D-Net

package eu.dnetlib.openaire.usermanagement.security;

import com.google.gson.Gson;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.web.authentication.AuthenticationSuccessHandler;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

/**

 * Created by stefanos on 9/5/2017.

 */

public class FrontEndLinkURIAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private static final Logger logger = Logger.getLogger(FrontEndLinkURIAuthenticationSuccessHandler.class);

    private String frontEndURI;

    private String frontPath;

    private String frontDomain;

    @Override

    public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication) throws IllegalArgumentException, IOException   {

        OIDCAuthenticationToken authOIDC = (OIDCAuthenticationToken) authentication;

        try {

//            Cookie jwt = new Cookie("XCsrfToken", JWTGenerator.generateToken(authOIDC, "my-very-secret"));

            Cookie openAIREUser = new Cookie("openAIREUser",  new Gson().toJson(JWTGenerator.generateJsonToken(authOIDC)));

            Cookie accessToken = new Cookie("AccessToken", authOIDC.getAccessTokenValue());

            // Expire the cookies in four hours (4 * 3600)

//            jwt.setMaxAge(14400);

            openAIREUser.setMaxAge(14400);

            accessToken.setMaxAge(14400);

            //TODO DELETE LOG

            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

//            logger.info("jwt: " + JWTGenerator.generateToken(authOIDC, "my-very-secret"));

            logger.info("access token: " + authOIDC.getAccessTokenValue());

            logger.info("openAIREUser: " + JWTGenerator.generateJsonToken(authOIDC));

            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

            //TODO DELETE LOG

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

//            logger.info("refresh token: " + authOIDC.getRefreshTokenValue());

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

//            jwt.setPath(frontPath);

            openAIREUser.setPath(frontPath);

            accessToken.setPath(frontPath);

            if (frontDomain!=null) {

//                jwt.setDomain(frontDomain);

                openAIREUser.setDomain(frontDomain);

                accessToken.setDomain(frontDomain);

            }

//            response.addCookie(jwt);

            response.addCookie(openAIREUser);

            response.addCookie(accessToken);

            response.sendRedirect(frontEndURI);

        } catch (IOException e) {

            logger.error("IOException in redirection ", e);

            throw new IOException(e);

        }catch (IllegalArgumentException e) {

            logger.error("IllegalArgumentException in redirection ", e);

            throw new IllegalArgumentException(e);

        }

    }

    public String getFrontEndURI() {

        return frontEndURI;

    }

    public void setFrontEndURI(String frontEndURI) {

        this.frontEndURI = frontEndURI;

    }

    public String getFrontPath() {

        return frontPath;

    }

    public void setFrontPath(String frontPath) {

        this.frontPath = frontPath;

    }

    public String getFrontDomain() {

        return frontDomain;

    }

    public void setFrontDomain(String frontDomain) {

        this.frontDomain = frontDomain;

    }

}

package eu.dnetlib.openaire.usermanagement.security;

import com.google.gson.JsonObject;

import eu.dnetlib.openaire.user.pojos.migration.MigrationUser;

import io.jsonwebtoken.Claims;

import io.jsonwebtoken.Jwts;

import io.jsonwebtoken.SignatureAlgorithm;

import org.apache.log4j.Logger;

import org.mitre.openid.connect.model.OIDCAuthenticationToken;

import org.mitre.openid.connect.model.UserInfo;

import java.io.UnsupportedEncodingException;

import java.net.URLEncoder;

import java.text.ParseException;

import java.util.Date;

public class JWTGenerator {

    private static final Logger logger = Logger.getLogger(JWTGenerator.class);

    public static String generateToken(MigrationUser u, String secret) {

        Claims claims = Jwts.claims().setSubject(u.getUsername());

        claims.put("fullname", u.getFullname() + "");

        claims.put("userId", u.getId() + "");

        claims.put("email", u.getEmail() + "");

        claims.put("role", u.getRoleId());

        //expiration

        long nowMillis = System.currentTimeMillis();

        Date now = new Date(nowMillis);

        long ttlMillis = 1800000;

        long expMillis = nowMillis + ttlMillis;

        Date exp = new Date(expMillis);

        return Jwts.builder()

                .setClaims(claims)

                .setExpiration(exp)

                .signWith(SignatureAlgorithm.HS512, secret)

