Spring Security
Ecorptrainings provides the Java web developer to the Spring Security Training framework training in hyderabad india . We start with an overview and practical exercises in basic usage: XML configuration for authentication and URL-based authorization. Then we start to dig into Spring Security training as a Java model, and develop advanced techniques including custom user realms, custom authorization constraints, method-based authorization, and instance-based authorization.
Duration: 30-35hrs
Course Content:
- Acquiring and Integrating Spring Security
- Relationship to Spring
- Relationship to Java EE Standards
- Basic Configuration
- How It Works
- Integration: LDAP, CAS, X.509, OpenID, etc.
- Integration: JAAS
Authentication
- The <http> Configuration
- The <intercept-url> Constraint
- The <form-login> Configuration
- Login Form Design
- “Remember Me”
- Anonymous “Authentication”
- Logout
- The JDBC Authentication Provider
- The Authentication/Authorization Schema
- Using Hashed Passwords
- Why Hashing Isn’t Enough
- Using Salts
- PasswordEncoder and SaltSource
- Key Lengthening
- Channel Security
- Session Management
URL Authorization
- URL Authorization
- Programmatic Authorization: Servlets
- Programmatic Authorization: Spring Security
- Role-Based Presentation
- The Spring Security Tag Library
Under the Hood: Authentication
- The Spring Security API
- The Filter Chain
- Authentication Manager and Providers
- The Security Context
- Plug-In Points
- Implementing UserDetailsService
- Connecting User Details to the Domain Model
Under the Hood: Authorization
- Authorization
- FilterSecurityInterceptor and Friends
- The AccessDecisionManager
- Voting
- Configuration Attributes
- Access-Decision Strategies
- Implementing AccessDecisionVoter
- The Role Prefix
Method and Instance Authorization
- Method Authorization
- Using Spring AOP
- XML vs. Annotations
- @PreAuthorize and @PostAuthorize
- Spring EL for Authorization
- @PreFilter and @PostFilter
- Domain-Object Authorization
- The ACL Schema
- Interface Model
- ACL-Based Presentation
Introduction to SAML/li_item]
- History of SAML
- Assertions
- Protocol
- Bindings
- Profiles
- Using OpenSAML
SAML Assertions and Protocol
- “Vouching for” a User
- Assertions and Subjects
- NameID Types
- Authentication Contexts
- Requests, Queries, and Responses
- Attribute Queries
- SAML and XML Signature
SAML Bindings
- Speaking “Through” the Browser
- The SOAP Binding
- SAML Over HTTP
- The Redirect, POST, and Artifact Bindings
- The PAOS Binding
- The URI Binding
Federated Identity and SSO
- SAML 2.0 Federations
- Single Sign-On
- Account Linking and Persistent Pseudonyms
- Transient Pseudonyms
- Name ID Mapping
- Single Logout
- Federation Termination
The Spring Security SAML Extension
- Combining SSO and Other Authentication Styles
- Customization
- Configuring an SP
- Configuring OpenAM
- Login and Logout Handlers
- IdP Discovery
- The SSO Processing Filters
- The SAML Filter Chain
- The SAML Entry Point
- The Spring Security SAML Extension
- Authorization and Attributes
OAuth for Spring Security
- Third-Party Authorization
- OAuth
- Roles and Initial Flow
- Grant Types
- Access Tokens
- The Google OAuth API
- OAuth for Spring Security
- Client-Details Services
- Token Services
- The AuthorizationEndpoint
- The TokenEndpoint
- The UserApprovalHandler
- The Resource-Server Filter
- The ScopeVoter
- The OAuth-Aware RestTemplate
- AccessTokenProviders
- The OAuth Redirecting Filter