From 2db44820173b572bdc486ea243caefda400d2fdd Mon Sep 17 00:00:00 2001
From: Mathieu Baudier <mbaudier@argeo.org>
Date: Wed, 22 Aug 2012 14:59:25 +0000
Subject: [PATCH] Optimize JCR remoting with session filter

git-svn-id: https://svn.argeo.org/commons/trunk@5534 4cfe0d0a-d680-48aa-b62c-e0a02a3f76cc
---
 .../WEB-INF/security-filters.xml              | 35 +++++++++----------
 1 file changed, 17 insertions(+), 18 deletions(-)

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index 57481b638..47ed794f7 100644
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -22,6 +22,12 @@
 			<sec:filter-chain pattern="/j_spring_security_logout"
 				filters="logout,exception" />
 		</sec:filter-chain-map>
+		<property name="matcher">
+			<bean class="org.springframework.security.util.AntUrlPathMatcher">
+				<!-- Do not convert to lower case -->
+				<constructor-arg value="false" />
+			</bean>
+		</property>
 	</bean>
 
 	<!-- The actual authorization checks (called last, but first here for ease 
@@ -57,7 +63,7 @@
 	<!-- Integrates the authentication information in the http sessions -->
 	<bean id="session"
 		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
-		<property name="allowSessionCreation" value="false" />
+		<property name="allowSessionCreation" value="true" />
 	</bean>
 
 	<!-- Processes logouts, removing both session informations and the remember-me 
@@ -67,29 +73,22 @@
 		<!-- URL redirected to after logout -->
 		<constructor-arg>
 			<list>
-<!-- 				<ref bean="rememberMeServices" /> -->
+				<!-- <ref bean="rememberMeServices" /> -->
 				<bean
 					class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
 			</list>
 		</constructor-arg>
 	</bean>
 
-	<!-- Use the remember me cookie to authenticate
-	<bean id="rememberMe"
-		class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
-		<property name="authenticationManager" ref="authenticationManager" />
-		<property name="rememberMeServices" ref="rememberMeServices" />
-	</bean>
+	<!-- Use the remember me cookie to authenticate <bean id="rememberMe" class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter"> 
+		<property name="authenticationManager" ref="authenticationManager" /> <property 
+		name="rememberMeServices" ref="rememberMeServices" /> </bean> <bean id="rememberMeServices" 
+		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices"> 
+		<property name="userDetailsService" ref="userDetailsService" /> <property 
+		name="key" value="${argeo.security.systemKey}" /> <property name="tokenValiditySeconds" 
+		value="${argeo.jcr.webapp.rememberMeValidity}" /> <property name="alwaysRemember" 
+		value="true" /> </bean> -->
 
-	<bean id="rememberMeServices"
-		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
-		<property name="userDetailsService" ref="userDetailsService" />
-		<property name="key" value="${argeo.security.systemKey}" />
-		<property name="tokenValiditySeconds" value="${argeo.jcr.webapp.rememberMeValidity}" />
-		<property name="alwaysRemember" value="true" />
-	</bean>
- -->
- 
 	<!-- Basic authentication -->
 	<bean id="basic"
 		class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
@@ -99,7 +98,7 @@
 		<property name="authenticationEntryPoint">
 			<ref local="basicProcessingFilterEntryPoint" />
 		</property>
-<!-- 		<property name="rememberMeServices" ref="rememberMeServices" /> -->
+		<!-- <property name="rememberMeServices" ref="rememberMeServices" /> -->
 	</bean>
 
 	<!-- Activate basic auth when needed -->
-- 
2.30.2