Revision 51060
Added by Panagiotis Kanakakis about 6 years ago
| springContext-repo-manager.xml | ||
|---|---|---|
| 3 | 3 |
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
| 4 | 4 |
xmlns:security="http://www.springframework.org/schema/security" |
| 5 | 5 |
xmlns:util="http://www.springframework.org/schema/util" xmlns:task="http://www.springframework.org/schema/task" |
| 6 |
xmlns:context="http://www.springframework.org/schema/context" |
|
| 6 | 7 |
xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd |
| 7 | 8 |
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.1.xsd |
| 8 | 9 |
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.1.xsd |
| 9 | 10 |
|
| 10 |
http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task.xsd" |
|
| 11 |
http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"
|
|
| 11 | 12 |
default-autowire="byType"> |
| 12 | 13 |
|
| 13 | 14 |
|
| 14 | 15 |
<task:annotation-driven executor="myExecutor" scheduler="myScheduler"/> |
| 15 | 16 |
<task:executor id="myExecutor" pool-size="5"/> |
| 16 | 17 |
<task:scheduler id="myScheduler" pool-size="10"/> |
| 18 |
<context:component-scan base-package="eu.dnetlib.repo.manager.server.config"/> |
|
| 17 | 19 |
|
| 18 | 20 |
|
| 19 |
|
|
| 20 | 21 |
<bean id="maillib" class="eu.dnetlib.utils.MailLibrary" init-method="init"> |
| 21 | 22 |
<property name="mailhost" value="${services.validator.mail.host}"/>
|
| 22 | 23 |
<property name="smtpPort" value="${services.validator.mail.port}"/>
|
| ... | ... | |
| 29 | 30 |
<property name="debug" value="${services.validator.mail.debug}"/>
|
| 30 | 31 |
</bean> |
| 31 | 32 |
|
| 33 |
|
|
| 32 | 34 |
<bean id="webexpressionHandler" |
| 33 | 35 |
class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/> |
| 34 | 36 |
|
| 37 |
<bean class="eu.dnetlib.repo.manager.server.utils.FrontEndLinkURIAuthenticationSuccessHandler" id="frontEndRedirect"> |
|
| 38 |
<property name="frontEndURI" value="${webapp.front}"/>
|
|
| 39 |
</bean> |
|
| 40 |
|
|
| 41 |
<!-- Enable SPEL annotation--> |
|
| 35 | 42 |
<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" |
| 36 | 43 |
authentication-manager-ref="authenticationManager"/> |
| 37 | 44 |
|
| 38 | 45 |
<security:http auto-config="false" use-expressions="true" |
| 39 | 46 |
disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint" |
| 40 | 47 |
pattern="/**"> |
| 41 |
|
|
| 42 |
<security:custom-filter before="PRE_AUTH_FILTER" ref="openIdConnectAuthenticationFilter" /> |
|
| 43 |
|
|
| 44 |
<security:logout /> |
|
| 45 |
|
|
| 46 | 48 |
</security:http> |
| 47 | 49 |
|
| 48 |
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint" > |
|
| 49 |
<constructor-arg type="java.lang.String" value="/openid_connect_login"/> |
|
| 50 |
</bean> |
|
| 50 |
<!--Disable authentication from this service--> |
|
| 51 |
<bean id="authenticationEntryPoint" |
|
| 52 |
class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint"/> |
|
| 53 |
<security:authentication-manager alias="authenticationManager"/> |
|
| 51 | 54 |
|
| 52 |
<security:authentication-manager alias="authenticationManager"> |
|
| 53 |
<security:authentication-provider ref="openIdConnectAuthenticationProvider" /> |
|
| 54 |
</security:authentication-manager> |
|
| 55 |
|
|
| 56 |
