<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN/EN" "http://www.springframework.org/dtd/spring-beans.dtd" >

<!-- Default security configuration.
   - User accounts and roles are handled by JAMWiki
-->

<beans>

	<!-- ======================== FILTER CHAIN ======================= -->

	<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
		<property name="filterInvocationDefinitionSource">
			<value>
				PATTERN_TYPE_APACHE_ANT
				/**=httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,exceptionMessageFilter,filterInvocationInterceptor
			</value>
		</property>
	</bean>


	<!-- ======================== HTTP Session integration ======================== -->

	<bean id="httpSessionContextIntegrationFilter"
		class="org.acegisecurity.context.HttpSessionContextIntegrationFilter">
		<property name="context">
			<value>org.acegisecurity.context.SecurityContextImpl</value>
		</property>
	</bean>

	<!-- ======================== Authentication ======================== -->

	<!-- +++++++++ Filter to process authentication +++++++++ -->

	<bean id="authenticationProcessingFilter" class="org.jamwiki.authentication.JAMWikiAuthenticationProcessingFilter">
		<property name="authenticationManager">
			<ref bean="authenticationManager" />
		</property>
		<property name="authenticationFailureUrl">
			<!-- do not include virtual wiki in the url, JAMWikiAuthenticationProcessingFilter adds it -->
			<value>/Special:Login?message=error.login</value>
		</property>
		<property name="defaultTargetUrl">
			<!-- special hard-coded constant indicating default for virtual wiki -->
			<value>/DEFAULT_VIRTUAL_WIKI</value>
		</property>
		<property name="filterProcessesUrl">
			<!-- do not include virtual wiki in the url, JAMWikiAuthenticationProcessingFilter adds it -->
			<value>/j_acegi_security_check</value>
		</property>
		<property name="rememberMeServices">
			<ref local="rememberMeServices" />
		</property>
	</bean>

	<bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
		<property name="providers">
			<list>
				<ref local="daoAuthenticationProvider" />
				<ref local="anonymousAuthenticationProvider" />
				<ref local="rememberMeAuthenticationProvider" />
			</list>
		</property>
	</bean>

	<!-- Automatically receives AuthenticationEvent messages -->
	<bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener" />

	<!-- +++++++++ Authenticate from JAMWiki database +++++++++ -->

	<bean id="daoAuthenticationProvider" class="org.jamwiki.authentication.JAMWikiDaoAuthenticationProvider">
		<property name="userDetailsService">
			<ref local="jamWikiAuthenticationDao" />
		</property>
		<property name="userCache">
			<ref local="userCache" />
		</property>
	</bean>

	<bean id="jamWikiAuthenticationDao" class="org.jamwiki.authentication.JAMWikiDaoImpl"></bean>

	<!-- +++++++++ User cache +++++++++ -->

	<bean id="userCache" class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
		<property name="cache">
			<ref local="userCacheBackend" />
		</property>
	</bean>

	<bean id="userCacheBackend" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
		<property name="cacheManager">
			<ref local="cacheManager" />
		</property>
		<property name="cacheName" value="userCache" />
	</bean>

	<bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />

	<!-- +++++++++ Anonymous authentication +++++++++ -->
	<!-- Anonymous users are assigned ROLE_ANONYMOUS to be able to allow exceptions to general access rules -->

	<bean id="anonymousProcessingFilter" class="org.jamwiki.authentication.JAMWikiAnonymousProcessingFilter">
		<property name="key" value="jam35Wiki" />
		<property name="userAttribute" value="anonymousUser,ROLE_ANONYMOUS" />
	</bean>

	<bean id="anonymousAuthenticationProvider" class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
		<property name="key" value="jam35Wiki" />
	</bean>

	<!-- +++++++++ RememberMe service +++++++++ -->

	<bean id="rememberMeProcessingFilter" class="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter">
		<property name="authenticationManager">
			<ref local="authenticationManager" />
		</property>
		<property name="rememberMeServices">
			<ref local="rememberMeServices" />
		</property>
	</bean>

	<bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
		<property name="userDetailsService">
			<ref local="jamWikiAuthenticationDao" />
		</property>
		<property name="key" value="jam35Wiki" />
	</bean>