                .compact();

    }

    public static String generateToken(OIDCAuthenticationToken authOIDC, String secret) {

        try {

            JsonObject userInfo = authOIDC.getUserInfo().getSource();

            Claims claims = Jwts.claims().setSubject(authOIDC.getUserInfo().getSub());

            claims.put("fullname", URLEncoder.encode(authOIDC.getUserInfo().getName(), "UTF-8") + "");

            if (authOIDC.getUserInfo().getGivenName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

                claims.put("firstname", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("firstname", URLEncoder.encode(authOIDC.getUserInfo().getGivenName(), "UTF-8") + "");

            }

            if (authOIDC.getUserInfo().getFamilyName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

                claims.put("lastname", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("lastname", URLEncoder.encode(authOIDC.getUserInfo().getFamilyName(), "UTF-8") + "");

            }

            claims.put("email", authOIDC.getUserInfo().getEmail() + "");

//            if (userInfo.getAsJsonArray("eduPersonScopedAffiliation").toString() != null) {

//                claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");

//            }

            if (userInfo.getAsJsonArray("edu_person_entitlements") == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have role");

                claims.put("role", URLEncoder.encode(" ", "UTF-8") + "");

            } else {

                claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

            }

            //TODO remove, We don't need it but if we are going to use it, we need to check if the user has affiliation

            //claims.put("edu_person_scoped_affiliations", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString(), "UTF-8") + "");

            //TODO remove

            //TODO THIS IS TEST

//            claims.put("fullname", URLEncoder.encode("Σοφία Μπαλτζή", "UTF-8") + "");

//            claims.put("firstname", URLEncoder.encode("Σοφία", "UTF-8") + "");

//            claims.put("lastname", URLEncoder.encode("Μπαλτζή", "UTF-8") + "");

//            claims.put("email", "sofie.mpl@gmail.com" + "");

//            claims.put("edu_person_scoped_affiliations", "faculty");

            Date exp = new Date(authOIDC.getIdToken().getJWTClaimsSet().getExpirationTime().getTime());

//            logger.info("expirationTime: "+ exp);

            //TODO DELETE LOGS

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

//            logger.info("fullName: " + authOIDC.getUserInfo().getName());

//            logger.info("firstName: " + authOIDC.getUserInfo().getGivenName());

//            logger.info("lastName: " + authOIDC.getUserInfo().getFamilyName());

//            logger.info("email: " + authOIDC.getUserInfo().getEmail());

//            //logger.info("Check everything");

//            logger.info("locale: " + authOIDC.getUserInfo().getSource());

//            logger.info("role: " + userInfo.getAsJsonArray("edu_person_entitlements").toString());

//            //logger.info("affiliation: " + userInfo.getAsJsonArray("edu_person_scoped_affiliations").toString());

//            logger.info("expirationTime: " + exp);

//            logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

                return Jwts.builder()

                        .setClaims(claims)

                        .setExpiration(exp)

                        .signWith(SignatureAlgorithm.HS512, secret)

                        .compact();

        } catch (ParseException e) {

            e.printStackTrace();

            logger.error("JWT Parse Exception from getting Expiration Time ", e);

            return "error";

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

            logger.error("UnsupportedEncodingException UTF-8 ", e);

            return "error";

        }

    }

     public static JsonObject generateJsonToken(OIDCAuthenticationToken authOIDC) {

         try {

            JsonObject userInfo = authOIDC.getUserInfo().getSource();

            JsonObject userInfo2 = new JsonObject();

            if (authOIDC.getUserInfo().getSub() == null) {

                logger.info("User doesn't have sub");

                userInfo2.addProperty("sub", "");

            } else {

                userInfo2.addProperty("sub", URLEncoder.encode(authOIDC.getUserInfo().getSub(), "UTF-8"));

            }

            if (authOIDC.getUserInfo().getName() == null) {

                logger.info("User doesn't have fullname");

                userInfo2.addProperty("fullname", "");

            } else {

                userInfo2.addProperty("fullname", URLEncoder.encode(authOIDC.getUserInfo().getName(), "UTF-8"));

            }

            if (authOIDC.getUserInfo().getGivenName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

//                userInfo2.addProperty("firstname", URLEncoder.encode(" ", "UTF-8") + "");

                userInfo2.addProperty("firstname", "");

