<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">

<beans>
	<!-- ****** START ACEGI Security Configuration *******-->
	<!-- ======================== FILTER CHAIN ======================= -->

	<!--  if you wish to use channel security, add "channelProcessingFilter," in front
		of "httpSessionContextIntegrationFilter" in the list below -->
	<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
		<property name="filterInvocationDefinitionSource">
			<value>
				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
				PATTERN_TYPE_APACHE_ANT
				/**=anonymousLocalFilter,httpSessionContextIntegrationFilter,casProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor,SecurityContextHolderAwareRequestFilter,localFilter,menuFilter
			</value>
		</property>
	</bean>

	<bean id="SecurityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>

	<bean id="anonymousLocalFilter" class="com.saintgobain.sgsi.welcomesg.coordination.common.AnonymousLocalFilter"/>

	<bean id="localFilter" class="com.saintgobain.sgsi.welcomesg.coordination.common.LocaleFilter"/>

	<bean id="menuFilter" class="com.saintgobain.sgsi.welcomesg.coordination.menu.MenuFilter">
		<property name="menuService">
			<ref bean="menuService"/>
		</property>
	</bean>


	<bean id="anonymousProcessingFilter" class="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter"> 
		<property name="key" value="anonymous"/>
		<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/> 
	</bean> 
	
	<bean id="chainFilterTarget" singleton="false" class="org.acegisecurity.util.FilterToBeanProxy"/>
	
	<!-- Define filter to handle FORM authentication -->
	 
	<bean id="httpSessionContextIntegrationFilter"
		class="org.acegisecurity.context.HttpSessionContextIntegrationFilter">
		<property name="context">
			<value>
				org.acegisecurity.context.SecurityContextImpl
			</value>
		</property>
	</bean>
	
	<!-- CAS FILTER -->
	
    <bean id="casProcessingFilter" class="org.acegisecurity.ui.cas.CasProcessingFilter">
        <property name="authenticationManager">
            <ref bean="authenticationManager"/>
        </property>
        <property name="authenticationFailureUrl">
            <value>/loginFailed.html</value>
        </property>
        <property name="defaultTargetUrl">
            <value>/</value>
        </property>
        <property name="filterProcessesUrl">
            <value>/j_acegi_cas_security_check</value>
        </property>
    </bean>	
	
	
	<!-- ExceptionTranslationFilter -->
	
	<bean id="exceptionTranslationFilter"
		class="org.acegisecurity.ui.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<ref local="casProcessingFilterEntryPoint"/>
		</property>
	</bean>
	
    <bean id="casProcessingFilterEntryPoint" class="org.acegisecurity.ui.cas.CasProcessingFilterEntryPoint">
        <property name="loginUrl">
            <value>https://sgsilxssop.saint-gobain.com/cas/login</value>
        </property>
        <property name="serviceProperties">
            <ref bean="serviceProperties"/>
        </property>
    </bean>	
	
	<!-- Start Security interceptor config -->
	<!-- IMPORTANT -->
	<!-- Define authentication manager, decision manager and secure URL patterns -->
	<bean id="filterSecurityInterceptor"
		class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
		<property name="authenticationManager">
			<ref bean="authenticationManager" /> 
		</property>
		<property name="accessDecisionManager">
			<ref bean="accessDecisionManager" />
		</property>
		<property name="objectDefinitionSource">
			<value>
				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
				PATTERN_TYPE_APACHE_ANT 
				/admin/*=ROLE_ADMIN
				/**=ROLE_ANONYMOUS
			</value>
		</property>
	</bean>
	<!-- End Security interceptor config -->
	
	<!-- Entry point configuration -->

	<!-- End entry point configuration -->
	
	<!-- Start authentication config -->
	<bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
		<property name="providers">
			<list>
				<ref bean="casAuthenticationProvider"/> 
				<ref local="anonymousAuthenticationProvider"/>
			</list>
		</property>
	</bean>
 
