# Authentication Services
This creates an instance of Spring Security’s ProviderManager
class, which needs to be configured with a list of one or more AuthenticationProvider
instances.
These can either be created using syntax elements provided by the namespace, or they can be standard bean definitions, marked for addition to the list using the authentication-provider
element.
# <authentication-manager>
Every Spring Security application which uses the namespace must have include this element somewhere.
It is responsible for registering the AuthenticationManager
which provides authentication services to the application.
All elements which create AuthenticationProvider
instances should be children of this element.
# <authentication-manager> Attributes
aliasThis attribute allows you to define an alias name for the internal instance for use in your own configuration.
erase-credentialsIf set to true, the AuthenticationManager will attempt to clear any credentials data in the returned Authentication object, once the user has been authenticated. Literally it maps to the
eraseCredentialsAfterAuthentication
property of theProviderManager
.idThis attribute allows you to define an id for the internal instance for use in your own configuration. It is the same as the alias element, but provides a more consistent experience with elements that use the id attribute.
# Child Elements of <authentication-manager>
# <authentication-provider>
Unless used with a ref
attribute, this element is shorthand for configuring a DaoAuthenticationProvider
.DaoAuthenticationProvider
loads user information from a UserDetailsService
and compares the username/password combination with the values supplied at login.
The UserDetailsService
instance can be defined either by using an available namespace element (jdbc-user-service
or by using the user-service-ref
attribute to point to a bean defined elsewhere in the application context).
# Parent Elements of <authentication-provider>
# <authentication-provider> Attributes
- refDefines a reference to a Spring bean that implements
AuthenticationProvider
.
If you have written your own AuthenticationProvider
implementation (or want to configure one of Spring Security’s own implementations as a traditional bean for some reason, then you can use the following syntax to add it to the internal list of ProviderManager
:
<security:authentication-manager>
<security:authentication-provider ref="myAuthenticationProvider" />
</security:authentication-manager>
<bean id="myAuthenticationProvider" class="com.something.MyAuthenticationProvider"/>
- user-service-refA reference to a bean that implements UserDetailsService that may be created using the standard bean element or the custom user-service element.
# Child Elements of <authentication-provider>
# <jdbc-user-service>
Causes creation of a JDBC-based UserDetailsService.
# <jdbc-user-service> Attributes
- authorities-by-username-queryAn SQL statement to query for a user’s granted authorities given a username.
The default is
select username, authority from authorities where username = ?
cache-refDefines a reference to a cache for use with a UserDetailsService.
data-source-refThe bean ID of the DataSource which provides the required tables.
group-authorities-by-username-queryAn SQL statement to query user’s group authorities given a username. The default is
select g.id, g.group_name, ga.authority from groups g, group_members gm, group_authorities ga where gm.username = ? and g.id = ga.group_id and g.id = gm.group_id
idA bean identifier, used for referring to the bean elsewhere in the context.
role-prefixA non-empty string prefix that will be added to role strings loaded from persistent storage (default is "ROLE_"). Use the value "none" for no prefix in cases where the default is non-empty.
users-by-username-queryAn SQL statement to query a username, password, and enabled status given a username. The default is
select username, password, enabled from users where username = ?
# <password-encoder>
Authentication providers can optionally be configured to use a password encoder as described in the Password Storage.
This will result in the bean being injected with the appropriate PasswordEncoder
instance.
# Parent Elements of <password-encoder>
# <password-encoder> Attributes
hashDefines the hashing algorithm used on user passwords. We recommend strongly against using MD4, as it is a very weak hashing algorithm.
refDefines a reference to a Spring bean that implements
PasswordEncoder
.
# <user-service>
Creates an in-memory UserDetailsService from a properties file or a list of "user" child elements. Usernames are converted to lower-case internally to allow for case-insensitive lookups, so this should not be used if case-sensitivity is required.
# <user-service> Attributes
idA bean identifier, used for referring to the bean elsewhere in the context.
propertiesThe location of a Properties file where each line is in the format of
username=password,grantedAuthority[,grantedAuthority][,enabled|disabled]
# Child Elements of <user-service>
# <user>
Represents a user in the application.
# Parent Elements of <user>
# <user> Attributes
authoritiesOne of more authorities granted to the user. Separate authorities with a comma (but no space). For example, "ROLE_USER,ROLE_ADMINISTRATOR"
disabledCan be set to "true" to mark an account as disabled and unusable.
lockedCan be set to "true" to mark an account as locked and unusable.
nameThe username assigned to the user.
passwordThe password assigned to the user. This may be hashed if the corresponding authentication provider supports hashing (remember to set the "hash" attribute of the "user-service" element). This attribute be omitted in the case where the data will not be used for authentication, but only for accessing authorities. If omitted, the namespace will generate a random value, preventing its accidental use for authentication. Cannot be empty.