Spring Security with ACEGI

Spring offers developers a simpler, more robust method for configuring applications. These benefits extend to security through the ACEGI framework. ACEGI makes the otherwise daunting task of securing your application logical and straightforward. More importantly, through its support for single sign-on provision through Yale's CAS system and its ability to provide instance-level authorization, Spring extends the common security model of most J2EE apps beyond what they are traditionally capable of.

In this session, we'll explore:

• configuring ACEGI to authorize against an in-memory user list, a database, and a JAAS login module

• page level authorization

• method level authorization

• instance level authorization

• forcing HTTPS connections to secured sites

• impersonation using the RunAsManager

About Justin Gehtland

Justin is the co-founder of Relevance, a consulting/training/research organization located in the Research Triangle of North Carolina. Justin has been developing applications with static and dynamic languages since 1992. He has written code with Java, .NET, C#, Visual Basic, Perl, Python and Ruby. He loves to talk, especially in front of people, but all by himself in the corner if he must. Justin is currently focused on: Rails (because its the law), Spring (because Java isn't going anywhere) and security (because paranoia is your friend).

More About Justin »