projects / lgpl / argeo-commons.git / blobdiff
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Optimize remoting
[lgpl/argeo-commons.git] / server / modules / org.argeo.jackrabbit.webapp / WEB-INF / security-filters.xml
diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index 0195436f46cbff0979a1a9a042ed9ace712c78b6..578997a1b04e8c1ed70b02392dbb33bf946072e3 100644 (file)
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -6,22 +6,54 @@
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 
-       <bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
+       <bean id="filterChain.davex" parent="filterChain.template">
                <sec:filter-chain-map path-type="ant">
-                       <sec:filter-chain pattern="/files/**"
-                               filters="session,x509,basic,exception,interceptor" />
-                       <sec:filter-chain pattern="/jcr/*/*/**"
-                               filters="session,x509,basic,exception,interceptor" />
+                       <sec:filter-chain pattern="/*/*/*/**"
+                               filters="session,x509,basic,exception" />
                        <!-- For some reason the first level listing workspaces must be public -->
-                       <sec:filter-chain pattern="/jcr/*/"
-                               filters="anonymous,exception,interceptorPublic" />
-                       <sec:filter-chain pattern="/public/**"
-                               filters="anonymous,exception,interceptorPublic" />
-                       <sec:filter-chain pattern="/pub/**"
-                               filters="anonymous,exception,interceptorPublic" />
-                       <sec:filter-chain pattern="/j_spring_security_logout"
-                               filters="logout,exception" />
+                       <sec:filter-chain pattern="/*/*/"
+                               filters="anonymous,exception" />
                </sec:filter-chain-map>
+       </bean>
+
+       <bean id="filterChain.private" parent="filterChain.template">
+               <sec:filter-chain-map path-type="ant">
+                       <sec:filter-chain pattern="/**"
+                               filters="session,x509,basic,exception" />
+               </sec:filter-chain-map>
+       </bean>
+
+       <bean id="filterChain.public" parent="filterChain.template">
+               <sec:filter-chain-map path-type="ant">
+                       <sec:filter-chain pattern="/**"
+                               filters="anonymous,exception" />
+               </sec:filter-chain-map>
+       </bean>
+
+       <!-- <bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy"> -->
+       <!-- <sec:filter-chain-map path-type="ant"> -->
+       <!-- <sec:filter-chain pattern="/files/**" -->
+       <!-- filters="session,x509,basic,exception,interceptor" /> -->
+       <!-- <sec:filter-chain pattern="/jcr/*/*/**" -->
+       <!-- filters="session,x509,basic,exception,interceptor" /> -->
+       <!-- <sec:filter-chain pattern="/jcr/*/" -->
+       <!-- filters="anonymous,exception,interceptorPublic" /> -->
+       <!-- <sec:filter-chain pattern="/public/**" -->
+       <!-- filters="anonymous,exception,interceptorPublic" /> -->
+       <!-- <sec:filter-chain pattern="/pub/**" -->
+       <!-- filters="anonymous,exception,interceptorPublic" /> -->
+       <!-- <sec:filter-chain pattern="/j_spring_security_logout" -->
+       <!-- filters="logout,exception" /> -->
+       <!-- </sec:filter-chain-map> -->
+       <!-- <property name="matcher"> -->
+       <!-- <bean class="org.springframework.security.util.AntUrlPathMatcher"> -->
+       <!-- <constructor-arg value="false" /> -->
+       <!-- </bean> -->
+       <!-- </property> -->
+       <!-- </bean> -->
+
+       <bean id="filterChain.template" abstract="true"
+               class="org.springframework.security.util.FilterChainProxy">
                <property name="matcher">
                        <bean class="org.springframework.security.util.AntUrlPathMatcher">
                                <!-- Do not convert to lower case -->
@@ -29,25 +61,25 @@
                        </bean>
                </property>
        </bean>
-
+       
        <!-- The actual authorization checks (called last, but first here for ease 
                of configuration) -->
-       <bean id="interceptor" parent="filterInvocationInterceptorTemplate">
-               <property name="objectDefinitionSource">
-                       <value>
-                               PATTERN_TYPE_APACHE_ANT
-                               /**=ROLE_USER,ROLE_ADMIN
-                       </value>
-               </property>
-       </bean>
-       <bean id="interceptorPublic" parent="filterInvocationInterceptorTemplate">
-               <property name="objectDefinitionSource">
-                       <value>
-                               PATTERN_TYPE_APACHE_ANT
-                               /**=IS_AUTHENTICATED_ANONYMOUSLY
-                       </value>
-               </property>
-       </bean>
+<!--   <bean id="interceptor" parent="filterInvocationInterceptorTemplate"> -->
+<!--           <property name="objectDefinitionSource"> -->
+<!--                   <value> -->
+<!--                           PATTERN_TYPE_APACHE_ANT -->
+<!--                           /**=ROLE_USER,ROLE_ADMIN -->
+<!--                   </value> -->
+<!--           </property> -->
+<!--   </bean> -->
+<!--   <bean id="interceptorPublic" parent="filterInvocationInterceptorTemplate"> -->
+<!--           <property name="objectDefinitionSource"> -->
+<!--                   <value> -->
+<!--                           PATTERN_TYPE_APACHE_ANT -->
+<!--                           /**=IS_AUTHENTICATED_ANONYMOUSLY -->
+<!--                   </value> -->
+<!--           </property> -->
+<!--   </bean> -->
 
