UPGRADING SPRING SECURITY

IN

TIBCOJASPERREPORTS SERVER 6.0.1

Table of Contents
Overview
Migrating External Authentication Sample Files
Wrapper Classes
Migrating Customizations

1
2
3
4

Overview
JasperReports Server uses the Spring Security framework to implement security throughout the product. In JasperReports Server 6.0.1, the Spring Security
framework has been updated from Spring Security 2.0.x to 3.2.5. For many users, this upgrade will have no impact. However, you may need to make some
changes if you have implemented the following:

External authentication If you have implemented external authentication or single sign-on in your server implementation, you need to update your
implementation:
If you implemented external authentication using one of the sample files included in the project, you need to reimplement your changes in the
updated sample files included in JasperReports Server 6.0.1.
If you implemented a custom external authentication solution, you need to migrate your solution to the new framework.
Customizations If you have customized the server using Spring Security classes, you need to migrate your solution to the new framework.

TIBCO Software Inc.

Upgrading Spring Security in TIBCO JasperReports Server

Migrating External Authentication Sample Files

Prior to upgrade, back up your existing applicationContext-<customName>.xml (for example, applicationContext-externalAuth-LDAP.xml), located in
the <js-webapp>/WEB-INF directory of your previous version of JasperReports Server.

2.

Update your server installation to JasperReports Server 6.0.1, as described in the JasperReports Server Upgrade Guide.
As of JasperReports Server 6.0.1, you can customize the default admin users created when external
authentication creates a new organization. You can also optionally encrypt the admin's password in the
configuration files. If you want to encrypt the default password, you need to set this up before installation or
upgrade. See the JasperReports Server External Authentication Cookbook and the JasperReports Server
Administrator Guide for more information.

3.

In the new installation, locate the sample file that corresponds to the file you implemented previously. For example, if you implemented
applicationContext-externalAuth-LDAP.xml, locate <js-install-6.0.1>/samples/externalAuth-sample-config/sample-applicationContext-externalAuthLDAP.xml.

4.

Rename the JasperReports Server 6.0.1 sample file to remove the sample- prefix. For example, rename sample-applicationContext-externalAuthLDAP.xml to applicationContext-externalAuth-LDAP.xml.

5.

Configure the properties in the new sample file to match the properties in your existing sample file. To do this:
a.

Locate each bean you have modified in the previous version.

b.

Find the same bean in the JasperReports Server 6.0.1 sample. The names of the beans have not changed between versions.

c.

Copy or re-enter the properties you need for your server, taking care not to copy over class names or class packages.
Although the bean names are the same in the JasperReports Server 6.0.1 sample files, the name and package of
the class in many bean definitions have changed. Make sure not to overwrite the new names with the old ones.

d.

Save the JasperReports Server 6.0.1 sample file.

e.

Rename the JasperReports Server 6.0.1 sample file to remove sample- prefix. For example, rename sample-applicationContext-externalAuthLDAP.xml to applicationContext-externalAuth-LDAP.xml.

f.

Place the modified file in the <js-webapp-6.0.1>/WEB-INF directory.

TIBCO Software Inc.

Wrapper Classes
To reduce the impact of future upgrades, we created wrapper classes for the Spring Security classes used in the external authentication sample files. The
following table shows the correspondence between Spring Security classes in earlier versions of JasperReports Server and the new wrapper classes in
JasperReports Server 6.0.1.
Table 1-1 Wrapper Classes in JasperReports Server 6.0.1
Spring Security 2.0.x Class

3.x External Authentication Wrappers

org.springframework.security.ui.ExceptionTranslationFilter

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSExceptionTranslationFilter

org.springframework.security.providers.ProviderManager

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSProviderManager

org.springframework.security.ui.AuthenticationDetailsSourceImpl

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSAuthenticationDetailsSourceImpl

org.springframework.security.ui.cas.CasProcessingFilterEntryPoint

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.cas.JSCasAuthenticationEntryPoint

org.springframework.security.providers.cas.CasAuthenticationProvider

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.cas.JSCasAuthenticationProvider

org.jasig.cas.client.validation.Cas20ServiceTicketValidator

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.jasig.JSCas20ServiceTicketValidator

org.springframework.security.providers.cas.cache.EhCacheBasedTicketCach
e

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSEhCacheBasedTicketCache

org.springframework.cache.ehcache.EhCacheFactoryBean

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSEhCacheFactoryBean

org.springframework.security.userdetails.ldap.LdapUserDetailsService

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSLdapUserDetailsService

org.springframework.security.ldap.search.FilterBasedLdapUserSearch

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSFilterBasedLdapUserSearch

org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSDefaultLdapAuthoritiesPopul
ator

org.springframework.security.ui.cas.ServiceProperties

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.cas.JSCASServiceProperties

org.springframework.security.providers.ldap.authenticator.BindAuthenticator

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSBindAuthenticator

TIBCO Software Inc.

