|
<?xml version="1.0" encoding="UTF-8"?> |
|
<beans |
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
|
xmlns="http://www.springframework.org/schema/beans" |
|
xmlns:ctx="http://www.springframework.org/schema/context" |
|
xmlns:sec="http://www.springframework.org/schema/security" |
|
xsi:schemaLocation=" |
|
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd |
|
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd |
|
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd"> |
|
|
|
<!-- |
|
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/security-filter-chain.html |
|
http://static.springsource.org/spring-security/site/docs/3.0.x/reference/ns-config.html#filter-stack |
|
--> |
|
<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"> |
|
<sec:filter-chain-map path-type="ant"> |
|
<!-- |
|
<sec:filter-chain pattern="/**" filters="none"/> |
|
--> |
|
<sec:filter-chain pattern="/js/**" filters="none"/> |
|
<sec:filter-chain pattern="/images/**" filters="none"/> |
|
<sec:filter-chain pattern="/css/**" filters="none"/> |
|
|
|
<sec:filter-chain pattern="/ws/cert/**" filters=" |
|
WsSecurityContextPersistenceFilter, |
|
X509AuthenticationFilter, |
|
Http403ExceptionTranslationFilter, |
|
FilterSecurityInterceptor" /> |
|
<sec:filter-chain pattern="/ws/basic/**" filters=" |
|
WsSecurityContextPersistenceFilter, |
|
BasicAuthenticationFilter, |
|
BasicAuthenticationExceptionTranslationFilter, |
|
FilterSecurityInterceptor" /> |
|
|
|
<sec:filter-chain pattern="/ui/access-denied.htm" filters="none"/> |
|
|
|
<sec:filter-chain pattern="/ui/**" filters=" |
|
UiSecurityContextPersistenceFilter, |
|
LogoutFilter, |
|
NtlmExceptionTranslationFilter, |
|
NtlmFilter, |
|
FilterSecurityInterceptor" /> |
|
</sec:filter-chain-map> |
|
|
|
<!-- |
|
<sec:filter-chain pattern="/ui/**" filters=" |
|
UiSecurityContextPersistenceFilter, |
|
LogoutFilter, |
|
FormLoginFilter, |
|
AnonymousAuthenticationFilter, |
|
FormExceptionTranslationFilter, |
|
FilterSecurityInterceptor" /> |
|
--> |
|
|
|
</bean> |
|
|
|
<!-- http://static.springsource.org/spring-security/site/docs/3.0.x/reference/core-web-filters.html --> |
|
<bean id="FilterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> |
|
<property name="authenticationManager" ref="FullAuthenticationManager"/> |
|
<property name="accessDecisionManager" ref="WebAccessDecisionManager"/> |
|
<property name="messageSource" ref="messageSource"/> |
|
|
|
<property name="securityMetadataSource"> |
|
<sec:filter-security-metadata-source path-type="ant" use-expressions="false"> |
|
<sec:intercept-url pattern="/" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" /> |
|
<sec:intercept-url pattern="/ui/welcome*" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" /> |
|
<sec:intercept-url pattern="/ui/account/login*" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" /> |
|
<sec:intercept-url pattern="/ui/j_spring_security_check" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" /> |
|
<sec:intercept-url pattern="/ui/access-denied.htm" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" /> |
|
<sec:intercept-url pattern="/**" access="ROLE_AUTHENTICATED" /> |
|
</sec:filter-security-metadata-source> |
|
</property> |
|
</bean> |
|
|
|
<bean id="FormExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"> |
|
<property name="authenticationEntryPoint"> |
|
<bean id="FormAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint"> |
|
<property name="loginFormUrl" value="/ui/account/login.htm"/> |
|
</bean> |
|
</property> |
|
<property name="accessDeniedHandler" ref="AccessDeniedHandler"/> |
|
</bean> |
|
|
|
<bean id="AccessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl"> |
|
<property name="errorPage" value="/ui/access-denied.htm"/> |
|
</bean> |
|
|
|
<!-- |
|
<bean id="SessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter"> |
|
<property name="authenticationFailureHandler"> |
|
<bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"> |
|
<property name="defaultFailureUrl" value="/account/login.htm?login_error=1"/> |
|
</bean> |
|
</property> |
|
</bean> |
|
--> |
|
|
|
<bean id="UiSecurityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"> |
|
<property name="securityContextRepository"> |
|
<bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"> |
|
<property name="allowSessionCreation" value="true" /> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<bean id="NtlmFilter" class="org.springframework.security.ui.ntlm.NtlmAuthenticationFilter"> |
|
<property name="retryOnAuthFailure" value="false" /> |
|
<property name="stripDomain" value="true"/> |
|
<property name="defaultDomain" value="${jcifs.smb.client.domain}"/> |
|
<property name="netbiosWINS" value="${jcifs.netbios.wins}"/> |
|
<property name="authenticationManager"> |
|
<bean class="org.springframework.security.authentication.ProviderManager"> |
|
<property name="providers"> |
|
<list> |
|
