Spring Security SAML and this week's SAML Vulnerability

Engineering | Rob Winch | March 01, 2018 | ...

This week, the software world found out that SAML Vulnerabilities Affecting Multiple Implementations were discovered. If you use Spring Security SAML’s defaults, you are not impacted by this vulnerability.

The underlying implementation that Spring Security SAML uses is Shibboleth’s OpenSAML Java library. The OpenSAML Java implementation was not listed in the libraries that contain the vulnerability (Shibboleth openSAML C++ was vulnerable). However, if the ParserPool has been customized, you may be impacted.

NOT Safe Configurations

Specifically, if the application explicitly sets the BasicParserPool or the StaticBasicParserPool to have ignoreComments = false, it is vulnerable to the…

This Week in Spring - February 27th, 2018

Engineering | Josh Long | February 28, 2018 | ...

Hi Spring fans and welcome to another installment of Spring Tips! This is a super exciting week! Spring Boot 2.0 is coming! Keep your eyes on the Spring Initializr or you'll miss it! :D

Today I was at the Okta Iterate conference talking to developers who are using Spring and Okta, thanks to my buddy Matt Raible. High point? I got to meet Jeff Atwood, the co-creator of Stack Overflow!

Tomorrow, I begin a whirlwind tour over the next two weeks. First, it's off to Glasgow, Scotland; then Sydney, Australia; then Dubai; then Bangalore, India (for Agile India 2018); and then it's off to Boston, Massachusetts for the SpringOne Tour event on March 13th. If you're in any of those places, don't hesitate to reach out

Spring Cloud Stream 2.0 - Polled Consumers

Engineering | Gary Russell | February 27, 2018 | ...

This is the second blog in a series of pre-release blogs in preparation for Spring Cloud Stream 2.0.0.RELEASE.

Preface

Spring Cloud Stream 2.0 introduces polled consumers, where the application can control message processing rates.

Introduction

Spring Cloud Stream has the concepts of producers and consumers; when using the messaging paradigm, MessageChannels are bound to destinations (e.g. Kafka topics, Rabbit Exchanges/Queues). To-date, on the consumer side, messages are delivered whenever an idle consumer is available. In effect, the broker controls the rate of delivery; usually, the next…

Spring Cloud Stream 2.0 - content-type negotiation and transformation

Engineering | Oleg Zhurakousky | February 26, 2018 | ...

This is the first blog in a series of pre-release blogs in preparation for Spring Cloud Stream 2.0.0.RELEASE.

Preface

Spring Cloud Stream 2.0 includes a complete revamp of content-type negotiation for the channel-based binders to address performance, flexibility and most importantly consistency. The following blog touches on some of the key points around what has been done, what to expect and how it may help you.

Introduction

Data transformation is one of the core features of any message-driven microservice architecture. In Spring Cloud Stream, such data is represented as a Spring Message.

Spring Cloud Stream Elmhurst.RC1 /2.0.0.RC1 Release Announcement

Engineering | Oleg Zhurakousky | February 23, 2018 | ...

After a long and exciting journey we are pleased to announce the first Release Candidate of the Spring Cloud Stream Elmhurst release train - Elmhurst.RC1/2.0.0.RC1.

Spring Cloud Stream Elmhurst 2.0.0.RC1 is available for use in the Spring Milestone repository. The release notes include relevant information about version compatibility with Spring Boot, Spring Cloud, Spring AMQP, and Spring for Apache Kafka.

Given that this is a Release Candidate the following section provides a brief summary of features and improvements not just included in this release but for 2.0 in general, with details to…

This Week in Spring - February 20th, 2018

Engineering | Josh Long | February 20, 2018 | ...

Hi Spring fans! Welcome to another installment of This Week in Spring! This week I'm speaking at the San Diego JUG with Mario Gray on testing with Spring. Then I'm off to the IBM Index conference here in San Francisco where I'll be talking about building reactive microservices, and then it's off to Devnexus in Atlanta, GA, where I'll be talking about Kotlin and testing. I hope you'll join me and say hi if you're nearby.

  • Stéphane Nicoll has just announced Spring Framework 5.0.4.
  • Check out this whitepaper on building flexible Spring Cloud Data Flow data pipelines
  • It's now even easier to use Spring Cloud Stream from the Spring Initializr: now you need only choose a binder implementation (Kafka, or RabbitMQ) and then choose whether you want the implementation to be reactive or not, and you're off to the races!
  • Spring Cloud Task lead Michael Minella just announced Spring Cloud Task 2.0.0.M3. The new release includes smarter default behavior when an application closes, the ability to restrict tasks from running concurrently,

Spring Cloud Contract in a polyglot world

Engineering | Marcin Grzejszczak | February 13, 2018 | ...

This article contains a short reminder of what Contract Testing is, how Spring Cloud Contract implements it, and how Spring Cloud Contract can be used in a polyglot world.

What is Contract Testing

In order to increase the certainty that our systems behave properly, we write different types of tests. According to the test pyramid the main types of tests are unit, integration, and UI. The more complex the tests, the more time and effort they require and the more brittle they become.

In a distributed system, one of the most frequent problems is testing integrations between applications. Let’s assume that your service sends a REST request to another application. When using Spring Boot, you can write a @SpringBootTest in which you test that behavior. You set up a Spring context, you prepare a request to be sent…​ and where do you send it? You haven’t started the other application, so you get a Connection Refused

This Week in Spring - February 13th, 2018

Engineering | Josh Long | February 13, 2018 | ...

Hi Spring fans! Welcome to another installment of This Week in Spring! This week I've been in Munich and Frankfurt, Germany, and Minneapolis, Minnesota, and it looks like i'll be in New York City and San Francisco for the balance of the week.

We've got a lot to cover so without further ado so let's get started.

Spring Web Flow 2.5 RC1 is available

Engineering | Rossen Stoyanchev | February 12, 2018 | ...

The first and only release candidate planned for Spring Web Flow 2.5 is now available from the Spring Milestones repository. The samples repository has been updated to use it.

This release provides an upgrade path to Spring Framework 5 along with Java 8, Servlet 3.1, Hibernate 5, Tiles 3, and JSF 2.2 as minimum requirements.

In this release "spring-js" has been merged with "spring-webflow" so there is no longer a separate "spring-js" module. As a result some configuration classes have changed packages. The "spring-js-resources" module is still available but as an optional module that must be…

This Week in Spring - February 6th, 2018

Engineering | Josh Long | February 06, 2018 | ...

Hi Spring fans! Welcome to another installment of This Week in Spring! This week I'm in Stockholm, Sweden, for the epic (and snowy) JFokus event, then it's off to Frankfurt, Germany for the OOP show. If you're at either event, don't hesitate to reach out and say hi on Twitter (@starbuxman)!

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all