wisemapping-open-source/wise-webapp/src/main/webapp/WEB-INF/wisemapping-acegi-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">

<beans>

    <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
            </value>
        </property>
    </bean>

    <bean id="shaPasswordEncoder" class="org.acegisecurity.providers.encoding.ShaPasswordEncoder"/>

    <bean id="passwordEncoder" class="com.wisemapping.security.CustomPasswordEncoder">
        <property name="delegatedEncoder" ref="shaPasswordEncoder"/>
    </bean>

    <bean id="httpSessionContextIntegrationFilter"
          class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>

    <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
        <property name="filterProcessesUrl" value="/c/logout.htm"/>
        <constructor-arg value="/c/login.htm"/>
        <!-- URL redirected to after logout -->
        <constructor-arg>
            <list>
                <ref bean="rememberMeServices"/>
                <bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
            </list>
        </constructor-arg>
    </bean>

    <bean id="ssoCustomAuthenticationHandler" class="com.wisemapping.security.DefaultAuthenticationHandler"/>

    <bean id="authenticationProcessingFilter" class="com.wisemapping.security.WiseAuthenticationProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="authenticationFailureUrl" value="/c/login.htm?login_error=1"/>
        <property name="defaultTargetUrl" value="/c/login.htm"/>
        <property name="filterProcessesUrl" value="/c/j_acegi_security_check"/>
        <property name="rememberMeServices" ref="rememberMeServices"/>
        <property name="authenticationHandler" ref="ssoCustomAuthenticationHandler"/>
        <property name="exceptionMappings">
            <props>
                <prop key="org.acegisecurity.BadCredentialsException">/c/login.htm?login_error=2</prop>
                <prop key="org.acegisecurity.LockedException">/c/login.htm?login_error=3</prop>
            </props>
        </property>
    </bean>

    <bean id="securityContextHolderAwareRequestFilter"
          class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>

    <bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="rememberMeServices" ref="rememberMeServices"/>
    </bean>

    <bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter">
        <property name="key" value="changeThis"/>
        <property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS"/>
    </bean>

    <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint">
            <bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
                <property name="loginFormUrl" value="/c/login.htm"/>
                <property name="forceHttps" value="false"/>
            </bean>
        </property>
        <property name="accessDeniedHandler">
            <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
                <property name="errorPage" value="/accessDenied.jsp"/>
            </bean>
        </property>
    </bean>

    <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager">
            <bean class="org.acegisecurity.vote.AffirmativeBased">
                <property name="allowIfAllAbstainDecisions" value="false"/>
                <property name="decisionVoters">
                    <list>
                        <bean class="org.acegisecurity.vote.RoleVoter"/>
                        <bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
                    </list>
                </property>
            </bean>
        </property>
        <property name="objectDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /index.jsp=IS_AUTHENTICATED_ANONYMOUSLY
                /c/login*=IS_AUTHENTICATED_ANONYMOUSLY
                /c/userregistration*=IS_AUTHENTICATED_ANONYMOUSLY
                /c/activation.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/forgotpassword*=IS_AUTHENTICATED_ANONYMOUSLY
                /c/captcha*=IS_AUTHENTICATED_ANONYMOUSLY
                /c/home.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/try.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/search.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/keyboard.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /css/*=IS_AUTHENTICATED_ANONYMOUSLY
                /js/**=IS_AUTHENTICATED_ANONYMOUSLY
                /ws/**=IS_AUTHENTICATED_ANONYMOUSLY
                /images/*=IS_AUTHENTICATED_ANONYMOUSLY
                /c/embeddedview.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/export.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /c/publicview.htm=IS_AUTHENTICATED_ANONYMOUSLY
                /dwr/engine.js=IS_AUTHENTICATED_ANONYMOUSLY
                /dwr/interface/loggerservice.js=IS_AUTHENTICATED_ANONYMOUSLY
                /dwr/call/plaincall/loggerservice.logerror.dwr=IS_AUTHENTICATED_ANONYMOUSLY
                /**=IS_AUTHENTICATED_REMEMBERED
            </value>
        </property>
    </bean>

    <bean id="rememberMeServices" class="com.wisemapping.security.CustomTokenBasedRememberMeServices">
        <property name="userDetailsService" ref="userDetailsService"/>
        <property name="key" value="changeThis"/>
    </bean>

    <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
        <property name="providers">
            <list>
                <ref local="daoAuthenticationProvider"/>
                <bean class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
                    <property name="key" value="changeThis"/>
                </bean>
                <bean class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
                    <property name="key" value="changeThis"/>
                </bean>
            </list>
        </property>
    </bean>

    <bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userDetailsService"/>
        <!-- @Todo: Check if this still required. this was removed in the new spring version.-->
        <!--<property name="userCache">-->
        <!--<bean class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">-->
        <!--<property name="cache">-->
        <!--<bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">-->
        <!--<property name="cacheManager">-->
        <!--<bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>-->
        <!--</property>-->
        <!--<property name="cacheName" value="userCache"/>-->
        <!--</bean>-->
        <!--</property>-->
        <!--</bean>-->
        <!--</property>-->
        <property name="passwordEncoder" ref="passwordEncoder"/>
    </bean>

    <bean id="userDetailsService" class="com.wisemapping.security.DatabaseUserDetailService">
        <property name="userManager" ref="userManager"/>
    </bean>

    <!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
    <bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
</beans>