What means this Spring Security diagram?

Question

I am studying for the Spring Core certification and I have some dobut related the meaning of this Spring Security diagram finding into the documentation:

It explain what is the architecture of the Spring Security projects and the interaction between its components but what exactly mean?

It show an Authentication Manager component, reading on the documentation I found that it handles authentication requests from other parts of the framework so I think that it provide something like an interface with some methods to perform the autherntication operations and that this interface it will be implemented by a specific authentitication providerd (according to the authentication technology choose)

What means that the Authentication Manager populates the Security Context . What exactly is the *Security Context** in Spring? Is it a "place" where are stored the information related to the Principal (for example an user authenticated on a web application) and the list of the authorizations of this principal on the secured resources? (for example the logged user and what operations this user can perform on the secured resources?) Is it right or am I missing something?

Then there is a Security Interceptor that I think have to be a proxied class that use something like a before advice AOP mechanism that perform a security advice befeore some specific joint point. Thee jointpoint are the operations on the secured resource (for example the method execution on a secured bean).

Looking at the picture I think that the proxy obtain this information from the Security Context that contains the principal (the logged user) and its authorizations (what operations can do this logged user) so it can create the before advices to check this operations. Is it right or am I missing something?

What represents the AccessDecision Manager component? and what are the voters showed into the picture?

Tnx

Answer 1

• The security-context contains the security information about the current user (name, login, privileges...). It is bounded to the current thread and session https://stackoverflow.com/a/6408377/280244

• The Authentication Manger will put ( poulate ) the security information about the user when he login into the security context.

• The Security interceptor (Method or Http Request) will intercept the invocations before they invoke an protected/secured resource . It obtain the information about the current user from the security context. What the requies rules to allow the invocation are, are obtained form some configuration (xml, annotations, ...). The decision about that the current user matches the required rules are delegated to the Access Decision Manger

• The Access Decision Manger does not implements the desision rules by its own, instead it uses (different) Voters that vote for access granted, access denied (or abstain).

@See: Spring Security Reference: Chapter 13 Authorization Architecture