modules/org.argeo.slc.server.repo.webapp/WEB-INF/security.xml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <beans xmlns="http://www.springframework.org/schema/beans"
   3         xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   4         xmlns:aop="http://www.springframework.org/schema/aop"
   5         xsi:schemaLocation="
   6        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
   7        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
   8
   9         <bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
  10                 <sec:filter-chain-map path-type="ant">
  11                         <sec:filter-chain pattern="/**"
  12                                 filters="httpSessionContextIntegrationFilter,logoutFilter,basicProcessingFilter,anonymousProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor" />
  13                 </sec:filter-chain-map>
  14         </bean>
  15
  16         <!-- The actual authorization checks (called last, but first here for ease
  17                 of configuration) -->
  18         <bean id="filterInvocationInterceptor" parent="filterInvocationInterceptorTemplate">
  19                 <property name="objectDefinitionSource">
  20                         <value>
  21                                 CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
  22                                 PATTERN_TYPE_APACHE_ANT
  23                                 /private/**=ROLE_USER
  24                                 /**=IS_AUTHENTICATED_ANONYMOUSLY
  25                         </value>
  26                 </property>
  27         </bean>
  28
  29         <!-- Integrates the authentication information in the http sessions -->
  30         <bean id="httpSessionContextIntegrationFilter"
  31                 class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
  32                 <property name="allowSessionCreation" value="true" />
  33         </bean>
  34
  35         <!-- Processes logouts, removing both session informations and the remember-me
  36                 cookie from the browser -->
  37         <bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
  38                 <constructor-arg value="/web/" />
  39                 <!-- URL redirected to after logout -->
  40                 <constructor-arg>
  41                         <list>
  42                                 <bean
  43                                         class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
  44                         </list>
  45                 </constructor-arg>
  46         </bean>
  47
  48         <!-- Double check, this may not be necessary -->
  49         <bean id="securityContextHolderAwareRequestFilter"
  50                 class="org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter" />
  51
  52         <!-- Basic authentication -->
  53         <bean id="basicProcessingFilter"
  54                 class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
  55                 <property name="authenticationManager">
  56                         <ref bean="authenticationManager" />
  57                 </property>
  58                 <property name="authenticationEntryPoint">
  59                         <ref local="basicProcessingFilterEntryPoint" />
  60                 </property>
  61         </bean>
  62
  63         <!-- Activate basic auth when needed -->
  64         <bean id="basicProcessingFilterEntryPoint"
  65                 class="org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint">
  66                 <property name="realmName">
  67                         <value>Argeo Repository</value>
  68                 </property>
  69         </bean>
  70
  71         <!-- If everything else failed, anonymous authentication -->
  72         <bean id="anonymousProcessingFilter"
  73                 class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
  74                 <property name="key" value="${argeo.security.systemKey}" />
  75                 <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" />
  76         </bean>
  77
  78         <!-- Reacts to security related exceptions -->
  79         <bean id="exceptionTranslationFilter"
  80                 class="org.springframework.security.ui.ExceptionTranslationFilter">
  81                 <property name="authenticationEntryPoint">
  82                         <ref bean="basicProcessingFilterEntryPoint" />
  83                 </property>
  84                 <property name="accessDeniedHandler">
  85                         <bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
  86                                 <property name="errorPage" value="/accessDenied.jsp" />
  87                         </bean>
  88                 </property>
  89         </bean>
  90
  91         <!-- Template for authorization checks -->
  92         <bean id="filterInvocationInterceptorTemplate" abstract="true"
  93                 class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
  94                 <property name="authenticationManager" ref="authenticationManager" />
  95                 <property name="accessDecisionManager">
  96                         <bean class="org.springframework.security.vote.AffirmativeBased">
  97                                 <property name="allowIfAllAbstainDecisions" value="false" />
  98                                 <property name="decisionVoters">
  99                                         <list>
 100                                                 <bean class="org.springframework.security.vote.RoleVoter" />
 101                                                 <bean class="org.springframework.security.vote.AuthenticatedVoter" />
 102                                         </list>
 103                                 </property>
 104                         </bean>
 105                 </property>
 106         </bean>
 107 </beans>