1
|
<beans xmlns="http://www.springframework.org/schema/beans"
|
2
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
3
|
xmlns:security="http://www.springframework.org/schema/security"
|
4
|
xmlns:util="http://www.springframework.org/schema/util"
|
5
|
xsi:schemaLocation="http://www.springframework.org/schema/security
|
6
|
http://www.springframework.org/schema/security/spring-security-3.2.xsd
|
7
|
http://www.springframework.org/schema/beans
|
8
|
http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
|
9
|
http://www.springframework.org/schema/util
|
10
|
http://www.springframework.org/schema/util/spring-util-4.1.xsd"
|
11
|
default-autowire="byType">
|
12
|
|
13
|
|
14
|
<bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
|
15
|
<property name="maxUploadSize" value="268435456"/>
|
16
|
</bean>
|
17
|
|
18
|
<!--<bean id="webexpressionHandler"
|
19
|
class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>-->
|
20
|
|
21
|
<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager"/>
|
22
|
|
23
|
<security:http auto-config="false" use-expressions="true"
|
24
|
disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint"
|
25
|
pattern="/**">
|
26
|
|
27
|
<security:custom-filter before="PRE_AUTH_FILTER" ref="openIdConnectAuthenticationFilter" />
|
28
|
|
29
|
<security:logout logout-url="/openid_logout" invalidate-session="true"
|
30
|
delete-cookies="openAIRESession" logout-success-url="${webapp.dev.front}"/>
|
31
|
|
32
|
</security:http>
|
33
|
|
34
|
|
35
|
<bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint" >
|
36
|
<constructor-arg type="java.lang.String" value="/openid_connect_login"/>
|
37
|
</bean>
|
38
|
|
39
|
<security:authentication-manager alias="authenticationManager">
|
40
|
<security:authentication-provider ref="openIdConnectAuthenticationProvider" />
|
41
|
</security:authentication-manager>
|
42
|
|
43
|
<bean id="openIdConnectAuthenticationProvider" class="org.mitre.openid.connect.client.OIDCAuthenticationProvider">
|
44
|
<property name="authoritiesMapper">
|
45
|
<bean class="eu.dnetlib.repo.manager.config.OpenAireProviderAuthoritiesMapper">
|
46
|
<constructor-arg name="userRoles" ref="userRoles"/>
|
47
|
</bean>
|
48
|
</property>
|
49
|
</bean>
|
50
|
|
51
|
<util:map id="userRoles">
|
52
|
<entry key="urn:geant:openaire.eu:group:Super+Administrator#aai.openaire.eu" value="ROLE_ADMIN"/>
|
53
|
<entry key="urn:geant:openaire.eu:group:Portal+Administrator#aai.openaire.eu" value="ROLE_PORTAL_ADMIN"/>
|
54
|
</util:map>
|
55
|
|
56
|
|
57
|
<bean class="eu.dnetlib.repo.manager.config.FrontEndLinkURIAuthenticationSuccessHandler" id="frontEndRedirect"
|
58
|
init-method="init">
|
59
|
<property name="frontEndURI" value="${webapp.dev.front}"/>
|
60
|
</bean>
|
61
|
|
62
|
<!--
|
63
|
-
|
64
|
- The authentication filter
|
65
|
-
|
66
|
-->
|
67
|
<bean id="openIdConnectAuthenticationFilter" class="org.mitre.openid.connect.client.OIDCAuthenticationFilter">
|
68
|
<property name="authenticationManager" ref="authenticationManager" />
|
69
|
|
70
|
<property name="issuerService" ref="staticIssuerService" />
|
71
|
<property name="serverConfigurationService" ref="staticServerConfigurationService" />
|
72
|
<property name="clientConfigurationService" ref="staticClientConfigurationService" />
|
73
|
<property name="authRequestOptionsService" ref="staticAuthRequestOptionsService" />
|
74
|
<property name="authRequestUrlBuilder" ref="plainAuthRequestUrlBuilder" />
|
75
|
<property name="authenticationSuccessHandler" ref="frontEndRedirect"/>
|
76
|
|
77
|
</bean>
|
78
|
|
79
|
<!--
|
80
|
Static issuer service, returns the same issuer for every request.
|
81
|
-->
|
82
|
<bean class="org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService" id="staticIssuerService">
|
83
|
<property name="issuer" value="${oidc.issuer}" />
|
84
|
</bean>
|
85
|
|
86
|
<!--
|
87
|
Dynamic server configuration, fetches the server's information using OIDC Discovery.
|
88
|
-->
|
89
|
<bean class="org.mitre.openid.connect.client.service.impl.StaticServerConfigurationService" id="staticServerConfigurationService">
|
90
|
<property name="servers">
|
91
|
<map>
|
92
|
<entry key="${oidc.issuer}">
|
93
|
<bean class="org.mitre.openid.connect.config.ServerConfiguration">
|
94
|
<property name="issuer" value="${oidc.issuer}" />
|
95
|
<property name="authorizationEndpointUri" value="${oidc.issuer}authorize" />
|
96
|
<property name="tokenEndpointUri" value="${oidc.issuer}token" />
|
97
|
<property name="userInfoUri" value="${oidc.issuer}userinfo" />
|
98
|
<property name="jwksUri" value="${oidc.issuer}jwk" />
|
99
|
<property name="revocationEndpointUri" value="${oidc.issuer}revoke" />
|
100
|
</bean>
|
101
|
</entry>
|
102
|
</map>
|
103
|
</property>
|
104
|
</bean>
|
105
|
|
106
|
|
107
|
<!--
|
108
|
Static Client Configuration. Configures a client statically by storing configuration on a per-issuer basis.
|
109
|
-->
|
110
|
<bean class="org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService" id="staticClientConfigurationService">
|
111
|
<property name="clients">
|
112
|
<map>
|
113
|
<entry key="${oidc.issuer}">
|
114
|
<bean class="org.mitre.oauth2.model.RegisteredClient">
|
115
|
<property name="clientId" value="${oidc.id}" />
|
116
|
<property name="clientSecret" value="${oidc.secret}" />
|
117
|
<property name="scope">
|
118
|
<set value-type="java.lang.String">
|
119
|
<value>openid</value>
|
120
|
</set>
|
121
|
</property>
|
122
|
<property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />
|
123
|
<property name="redirectUris">
|
124
|
<set>
|
125
|
<value>${oidc.dev.home}</value>
|
126
|
</set>
|
127
|
</property>
|
128
|
</bean>
|
129
|
</entry>
|
130
|
</map>
|
131
|
</property>
|
132
|
</bean>
|
133
|
|
134
|
|
135
|
<!--
|
136
|
-
|
137
|
- Auth request options service: returns the optional components of the request
|
138
|
-
|
139
|
-->
|
140
|
<bean class="org.mitre.openid.connect.client.service.impl.StaticAuthRequestOptionsService" id="staticAuthRequestOptionsService">
|
141
|
<property name="options">
|
142
|
<map>
|
143
|
<!-- Entries in this map are sent as key-value parameters to the auth request -->
|
144
|
<!--
|
145
|
<entry key="display" value="page" />
|
146
|
<entry key="max_age" value="30" />
|
147
|
<entry key="prompt" value="none" />
|
148
|
-->
|
149
|
</map>
|
150
|
</property>
|
151
|
</bean>
|
152
|
|
153
|
<!--
|
154
|
Plain authorization request builder, puts all options as query parameters on the GET request
|
155
|
-->
|
156
|
<bean class="org.mitre.openid.connect.client.service.impl.PlainAuthRequestUrlBuilder" id="plainAuthRequestUrlBuilder" />
|
157
|
</beans>
|