RE: [Springframework-developer] Road map (security)

[Ben A. <ben...@ac...>]

> How about declarative security, should somehow also be 
> mentioned in the roadmap. Any ideas so far about how to go about it?

Thought I'd jump in here. The Acegi Security System for Spring project now
has a home at SoureForge. I'm currently writing automated container
integration unit tests (ie unzip a stock standard container release, install
the security module to it, and run unit tests). CVS and a new ZIP release
will be at SourceForge in a day or two, and anyone interested is welcome to
participate in development.

Whilst I initially wrote the above project with a view to inclusion in
Spring, I also recognise there are no Spring-specific dependencies apart
from standard bean context and interceptor services. As such, from a
technical perspective security could be effectively developed in a separate
project, or as a separate module under Spring CVS. There is no technical
requirement in having it in Spring core. The real issue is whether from a
marketing perspective the Spring Framework needs its very own security
capability/project, an "official" separate security project that users are
pointed towards, or a list of external (untested) security projects that
claim to support Spring.

It would be nice to avoid duplication of efforts on security, particularly
given most of it involves writing adapters between the project security and
the container's native security. Maximising the user and developer base of a
single security project will also have obvious benefits in terms of testing,
issue identification, support and improvement.

Ben