Spring Integration builds upon the Spring Security project to enable role based security checks to be applied to channel send and receive invocations.
Spring Integration provides the interceptor
ChannelSecurityInterceptor, which extends
AbstractSecurityInterceptor and intercepts send and receive calls on the channel. Access decisions
are then made with reference to a
ChannelSecurityMetadataSource which provides the metadata describing
the send and receive access policies for certain channels. The interceptor requires that a valid
has been established by authenticating with Spring Security. See the Spring Security reference documentation for details.
Namespace support is provided to allow easy configuration of security constraints. This consists of the secured channels tag which allows
definition of one or more channel name patterns in conjunction with a definition of the security configuration for send and receive. The pattern
<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/integration" xmlns:si-security="http://www.springframework.org/schema/integration/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd http://www.springframework.org/schema/integration http://www.springframework.org/schema/integration/spring-integration-2.0.xsd http://www.springframework.org/schema/integration/security http://www.springframework.org/schema/integration/security/spring-integration-security-2.0.xsd"> <si-security:secured-channels> <si-security:access-policy pattern="admin.*" send-access="ROLE_ADMIN"/> <si-security:access-policy pattern="user.*" receive-access="ROLE_USER"/> </si-security:secured-channels>
By default the secured-channels namespace element expects a bean named authenticationManager which implements
AuthenticationManager and a bean named accessDecisionManager which implements
AccessDecisionManager. Where this is not the case references to the appropriate beans can be configured
as attributes of the secured-channels element as below.
<si-security:secured-channels access-decision-manager="customAccessDecisionManager" authentication-manager="customAuthenticationManager"> <si-security:access-policy pattern="admin.*" send-access="ROLE_ADMIN"/> <si-security:access-policy pattern="user.*" receive-access="ROLE_USER"/> </si-security:secured-channels>