The Anatomy of a Secure Web Application in Java Using Spring Security and Apache Fortress
summary
A runnable Apache Wicket app on Tomcat demonstrates Java + Spring + Apache Fortress controls: a three‑page, three‑customer policy that maps to 9 roles with a dynamic separation-of-duty constraint enforced at session time. The build shows Java Security Manager usage, page-level Spring Security guards, DAO-level programmatic checks, TLS everywhere, Selenium positive/negative tests, and a role‑constraint mechanism that prevents role explosion so the RBAC model stays manageable. Apache Fortress demo artifacts and code are published and work as shown.
AI-written summary · about
chapters (22)
- 0:00Objective
- 0:15Intro
- 1:16Recommendation
- 1:38What's The Problem
- 5:46Apache Struts Statement on Equifax Security Breach
- 6:37The Solution (Take 2)
- 8:21Employ a Runtime Java Security Policy
- 8:53Not a Perfect Solution
- 13:10the deadbolt
- 17:44The Standards Journey
- 18:15Use ANSI RBAC INCITS 359 Specification
- 20:35Use RBAC Object Model
- 21:46Apache Fortress Access Management SDK and Web Components
- 22:12Use RBAC Functional Model
- 23:11Example #3: Role Engineering Sample
- 23:39Locks on the rooms
- 25:15Apache Fortress Demo
- 31:10RBAC Policy Enhanced
- 31:58Use ANSI RBAC & ABAC
- 33:22Under the Hood
- 34:06ABAC Demo
- 35:08Questions
related talks
01h 33mA How to Guide to Security in the PAAS Cloud
33mSpring Security Patterns
43mTest Driven Application Security
52mSpring Security for N00bz: A quick introduction for the terminally insecure
57mSpring Security for N00bz: A quick introduction for the terminally insecure
38mForteca Java: Multi-Level Security from Architecture to CI/CD
49m10 Excellent Ways to Secure Your Spring Boot Application
45mSpring Security: The Good Parts