Spring Security Flashcards
Normal spring projects that have to be converted to WAR and deployed in container.
Which configuration is used to automatically generate login and logout functionality in Spring security?
auto-config = “true” property means that Spring will generate default login page and logout functionality.
How to define in memory users with roles in Spring Security XML configuration?
How to get authenticated user’s name in JSP?
<h1>${title}</h1>
<h2>${message}</h2>
<h2>Welcome: ${pageContext.request.userPrincipal.name}
<a href="%24%7BlogoutUrl%7D">Sign Out</a> </h2>
pageContext.request.userPrincipal.name will contain the name of the authenticated user.
Which security expression evaluates to true if the user has been granted the specified role?
hasRole(role) and this expression has to be provided in spring-security xml.
Which tags are useful for security in view layer?
Security in view layer can be achieved using JSP tag library.
Use of tag
Allows body of the tag to be rendered if the currently authenticated user has on of the stipulated permissions in the specified domain object
Use of tag
Accesses properties of the current user’s authentication object
Use of object
Allows the body of the tag to be rendered if a specified security constraint has been met
Using which mechanisms can we authenticate user
1) In memory user repository
2) JDBC based user repository
3) LDAP based user repository
4) OpenID decentralized user identity systems
5) Central Authentication systems (CAS)
6) X.509 certificates
7) JAAS based providers.
Which tag is used to provide jdbc user repository?
How to define SQL to use for querying .
users-by-username-query: Queries for a user’s username, password and enabled status given the username
authorities-by-username-query: Queries for a user’s granted authorities given the username
group-authorities-by-username-query: Queries for a user’s group authorities given the username
Configuration for configuring custom login page in Spring Security?
In what ways we can provide method security?
1) Method annotated with @Secured from Spring security
2) Method annotated with @RolesAllowed from JSR 250
3) Methods annotated with Spring pre and post invocation annotations
4) Methods matching one or more explicitly declared pointcuts
What should be enabled in XML to allow annotation driven security?
should be configured in spring-security context.
Example of method with method level security using Secured annotation
@Secured({“ROLE_ADMIN”, “ROLE_TELLER”})
public Account post(Account account, double amount)
