You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/modules/ROOT/pages/servlet/authentication/architecture.adoc
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -117,13 +117,13 @@ However, if you do, take a look at the JavaDoc for `SecurityContextHolder` to le
117
117
[[servlet-authentication-securitycontext]]
118
118
== SecurityContext
119
119
120
-
The {security-api-url}org/springframework/security/core/context/SecurityContext.html[`SecurityContext`] is obtained from the <<servlet-authentication-securitycontextholder>>.
120
+
The javadoc:org.springframework.security.core.context.SecurityContext[] is obtained from the <<servlet-authentication-securitycontextholder>>.
121
121
The `SecurityContext` contains an <<servlet-authentication-authentication>> object.
122
122
123
123
[[servlet-authentication-authentication]]
124
124
== Authentication
125
125
126
-
The {security-api-url}org/springframework/security/core/Authentication.html[`Authentication`] interface serves two main purposes within Spring Security:
126
+
The javadoc:org.springframework.security.core.Authentication[] interface serves two main purposes within Spring Security:
127
127
128
128
* An input to <<servlet-authentication-authenticationmanager,`AuthenticationManager`>> to provide the credentials a user has provided to authenticate.
129
129
When used in this scenario, `isAuthenticated()` returns `false`.
@@ -141,7 +141,7 @@ Two examples are roles and scopes.
141
141
142
142
[[servlet-authentication-granted-authority]]
143
143
== GrantedAuthority
144
-
{security-api-url}org/springframework/security/core/GrantedAuthority.html[`GrantedAuthority`] instances are high-level permissions that the user is granted.
144
+
javadoc:org.springframework.security.core.GrantedAuthority[] instances are high-level permissions that the user is granted.
145
145
Two examples are roles and scopes.
146
146
147
147
You can obtain `GrantedAuthority` instances from the <<servlet-authentication-authentication,`Authentication.getAuthorities()`>> method.
@@ -160,7 +160,7 @@ Of course, Spring Security is expressly designed to handle this common requireme
160
160
[[servlet-authentication-authenticationmanager]]
161
161
== AuthenticationManager
162
162
163
-
{security-api-url}org/springframework/security/authentication/AuthenticationManager.html[`AuthenticationManager`] is the API that defines how Spring Security's Filters perform xref:features/authentication/index.adoc#authentication[authentication].
163
+
javadoc:org.springframework.security.authentication.AuthenticationManager[] is the API that defines how Spring Security's Filters perform xref:features/authentication/index.adoc#authentication[authentication].
164
164
The <<servlet-authentication-authentication,`Authentication`>> that is returned is then set on the <<servlet-authentication-securitycontextholder>> by the controller (that is, by xref:servlet/architecture.adoc#servlet-security-filters[Spring Security's `Filters` instances]) that invoked the `AuthenticationManager`.
165
165
If you are not integrating with Spring Security's `Filters` instances, you can set the `SecurityContextHolder` directly and are not required to use an `AuthenticationManager`.
166
166
@@ -170,7 +170,7 @@ While the implementation of `AuthenticationManager` could be anything, the most
170
170
[[servlet-authentication-providermanager]]
171
171
== ProviderManager
172
172
173
-
{security-api-url}org/springframework/security/authentication/ProviderManager.html[`ProviderManager`] is the most commonly used implementation of <<servlet-authentication-authenticationmanager,`AuthenticationManager`>>.
173
+
javadoc:org.springframework.security.authentication.ProviderManager[] is the most commonly used implementation of <<servlet-authentication-authenticationmanager,`AuthenticationManager`>>.
174
174
`ProviderManager` delegates to a `List` of <<servlet-authentication-authenticationprovider,`AuthenticationProvider`>> instances.
175
175
Each `AuthenticationProvider` has an opportunity to indicate that authentication should be successful, fail, or indicate it cannot make a decision and allow a downstream `AuthenticationProvider` to decide.
176
176
If none of the configured `AuthenticationProvider` instances can authenticate, authentication fails with a `ProviderNotFoundException`, which is a special `AuthenticationException` that indicates that the `ProviderManager` was not configured to support the type of `Authentication` that was passed into it.
@@ -202,19 +202,19 @@ If the `Authentication` contains a reference to an object in the cache (such as
202
202
You need to take this into account if you use a cache.
203
203
An obvious solution is to first make a copy of the object, either in the cache implementation or in the `AuthenticationProvider` that creates the returned `Authentication` object.
204
204
Alternatively, you can disable the `eraseCredentialsAfterAuthentication` property on `ProviderManager`.
205
-
See the Javadoc for the {security-api-url}org/springframework/security/authentication/ProviderManager.html[ProviderManager] class.
205
+
See the Javadoc for the javadoc:org.springframework.security.authentication.ProviderManager[] class.
206
206
207
207
[[servlet-authentication-authenticationprovider]]
208
208
== AuthenticationProvider
209
209
210
-
You can inject multiple {security-api-url}org/springframework/security/authentication/AuthenticationProvider.html[``AuthenticationProvider``s] instances into <<servlet-authentication-providermanager,`ProviderManager`>>.
210
+
You can inject multiple javadoc:org.springframework.security.authentication.AuthenticationProvider[] instances into <<servlet-authentication-providermanager,`ProviderManager`>>.