<bean id="openIdConnectAuthenticationProvider" class="org.mitre.openid.connect.client.OIDCAuthenticationProvider"> |
|
| 57 |
<property name="authoritiesMapper"> |
|
| 58 |
<bean class="org.mitre.openid.connect.client.NamedAdminAuthoritiesMapper"> |
|
| 59 |
<property name="admins" ref="namedAdmins" /> |
|
| 60 |
</bean> |
|
| 61 |
</property> |
|
| 62 |
</bean> |
|
| 63 |
|
|
| 64 |
<util:set id="namedAdmins" value-type="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority"> |
|
| 65 |
<!-- |
|
| 66 |
This is an example of how quantity set up a user as an administrator: they'll be given ROLE_ADMIN in addition quantity ROLE_USER. |
|
| 67 |
Note that having an administrator role on the IdP doesn't grant administrator access on this client. |
|
| 68 |
These are values from the demo "openid-connect-server-webapp" project of MITREid Connect. |
|
| 69 |
--> |
|
| 70 |
<bean class="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority"> |
|
| 71 |
<constructor-arg name="subject" value="90342.ASDFJWFA" /> |
|
| 72 |
<constructor-arg name="issuer" value="${oidc.issuer}" />
|
|
| 73 |
</bean> |
|
| 74 |
</util:set> |
|
| 75 |
|
|
| 76 |
|
|
| 77 |
<bean class="eu.dnetlib.repo.manager.server.utils.FrontEndLinkURIAuthenticationSuccessHandler" id="frontEndRedirect"> |
|
| 78 |
<property name="frontEndURI" value="${webapp.front}"/>
|
|
| 79 |
</bean> |
|
| 80 |
<!-- |
|
| 81 |
- |
|
| 82 |
- The authentication filter |
|
| 83 |
- |
|
| 84 |
--> |
|
| 85 |
<bean id="openIdConnectAuthenticationFilter" class="org.mitre.openid.connect.client.OIDCAuthenticationFilter"> |
|
| 86 |
<property name="authenticationManager" ref="authenticationManager" /> |
|
| 87 |
|
|
| 88 |
<property name="issuerService" ref="staticIssuerService" /> |
|
| 89 |
<property name="serverConfigurationService" ref="staticServerConfigurationService" /> |
|
| 90 |
<property name="clientConfigurationService" ref="staticClientConfigurationService" /> |
|
| 91 |
<property name="authRequestOptionsService" ref="staticAuthRequestOptionsService" /> |
|
| 92 |
<property name="authRequestUrlBuilder" ref="plainAuthRequestUrlBuilder" /> |
|
| 93 |
<property name="authenticationSuccessHandler" ref="frontEndRedirect"/> |
|
| 94 |
|
|
| 95 |
</bean> |
|
| 96 |
|
|
| 97 |
|
|
| 98 |
|
|
| 99 |
<!-- |
|
| 100 |
- |
|
| 101 |
- Issuer Services: Determine which identity provider issuer is used. |
|
| 102 |
- |
|
| 103 |
--> |
|
| 104 |
|
|
| 105 |
|
|
| 106 |
<!-- |
|
| 107 |
Static issuer service, returns the same issuer for every request. |
|
| 108 |
--> |
|
| 109 |
<bean class="org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService" id="staticIssuerService"> |
|
| 110 |
<property name="issuer" value="${oidc.issuer}" />
|
|
| 111 |
</bean> |
|
| 112 |
|
|
| 113 |
<bean class="org.mitre.openid.connect.client.service.impl.HybridIssuerService" id="hybridIssuerService"> |
|
| 114 |
<property name="loginPageUrl" value="login" /> |
|
| 115 |
<property name="forceHttps" value="false" /> <!-- this default property forces the webfinger issuer URL quantity be HTTPS, turn off for development work --> |
|
| 116 |
</bean> |
|
| 117 |
|
|
| 118 |
<!-- |
|
| 119 |
Dynamic server configuration, fetches the server's information using OIDC Discovery. |
|
| 120 |
--> |
|
| 121 |
