<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:security="http://www.springframework.org/schema/security"
             xmlns:context="http://www.springframework.org/schema/context"
             xmlns:jee="http://www.springframework.org/schema/jee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
                                 http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
                                 http://www.springframework.org/schema/security
                                 http://www.springframework.org/schema/security/spring-security-3.2.xsd
                                 http://www.springframework.org/schema/context
                                 http://www.springframework.org/schema/context/spring-context-3.1.xsd
                                 http://www.springframework.org/schema/jee
                                 http://www.springframework.org/schema/jee/spring-jee-3.1.xsd">

  <context:component-scan base-package="com.openkm"/>

  <!-- OpenKM API -->
  <beans:import resource="soap.xml"/>
  <beans:import resource="rest.xml"/>
  <beans:import resource="cmis.xml"/>
  
  <!-- Swagger -->
  <beans:bean id="swagger2Feature" class="com.openkm.core.Swagger2Config" />

  <!--
  <beans:bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
      <beans:property name="targetClass" value="org.springframework.security.core.context.SecurityContextHolder" />
      <beans:property name="targetMethod" value="setStrategyName" />
      <beans:property name="arguments" value="_INHERITABLETHREADLOCAL" />
  </beans:bean>
  -->

  <security:global-method-security secured-annotations="enabled"/>

  <!-- Remove prefix to be able of use custom roles -->
  <beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
    <beans:property name="rolePrefix" value="ROLE_"/>
  </beans:bean>

  <!-- Status -->
  <security:http pattern="/Status" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- Download -->
  <security:http pattern="/Download" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- Workflow deploy -->
  <security:http pattern="/workflow-register" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- WebDAV using Basic authentication -->
  <security:http pattern="/webdav/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- Syndication using Basic authentication -->
  <security:http pattern="/feed/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- OpenCMIS (Browser) using Basic authentication -->
  <security:http pattern="/cmis/browser/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- OpenCMIS (AtomPub) using Basic authentication -->
  <security:http pattern="/cmis/atom/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- OpenCMIS (AtomPub) using Basic authentication -->
  <security:http pattern="/cmis/atom11/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- REST -->
  <security:http pattern="/services/rest/**" create-session="stateless">
    <security:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY"/>
    <security:http-basic/>
  </security:http>

  <!-- Additional filter chain for normal users, matching all other requests -->
  <!-- http://info.michael-simons.eu/2011/01/28/disable-jsessionid-path-parameter-in-java-web-applications/ -->
  <security:http access-decision-manager-ref="accessDecisionManager" access-denied-page="/unauthorized.jsp">

    <!-- GWT -->
    <security:intercept-url pattern="/frontend/**" access="IS_AUTHENTICATED_FULLY"/>

    <!-- JSPs -->
    <security:intercept-url pattern="/login.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <security:intercept-url pattern="/admin/**" access="ROLE_ADMIN"/>
    <security:intercept-url pattern="/mobile/**" access="IS_AUTHENTICATED_FULLY"/>

    <!-- Servlets -->
    <security:intercept-url pattern="/RepositoryStartup" access="IS_AUTHENTICATED_FULLY"/>
    <security:intercept-url pattern="/TextToSpeech" access="IS_AUTHENTICATED_FULLY"/>
    <security:intercept-url pattern="/HtmlPreview" access="IS_AUTHENTICATED_FULLY"/>
    <security:intercept-url pattern="/SyntaxHighlighter" access="IS_AUTHENTICATED_FULLY"/>
    <security:intercept-url pattern="/Test" access="IS_AUTHENTICATED_FULLY"/>

    <!-- Extensions -->
    <security:intercept-url pattern="/extension/ZohoFileUpload" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
    <security:intercept-url pattern="/extension/**" access="IS_AUTHENTICATED_FULLY"/>

    <!-- Login page -->
    <security:form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=1"/>

  </security:http>

  <!-- Needed for changing default role prefix -->
  <beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
    <beans:property name="decisionVoters">
      <beans:list>
        <beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter"/>
        <beans:ref bean="roleVoter"/>
        <beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter"/>
      </beans:list>
    </beans:property>
  </beans:bean>

  <!-- Security access logger -->
  <beans:bean id="loggerListener" class="com.openkm.spring.LoggerListener"/>

  <jee:jndi-lookup id="dataSource" jndi-name="jdbc/OpenKMDS" resource-ref="true"/>

  <!-- Security configuration moved to $CATALINA_HOME/OpenKM.xml -->
  <!-- WINFIX
  <security:authentication-manager alias="authenticationManager">
      <security:authentication-provider>
          <security:password-encoder hash="md5"/>
          <security:jdbc-user-service
              data-source-ref="dataSource"
              users-by-username-query="select usr_id, usr_password, 1 from OKM_USER where usr_id=? and usr_active='T'"
              authorities-by-username-query="select ur_user, ur_role from OKM_USER_ROLE where ur_user=?"/>
      </security:authentication-provider>
  </security:authentication-manager>
  WINFIX -->
</beans:beans>
