Форум программистов [Powered by Invision Power Board]

Код

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.0.xsd">


    <http entry-point-ref="authenticationProcessingFilterEntryPoint">
        <custom-filter position="BASIC_AUTH_FILTER" ref="authenticationProcessingFilter"/>
        <custom-filter position="REMEMBER_ME_FILTER" ref="rememberMeProcessingFilter"/>
        <custom-filter position="LOGOUT_FILTER" ref="logoutFilter"/>
        <!-- Allow access welcome.htm to anyone (even un-authenticated users) -->
        <!--<intercept-url pattern="/welcome.htm" access="IS_AUTHENTICATED_ANONYMOUSLY"/>-->
        <intercept-url pattern="/test_ajax.jsp" filters="none"/>

        <!-- Don't apply any filters to the login form either, we want unauthenticated users to be able to see this -->
        <intercept-url pattern="/recovery" filters="none"/>
        <intercept-url pattern="/controller/recovery_password" filters="none"/>

        <intercept-url pattern="/design/**" filters="none"/>

        <intercept-url pattern="/**" access="ROLE_USER, ROLE_ORGANIZATION"/>

        <anonymous/>
        <http-basic/>
    </http>

    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="userDetailsService"/>
        <authentication-provider ref="rememberMeAuthenticationProvider"/>
    </authentication-manager>

    <!-- I've defined a custom UserDetails service to lookup users in my db using me own implementation -->
    <beans:bean id="userDetailsService" class="ru.iamready.security.UserDetailsServiceImpl">
        <beans:property name="loginInfoDAO" ref="loginInfoDAO"/>
    </beans:bean>

    <beans:bean id="authenticationProcessingFilterEntryPoint"
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <beans:property name="loginFormUrl" value="/start"/>
        <beans:property name="forceHttps" value="false"/>
    </beans:bean>

    <!-- custom form authentication filter - overridden so I can do some other business logic when a user logs in (update login count etc) -->
    <beans:bean id="authenticationProcessingFilter"
                class="org.springframework.security.web.authentication.AuthenticationProcessingFilter">
        <!-- sets this as the authentication filter over the default -->

        <beans:property name="authenticationManager" ref="authenticationManager"/>
        <!--<beans:property name="authenticationFailureUrl" value=""/>-->
        <!--<beans:property name="defaultTargetUrl" value="/start"/>-->
        <!--<beans:property name="targetUrlResolver" ref="roleBasedTargetUrlResolver"/>-->
        <beans:property name="authenticationFailureHandler" ref="authenticationFailureHandler"/>
        <beans:property name="authenticationSuccessHandler" ref="authenticationSuccessHandler"/>
        <beans:property name="filterProcessesUrl" value="/j_spring_security_check"/>
        <beans:property name="continueChainBeforeSuccessfulAuthentication" value="false"/>
        <beans:property name="rememberMeServices" ref="rememberMeServices"/>
    </beans:bean>

    <beans:bean id="authenticationFailureHandler" class="ru.iamready.security.AuthentificationFailureHandlerImpl">
        <beans:property name="authenticationFailureUrl" value="/start?authfailed=true"/>
    </beans:bean>

    <beans:bean id="authenticationSuccessHandler" class="ru.iamready.security.AuthentificationSuccessHandlerImpl">
        <beans:property name="organizationRoleTargetUrl" value="/org"/>
        <beans:property name="userRoleTargetUrl" value="/user"/>
    </beans:bean>

    <!-- Override RememberMeProcessingFilter to allow application of other business logic (update login count when user returns to the site -->
    <beans:bean id="rememberMeProcessingFilter"
                class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">

        <beans:property name="rememberMeServices" ref="rememberMeServices"/>
        <beans:property name="authenticationManager" ref="authenticationManager"/>
    </beans:bean>

    <!-- Defines which remember me implementation to use - in this case using a database table to log 'remembered' tokens -->
    <beans:bean id="rememberMeServices" class="ru.iamready.security.PersistentAuthTokenRememberMeServices">
        <beans:property name="tokenRepository" ref="authTokenDAO"/>
        <beans:property name="userDetailsService" ref="userDetailsService"/>
        <beans:property name="key" value="springRocks"/>
        <beans:property name="alwaysRemember" value="false"/>
        <beans:property name="cookieName" value="iamready_cookie_name"/>
        <!--Время жизни токена 10*60*60 секунд-->
        <beans:property name="tokenValiditySeconds" value="36000"/>
        <beans:property name="seriesLength" value="20"/>
        <beans:property name="tokenLength" value="20"/>
        <beans:property name="parameter" value="is_remember"/>
    </beans:bean>

    <beans:bean id="rememberMeAuthenticationProvider"
                class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
        <!-- This ensures that remember-me is added as an authentication provider -->
        <beans:property name="key" value="springRocks"/>
    </beans:bean>

    <beans:bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">

        <beans:property name="filterProcessesUrl" value="/logout"/>

        <beans:constructor-arg value="/start?loggedout=true"/>
        <!-- URL redirected to after logout -->
        <beans:constructor-arg>
            <beans:list>
                <!-- I add a bean here to perform some custom tasks when the user logs out -->
                <beans:ref bean="rememberMeServices"/>
                <beans:bean class="ru.iamready.security.LogoutHandlerImpl"/>
            </beans:list>
        </beans:constructor-arg>

    </beans:bean>

    <beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>
</beans:beans>