<bean class="org.mitre.openid.connect.client.service.impl.StaticServerConfigurationService" id="staticServerConfigurationService"> |
|
| 122 |
<property name="servers"> |
|
| 123 |
<map> |
|
| 124 |
<entry key="${oidc.issuer}">
|
|
| 125 |
<bean class="org.mitre.openid.connect.config.ServerConfiguration"> |
|
| 126 |
<property name="issuer" value="${oidc.issuer}" />
|
|
| 127 |
<property name="authorizationEndpointUri" value="${oidc.issuer}authorize" />
|
|
| 128 |
<property name="tokenEndpointUri" value="${oidc.issuer}token" />
|
|
| 129 |
<property name="userInfoUri" value="${oidc.issuer}userinfo" />
|
|
| 130 |
<property name="jwksUri" value="${oidc.issuer}jwk" />
|
|
| 131 |
<property name="revocationEndpointUri" value="${oidc.issuer}revoke" />
|
|
| 132 |
</bean> |
|
| 133 |
</entry> |
|
| 134 |
</map> |
|
| 135 |
</property> |
|
| 136 |
</bean> |
|
| 137 |
|
|
| 138 |
|
|
| 139 |
<!-- |
|
| 140 |
Static Client Configuration. Configures a client statically by storing configuration on a per-issuer basis. |
|
| 141 |
--> |
|
| 142 |
|
|
| 143 |
<bean class="org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService" id="staticClientConfigurationService"> |
|
| 144 |
<property name="clients"> |
|
| 145 |
<map> |
|
| 146 |
<entry key="${oidc.issuer}">
|
|
| 147 |
<bean class="org.mitre.oauth2.model.RegisteredClient"> |
|
| 148 |
<property name="clientId" value="${oidc.id}" />
|
|
| 149 |
<property name="clientSecret" value="${oidc.secret}" />
|
|
| 150 |
<property name="scope"> |
|
| 151 |
<set value-type="java.lang.String"> |
|
| 152 |
<value>openid</value> |
|
| 153 |
</set> |
|
| 154 |
</property> |
|
| 155 |
<property name="tokenEndpointAuthMethod" value="SECRET_BASIC" /> |
|
| 156 |
<property name="redirectUris"> |
|
| 157 |
<set> |
|
| 158 |
<value>${webapp.home}</value>
|
|
| 159 |
</set> |
|
| 160 |
</property> |
|
| 161 |
</bean> |
|
| 162 |
</entry> |
|
| 163 |
</map> |
|
| 164 |
</property> |
|
| 165 |
</bean> |
|
| 166 |
|
|
| 167 |
|
|
| 168 |
<!-- |
|
| 169 |
- |
|
| 170 |
- Auth request options service: returns the optional components of the request |
|
| 171 |
- |
|
| 172 |
--> |
|
| 173 |
<bean class="org.mitre.openid.connect.client.service.impl.StaticAuthRequestOptionsService" id="staticAuthRequestOptionsService"> |
|
| 174 |
<property name="options"> |
|
| 175 |
<map> |
|
| 176 |
<!-- Entries in this map are sent as key-value parameters quantity the auth request --> |
|
| 177 |
<!-- |
|
| 178 |
<entry key="display" value="page" /> |
|
| 179 |
<entry key="max_age" value="30" /> |
|
| 180 |
<entry key="prompt" value="none" /> |
|
| 181 |
--> |
|
| 182 |
</map> |
|
| 183 |
</property> |
|
| 184 |
</bean> |
|
| 185 |
|
|
| 186 |
<!-- |
|
| 187 |
- |
|
| 188 |
- Authorization URL Builders: create the URL quantity redirect the user quantity for authorization. |
|
| 189 |
- |
|
| 190 |
--> |
|
| 191 |
|
|
| 192 |
<!-- |
|
| 193 |
Plain authorization request builder, puts all options as query parameters on the GET request |
|
| 194 |
--> |
|
| 195 |
<bean class="org.mitre.openid.connect.client.service.impl.PlainAuthRequestUrlBuilder" id="plainAuthRequestUrlBuilder" /> |
|
| 196 | 55 |
</beans> |
Also available in: Unified diff
1. Add config class ( redis configuration )
2. Modify properties file
3. Write logs to var/log folder