Acegi Security System for Spring 书摘(II)

Four main concerns must be addressed in typical enterprise application:
Authentication:Enterprise applications typicaly need to access a variety of authentication repositories. Depending on the repository, the server may never expose the credentials (in which case authentication is performed only by binding to the repository with the correct credentials) or the credentials may be in a hashed format. Each authentication repository also must track the authorities granted to a principal. Security frameworks must intergrate withe these types of repositories, or new ones, sometimes simultaneously. There my also be a range of client types for an enterprise application. The security framework needs to deal consistently with authentication requests from any such client type.
Web request security: Many enterprise applications are web-based, often using an MVC framework and possibly publishing web services. Security is often required to protect URI patterns. In addtion, web views often require intergration with a security framework so content can be generated based on the authorities held by the principal.
Service layer security:Services(business) layers should be secured in all but the simplest of applications. Security is usually best modeled as an aspect. Using an AOP-based solution allows service layer implementations to be largely or completely unaware of security. It also eliminates the error-prone and tedious approach of enforcing security in user interface tiers via techniques such as URI pattern filtering. Acegi Security can secure an AOP Alliance MethodInvocation, using Spring AOP. It can also secure an AspectJ JoinPoint.
Domain object instance security: Java application also use domain objects to model the problem domain. Different instances of these domain objects may require different security. A principal may have delete permission to one domain object instance but only read permission to a different domain object instance. Permission are assigned to a recipient, which refers to a principal or a role. The list of permissions assigned to different recipients for a given domain object instance is known as access control list , or ACL.