            } else {

                userInfo2.addProperty("firstname", URLEncoder.encode(authOIDC.getUserInfo().getGivenName(), "UTF-8") + "");

            }

            if (authOIDC.getUserInfo().getFamilyName() == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have first name");

//                userInfo2.addProperty("lastname", URLEncoder.encode(" ", "UTF-8") + "");

                userInfo2.addProperty("lastname", "");

            } else {

                userInfo2.addProperty("lastname", URLEncoder.encode(authOIDC.getUserInfo().getFamilyName(), "UTF-8") + "");

            }

            userInfo2.addProperty("email", authOIDC.getUserInfo().getEmail() + "");

            if (userInfo.getAsJsonArray("edu_person_entitlements") == null){

                logger.info("User: " + authOIDC.getUserInfo().getName() + "doesn't have role");

//                userInfo2.addProperty("role", URLEncoder.encode(" ", "UTF-8") + "");

                userInfo2.addProperty("role", "");

            } else {

                userInfo2.addProperty("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

            }

            logger.info("UserINFO: " + userInfo2.toString());

            return userInfo2;

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

            logger.error("UnsupportedEncodingException UTF-8 ", e);

            JsonObject error = new JsonObject();

            error.addProperty("error", "UnsupportedEncodingException UTF-8 " + e);

            return error;

        }

     }

    //TODO DELETE IF IT IS NOT NECESSARY

    public static String generateAccessToken(OIDCAuthenticationToken authOIDC, String secret) {

        Claims claims = Jwts.claims().setId(authOIDC.getAccessTokenValue());

        //TODO DELETE LOGS

        logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

        logger.info("access token: " + authOIDC.getAccessTokenValue());

        logger.info("\n////////////////////////////////////////////////////////////////////////////////////////////////\n");

        return Jwts.builder()

                .setClaims(claims)

                .signWith(SignatureAlgorithm.HS512, secret)

                .compact();

    }

    public static String generateToken(UserInfo user, String secret) {

        try {

            JsonObject userInfo = user.getSource();

            Claims claims = Jwts.claims().setSubject(user.getSub());

            claims.put("email", user.getEmail() + "");

            claims.put("role", URLEncoder.encode(userInfo.getAsJsonArray("edu_person_entitlements").toString(), "UTF-8") + "");

            return Jwts.builder()

                    .setClaims(claims)

                    .signWith(SignatureAlgorithm.HS512, secret)

                    .compact();

        } catch (UnsupportedEncodingException e) {

            e.printStackTrace();

            logger.error("UnsupportedEncodingException UTF-8 ", e);

            return "error";

        }

    }

}

// How to add it manually

//        long nowMillis = System.currentTimeMillis();

//        //This is my token

//        try {

//            String jwt = Jwts.builder()

//                    .setSubject("Argiro")

//                    .setExpiration(new Date(nowMillis+1800000))

//                    .claim("fullname", "Argiro Kokogianaki")

//                    .claim("id", "8")

//                    .claim("email", "argiro@gmail.com")

//                    .claim("role","2")

//                    .signWith(

//                            SignatureAlgorithm.HS512,

//                            "my-very-secret".getBytes("UTF-8")

//                    )

//                    .compact();

package eu.dnetlib.openaire.usermanagement.registry.beans;

import org.apache.log4j.Logger;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.PropertySource;

import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;

import org.springframework.session.data.redis.config.annotation.web.http.EnableRedisHttpSession;

import org.springframework.session.web.http.CookieSerializer;

import org.springframework.session.web.http.DefaultCookieSerializer;

/**

 * Created by stefanos on 14/6/2017.