211
211
Each `AuthenticationProvider` performs a specific type of authentication.
212
212
For example, xref:servlet/authentication/passwords/dao-authentication-provider.adoc#servlet-authentication-daoauthenticationprovider[`DaoAuthenticationProvider`] supports username/password-based authentication, while `JwtAuthenticationProvider` supports authenticating a JWT token.
== Request Credentials with `AuthenticationEntryPoint`
216
216
217
-
{security-api-url}org/springframework/security/web/AuthenticationEntryPoint.html[`AuthenticationEntryPoint`] is used to send an HTTP response that requests credentials from a client.
217
+
javadoc:org.springframework.security.web.AuthenticationEntryPoint[] is used to send an HTTP response that requests credentials from a client.
218
218
219
219
Sometimes, a client proactively includes credentials (such as a username and password) to request a resource.
220
220
In these cases, Spring Security does not need to provide an HTTP response that requests credentials from the client, since they are already included.
@@ -231,7 +231,7 @@ The `AuthenticationEntryPoint` implementation might perform a xref:servlet/authe
{security-api-url}org/springframework/security/web/authentication/AbstractAuthenticationProcessingFilter.html[`AbstractAuthenticationProcessingFilter`] is used as a base `Filter` for authenticating a user's credentials.
234
+
javadoc:org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter[] is used as a base `Filter` for authenticating a user's credentials.
235
235
Before the credentials can be authenticated, Spring Security typically requests the credentials by using <<servlet-authentication-authenticationentrypoint,`AuthenticationEntryPoint`>>.
236
236
237
237
Next, the `AbstractAuthenticationProcessingFilter` can authenticate any authentication requests that are submitted to it.
@@ -249,24 +249,24 @@ image:{icondir}/number_3.png[] If authentication fails, then __Failure__.
249
249
* The <<servlet-authentication-securitycontextholder>> is cleared out.
250
250
* `RememberMeServices.loginFail` is invoked.
251
251
If remember me is not configured, this is a no-op.
252
-
See the {security-api-url}org/springframework/security/web/authentication/rememberme/package-frame.html[`rememberme`] package.
252
+
See the javadoc:org.springframework.security.web.authentication.rememberme.package-summary[] package.
253
253
* `AuthenticationFailureHandler` is invoked.
254
-
See the {security-api-url}org/springframework/security/web/authentication/AuthenticationFailureHandler.html[`AuthenticationFailureHandler`] interface.
254
+
See the javadoc:org.springframework.security.web.authentication.AuthenticationFailureHandler[] interface.
255
255
256
256
image:{icondir}/number_4.png[] If authentication is successful, then __Success__.
257
257
258
258
* `SessionAuthenticationStrategy` is notified of a new login.
259
259
See the {security-api-url}org/springframework/security/web/authentication/session/SessionAuthenticationStrategy.html[`SessionAuthenticationStrategy`] interface.
260
260
* The <<servlet-authentication-authentication>> is set on the <<servlet-authentication-securitycontextholder>>.
261
261
Later, if you need to save the `SecurityContext` so that it can be automatically set on future requests, `SecurityContextRepository#saveContext` must be explicitly invoked.
262
-
See the {security-api-url}org/springframework/security/web/context/SecurityContextHolderFilter.html[`SecurityContextHolderFilter`] class.
262
+
See the javadoc:org.springframework.security.web.context.SecurityContextHolderFilter[] class.
263
263
264
264
* `RememberMeServices.loginSuccess` is invoked.
265
265
If remember me is not configured, this is a no-op.
266
-
See the {security-api-url}org/springframework/security/web/authentication/rememberme/package-frame.html[`rememberme`] package.
266
+
See the javadoc:org.springframework.security.web.authentication.rememberme.package-summary[] package.
267
267
* `ApplicationEventPublisher` publishes an `InteractiveAuthenticationSuccessEvent`.
268
268
* `AuthenticationSuccessHandler` is invoked.
269
-
See the {security-api-url}org/springframework/security/web/authentication/AuthenticationSuccessHandler.html[`AuthenticationSuccessHandler`] interface.
269
+
See the javadoc:org.springframework.security.web.authentication.AuthenticationSuccessHandler[] interface.
270
270
271
271
272
272
// daoauthenticationprovider (goes in username/password)
Copy file name to clipboardExpand all lines: docs/modules/ROOT/pages/servlet/authentication/passwords/user-details.adoc
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
[[servlet-authentication-userdetails]]
2
2
= UserDetails
3
3
4
-
{security-api-url}org/springframework/security/core/userdetails/UserDetails.html[`UserDetails`] is returned by the xref:servlet/authentication/passwords/user-details-service.adoc#servlet-authentication-userdetailsservice[`UserDetailsService`].
4
+
javadoc:org.springframework.security.core.userdetails.UserDetails[] is returned by the xref:servlet/authentication/passwords/user-details-service.adoc#servlet-authentication-userdetailsservice[`UserDetailsService`].
5
5
The xref:servlet/authentication/passwords/dao-authentication-provider.adoc#servlet-authentication-daoauthenticationprovider[`DaoAuthenticationProvider`] validates the `UserDetails` and then returns an xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[`Authentication`] that has a principal that is the `UserDetails` returned by the configured `UserDetailsService`.
0 commit comments