X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=server%2Fmodules%2Forg.argeo.jackrabbit.webapp%2FWEB-INF%2Fsecurity-filters.xml;h=52238a7de8600c38aae33781d6066d4bbb1217dd;hb=aa9d3a8e795237d8593f6e437afc4f61debc318a;hp=f12f0c8048e5f62630a7d0d2cbfa144592450372;hpb=0c7d4e488bf4e357ca33329c87a29baae63a5be9;p=lgpl%2Fargeo-commons.git

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index f12f0c804..52238a7de 100644
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -6,29 +6,47 @@
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 
-	<bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
+	<bean id="filterChain.davex" parent="filterChain.template">
 		<sec:filter-chain-map path-type="ant">
-			<sec:filter-chain pattern="/webdav/**"
-				filters="session,basic,rememberMe,anonymous,exception,interceptor" />
-			<sec:filter-chain pattern="/remoting/**"
-				filters="session,basic,rememberMe,anonymous,exception,interceptor" />
-			<sec:filter-chain pattern="/public/**"
-				filters="session,anonymous,exception,interceptorPublic" />
-			<sec:filter-chain pattern="/pub/**"
-				filters="session,anonymous,exception,interceptorPublic" />
-			<sec:filter-chain pattern="/j_spring_security_logout"
-				filters="session,logout,exception" />
+			<sec:filter-chain pattern="/*/*/*/**"
+				filters="session,x509,basic,exception,interceptor" />
+			<!-- For some reason the first level listing workspaces must be public -->
+			<sec:filter-chain pattern="/*/*/"
+				filters="anonymous,exception,interceptorPublic" />
 		</sec:filter-chain-map>
 	</bean>
 
+	<bean id="filterChain.private" parent="filterChain.template">
+		<sec:filter-chain-map path-type="ant">
+			<sec:filter-chain pattern="/**"
+				filters="session,x509,basic,exception,interceptor" />
+		</sec:filter-chain-map>
+	</bean>
+
+	<bean id="filterChain.public" parent="filterChain.template">
+		<sec:filter-chain-map path-type="ant">
+			<sec:filter-chain pattern="/**"
+				filters="anonymous,exception,interceptorPublic" />
+		</sec:filter-chain-map>
+	</bean>
+
+	<bean id="filterChain.template" abstract="true"
+		class="org.springframework.security.util.FilterChainProxy">
+		<property name="matcher">
+			<bean class="org.springframework.security.util.AntUrlPathMatcher">
+				<!-- Do not convert to lower case -->
+				<constructor-arg value="false" />
+			</bean>
+		</property>
+	</bean>
+
 	<!-- The actual authorization checks (called last, but first here for ease 
 		of configuration) -->
 	<bean id="interceptor" parent="filterInvocationInterceptorTemplate">
 		<property name="objectDefinitionSource">
 			<value>
 				PATTERN_TYPE_APACHE_ANT
-				/*/*/*/**=ROLE_USER,ROLE_ADMIN
-				/**=ROLE_ANONYMOUS
+				/**=ROLE_USER,ROLE_ADMIN
 			</value>
 		</property>
 	</bean>
@@ -41,40 +59,35 @@
 		</property>
 	</bean>
 
+	<bean id="x509"
+		class="org.springframework.security.ui.preauth.x509.X509PreAuthenticatedProcessingFilter">
+		<property name="authenticationManager" ref="authenticationManager" />
+		<property name="principalExtractor">
+			<bean
+				class="org.springframework.security.ui.preauth.x509.SubjectDnX509PrincipalExtractor">
+				<property name="subjectDnRegex" value="CN=(.*?)," />
+			</bean>
+		</property>
+	</bean>
+
 	<!-- Integrates the authentication information in the http sessions -->
 	<bean id="session"
 		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
-		<property name="allowSessionCreation" value="false" />
+		<property name="allowSessionCreation" value="true" />
 	</bean>
 
 	<!-- Processes logouts, removing both session informations and the remember-me 
 		cookie from the browser -->
-	<bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter">
-		<constructor-arg value="/webdav/node/main" />
-		<!-- URL redirected to after logout -->
-		<constructor-arg>
-			<list>
-				<ref bean="rememberMeServices" />
-				<bean
-					class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
-			</list>
-		</constructor-arg>
-	</bean>
-
-	<!-- Use the remember me cookie to authenticate -->
-	<bean id="rememberMe"
-		class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
-		<property name="authenticationManager" ref="authenticationManager" />
-		<property name="rememberMeServices" ref="rememberMeServices" />
-	</bean>
-
-	<bean id="rememberMeServices"
-		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
-		<property name="userDetailsService" ref="userDetailsService" />
-		<property name="key" value="${argeo.security.systemKey}" />
-		<property name="tokenValiditySeconds" value="${argeo.jcr.webapp.rememberMeValidity}" />
-		<property name="alwaysRemember" value="true" />
-	</bean>
+	<!-- <bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter"> -->
+	<!-- <constructor-arg value="/webdav/node/main" /> -->
+	<!-- <constructor-arg> -->
+	<!-- <list> -->
+	<!-- <bean -->
+	<!-- class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" 
+		/> -->
+	<!-- </list> -->
+	<!-- </constructor-arg> -->
+	<!-- </bean> -->
 
 	<!-- Basic authentication -->
 	<bean id="basic"
@@ -85,14 +98,13 @@
 		<property name="authenticationEntryPoint">
 			<ref local="basicProcessingFilterEntryPoint" />
 		</property>
-		<property name="rememberMeServices" ref="rememberMeServices" />
 	</bean>
 
 	<!-- Activate basic auth when needed -->
 	<bean id="basicProcessingFilterEntryPoint"
 		class="org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint">
 		<property name="realmName">
-			<value>Argeo</value>
+			<value>${argeo.server.realmName}</value>
 		</property>
 	</bean>
 
@@ -111,7 +123,7 @@
 		</property>
 		<property name="accessDeniedHandler">
 			<bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
-				<property name="errorPage" value="/accessDenied.jsp" />
+				<!-- <property name="errorPage" value="/accessDenied.jsp" /> -->
 			</bean>
 		</property>
 	</bean>