<!-- Cas Provider -->

    <bean id="casAuthenticationProvider" class="org.acegisecurity.providers.cas.CasAuthenticationProvider">
        <property name="casAuthoritiesPopulator">
            <ref bean="casAuthoritiesPopulator"/> 	
        </property>
        <property name="casProxyDecider">
            <ref bean="casProxyDecider"/>
        </property>
        <property name="ticketValidator">
            <ref bean="casProxyTicketValidator"/> 
        </property>
        <property name="statelessTicketCache">
            <ref bean="statelessTicketCache"/>	
        </property>
        <property name="key">
            <value>my_password_for_this_auth_provider_only</value>
        </property>
    </bean>
    
   <bean id="casAuthoritiesPopulator" class="org.acegisecurity.providers.cas.populator.DaoCasAuthoritiesPopulator">
        <property name="userDetailsService">
            <ref bean="authenticationService"/>
        </property>
    </bean>
    
    <bean id="casProxyDecider" class="org.acegisecurity.providers.cas.proxy.RejectProxyTickets"/>
    
    <bean id="casProxyTicketValidator" class="org.acegisecurity.providers.cas.ticketvalidator.CasProxyTicketValidator">
        <property name="casValidate">
            <value>https://sgsilxssop.saint-gobain.com/cas/proxyValidate</value> <!-- TODO -->	
        </property>
        <property name="proxyCallbackUrl">
            <value>http://localhost:8080/welcomesg/casProxy/receptor</value> <!-- TODO -->
        </property>
        <property name="serviceProperties">
            <ref bean="serviceProperties"/>
        </property>
    </bean>
    
    <bean id="serviceProperties" class="org.acegisecurity.ui.cas.ServiceProperties">
        <property name="service">
            <value>http://localhost:8080/welcomesg/j_acegi_cas_security_check</value> <!-- TODO -->
        </property>
        <property name="sendRenew">
            <value>false</value>
        </property>
    </bean>
    
    <bean id="statelessTicketCache" class="org.acegisecurity.providers.cas.cache.EhCacheBasedTicketCache">
        <property name="cache">
            <ref local="ticketCacheBackend"/>
        </property>
    </bean>
    
    <bean id="ticketCacheBackend" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
        <property name="cacheManager">
            <ref local="cacheManager"/>
        </property>
        <property name="cacheName">
            <value>ticketCache</value>
        </property>
    </bean>
    
    <bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean">
        <property name="configLocation">
            <value>classpath:/ehcache-failsafe.xml</value> <!-- TODO -->
        </property>
    </bean>            
<!-- End Cas Provider -->
 
 <!-- User details -->
 <bean id="authenticationService" class="com.saintgobain.sgsi.welcomesg.service.security.AuthenticationServiceImpl">
	<property name="dataSource">
  		<ref bean="dataSource"/>
  	</property>
	<property name="sessionFactory">
  		<ref bean="sessionFactory"/>
  	</property>
	<property name="ldapTemplate">
  		<ref bean="ldapTemplate"/>
  	</property>  	
  </bean> 
 <!-- End user details -->
 
<!-- Anonymous Provider -->
	<bean id="anonymousAuthenticationProvider" class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
		<property name="key" value="anonymous"/>
	</bean>
<!-- end Anonymous Provider -->

<!-- DecisionManager configuration. Provide authorization after authentication -->
	<!-- Start authorization config -->
	<bean id="accessDecisionManager"
		class="org.acegisecurity.vote.UnanimousBased">
		<property name="decisionVoters">
			<list>
				<ref bean="roleVoter" />
			</list>
		</property>
	</bean>

	<bean id="roleVoter" 
		class="org.acegisecurity.vote.RoleVoter">
		<property name="rolePrefix">
			<value>ROLE_</value>
		</property>
	</bean>
	<!-- End authorization config -->
	
	<!-- testing only -->
	<bean id="securityFilter" class="com.saintgobain.sgsi.welcomesg.coordination.common.TestingSecurityFilter">
	<property name="sessionFactory">
  		<ref bean="sessionFactory"/>
  	</property>
	</bean>
</beans>
