X-Git-Url: https://git.argeo.org/?a=blobdiff_plain;f=server%2Fmodules%2Forg.argeo.jackrabbit.webapp%2FWEB-INF%2Fsecurity-filters.xml;h=d7613a0ff0cd3f406df63495e12b8e054cb16708;hb=87a5c6c8c109097c8be2412f5a10df2de3a6e0c0;hp=c969b4d828de61af7875b5fc919ac156df8d78b2;hpb=10c220cf49f5b146bac50ed7fe2578135cd466f1;p=lgpl%2Fargeo-commons.git

diff --git a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
index c969b4d82..d7613a0ff 100644
--- a/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
+++ b/server/modules/org.argeo.jackrabbit.webapp/WEB-INF/security-filters.xml
@@ -6,109 +6,124 @@
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
 
-
-	<!-- Filter chain -->
-	<alias name="filterChainProxy" alias="springSecurityFilterChain" />
-
-	<bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
+	<bean id="springSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
 		<sec:filter-chain-map path-type="ant">
-			<sec:filter-chain pattern="/images/*" filters="none" />
 			<sec:filter-chain pattern="/**"
-				filters="securityContextFilter, logoutFilter, requestCacheFilter,
-                 servletApiFilter, anonFilter, sessionMgmtFilter, exceptionTranslator, filterSecurityInterceptor" />
+				filters="httpSessionContextIntegrationFilter,logoutFilter,basicProcessingFilter,anonymousProcessingFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor" />
 		</sec:filter-chain-map>
 	</bean>
 
-	<!-- Filters -->
-	<bean id="securityContextFilter"
-		class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
-		<property name="securityContextRepository" ref="securityContextRepository" />
+	<!-- The actual authorization checks (called last, but first here for ease 
+		of configuration) -->
+	<bean id="filterInvocationInterceptor" parent="filterInvocationInterceptorTemplate">
+		<property name="objectDefinitionSource">
+			<value>
+				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
+				PATTERN_TYPE_APACHE_ANT
+				/public/**=IS_AUTHENTICATED_ANONYMOUSLY
+				/*/*/*/**=ROLE_USER
+				/**=IS_AUTHENTICATED_ANONYMOUSLY
+			</value>
+			<!-- <value> -->
+			<!-- CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON -->
+			<!-- PATTERN_TYPE_APACHE_ANT -->
+			<!-- /config/**=ROLE_ADMINISTRATOR -->
+			<!-- /**=IS_AUTHENTICATED_ANONYMOUSLY -->
+			<!-- </value> -->
+		</property>
 	</bean>
 
-	<bean id="securityContextRepository"
-		class="org.springframework.security.web.context.HttpSessionSecurityContextRepository" />
+	<!-- Integrates the authentication information in the http sessions -->
+	<bean id="httpSessionContextIntegrationFilter"
+		class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
+		<property name="allowSessionCreation" value="true" />
+	</bean>
 
-	<bean id="logoutFilter"
-		class="org.springframework.security.web.authentication.logout.LogoutFilter">
-		<constructor-arg value="/logged_out.htm" />
+	<!-- Processes logouts, removing both session informations and the remember-me 
+		cookie from the browser -->
+	<bean id="logoutFilter" class="org.springframework.security.ui.logout.LogoutFilter">
+		<constructor-arg value="/web/" />
+		<!-- URL redirected to after logout -->
 		<constructor-arg>
 			<list>
+				<ref bean="rememberMeServices" />
 				<bean
-					class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler" />
+					class="org.springframework.security.ui.logout.SecurityContextLogoutHandler" />
 			</list>
 		</constructor-arg>
 	</bean>
 
-	<!-- <bean id="formLoginFilter" -->
-	<!-- class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> -->
-	<!-- <property name="authenticationManager" ref="authenticationManager" 
-		/> -->
-	<!-- <property name="authenticationSuccessHandler"> -->
-	<!-- <bean -->
-	<!-- class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"> -->
-	<!-- <property name="defaultTargetUrl" value="/index.jsp" /> -->
-	<!-- </bean> -->
-	<!-- </property> -->
-	<!-- <property name="sessionAuthenticationStrategy"> -->
-	<!-- <bean -->
-	<!-- class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy" 
-		/> -->
-	<!-- </property> -->
-	<!-- </bean> -->
+	<!-- Double check, this may not be necessary -->
+	<bean id="securityContextHolderAwareRequestFilter"
+		class="org.springframework.security.wrapper.SecurityContextHolderAwareRequestFilter" />
+
+	<!-- Use the remember me cookie to authenticate -->
+	<bean id="rememberMeProcessingFilter"
+		class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">
+		<property name="authenticationManager" ref="authenticationManager" />
+		<property name="rememberMeServices" ref="rememberMeServices" />
+	</bean>
 