<ref bean="LdapAuthenticationProvider"/> |
|
</list> |
|
</property> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<!-- Providers are checked sequentially, if it is problem, multiple dedicated AuthenticationManages can be configured --> |
|
<bean id="FullAuthenticationManager" class="org.springframework.security.authentication.ProviderManager"> |
|
<property name="providers"> |
|
<list> |
|
<ref local="PreAuthenticatedAuthenticationProvider"/> |
|
<ref local="BasicAuthenticationProvider"/> |
|
<ref bean="LdapAuthenticationProvider"/> |
|
</list> |
|
</property> |
|
</bean> |
|
|
|
<bean id="NullRequestCacheAwareFilter" class="org.springframework.security.web.savedrequest.NullRequestCache"/> |
|
|
|
<bean id="NtlmEntryPoint" class="org.springframework.security.ui.ntlm.NtlmAuthenticationFilterEntryPoint"> |
|
<property name="authenticationFailureUrl" value="/ui/access-denied.htm"/> |
|
</bean> |
|
|
|
<bean id="NtlmExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"> |
|
<property name="authenticationEntryPoint" ref="NtlmEntryPoint"/> |
|
</bean> |
|
|
|
<bean id="FormLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter"> |
|
<property name="authenticationManager"> |
|
<bean class="org.springframework.security.authentication.ProviderManager"> |
|
<property name="providers"> |
|
<list> |
|
<ref local="BasicAuthenticationProvider"/> |
|
</list> |
|
</property> |
|
</bean> |
|
</property> |
|
<property name="filterProcessesUrl" value="/ui/j_spring_security_check"/> |
|
<property name="authenticationSuccessHandler"> |
|
<bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"> |
|
</bean> |
|
</property> |
|
<property name="authenticationFailureHandler"> |
|
<bean class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler"> |
|
<property name="defaultFailureUrl" value="/ui/account/login.htm?authfailed=true"/> |
|
<property name="exceptionMappings"> |
|
<map> |
|
<entry key="org.springframework.security.core.userdetails.UsernameNotFoundException" value="/ui/account/login.htm?errusername=true"/> |
|
<entry key="org.springframework.security.authentication.BadCredentialsException" value="/ui/account/login.htm?errpassword=true"/> |
|
<entry key="org.springframework.security.authentication.CredentialsExpiredException" value="/ui/account/login.htm?newpassword=true"/> |
|
<entry key="org.springframework.security.authentication.LockedException" value="/ui/account/login.htm?acclocked=true"/> |
|
<entry key="org.springframework.security.authentication.DisabledException" value="/ui/account/login.htm?accdisabled=true"/> |
|
</map> |
|
</property> |
|
</bean> |
|
</property> |
|
<property name="sessionAuthenticationStrategy"> |
|
<bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"> |
|
<constructor-arg ref="SessionRegistry"/> |
|
<property name="maximumSessions" value="1"/> |
|
<property name="exceptionIfMaximumExceeded" value="true"/> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<bean id="SessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/> |
|
|
|
<bean id="LogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter"> |
|
<constructor-arg name="logoutSuccessHandler" ref="LogoutSuccessHandler"/> |
|
<constructor-arg name="handlers"> |
|
<array> |
|
<bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"> |
|
<property name="invalidateHttpSession" value="true"/> |
|
</bean> |
|
</array> |
|
</constructor-arg> |
|
<property name="filterProcessesUrl" value="/ui/account/logout"/> |
|
</bean> |
|
|
|
<bean id="LogoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler"> |
|
<!-- |
|
<property name="defaultTargetUrl" value="/ui/account/login.htm?loggedout=true"/> |
|
--> |
|
<property name="defaultTargetUrl" value="/ui/index.htm"/> |
|
</bean> |
|
|
|
<!-- 12. Anonymous Authentication http://static.springsource.org/spring-security/site/docs/3.0.x/reference/anonymous.html --> |
|
|
|
<bean id="AnonymousAuthenticationFilter" class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter"> |
|
<property name="key" value="anonymous-key"/> |
|
<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/> |
|
</bean> |
|
|
|
<!-- WebSvc --> |
|
|
|
<bean id="WsSecurityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"> |
|
<property name="securityContextRepository"> |
|
<bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository"> |
|
<property name="allowSessionCreation" value="false" /> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<bean id="X509AuthenticationFilter" class="org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter"> |
|
<property name="authenticationManager"> |
|
<bean class="org.springframework.security.authentication.ProviderManager"> |
|
<property name="providers"> |
|
<list> |
|
<ref local="PreAuthenticatedAuthenticationProvider"/> |
|
</list> |
|
</property> |
|
</bean> |
|
</property> |
|
<property name="principalExtractor"> |
|
<bean class="org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor"> |
