How spring-projects/spring-security works
Spring Security is a Java security framework spanning authentication context, authorization, ACLs, and protocol-specific integrations. The central workflow is an application request entering a security interceptor, obtaining authorization metadata, and being evaluated against the current identity and its authorities; ACLs add object-level permissions. The tree also exposes OAuth client and authorization-server persistence, plus CAS, LDAP, SAML, and WebAuthn modules. Several core relationships are documented by the excerpts and source index; unsampled runtime connections are shown as unverified rather than asserted.
Main entry points: JdbcMutableAclService.java JDBC ACL Service · MethodSecurityInterceptor.java Method Interceptor · DelegatingSecurityContextExecutorService.java Context Executor · PreAuthenticatedGrantedAuthoritiesUserDetailsService.java Pre-auth User Details
Components 26
Identity Context
- Authentication
core/src/main/java/org/springframework/security/core/Authentication.java - Granted Authorities
core/src/main/java/org/springframework/security/core/GrantedAuthority.java - Security Context
core/src/main/java/org/springframework/security/core/context/SecurityContext.java - Context Holder
core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java - Context Executor
core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java - Pre-auth User Details
web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java
Access Authorization
- Web Interceptor
access/src/main/java/org/springframework/security/web/access/intercept/FilterSecurityInterceptor.java - Method Interceptor
access/src/main/java/org/springframework/security/access/intercept/aopalliance/MethodSecurityInterceptor.java - Method Metadata
access/src/main/java/org/springframework/security/access/method/DelegatingMethodSecurityMetadataSource.java - Access Decisions
access/src/main/java/org/springframework/security/access/vote/AffirmativeBased.java - Message Security
messaging/src/main/java/org/springframework/security/messaging/access/intercept/MessageMatcherDelegatingAuthorizationManager.java
ACL Permissions
- Object Identity
acl/src/main/java/org/springframework/security/acls/model/ObjectIdentity.java - Security Identity
acl/src/main/java/org/springframework/security/acls/model/Sid.java - JDBC ACL Service
acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java - ACL Model
acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java
OAuth2 Services
- Client Registration
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/registration/ClientRegistration.java - UserInfo Client
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java - Access Token
oauth2/oauth2-core/src/main/java/org/springframework/security/oauth2/core/OAuth2AccessToken.java - Authorized Client Store
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java - Authorization Store
oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java - Registered Client
oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/client/RegisteredClient.java
Protocol Integrations
- CAS Authentication
cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java - LDAP User Services
ldap/src/main/java/org/springframework/security/ldap/userdetails/LdapUserDetailsService.java - SAML Support
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/core/OpenSamlInitializationService.java - WebAuthn
webauthn/src/main/java/org/springframework/security/web/webauthn/api/CredProtectAuthenticationExtensionsClientInput.java
Other components
- Application
Connections 20
- Application → Web Interceptor: invokes
- Application → Method Interceptor: invokes
- Application → Message Security: secures messages
- Web Interceptor → Access Decisions: checks access
- Method Interceptor → Method Metadata: loads metadata
- Method Interceptor → Access Decisions: checks access
- Authentication → Granted Authorities: carries
core/src/main/java/org/springframework/security/core/GrantedAuthority.java - Context Holder → Security Context: stores context
core/src/main/java/org/springframework/security/core/context/SecurityContextHolder.java - Context Executor → Context Holder: propagates context
core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java - Context Executor → Security Context: wraps tasks with
core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextExecutorService.java - Pre-auth User Details → Authentication: reads token
web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java - Pre-auth User Details → Granted Authorities: uses authorities
web/src/main/java/org/springframework/security/web/authentication/preauth/PreAuthenticatedGrantedAuthoritiesUserDetailsService.java - JDBC ACL Service → Object Identity: persists identity
acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java - JDBC ACL Service → Security Identity: persists SID
acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java - JDBC ACL Service → ACL Model: writes entries
- UserInfo Client → Client Registration: reads provider config
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/userinfo/DefaultOAuth2UserService.java - Authorized Client Store → Client Registration: loads registration
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java - Authorized Client Store → Access Token: persists token
oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/JdbcOAuth2AuthorizedClientService.java - Authorization Store → Registered Client: uses registered client
oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java - Authorization Store → Access Token: persists token
oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/JdbcOAuth2AuthorizationService.java