SpringSource/spring-security — pull request #7 by xuhuisheng (2012-05-21 07:41:14+00:00)
Title: add cache-ref to authenticaiton-provider, add allow-empty-authorities to java-user-service

* add cache-ref to

At this time, we could use the cache-ref attribute in user-detail-service. It seems to create a new instance of CacheUserDetailsService to cache the UserDetails, but if you only set userCache of JdbcDaoImpl, it will cause an Exception. Because JdbcDaoImpl will evict the password, so if the same user do logout, and try to login again, it will said that the credencial is not correct, then the user cannot login the system since the cache expired.

So the cache-ref of user-detail-service is confused, although it will be set to DaoAuthenticaitonProvider, but create a CacheuserDetailService is such a waste. So I wish there would be a cache-ref for authentication-provider to do same thing, and more meaningful.

* add allow-empty-authorities to

If the login user has no authorities, there will always throw an UserNotFoundException, I wish there could be an attribute to control whether we should throw an exception. so add allow-empty-authorities to do such thing.

Please review it. Thank you very much.