|
<property name="subjectDnRegex" value="CN=([^,]+)"/> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<bean id="BasicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter"> |
|
<property name="authenticationManager"> |
|
<bean class="org.springframework.security.authentication.ProviderManager"> |
|
<property name="providers"> |
|
<list> |
|
<ref local="BasicAuthenticationProvider"/> |
|
</list> |
|
</property> |
|
</bean> |
|
</property> |
|
<property name="authenticationEntryPoint" ref="BasicAuthenticationEntryPoint"/> |
|
</bean> |
|
|
|
<bean id="BasicAuthenticationExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"> |
|
<property name="authenticationEntryPoint" ref="BasicAuthenticationEntryPoint" /> |
|
<property name="accessDeniedHandler"> |
|
<bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl" /> |
|
</property> |
|
</bean> |
|
|
|
<bean id="BasicAuthenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint"> |
|
<property name="realmName" value="MyGreatRealm"/> |
|
</bean> |
|
|
|
<bean id="BasicAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> |
|
<property name="userDetailsService" ref="WsUserDetailsService"/> |
|
<property name="hideUserNotFoundExceptions" value="false"/> |
|
</bean> |
|
|
|
<bean id="PreAuthenticatedAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider"> |
|
<property name="preAuthenticatedUserDetailsService"> |
|
<bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> |
|
<property name="userDetailsService" ref="WsUserDetailsService"/> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<sec:user-service id="WsUserDetailsService"> |
|
<!-- x509 certificate --> |
|
<sec:user name="localhost" password="" authorities="ROLE_SOMETHING, ROLE_WHATEVER, ROLE_REPORTER, ROLE_ADMIN"/> |
|
<!-- http basic --> |
|
<sec:user name="wsclient" password="password" authorities="ROLE_SOMETHING, ROLE_WHATEVER, ROLE_REPORTER, ROLE_ADMIN" /> |
|
</sec:user-service> |
|
|
|
<bean id="Http403ExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter"> |
|
<property name="authenticationEntryPoint"> |
|
<bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" /> |
|
</property> |
|
</bean> |
|
|
|
<!-- common --> |
|
|
|
<bean id="WebAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"> |
|
<property name="allowIfAllAbstainDecisions" value="false"/> |
|
<property name="decisionVoters"> |
|
<list> |
|
<bean id="RoleHierarchyVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter"> |
|
<constructor-arg ref="AppRoleHierarchy"/> |
|
<property name="rolePrefix" value="ROLE_"/> |
|
</bean> |
|
<bean id="WebPreInvocationAuthorizationAdviceVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter"> |
|
<property name="expressionHandler" ref="WebExpressionHandler" /> |
|
</bean> |
|
</list> |
|
</property> |
|
</bean> |
|
|
|
<bean id="WebExpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"> |
|
<property name="roleHierarchy" ref="AppRoleHierarchy" /> |
|
</bean> |
|
|
|
<bean id="AppRoleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl"> |
|
<property name="hierarchy"> |
|
<value> |
|
ROLE_SOMETHING > ROLE_AUTHENTICATED |
|
ROLE_WHATEVER > ROLE_AUTHENTICATED |
|
ROLE_REPORTER > ROLE_AUTHENTICATED |
|
ROLE_ADMIN > ROLE_AUTHENTICATED |
|
</value> |
|
</property> |
|
</bean> |
|
|
|
<bean id="LdapAuthenticationProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"> |
|
<constructor-arg> |
|
<bean class="org.springframework.security.ui.ntlm.ldap.authenticator.NtlmAwareLdapAuthenticator"> |
|
<constructor-arg ref="LdapContextSource"/> |
|
<property name="userSearch"> |
|
<bean id="LdapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch"> |
|
<constructor-arg index="0" value="${ldap.search.base}"/> |
|
<constructor-arg index="1" value="${ldap.search.auth.user.filter}"/> |
|
<constructor-arg index="2" ref="LdapContextSource" /> |
|
</bean> |
|
</property> |
|
</bean> |
|
</constructor-arg> |
|
<constructor-arg> |
|
<bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"> |
|
<constructor-arg ref="LdapContextSource" /> |
|
<constructor-arg value="${ldap.search.base}" /> |
|
<property name="searchSubtree" value="true"/> |
|
<property name="groupSearchFilter" value="${ldap.search.auth.role.filter}"/> |
|
<property name="rolePrefix" value=""/> |
|
<property name="convertToUpperCase" value="false"/> |
|
</bean> |
|
</constructor-arg> |
|
<property name="userDetailsContextMapper"> |
|
<bean class="x.y.z.services.user.UserDetailsContextMapper"> |
|
<property name="emailAttribute" value="${ldap.user.email.attribute}"/> |
|
</bean> |
|
</property> |
|
</bean> |
|
|
|
<bean id="LdapContextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource"> |
|
<constructor-arg value="${ldap.bind.url}"/> |
|
<property name="userDn" value="${ldap.bind.userDn}"/> |
|
<property name="password" value="${ldap.bind.password}"/> |
|
|
|
</bean> |
|
</beans> |
GoDaddyG2 cerificate
