Spring Security Notes

When specifying the auto-config= "true" of an HTTP element, it is equivalent to a shorthand for the following.

   <security:http>      <security:form-login/>      <security:http-basic/>      <security: Logout/>   </security:http>

In spring security, the default implementation of AuthenticationManager is Providermanager, and it does not process the authentication request directly, but instead delegates to its configured Authenticationprovider list. Each authenticationprovider is then used in turn for authentication, and if a authenticationprovider-certified result is not NULL, the Authenticationprovider has been successfully certified, Subsequent authenticationprovider will no longer continue to be certified. Then directly with the Authenticationprovider certification results as the Providermanager certification results.

When we use namespace, the use of the Authentication-manager element causes spring Security to create a providermanager internally, You can then add authenticationprovider to it through the authentication-provider element. When defining the Authentication-provider element, if no association is specified by the ref attribute which authenticationprovider,spring Security will use Daoauthenticationprovider by default.

Spring Security Notes