 */

@PropertySource(value = { "classpath:eu/dnet/openaire/usermanagement/redis.properties", "classpath:eu/dnet/openaire/usermanagement/springContext-dnetOpenaireUsersService.properties"} )

@Configuration

@EnableRedisHttpSession

public class Config {

    private static Logger logger = Logger.getLogger(Config.class);

    @Value("${redis.host:localhost}")

    private String host;

    @Value("${redis.port:6379}")

    private String port;

    @Value("${redis.password:#{null}}")

    private String password;

    @Value("${webbapp.front.domain:.openaire.eu}")

    private String domain;

    @Bean

    public LettuceConnectionFactory connectionFactory() {

        logger.info(String.format("Redis connection listens to %s:%s ",host,port));

        LettuceConnectionFactory factory = new LettuceConnectionFactory(host,Integer.parseInt(port));

        if(password != null) factory.setPassword(password);

        return factory;

    }

    @Bean

    public CookieSerializer cookieSerializer() {

        logger.info("Cookie Serializer: Domain is "+domain);

        DefaultCookieSerializer serializer = new DefaultCookieSerializer();

        serializer.setCookieName("openAIRESession"); // <1>

        serializer.setCookiePath("/"); // <2>

//        serializer.setDomainNamePattern(""); //with value "" set's the domain of the service e.g scoobydoo.di.uoa.gr

        serializer.setDomainName(domain);

        return serializer;

    }

}

import eu.dnetlib.openaire.usermanagement.security.JWTGenerator;

    @GET

    @Path("/{userId}")

    @Produces(MediaType.APPLICATION_JSON)

    public Response getUserById(@PathParam("userId") int userId) {

        try {

            MigrationUser mUser = sqlMigrationUserDAO.fetchById(userId);

            // Invalide user ID

            if (mUser == null) {

                String errorMessageJson = compose404Message("Cannot find user with id " + userId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            return Response.status(200).entity(composeDataResponse(mUser)).build();

        }

        catch (SQLException e) {

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", e))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        }

    }

     /* How to check @browser ../authenticate/?username=MY_USERNAME&password=MY_PASSWORD

     * http://localhost:8080/uoa-user-management-1.0.0-SNAPSHOT/api/users/authenticate?username=sba&password=12345678

    @Path("/authenticate")

    public Response authenticateUserGET(@QueryParam("username") String username, @QueryParam("password") String password)

    {

        return commonAuthenticateFunction(username, password);

    }*/

    @POST

    @Path("/authenticates")

    @Produces(MediaType.APPLICATION_JSON)

    @Consumes(MediaType.APPLICATION_JSON)

    public Response authenticateUserPOST(String input) {

        JsonObject jsonObject = new JsonParser().parse(input).getAsJsonObject();

        String username = jsonObject.get("username").getAsString();

        String password = jsonObject.get("password").getAsString();

        return commonAuthenticateFunction(username, password);

    }

    private Response commonAuthenticateFunction(String username, String password)

    {

            boolean usernameExists = mUserActionsLDAP.usernameExists(username);

            // if user was not found

            if (!usernameExists) {

                String errorMessageJson = compose401Message("Wrong credentials.");

                return Response

                        .status(Response.Status.UNAUTHORIZED)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            boolean authenticated = mUserActionsLDAP.authenticate(username, password);

            // if user was not authenticated

            if (!authenticated) {

                return Response

                        .status(Response.Status.UNAUTHORIZED)

                        .entity(compose401Message("User " + username + " could not be authenticated."))

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            MigrationUser mUser = sqlMigrationUserDAO.fetchByUsername(username);

            // if user was not found in my db

            LDAPUser ldapUser = null;

            if (mUser == null) {

                mUser = new MigrationUser(username);

                ldapUser = mUserActionsLDAP.getUser(username);

                mUser.setFullname(ldapUser.getDisplayName());

                mUser.setEmail(ldapUser.getEmail());

                mUser.setRoleId(2);

                sqlMigrationUserDAO.insert(mUser);

            }

            return Response.status(200).entity(composeDataResponse(mUser)).type(MediaType.APPLICATION_JSON).build();

        } catch (LDAPException exc) {

            logger.error("Fail to connect to LDAP. ", exc);

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("LDAP error.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        } catch (SQLException exc) {

            logger.error("Fail to fetch users. ", exc);

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

    }

    @GET

    @Path("/changeRole")

    @Produces(MediaType.APPLICATION_JSON)

    public Response changeRole(@QueryParam("roleId") int roleId, @QueryParam("userId") int userId)

    {

        RoleDAO roleDAO = new RoleDAO();

        try

        {

            Role role = roleDAO.fetchById(roleId);

            if (role == null)

            {

                //fetch all roleids TODO

                String errorMessageJson = compose404Message("Cannot find role with id" + roleId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            MigrationUser mUser = sqlMigrationUserDAO.fetchById(userId);

            if (mUser == null)

