Spring Security
Overview
Documents
Authentication
Docs
classDiagram
class AuthenticationManager {
authenticate(Authentication authentication) Authentication
}
class AuthenticationProvider {
authenticate(Authentication authentication) Authentication
supports(Class~?~ authentication) boolean
}
class UserDetailsService {
loadUserByUsername(String username) UserDetails
}
class UserDetails {
getAuthorities() Collection~? extends GrantedAuthority~
getPassword() String
isAccountNonExpired() boolean
isAccountNonLocked() boolean
isCredentialsNonExpired() boolean
isEnabled() boolean
}
AuthenticationManager --> AuthenticationProvider : authRequest
AuthenticationProvider <..> UserDetailsService : 서비스 주입 후 authenticate()에서 사용자 정보를 꺼내어 사용
UserDetailsService -- UserDetails
AuthenticationManager
AuthenticationProvider
UserDetailsService
전역적인(globally) authentication이 필요할 때 사용.
WebSecurityConfigurerAdapter를 상속해서 사용한다. 여기서 주의깊게 봐야 하는 Method는 “configure”인데, 3개의 종류를 가진다.
protected void configure(AuthenticationManagerBuilder auth)
protected void configure(HttpSecurity http)
void configure(WebSecurity web)
WebSecurityConfigurerAdapter, AbstractConfiguredSecurityBuilder, AbstractSecurityBuilder : abstract class
WebSecurity : final class
classDiagram
class SecurityConfigurer~O, B extends SecurityBuilder＜O＞~ {
init(B builder)
configure(B builder)
}
class WebSecurityConfigurer~T extends SecurityBuilder＜Filter＞~
class SecurityBuilder~O~ {
build() O
}
class AbstractSecurityBuilder~O~
class AbstractConfiguredSecurityBuilder~O, B extends SecurityBuilder＜O＞~
class WebSecurity
SecurityConfigurer <|-- WebSecurityConfigurer : ＜Filter, T extends SecurityBuilder＜Filter＞＞
WebSecurityConfigurer <|-- WebSecurityConfigurerAdapter : ＜WebSecurity＞
SecurityBuilder <|-- AbstractSecurityBuilder
AbstractSecurityBuilder <|-- AbstractConfiguredSecurityBuilder
AbstractConfiguredSecurityBuilder <|-- WebSecurity : ＜Filter, WebSecurity＞
Aware <|-- ApplicationContextAware
SecurityBuilder <|-- WebSecurity : ＜Filter＞
ApplicationContextAware <|-- WebSecurity
Authorization
Protection Against Exploits
