0
# Spring Security Remoting
1

2
Spring Security Remoting provides security services for remote method invocation in distributed Spring applications. It includes support for RMI context propagation, HTTP invoker authentication, and DNS resolution utilities that maintain security context across remote calls.
3

4
**Deprecation Notice**: All APIs in this module are deprecated as of Spring Security 5.6.0 with no replacement and will be removed in future versions.
5

6
## Package Information
7

8
- **Package Name**: org.springframework.security:spring-security-remoting
9
- **Package Type**: Maven
10
- **Language**: Java
11
- **Installation**: 
12
  ```xml
13
  <dependency>
14
    <groupId>org.springframework.security</groupId>
15
    <artifactId>spring-security-remoting</artifactId>
16
    <version>5.8.16</version>
17
  </dependency>
18
  ```
19

20
## Core Imports
21

22
```java
23
// DNS resolution
24
import org.springframework.security.remoting.dns.DnsResolver;
25
import org.springframework.security.remoting.dns.JndiDnsResolver;
26
import org.springframework.security.remoting.dns.InitialContextFactory;
27
import org.springframework.security.remoting.dns.DnsLookupException;
28
import org.springframework.security.remoting.dns.DnsEntryNotFoundException;
29

30
// HTTP invoker authentication
31
import org.springframework.security.remoting.httpinvoker.AuthenticationSimpleHttpInvokerRequestExecutor;
32
import org.springframework.security.authentication.AuthenticationTrustResolver;
33

34
// RMI context propagation
35
import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocationFactory;
36
import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocation;
37
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
38
```
39

40
Required framework imports for DNS resolution:
41
```java
42
import javax.naming.directory.DirContext;
43
import javax.naming.directory.InitialDirContext;
44
```
45

46
## Basic Usage
47

48
### HTTP Invoker with Authentication
49

50
```java
51
import org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean;
52
import org.springframework.security.remoting.httpinvoker.AuthenticationSimpleHttpInvokerRequestExecutor;
53

54
// Configure HTTP invoker with authentication
55
HttpInvokerProxyFactoryBean proxy = new HttpInvokerProxyFactoryBean();
56
proxy.setServiceUrl("http://localhost:8080/remoting/MyService");
57
proxy.setServiceInterface(MyService.class);
58

59
// Add authentication support
60
AuthenticationSimpleHttpInvokerRequestExecutor executor = 
61
    new AuthenticationSimpleHttpInvokerRequestExecutor();
62
proxy.setHttpInvokerRequestExecutor(executor);
63

64
MyService service = (MyService) proxy.getObject();
65
```
66

67
### RMI with Security Context Propagation
68

69
```java
70
import org.springframework.remoting.rmi.RmiProxyFactoryBean;  
71
import org.springframework.security.remoting.rmi.ContextPropagatingRemoteInvocationFactory;
72

73
// Configure RMI proxy with security context propagation
74
RmiProxyFactoryBean proxy = new RmiProxyFactoryBean();
75
proxy.setServiceUrl("rmi://localhost:1099/MyService");
76
proxy.setServiceInterface(MyService.class);
77
proxy.setRefreshStubOnConnectFailure(true);
78

79
// Add security context propagation
80
ContextPropagatingRemoteInvocationFactory factory = 
81
    new ContextPropagatingRemoteInvocationFactory();
82
proxy.setRemoteInvocationFactory(factory);
83

84
MyService service = (MyService) proxy.getObject();
85
```
86

87
## Architecture
88

89
Spring Security Remoting extends Spring Framework's remoting capabilities to support security context propagation across distributed applications:
90

91
- **HTTP Invoker Integration**: Extends SimpleHttpInvokerRequestExecutor to add BASIC authentication using SecurityContextHolder credentials
92
- **RMI Context Propagation**: Custom RemoteInvocation implementation that carries security principal and credentials from client to server
93
- **DNS Resolution**: JNDI-based DNS resolver for service discovery in distributed environments
94
- **Security Context Management**: Automatic propagation and restoration of Spring Security context across remote boundaries
95

96
## Capabilities
97

98
### DNS Resolution
99

100
DNS resolution utilities for service discovery in distributed environments, supporting both A record and SRV record lookups with JNDI-based implementation.
101

102
```java { .api }
103
public interface DnsResolver {
104
    String resolveIpAddress(String hostname) throws DnsEntryNotFoundException, DnsLookupException;
105
    String resolveServiceEntry(String serviceType, String domain) throws DnsEntryNotFoundException, DnsLookupException;
106
    String resolveServiceIpAddress(String serviceType, String domain) throws DnsEntryNotFoundException, DnsLookupException;
107
}
108

109
public class JndiDnsResolver implements DnsResolver {
110
    public void setCtxFactory(InitialContextFactory ctxFactory);
111
    public String resolveServiceIpAddressAndPort(String serviceType, String domain);
112
}
113
```
114

115
[DNS Resolution](./dns-resolution.md)
116

117
### HTTP Invoker Authentication
118

119
BASIC authentication support for Spring's HTTP invoker remoting, automatically using credentials from SecurityContextHolder to authenticate remote method calls.
120

121
```java { .api }
122
public class AuthenticationSimpleHttpInvokerRequestExecutor extends SimpleHttpInvokerRequestExecutor {
123
    protected void prepareConnection(HttpURLConnection con, int contentLength) throws IOException;
124
    protected void doPrepareConnection(HttpURLConnection con, int contentLength) throws IOException;
125
}
126
```
127

128
[HTTP Invoker Authentication](./http-invoker-auth.md)
129

130
### RMI Context Propagation
131

132
Security context propagation for RMI remoting, enabling transparent transmission of authentication information from client to server in distributed RMI applications.
133

134
```java { .api }
135
public class ContextPropagatingRemoteInvocation extends RemoteInvocation {
136
    public ContextPropagatingRemoteInvocation(MethodInvocation methodInvocation);
137
    public Object invoke(Object targetObject) throws NoSuchMethodException, IllegalAccessException, InvocationTargetException;
138
    protected Authentication createAuthenticationRequest(String principal, String credentials);
139
}
140

141
public class ContextPropagatingRemoteInvocationFactory implements RemoteInvocationFactory {
142
    public RemoteInvocation createRemoteInvocation(MethodInvocation methodInvocation);
143
}
144
```
145

146
[RMI Context Propagation](./rmi-context-propagation.md)
147

148
## Exception Types
149

150
```java { .api }
151
public class DnsLookupException extends RuntimeException {
152
    public DnsLookupException(String msg);
153
    public DnsLookupException(String msg, Throwable cause);
154
}
155

156
public class DnsEntryNotFoundException extends DnsLookupException {
157
    public DnsEntryNotFoundException(String msg);
158
    public DnsEntryNotFoundException(String msg, Throwable cause);
159
}
160
```
161

162
## Integration Dependencies
163

164
This module requires the following Spring Framework components:
165
- `spring-remoting` for HTTP invoker and RMI support
166
- `spring-security-core` for SecurityContextHolder and Authentication
167
- Java Naming API (`javax.naming`) for DNS resolution
168
- Apache Commons Logging for internal logging