            {

                String errorMessageJson = compose404Message("Cannot find user with id " + userId + ".");

                return Response

                        .status(Response.Status.NOT_FOUND)

                        .entity(errorMessageJson)

                        .type(MediaType.APPLICATION_JSON)

                        .build();

            }

            mUser.setRoleId(roleId);

            sqlMigrationUserDAO.update(mUser);

            return Response.status(200).entity(composeDataResponse(mUser)).build();

        }

        catch (SQLException exc)

        {

            return Response

                    .status(Response.Status.INTERNAL_SERVER_ERROR)

                    .entity(compose500Message("Fail to fetch users.", exc))

                    .type(MediaType.APPLICATION_JSON)

                    .build();

        }

    private String composeDataResponse(UserInfo user) {

        return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : \"" + JWTGenerator.generateToken(user, "my-very-secret") + "\" }";

    }

    private String composeDataResponse(MigrationUser user) {

        //return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(user) + " }";

        return "{ \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : \"" + JWTGenerator.generateToken(user, "my-very-secret") + "\" }";

    }

//        private String composeDataResponse(String username) {

//            return " { \"status\" : \"success\", \"code\": \"200\", " + "\"data\" : " + new Gson().toJson(username) + " }";

//        }

redis.host = 127.0.0.1

#redis.port = 6379

#redis.password

oidc.id=767422b9-5461-4807-a80a-f9a2072d3a7d

oidc.secret=AMQtGlbTXNjwjhF0st28LmM6V0XypMdaVS7tJmGuYFlmH36iIv4t7tVqYuLYrNPkhnZ_GPUJvhymBhFupdgb6aU

oidc.issuer = https://aai.openaire.eu/oidc/

#oidc.home = https://beta.services.openaire.eu/admin-user-management/openid_connect_login

#webbapp.front = https://beta.admin.connect.openaire.eu/reload

#webbapp.front.path = /

#webbapp.front.domain = .openaire.eu

#testing

oidc.home = http://scoobydoo.di.uoa.gr:8080/dnet-openaire-users-1.0.0-SNAPSHOT/openid_connect_login

webbapp.front = https://scoobydoo.di.uoa.gr:4200/reload

webbapp.front.path = /

webbapp.front.domain =.di.uoa.gr

<!--<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

       xmlns:context="http://www.springframework.org/schema/context"

       xmlns="http://www.springframework.org/schema/beans"

       xmlns:security="http://www.springframework.org/schema/security"

       xmlns:util="http://www.springframework.org/schema/util"

       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd

	    http://www.springframework.org/schema/context

	    http://www.springframework.org/schema/context/spring-context-4.0.xsd

	    http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd

        http://www.springframework.org/schema/util

        http://www.springframework.org/schema/util/spring-util.xsd"

       default-autowire="byName"> -->

		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd

    <!--<bean id="dataSourceConnector" class="eu.dnetlib.openaire.user.store.DataSourceConnector" init-method="init" autowire="byName">-->

        <!--<property name="username" value="${openaire.users.db.username}"/>-->

        <!--<property name="password" value="${openaire.users.db.password}"/>-->

        <!--<property name="dbUrl" value="${openaire.users.db.url}" />-->

        <!--<property name="driver" value="${openaire.users.db.driverClassName}" />-->

    <!--</bean>-->

    <!--<bean id="sqlMigrationUserDAO" class="eu.dnetlib.openaire.user.dao.SQLMigrationUserDAO" autowire="byName"/>-->

    <!--<bean id="userVerificationDAO" class="eu.dnetlib.openaire.user.dao.UserVerificationDAO">-->

        <!--<property name="dataSourceConnector" ref="dataSourceConnector"/>-->

    <!--</bean>-->

    <!--<bean id="verificationActions" class="eu.dnetlib.openaire.user.utils.VerificationActions">-->

        <!--<property name="dataSourceConnector" ref="dataSourceConnector"/>-->

    <!--</bean>-->

    <security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager"/>

    <security:http auto-config="false" use-expressions="true"

                   disable-url-rewriting="true" entry-point-ref="authenticationEntryPoint"

                   pattern="/**">

        <security:custom-filter before="PRE_AUTH_FILTER" ref="openIdConnectAuthenticationFilter" />

