<!--
    R Service Bus

    Copyright (c) Copyright of OpenAnalytics BVBA, 2010-2014
 
    ===========================================================================
 
    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Affero General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.
 
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Affero General Public License for more details.
 
    You should have received a copy of the GNU Affero General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>

    @author rsb.development@openanalytics.eu
-->
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xsi:schemaLocation="
           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- Uncomment to enable security
    <global-method-security pre-post-annotations="enabled">
        <expression-handler ref="expressionHandler" />
    </global-method-security>
    -->

    <!-- 
         Below is a sample in-memory authentication provider: configure one that fits your needs.
    -->
    <authentication-manager alias="authenticationManager">
        <authentication-provider>
            <user-service>
                <user name="user" password="user" authorities="ROLE_APP_USER" />
                <user name="admin" password="admin" authorities="ROLE_APP_ADMIN" />
                <user name="boss" password="boss" authorities="ROLE_RSB_ADMIN" />
            </user-service>
        </authentication-provider>
    </authentication-manager>

    <http pattern="/login.html*" security="none" />
    <http pattern="/logout.html*" security="none" />
    <http pattern="/openid.html*" security="none" />
    <http pattern="/images/**" security="none" />
    <http pattern="/css/**" security="none" />
    <http pattern="/js/**" security="none" />

    <http realm="RSB" use-expressions="true">
        <expression-handler ref="webExpressionHandler" />
        <intercept-url pattern="/**/admin/system/**"
            access="isAuthenticated() and hasPermission(T(eu.openanalytics.rsb.component.AdminResource).ADMIN_SYSTEM_PATH, 'RSB_RESOURCE')" />
        <intercept-url pattern="/**" access="isAuthenticated()" />

        <logout logout-url="/logout" logout-success-url="/logout.html" invalidate-session="true" />

        <!-- Pick the authentication mechanism (basic, form or OpenID) -->
        <http-basic />
        <!--
        <form-login login-page="/login.html"
                    authentication-failure-url="/login.html?login_error=true"
                    default-target-url="/index.html" />

        <openid-login login-page="/openid.html"
                      authentication-failure-url="/openid.html?login_error=true"
                      default-target-url="/index.html" />
        -->

        <!--
        <custom-filter ref="x509Filter" position="PRE_AUTH_FILTER" /> 
         -->
    </http>

    <beans:bean id="expressionHandler"
        class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler"
        p:permissionEvaluator-ref="applicationPermissionEvaluator" />

    <beans:bean id="webExpressionHandler"
        class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"
        p:permissionEvaluator-ref="applicationPermissionEvaluator" />

    <beans:bean id="applicationPermissionEvaluator"
        class="eu.openanalytics.rsb.security.ApplicationPermissionEvaluator" />
</beans:beans>