Upgrading Spring Security in TIBCO JasperReports Server

Spring Security 2.0.x Class

3.x External Authentication Wrappers

org.springframework.security.ldap.populator.DefaultLdapAuthoritiesPopulator

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSDefaultLdapAuthoritiesPopul
ator

org.springframework.security.providers.ldap.LdapAuthenticationProvider

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.ldap.JSLdapAuthenticationProvider

org.springframework.http.client.SimpleClientHttpRequestFactory

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSSimpleClientHttpRequestFactory

org.springframework.jdbc.datasource.DriverManagerDataSource

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.jdbc.JSDriverManagerDataSource

org.springframework.security.providers.preauth.PreAuthenticatedAuthenticati
onProvider

com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.preauth.JSPreAuthenticatedAuthenti
cationProvider

This table shows the 2.0.x Spring Security class names and paths. Note that three of the Spring Security classes in the table above have moved to
different packages:
ExceptionTranslationFilter

moved to

org.springframework.security.web.access.ExceptionTranslationFilter

ProviderManager

moved to

org.springframework.security.authentication.ProviderManager

AuthenticationDetailsSourceImpl

moved to

org.springframework.security.authentication.AuthenticationDetailsSourceImpl

Migrating Customizations
At a minimum, you need to change the names and paths of the Spring Security classes you reference in any customizations you have made to JasperReports
Server. The Spring Security codebase was significantly restructured from 2.x to 3.x. Many classes were moved to new packages and some classes were
renamed. The following table shows the mapping from 2.0.x to 3.2 for important Spring Security classes used in JasperReports Server. This table is for
informational purposes only. It has not been verified with the Spring Security project and is not guaranteed to be correct. Additional information is
included in the Spring Security 3.2.5 source code. You can also search the internet.

TIBCO Software Inc.

Table 1-2 Mapping of Spring Classes from 2.0.x to 3.2.5

Spring Security 3.2 Class

org.springframework.security.context.SecurityContextHolder

org.springframework.security.core.context.SecurityContextHolder

org.springframework.security.Authentication

org.springframework.security.core.Authentication

org.springframework.security.util.FilterChainProxy

org.springframework.security.web.FilterChainProxy

org.springframework.security.providers.anonymous.AnonymousProcessingFilter

org.springframework.security.web.authentication.AnonymousAuthenticationFilter

org.springframework.security.ui.basicauth.BasicProcessingFilter

org.springframework.security.web.authentication.www.BasicAuthenticationFilter

org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint

org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint

org.springframework.security.ui.ExceptionTranslationFilter

org.springframework.security.web.access.ExceptionTranslationFilter

org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint

org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint

org.springframework.security.ui.webapp.AuthenticationProcessingFilter

org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter

org.springframework.security.context.HttpSessionContextIntegrationFilter

org.springframework.security.web.context.SecurityContextPersistenceFilter

org.springframework.security.vote.AffirmativeBased

org.springframework.security.access.vote.AffirmativeBased

org.springframework.security.vote.AuthenticatedVoter

org.springframework.security.access.vote.AuthenticatedVoter

org.springframework.security.intercept.web.FilterSecurityInterceptor

org.springframework.security.web.access.intercept.FilterSecurityInterceptor

com.jaspersoft.jasperserver.api.security.JSSwitchUserProcessingFilter

com.jaspersoft.jasperserver.war.common.JSSwitchUserProcessingFilter

org.springframework.security.acl.basic.AclObjectIdentity

org.springframework.security.acls.model.ObjectIdentity

org.springframework.security.GrantedAuthority

org.springframework.security.core.GrantedAuthority

org.springframework.security.userdetails.User

org.springframework.security.core.userdetails.User

TIBCO Software Inc.

