X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=server%2Fmodules%2Forg.argeo.jackrabbit.webapp%2FWEB-INF%2Fsecurity-filters.xml;h=7874e5058e7ea8fd7c2b1670156bb06c19c34b28;hb=82fc1287c13e9bd42b96af762a1c0f1549c82a4f;hp=0195436f46cbff0979a1a9a042ed9ace712c78b6;hpb=6df2bd7adad9e7d9e7882c5632e7598a02107af9;p=lgpl%2Fargeo-commons.git

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index 0195436f4..7874e5058 100644
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -6,22 +6,31 @@
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 
-	<bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
+	<bean id="filterChain.davex" parent="filterChain.template">
 		<sec:filter-chain-map path-type="ant">
-			<sec:filter-chain pattern="/files/**"
-				filters="session,x509,basic,exception,interceptor" />
-			<sec:filter-chain pattern="/jcr/*/*/**"
+			<sec:filter-chain pattern="/*/*/*/**"
 				filters="session,x509,basic,exception,interceptor" />
 			<!-- For some reason the first level listing workspaces must be public -->
-			<sec:filter-chain pattern="/jcr/*/"
-				filters="anonymous,exception,interceptorPublic" />
-			<sec:filter-chain pattern="/public/**"
-				filters="anonymous,exception,interceptorPublic" />
-			<sec:filter-chain pattern="/pub/**"
+			<sec:filter-chain pattern="/*/*/" filters="anonymous,exception" />
+		</sec:filter-chain-map>
+	</bean>
+
+	<bean id="filterChain.private" parent="filterChain.template">
+		<sec:filter-chain-map path-type="ant">
+			<sec:filter-chain pattern="/**"
+				filters="session,x509,basic,exception,interceptor" />
+		</sec:filter-chain-map>
+	</bean>
+
+	<bean id="filterChain.public" parent="filterChain.template">
+		<sec:filter-chain-map path-type="ant">
+			<sec:filter-chain pattern="/**"
 				filters="anonymous,exception,interceptorPublic" />
-			<sec:filter-chain pattern="/j_spring_security_logout"
-				filters="logout,exception" />
 		</sec:filter-chain-map>
+	</bean>
+
+	<bean id="filterChain.template" abstract="true"
+		class="org.springframework.security.util.FilterChainProxy">
 		<property name="matcher">
 			<bean class="org.springframework.security.util.AntUrlPathMatcher">
 				<!-- Do not convert to lower case -->
@@ -68,26 +77,16 @@
 
 	<!-- Processes logouts, removing both session informations and the remember-me 
 		cookie from the browser -->
-	<bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter">
-		<constructor-arg value="/webdav/node/main" />
-		<!-- URL redirected to after logout -->
-		<constructor-arg>
-			<list>
-				<!-- <ref bean="rememberMeServices" /> -->
-				<bean
-					class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
-			</list>
-		</constructor-arg>
-	</bean>
-
-	<!-- Use the remember me cookie to authenticate <bean id="rememberMe" class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter"> 
-		<property name="authenticationManager" ref="authenticationManager" /> <property 
-		name="rememberMeServices" ref="rememberMeServices" /> </bean> <bean id="rememberMeServices" 
-		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices"> 
-		<property name="userDetailsService" ref="userDetailsService" /> <property 
-		name="key" value="${argeo.security.systemKey}" /> <property name="tokenValiditySeconds" 
-		value="${argeo.jcr.webapp.rememberMeValidity}" /> <property name="alwaysRemember" 
-		value="true" /> </bean> -->
+	<!-- <bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter"> -->
+	<!-- <constructor-arg value="/webdav/node/main" /> -->
+	<!-- <constructor-arg> -->
+	<!-- <list> -->
+	<!-- <bean -->
+	<!-- class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" 
+		/> -->
+	<!-- </list> -->
+	<!-- </constructor-arg> -->
+	<!-- </bean> -->
 
 	<!-- Basic authentication -->
 	<bean id="basic"
@@ -98,7 +97,6 @@
 		<property name="authenticationEntryPoint">
 			<ref local="basicProcessingFilterEntryPoint" />
 		</property>
-		<!-- <property name="rememberMeServices" ref="rememberMeServices" /> -->
 	</bean>
 
 	<!-- Activate basic auth when needed -->
@@ -124,7 +122,7 @@
 		</property>
 		<property name="accessDeniedHandler">
 			<bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
-				<property name="errorPage" value="/accessDenied.jsp" />
+				<!-- <property name="errorPage" value="/accessDenied.jsp" /> -->
 			</bean>
 		</property>
 	</bean>