-	<bean id="requestCacheFilter"
-		class="org.springframework.security.web.savedrequest.RequestCacheAwareFilter" />
+	<bean id="rememberMeServices"
+		class="org.springframework.security.ui.rememberme.TokenBasedRememberMeServices">
+		<property name="userDetailsService" ref="userDetailsService" />
+		<property name="key" value="${argeo.security.systemKey}" />
+	</bean>
 
-	<bean id="servletApiFilter"
-		class="org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter" />
+	<!-- Basic authentication -->
+	<bean id="basicProcessingFilter"
+		class="org.springframework.security.ui.basicauth.BasicProcessingFilter">
+		<property name="authenticationManager">
+			<ref bean="authenticationManager" />
+		</property>
+		<property name="authenticationEntryPoint">
+			<ref local="basicProcessingFilterEntryPoint" />
+		</property>
+		<property name="rememberMeServices" ref="rememberMeServices" />
+	</bean>
 
-	<bean id="anonFilter"
-		class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
-		<property name="key" value="SomeUniqueKeyForThisApplication" />
-		<property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS" />
+	<!-- Activate basic auth when needed -->
+	<bean id="basicProcessingFilterEntryPoint"
+		class="org.springframework.security.ui.basicauth.BasicProcessingFilterEntryPoint">
+		<property name="realmName">
+			<value>Argeo</value>
+		</property>
 	</bean>
 
-	<bean id="sessionMgmtFilter"
-		class="org.springframework.security.web.session.SessionManagementFilter">
-		<constructor-arg ref="securityContextRepository" />
+	<!-- If everything else failed, anonymous authentication -->
+	<bean id="anonymousProcessingFilter"
+		class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
+		<property name="key" value="${argeo.security.systemKey}" />
+		<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS" />
 	</bean>
 
-	<bean id="exceptionTranslator"
-		class="org.springframework.security.web.access.ExceptionTranslationFilter">
+	<!-- Reacts to security related exceptions -->
+	<bean id="exceptionTranslationFilter"
+		class="org.springframework.security.ui.ExceptionTranslationFilter">
 		<property name="authenticationEntryPoint">
-			<bean
-				class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
-				<property name="loginFormUrl" value="/login.htm" />
+			<ref bean="basicProcessingFilterEntryPoint" />
+		</property>
+		<property name="accessDeniedHandler">
+			<bean class="org.springframework.security.ui.AccessDeniedHandlerImpl">
+				<property name="errorPage" value="/accessDenied.jsp" />
 			</bean>
 		</property>
 	</bean>
 
-	<bean id="filterSecurityInterceptor"
-		class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
-		<!-- <property name="securityMetadataSource"> -->
-		<!-- <sec:filter-security-metadata-source> -->
-		<!-- <sec:intercept-url pattern="/secure/extreme/*" -->
-		<!-- access="ROLE_SUPERVISOR" /> -->
-		<!-- <sec:intercept-url pattern="/secure/**" -->
-		<!-- access="IS_AUTHENTICATED_FULLY" /> -->
-		<!-- <sec:intercept-url pattern="/login.htm" -->
-		<!-- access="IS_AUTHENTICATED_ANONYMOUSLY" /> -->
-		<!-- <sec:intercept-url pattern="/**" access="ROLE_USER" /> -->
-		<!-- </sec:filter-security-metadata-source> -->
-		<!-- </property> -->
+	<!-- Template for authorization checks -->
+	<bean id="filterInvocationInterceptorTemplate" abstract="true"
+		class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
 		<property name="authenticationManager" ref="authenticationManager" />
-		<property name="accessDecisionManager" ref="accessDecisionManager" />
-	</bean>
-
-	<!-- Access decision manager -->
-	<bean id="accessDecisionManager"
-		class="org.springframework.security.access.vote.AffirmativeBased">
-		<property name="decisionVoters">
-			<list>
-				<bean class="org.springframework.security.access.vote.RoleVoter" />
-				<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
-			</list>
+		<property name="accessDecisionManager">
+			<bean class="org.springframework.security.vote.AffirmativeBased">
+				<property name="allowIfAllAbstainDecisions" value="false" />
+				<property name="decisionVoters">
+					<list>
+						<bean class="org.springframework.security.vote.RoleVoter" />
+						<bean class="org.springframework.security.vote.AuthenticatedVoter" />
+					</list>
+				</property>
+			</bean>
 		</property>
 	</bean>
-
 </beans>
\ No newline at end of file