Upgrading Spring Security in TIBCO JasperReports Server

Spring Security 2.0.x Class

Spring Security 3.2 Class

org.springframework.security.core.AuthenticationServiceException

org.springframework.security.authentication.AuthenticationServiceException

org.springframework.security.AuthorizationServiceException

org.springframework.security.access.AuthorizationServiceException

org.springframework.security.providers.UsernamePasswordAuthenticationToken

org.springframework.security.authentication.UsernamePasswordAuthenticationToken

org.springframework.security.core.GrantedAuthorityImpl

org.springframework.security.core.authority.GrantedAuthorityImpl

org.springframework.security.vote.BasicAclEntryVoter

org.springframework.security.acls.AclEntryVoter

org.springframework.security.vote.AccessDecisionVoter

org.springframework.security.access.AccessDecisionVoter

org.springframework.security.acl.AclEntry

org.springframework.security.acls.model.Acl

org.springframework.security.ConfigAttributeDefinition

Collection<org.springframework.security.access.ConfigAttribute>

org.springframework.security.ConfigAttribute

org.springframework.security.access.ConfigAttribute

org.springframework.security.AuthorizationServiceException

org.springframework.security.access.AuthorizationServiceException

org.springframework.security.afterinvocation.AfterInvocationProvider

org.springframework.security.access.AfterInvocationProvider

org.springframework.security.AccessDeniedException

org.springframework.security.access.AccessDeniedException

org.springframework.security.acl.AclManager

org.springframework.security.acls.model.AclService

org.springframework.security.concurrent.SessionRegistry

org.springframework.security.core.session.SessionRegistry

org.springframework.security.concurrent.SessionInformation

org.springframework.security.core.session.SessionInformation

org.springframework.security.SecurityConfig

org.springframework.security.access.SecurityConfig

org.springframework.security.AuthorizationServiceException

org.springframework.security.access.AuthorizationServiceException

org.springframework.security.providers.encoding.PasswordEncoder

org.springframework.security.authentication.encoding.PasswordEncoder

TIBCO Software Inc.

Spring Security 2.0.x Class

Spring Security 3.2 Class

org.springframework.security.ui.WebAuthenticationDetails

org.springframework.security.web.authentication.WebAuthenticationDetails

org.springframework.security.providers.dao.DaoAuthenticationProvider

org.springframework.security.authentication.dao.DaoAuthenticationProvider

org.springframework.security.ui.switchuser.SwitchUserGrantedAuthority

org.springframework.security.web.authentication.switchuser.SwitchUserGrantedAuthority

org.springframework.security.vote.AbstractAclVoter

org.springframework.security.access.vote.AbstractAclVoter

org.springframework.security.providers.anonymous.AnonymousAuthenticationToken

org.springframework.security.authentication.AnonymousAuthenticationToken

org.springframework.security.afterinvocation.AfterInvocationProvider

org.springframework.security.access.AfterInvocationProvider

org.springframework.security.AccessDeniedException

org.springframework.security.access.AccessDeniedException

org.springframework.security.core.AuthenticationManager

org.springframework.security.authentication.AuthenticationManager

org.springframework.security.ui.cas.CasProcessingFilter

org.springframework.security.cas.web.CasAuthenticationFilter

org.springframework.security.ui.rememberme.NullRememberMeServices

org.springframework.security.web.authentication.NullRememberMeServices

org.springframework.security.util.UrlUtils

org.springframework.security.web.util.UrlUtils

org.springframework.security.providers.AuthenticationProvider

org.springframework.security.authentication.AuthenticationProvider

org.springframework.security.userdetails.jdbc.JdbcDaoImpl

org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl

org.springframework.security.BadCredentialsException

org.springframework.security.authentication.BadCredentialsException

org.springframework.security.userdetails.memory.UserAttribute

org.springframework.security.core.userdetails.memory.UserAttribute

org.springframework.security.context.SecurityContext

org.springframework.security.core.context.SecurityContext

org.springframework.security.providers.TestingAuthenticationToken

org.springframework.security.authentication.TestingAuthenticationToken

org.springframework.security.userdetails.ldap.LdapUserDetails

org.springframework.security.ldap.userdetails.LdapUserDetails

TIBCO Software Inc.

Upgrading Spring Security in TIBCO JasperReports Server

Spring Security 2.0.x Class

Spring Security 3.2 Class

org.springframework.security.vote.RoleVoter

org.springframework.security.access.vote.RoleVoter

org.springframework.security.intercept.method.aopalliance.MethodSecurityInterceptor

org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor

org.springframework.security.vote.UnanimousBased

org.springframework.security.access.vote.UnanimousBased

org.springframework.security.afterinvocation.AfterInvocationProviderManager

org.springframework.security.access.intercept.AfterInvocationProviderManager

org.springframework.security.providers.ProviderManager

org.springframework.security.authentication.ProviderManager

org.springframework.security.ui.AuthenticationDetailsSourceImpl

org.springframework.security.authentication.AuthenticationDetailsSourceImpl

org.springframework.security.afterinvocation.BasicAclEntryAfterInvocationCollectionFiltering
Provider

org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationCollectionFiltering
Provider

org.springframework.security.userdetails.memory.InMemoryDaoImpl

org.springframework.security.core.userdetails.memory.InMemoryDaoImpl

org.springframework.security.event.authentication.LoggerListener

org.springframework.security.authentication.event.LoggerListener

org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter

org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter

org.springframework.security.afterinvocation.BasicAclEntryAfterInvocationProvider

org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider

org.springframework.security.concurrent.SessionRegistryImpl

org.springframework.security.core.session.SessionRegistryImpl

TIBCO Software Inc.