	<bean id="rememberMeAuthenticationProvider"
		class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
		<property name="key" value="jam35Wiki" />
	</bean>

	<bean id="logoutFilter" class="org.jamwiki.authentication.JAMWikiLogoutFilter">
		<!-- special hard-coded constant indicating default for virtual wiki -->
		<constructor-arg value="/DEFAULT_VIRTUAL_WIKI" />
		<constructor-arg>
			<list>
				<ref bean="rememberMeServices" />
				<bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />
			</list>
		</constructor-arg>
		<!-- do not include virtual wiki in the url, JAMWikiLogoutFilter adds it -->
		<property name="filterProcessesUrl" value="/Special:Logout" />
	</bean>

	<!-- ======================== Authorization ======================== -->

	<!-- +++++++++ Access Decision: is access allowed? +++++++++ -->

	<bean id="roleVoter" class="org.acegisecurity.vote.RoleVoter" />

	<bean id="accessDecisionManager" class="org.acegisecurity.vote.AffirmativeBased">
		<property name="allowIfAllAbstainDecisions">
			<value>false</value>
		</property>
		<property name="decisionVoters">
			<list>
				<ref local="roleVoter" />
			</list>
		</property>
	</bean>

	<!-- +++++++++ Error Message Provider +++++++++ -->
	
	<!-- specify default error messages when access is denied to a specific URL -->
	<bean id="errorMessageProvider" class="org.jamwiki.authentication.JAMWikiErrorMessageProvider">
		<property name="urlPatterns">
			<value>
				PATTERN_TYPE_APACHE_ANT
				/**/Special:Admin=login.message.admin
				/**/Special:Edit=login.message.edit
				/**/Special:Maintenance=login.message.admin
				/**/Special:Manage=login.message.admin
				/**/Special:Move=login.message.move
				/**/Special:Roles=login.message.admin
				/**/Special:Translation=login.message.admin
				/**/*=login.message.default
			</value>
		</property>
	</bean>

	<!-- add exception message to the request -->
	<bean id="exceptionMessageFilter" class="org.jamwiki.authentication.JAMWikiExceptionMessageFilter">
		<property name="errorMessageProvider">
			<ref bean="errorMessageProvider" />
		</property>
	</bean>

	<!-- +++++++++ Enforce Security based on URLs  +++++++++ -->

	<bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<ref bean="authenticationEntryPoint" />
		</property>
		<property name="accessDeniedHandler">
			<bean class="org.jamwiki.authentication.JAMWikiAccessDeniedHandler">
				<property name="errorPage" value="/en/Special:Login" />
			</bean>
		</property>
	</bean>

	<!-- Redirection of user login -->
	<bean id="authenticationEntryPoint" class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
		<property name="loginFormUrl" value="/en/Special:Login" />
		<!-- a PortMapper has to be configured if this is true and we are not using default ports -->
		<property name="forceHttps" value="false" />
	</bean>
	
	<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
		<property name="authenticationManager">
			<ref local="authenticationManager" />
		</property>
		<property name="accessDecisionManager">
			<ref local="accessDecisionManager" />
		</property>
		<property name="objectDefinitionSource">
			<value>
				PATTERN_TYPE_APACHE_ANT
				/**/Special:Admin=ROLE_SYSADMIN
				/**/Special:Edit=ROLE_EDIT_EXISTING,ROLE_EDIT_NEW
				/**/Special:Login=ROLE_ANONYMOUS,ROLE_USER
				/**/Special:Maintenance=ROLE_SYSADMIN
				/**/Special:Manage=ROLE_ADMIN
				/**/Special:Move=ROLE_MOVE
				/**/Special:RecentChangesFeed=ROLE_ANONYMOUS,ROLE_USER
				/**/Special:Roles=ROLE_SYSADMIN
				/**/Special:Setup=ROLE_ANONYMOUS,ROLE_USER
				/**/Special:Translation=ROLE_TRANSLATE
				/**/Special:Upload=ROLE_UPLOAD
				/**/Special:Upgrade=ROLE_ANONYMOUS,ROLE_USER
				/**/*.jsp=ROLE_ANONYMOUS,ROLE_USER
				/**=ROLE_VIEW
			</value>
		</property>
	</bean>

</beans>

