X-Git-Url: http://git.argeo.org/?a=blobdiff_plain;f=server%2Fmodules%2Forg.argeo.jackrabbit.webapp%2FWEB-INF%2Fsecurity-filters.xml;h=bfdafd34149345d8472b1c97e91e293e38cbf153;hb=ced6639536af26ce611ab3ac464821376a627af4;hp=d7613a0ff0cd3f406df63495e12b8e054cb16708;hpb=7ffa880a608e9a1ed12b9d394bc3434da33c5914;p=lgpl%2Fargeo-commons.git

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index d7613a0ff..bfdafd341 100644
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -8,41 +8,59 @@
 
 	<bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
 		<sec:filter-chain-map path-type="ant">
-			<sec:filter-chain pattern="/**"
-				filters="httpSessionContextIntegrationFilter,logoutFilter,basicProcessingFilter,anonymousProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor" />
+			<sec:filter-chain pattern="/webdav/**"
+				filters="session,x509,basic,rememberMe,exception,interceptor" />
+			<sec:filter-chain pattern="/remoting/**"
+				filters="x509,basic,anonymous,exception,interceptor" />
+			<sec:filter-chain pattern="/public/**"
+				filters="anonymous,exception,interceptorPublic" />
+			<sec:filter-chain pattern="/pub/**"
+				filters="anonymous,exception,interceptorPublic" />
+			<sec:filter-chain pattern="/j_spring_security_logout"
+				filters="logout,exception" />
 		</sec:filter-chain-map>
 	</bean>
 
 	<!-- The actual authorization checks (called last, but first here for ease 
 		of configuration) -->
-	<bean id="filterInvocationInterceptor" parent="filterInvocationInterceptorTemplate">
+	<bean id="interceptor" parent="filterInvocationInterceptorTemplate">
+		<property name="objectDefinitionSource">
+			<value>
+				PATTERN_TYPE_APACHE_ANT
+				/*/*/*/**=ROLE_USER,ROLE_ADMIN
+			</value>
+		</property>
+	</bean>
+	<bean id="interceptorPublic" parent="filterInvocationInterceptorTemplate">
 		<property name="objectDefinitionSource">
 			<value>
-				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
 				PATTERN_TYPE_APACHE_ANT
-				/public/**=IS_AUTHENTICATED_ANONYMOUSLY
-				/*/*/*/**=ROLE_USER
 				/**=IS_AUTHENTICATED_ANONYMOUSLY
 			</value>
-			<!-- <value> -->
-			<!-- CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON -->
-			<!-- PATTERN_TYPE_APACHE_ANT -->
-			<!-- /config/**=ROLE_ADMINISTRATOR -->
-			<!-- /**=IS_AUTHENTICATED_ANONYMOUSLY -->
-			<!-- </value> -->
 		</property>
 	</bean>
 
-	<!-- Integrates the authentication information in the http sessions -->
-	<bean id="httpSessionContextIntegrationFilter"
-		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
-		<property name="allowSessionCreation" value="true" />
+	<bean id="x509"
+		class="org.springframework.security.ui.preauth.x509.X509PreAuthenticatedProcessingFilter">
+		<property name="authenticationManager" ref="authenticationManager" />
+		<property name="principalExtractor">
+			<bean
+				class="org.springframework.security.ui.preauth.x509.SubjectDnX509PrincipalExtractor">
+				<property name="subjectDnRegex" value="CN=(.*?)," />
+			</bean>
+		</property>
 	</bean>
 
+	<!-- Integrates the authentication information in the http sessions
+	<bean id="session"
+		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
+		<property name="allowSessionCreation" value="false" />
+	</bean>
+ -->
 	<!-- Processes logouts, removing both session informations and the remember-me 
 		cookie from the browser -->
-	<bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
-		<constructor-arg value="/web/" />
+	<bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter">
+		<constructor-arg value="/webdav/node/main" />
 		<!-- URL redirected to after logout -->
 		<constructor-arg>
 			<list>
@@ -53,12 +71,8 @@
 		</constructor-arg>
 	</bean>
 
-	<!-- Double check, this may not be necessary -->
-	<bean id="securityContextHolderAwareRequestFilter"
-		class="org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter" />
-
 	<!-- Use the remember me cookie to authenticate -->
-	<bean id="rememberMeProcessingFilter"
+	<bean id="rememberMe"
 		class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
 		<property name="authenticationManager" ref="authenticationManager" />
 		<property name="rememberMeServices" ref="rememberMeServices" />
@@ -68,10 +82,12 @@
 		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
 		<property name="userDetailsService" ref="userDetailsService" />
 		<property name="key" value="${argeo.security.systemKey}" />
+		<property name="tokenValiditySeconds" value="${argeo.jcr.webapp.rememberMeValidity}" />
+		<property name="alwaysRemember" value="true" />
 	</bean>
 
 	<!-- Basic authentication -->
-	<bean id="basicProcessingFilter"
+	<bean id="basic"
 		class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
 		<property name="authenticationManager">
 			<ref bean="authenticationManager" />
@@ -91,14 +107,14 @@
 	</bean>
 
 	<!-- If everything else failed, anonymous authentication -->
-	<bean id="anonymousProcessingFilter"
+	<bean id="anonymous"
 		class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
 		<property name="key" value="${argeo.security.systemKey}" />
 		<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" />
 	</bean>
 
 	<!-- Reacts to security related exceptions -->
-	<bean id="exceptionTranslationFilter"
+	<bean id="exception"
 		class="org.springframework.security.ui.ExceptionTranslationFilter">
 		<property name="authenticationEntryPoint">
 			<ref bean="basicProcessingFilterEntryPoint" />