuthenticationProviders can be targeted using the ref element as shown here:

<security:authentication-manager >
  <security:authentication-provider ref='myAuthenticationProvider'/>
</security:authentication-manager>

Now, here is our configuration:

<security:authentication-manager alias"="authenticationManager"">
  <security:authentication-provider user-service-ref='communityServiceImpl'>
    <security:password-encoder ref="passwordEncoder"/>
  </security:authentication-provider>
</security:authentication-manager>

There is no ref element in our configuration. The namespace will by default instantiate a DaoAuthenticationProvider. It will also inject our UserDetailsService implementation: communityServiceImpl, because we have specified it with user-service-ref.

This DaoAuthenticationProvider throws an AuthenticationException when the password submitted in a UsernamePasswordAuthenticationToken doesn't match the one which is loaded by UserDetailsService (making use of the loadUserByUsername method).

It exists a few other AuthenticationProviders that could be used in our projects, for example,, RememberMeAuthenticationProvider, LdapAuthenticationProvider, CasAuthenticationProvider, or JaasAuthenticationProvider.

As we have said using a BASIC scheme is a great technique for REST applications. However when using it, it is critical to use an encrypted communication protocol (HTTPS) as the passwords are sent in plain text.

As demonstrated in the How to do it section, the principle is very simple. The HTTP requests are the same as usual with an extra header Authentication. This header has the value made of the keyword Basic followed by a space, followed by a String encoded in base 64.

We can find online a bunch of free services to quickly encode/decode in base 64 a String. The String to be encoded in base 64 has to be in the following form: <username>:<password>.

This section has been largely inspired from the Spring rsecurity reference, which is again a great resource:

http://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle

An appendix provides a very complete guide to the Spring Security namespace:

http://docs.spring.io/spring-security/site/docs/current/reference/html/appendix-namespace.html

We passed over the RememberMeAuthenticationFilter that provides different ways for the server to remember the identity of a Principal between sessions. The Spring Security reference provides extensive information on this topic.