server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml

   1 <?xml version="1.0" encoding="UTF-8"?>
   2 <beans xmlns="http://www.springframework.org/schema/beans"
   3         xmlns:sec="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   4         xmlns:aop="http://www.springframework.org/schema/aop"
   5         xsi:schemaLocation="
   6        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
   7        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
   8
   9
  10         <!-- Filter chain -->
  11         <alias name="filterChainProxy" alias="springSecurityFilterChain" />
  12
  13         <bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
  14                 <sec:filter-chain-map path-type="ant">
  15                         <sec:filter-chain pattern="/images/*" filters="none" />
  16                         <sec:filter-chain pattern="/**"
  17                                 filters="securityContextFilter, logoutFilter, requestCacheFilter,
  18                  servletApiFilter, anonFilter, sessionMgmtFilter, exceptionTranslator, filterSecurityInterceptor" />
  19                 </sec:filter-chain-map>
  20         </bean>
  21
  22         <!-- Filters -->
  23         <bean id="securityContextFilter"
  24                 class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
  25                 <property name="securityContextRepository" ref="securityContextRepository" />
  26         </bean>
  27
  28         <bean id="securityContextRepository"
  29                 class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" />
  30
  31         <bean id="logoutFilter"
  32                 class="org.springframework.security.web.authentication.logout.LogoutFilter">
  33                 <constructor-arg value="/logged_out.htm" />
  34                 <constructor-arg>
  35                         <list>
  36                                 <bean
  37                                         class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
  38                         </list>
  39                 </constructor-arg>
  40         </bean>
  41
  42         <!-- <bean id="formLoginFilter" -->
  43         <!-- class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> -->
  44         <!-- <property name="authenticationManager" ref="authenticationManager"
  45                 /> -->
  46         <!-- <property name="authenticationSuccessHandler"> -->
  47         <!-- <bean -->
  48         <!-- class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"> -->
  49         <!-- <property name="defaultTargetUrl" value="/index.jsp" /> -->
  50         <!-- </bean> -->
  51         <!-- </property> -->
  52         <!-- <property name="sessionAuthenticationStrategy"> -->
  53         <!-- <bean -->
  54         <!-- class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy"
  55                 /> -->
  56         <!-- </property> -->
  57         <!-- </bean> -->
  58
  59         <bean id="requestCacheFilter"
  60                 class="org.springframework.security.web.savedrequest.RequestCacheAwareFilter" />
  61
  62         <bean id="servletApiFilter"
  63                 class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />
  64
  65         <bean id="anonFilter"
  66                 class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
  67                 <property name="key" value="SomeUniqueKeyForThisApplication" />
  68                 <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS" />
  69         </bean>
  70
  71         <bean id="sessionMgmtFilter"
  72                 class="org.springframework.security.web.session.SessionManagementFilter">
  73                 <constructor-arg ref="securityContextRepository" />
  74         </bean>
  75
  76         <bean id="exceptionTranslator"
  77                 class="org.springframework.security.web.access.ExceptionTranslationFilter">
  78                 <property name="authenticationEntryPoint">
  79                         <bean
  80                                 class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
  81                                 <property name="loginFormUrl" value="/login.htm" />
  82                         </bean>
  83                 </property>
  84         </bean>
  85
  86         <bean id="filterSecurityInterceptor"
  87                 class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
  88                 <!-- <property name="securityMetadataSource"> -->
  89                 <!-- <sec:filter-security-metadata-source> -->
  90                 <!-- <sec:intercept-url pattern="/secure/extreme/*" -->
  91                 <!-- access="ROLE_SUPERVISOR" /> -->
  92                 <!-- <sec:intercept-url pattern="/secure/**" -->
  93                 <!-- access="IS_AUTHENTICATED_FULLY" /> -->
  94                 <!-- <sec:intercept-url pattern="/login.htm" -->
  95                 <!-- access="IS_AUTHENTICATED_ANONYMOUSLY" /> -->
  96                 <!-- <sec:intercept-url pattern="/**" access="ROLE_USER" /> -->
  97                 <!-- </sec:filter-security-metadata-source> -->
  98                 <!-- </property> -->
  99                 <property name="authenticationManager" ref="authenticationManager" />
 100                 <property name="accessDecisionManager" ref="accessDecisionManager" />
 101         </bean>
 102
 103         <!-- Access decision manager -->
 104         <bean id="accessDecisionManager"
 105                 class="org.springframework.security.access.vote.AffirmativeBased">
 106                 <property name="decisionVoters">
 107                         <list>
 108                                 <bean class="org.springframework.security.access.vote.RoleVoter" />
 109                                 <bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
 110                         </list>
 111                 </property>
 112         </bean>
 113
 114 </beans>