        <bean id="x509"
                class="org.springframework.security.ui.preauth.x509.X509PreAuthenticatedProcessingFilter">
@@ -68,26 +100,15 @@
 
        <!-- Processes logouts, removing both session informations and the remember-me 
                cookie from the browser -->
-       <bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter">
-               <constructor-arg value="/webdav/node/main" />
-               <!-- URL redirected to after logout -->
-               <constructor-arg>
-                       <list>
-                               <!-- <ref bean="rememberMeServices" /> -->
-                               <bean
-                                       class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
-                       </list>
-               </constructor-arg>
-       </bean>
-
-       <!-- Use the remember me cookie to authenticate <bean id="rememberMe" class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter"> 
-               <property name="authenticationManager" ref="authenticationManager" /> <property 
-               name="rememberMeServices" ref="rememberMeServices" /> </bean> <bean id="rememberMeServices" 
-               class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices"> 
-               <property name="userDetailsService" ref="userDetailsService" /> <property 
-               name="key" value="${argeo.security.systemKey}" /> <property name="tokenValiditySeconds" 
-               value="${argeo.jcr.webapp.rememberMeValidity}" /> <property name="alwaysRemember" 
-               value="true" /> </bean> -->
+<!--   <bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter"> -->
+<!--           <constructor-arg value="/webdav/node/main" /> -->
+<!--           <constructor-arg> -->
+<!--                   <list> -->
+<!--                           <bean -->
+<!--                                   class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" /> -->
+<!--                   </list> -->
+<!--           </constructor-arg> -->
+<!--   </bean> -->
 
        <!-- Basic authentication -->
        <bean id="basic"
@@ -98,7 +119,6 @@
                <property name="authenticationEntryPoint">
                        <ref local="basicProcessingFilterEntryPoint" />
                </property>
-               <!-- <property name="rememberMeServices" ref="rememberMeServices" /> -->
        </bean>
 
        <!-- Activate basic auth when needed -->
@@ -124,25 +144,25 @@
                </property>
                <property name="accessDeniedHandler">
                        <bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
-                               <property name="errorPage" value="/accessDenied.jsp" />
+<!--                           <property name="errorPage" value="/accessDenied.jsp" /> -->
                        </bean>
                </property>
        </bean>
 
        <!-- Template for authorization checks -->
-       <bean id="filterInvocationInterceptorTemplate" abstract="true"
-               class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
-               <property name="authenticationManager" ref="authenticationManager" />
-               <property name="accessDecisionManager">
-                       <bean class="org.springframework.security.vote.AffirmativeBased">
-                               <property name="allowIfAllAbstainDecisions" value="false" />
-                               <property name="decisionVoters">
-                                       <list>
-                                               <bean class="org.springframework.security.vote.RoleVoter" />
-                                               <bean class="org.springframework.security.vote.AuthenticatedVoter" />
-                                       </list>
-                               </property>
-                       </bean>
-               </property>
-       </bean>
+<!--   <bean id="filterInvocationInterceptorTemplate" abstract="true" -->
+<!--           class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> -->
+<!--           <property name="authenticationManager" ref="authenticationManager" /> -->
+<!--           <property name="accessDecisionManager"> -->
+<!--                   <bean class="org.springframework.security.vote.AffirmativeBased"> -->
+<!--                           <property name="allowIfAllAbstainDecisions" value="false" /> -->
+<!--                           <property name="decisionVoters"> -->
+<!--                                   <list> -->
+<!--                                           <bean class="org.springframework.security.vote.RoleVoter" /> -->
+<!--                                           <bean class="org.springframework.security.vote.AuthenticatedVoter" /> -->
+<!--                                   </list> -->
+<!--                           </property> -->
+<!--                   </bean> -->
+<!--           </property> -->
+<!--   </bean> -->
 </beans>
\ No newline at end of file
Argeo Commons - Lightweight integration framework in pure Java/OSGi