Add remember me capabilities to RAP

[lgpl/argeo-commons.git] / server / modules / org.argeo.jackrabbit.webapp / WEB-INF / security-filters.xml

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index d7613a0ff0cd3f406df63495e12b8e054cb16708..f12f0c8048e5f62630a7d0d2cbfa144592450372 100644 (file)
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -8,41 +8,49 @@
 
        <bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
                <sec:filter-chain-map path-type="ant">
-                       <sec:filter-chain pattern="/**"
-                               filters="httpSessionContextIntegrationFilter,logoutFilter,basicProcessingFilter,anonymousProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor" />
+                       <sec:filter-chain pattern="/webdav/**"
+                               filters="session,basic,rememberMe,anonymous,exception,interceptor" />
+                       <sec:filter-chain pattern="/remoting/**"
+                               filters="session,basic,rememberMe,anonymous,exception,interceptor" />
+                       <sec:filter-chain pattern="/public/**"
+                               filters="session,anonymous,exception,interceptorPublic" />
+                       <sec:filter-chain pattern="/pub/**"
+                               filters="session,anonymous,exception,interceptorPublic" />
+                       <sec:filter-chain pattern="/j_spring_security_logout"
+                               filters="session,logout,exception" />
                </sec:filter-chain-map>
        </bean>
 
        <!-- The actual authorization checks (called last, but first here for ease 
                of configuration) -->
-       <bean id="filterInvocationInterceptor" parent="filterInvocationInterceptorTemplate">
+       <bean id="interceptor" parent="filterInvocationInterceptorTemplate">
+               <property name="objectDefinitionSource">
+                       <value>
+                               PATTERN_TYPE_APACHE_ANT
+                               /*/*/*/**=ROLE_USER,ROLE_ADMIN
+                               /**=ROLE_ANONYMOUS
+                       </value>
+               </property>
+       </bean>
+       <bean id="interceptorPublic" parent="filterInvocationInterceptorTemplate">
                <property name="objectDefinitionSource">
                        <value>
-                               CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                                PATTERN_TYPE_APACHE_ANT
-                               /public/**=IS_AUTHENTICATED_ANONYMOUSLY
-                               /*/*/*/**=ROLE_USER
                                /**=IS_AUTHENTICATED_ANONYMOUSLY
                        </value>
-                       <!-- <value> -->
-                       <!-- CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON -->
-                       <!-- PATTERN_TYPE_APACHE_ANT -->
-                       <!-- /config/**=ROLE_ADMINISTRATOR -->
-                       <!-- /**=IS_AUTHENTICATED_ANONYMOUSLY -->
-                       <!-- </value> -->
                </property>
        </bean>
 
        <!-- Integrates the authentication information in the http sessions -->
-       <bean id="httpSessionContextIntegrationFilter"
+       <bean id="session"
                class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
-               <property name="allowSessionCreation" value="true" />
+               <property name="allowSessionCreation" value="false" />
        </bean>
 
        <!-- Processes logouts, removing both session informations and the remember-me 
                cookie from the browser -->
-       <bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
-               <constructor-arg value="/web/" />
+       <bean id="logout" class="org.springframework.security.ui.logout.LogoutFilter">
+               <constructor-arg value="/webdav/node/main" />
                <!-- URL redirected to after logout -->
                <constructor-arg>
                        <list>
@@ -53,12 +61,8 @@
                </constructor-arg>
        </bean>
 
-       <!-- Double check, this may not be necessary -->
-       <bean id="securityContextHolderAwareRequestFilter"
-               class="org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter" />
-
        <!-- Use the remember me cookie to authenticate -->
-       <bean id="rememberMeProcessingFilter"
+       <bean id="rememberMe"
                class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
                <property name="authenticationManager" ref="authenticationManager" />
                <property name="rememberMeServices" ref="rememberMeServices" />
@@ -68,10 +72,12 @@
                class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
                <property name="userDetailsService" ref="userDetailsService" />
                <property name="key" value="${argeo.security.systemKey}" />
+               <property name="tokenValiditySeconds" value="${argeo.jcr.webapp.rememberMeValidity}" />
+               <property name="alwaysRemember" value="true" />
        </bean>
 
        <!-- Basic authentication -->
-       <bean id="basicProcessingFilter"
+       <bean id="basic"
                class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
                <property name="authenticationManager">
                        <ref bean="authenticationManager" />
@@ -91,14 +97,14 @@
        </bean>
 
        <!-- If everything else failed, anonymous authentication -->
-       <bean id="anonymousProcessingFilter"
+       <bean id="anonymous"
                class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
                <property name="key" value="${argeo.security.systemKey}" />
                <property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" />
        </bean>
 
        <!-- Reacts to security related exceptions -->
-       <bean id="exceptionTranslationFilter"
+       <bean id="exception"
                class="org.springframework.security.ui.ExceptionTranslationFilter">
                <property name="authenticationEntryPoint">
                        <ref bean="basicProcessingFilterEntryPoint" />