Spring Integration and Security

[Sergio da Silva]

I took a look at the Spring Integration Action TOC and did not find security related topics.

How does Spring Integration "integrate" with Spring Security? How is the security context propagated ?

Thanks!

[Iwein Fuld]

Nice question! The integration is rather simple: http://static.springsource.org/spring-integration/docs/latest-ga/reference/htmlsingle/#security

We planned a chapter on security in the book, but as you can see it would be tricky to fill it with much information specific to Spring Integration. Because Spring Integration works with Spring Security and Spring WS, the interesting parts happen in there.

There are two ways Messaging and Security intersect: on the message level and on the transport level. The transport could be http secured by tls for example. But it can also be Java itself, secured by Spring Security through AOP. For message level security you could use ws-security, which is nicely supported in Spring WS, but you can also use your own encryption if you don't want to send xml.