Spring Integration provides integration with the Spring Security project to allow role based security checks to be applied to channel send and receive invocations.
Spring Integration provides the interceptor
ChannelSecurityInterceptor, which extends
AbstractSecurityInterceptor and intercepts send and receive calls on the channel. Access decisions
are then made with reference to
ChannelInvocationDefinitionSource which provides the definition of
the send and receive security constraints. The interceptor requires that a valid
has been established by authenticating with Spring Security, see the Spring Security reference documentation for details.
Namespace support is provided to allow easy configuration of security constraints. This consists of the secured channels tag which allows
definition of one or more channel name patterns in conjunction with a definition of the security configuration for send and receive. The pattern
<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/integration" xmlns:si-security="http://www.springframework.org/schema/integration/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-2.0.xsd http://www.springframework.org/schema/integration/security http://www.springframework.org/schema/integration/security/spring-integration-security-2.0.xsd"> <si-security:secured-channels> <si-security:access-policy pattern="admin.*" send-access="ROLE_ADMIN"/> <si-security:access-policy pattern="user.*" receive-access="ROLE_USER"/> </si-security:secured-channels>
By default the secured-channels namespace element expects a bean named authenticationManager which implements
AuthenticationManager and a bean named accessDecisionManager which implements
AccessDecisionManager. Where this is not the case references to the appropriate beans can be configured
as attributes of the secured-channels element as below.
<si-security:secured-channels access-decision-manager="customAccessDecisionManager" authentication-manager="customAuthenticationManager"> <si-security:access-policy pattern="admin.*" send-access="ROLE_ADMIN"/> <si-security:access-policy pattern="user.*" receive-access="ROLE_USER"/> </si-security:secured-channels>