        <security:logout logout-url="/openid_logout" invalidate-session="true"/>

    </security:http>

    <bean id="requestContextFilter" class="org.springframework.web.filter.RequestContextFilter"/>

    <bean id="webexpressionHandler"

          class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler"/>

    <bean id="authenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint" >

        <constructor-arg type="java.lang.String" value="/openid_connect_login"/>

    </bean>

    <security:authentication-manager alias="authenticationManager">

        <security:authentication-provider ref="openIdConnectAuthenticationProvider" />

    </security:authentication-manager>

    <bean id="openIdConnectAuthenticationProvider" class="org.mitre.openid.connect.client.OIDCAuthenticationProvider">

        <property name="authoritiesMapper">

            <bean class="org.mitre.openid.connect.client.NamedAdminAuthoritiesMapper">

                <property name="admins" ref="namedAdmins" />

            </bean>

        </property>

    </bean>

    <util:set id="namedAdmins" value-type="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority">

        <!--

            This is an example of how to set up a user as an administrator: they'll be given ROLE_ADMIN in addition to ROLE_USER.

            Note that having an administrator role on the IdP doesn't grant administrator access on this client.

            These are values from the demo "openid-connect-server-webapp" project of MITREid Connect.

        -->

        <bean class="org.mitre.openid.connect.client.SubjectIssuerGrantedAuthority">

            <constructor-arg name="subject" value="subject_value" />

            <constructor-arg name="issuer" value="${oidc.issuer}" />

        </bean>

    </util:set>

    <bean class="eu.dnetlib.openaire.usermanagement.security.FrontEndLinkURIAuthenticationSuccessHandler" id="frontEndRedirect">

        <property name="frontEndURI" value="${webbapp.front}"/>

        <property name="frontPath" value="${webbapp.front.path}"/>

        <property name="frontDomain" value="${webbapp.front.domain:#{null}}"/>

    </bean>

    <!--<bean id="securityContextLogoutHandler" class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>-->

    <!--<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">-->

        <!--<property name="filterProcessesUrl" value="/logout"/>-->

        <!--<constructor-arg index="0" value="/"/>-->

        <!--<constructor-arg index="1">-->

            <!--<list>-->

                <!--<ref bean="securityContextLogoutHandler"/>-->

                <!--&lt;!&ndash;ref bean="myLogoutHandler"/&ndash;&gt;-->

            <!--</list>-->

        <!--</constructor-arg>-->

    <!--</bean>-->

    <!--<bean class="eu.dnetlib.openaire.user.security.FrontEndLinkURILogoutSuccessHandler" id="frontEndRedirectLogout"/>-->

    <!--<bean id="logoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">-->

        <!--<property name="filterProcessesUrl" value="/logout"/>-->

        <!--<constructor-arg index="0" value="/"/>-->

        <!--<constructor-arg index="1">-->

            <!--<list>-->

                <!--<ref bean="securityContextLogoutHandler"/>-->

                <!--&lt;!&ndash;ref bean="myLogoutHandler"/&ndash;&gt;-->

            <!--</list>-->

        <!--</constructor-arg>-->

    <!--</bean>-->

    <!--

      -

      - The authentication filter

      -

      -->

    <bean id="openIdConnectAuthenticationFilter" class="org.mitre.openid.connect.client.OIDCAuthenticationFilter">

        <property name="authenticationManager" ref="authenticationManager" />

        <property name="issuerService" ref="staticIssuerService" />

        <property name="serverConfigurationService" ref="staticServerConfigurationService" />

        <property name="clientConfigurationService" ref="staticClientConfigurationService" />

        <property name="authRequestOptionsService" ref="staticAuthRequestOptionsService" />

        <property name="authRequestUrlBuilder" ref="plainAuthRequestUrlBuilder" />

        <property name="authenticationSuccessHandler" ref="frontEndRedirect"/>

    </bean>

    <!--

        Static issuer service, returns the same issuer for every request.

    -->

    <bean class="org.mitre.openid.connect.client.service.impl.StaticSingleIssuerService" id="staticIssuerService">

        <property name="issuer" value="${oidc.issuer}" />

    </bean>

    <!--

        Dynamic server configuration, fetches the server's information using OIDC Discovery.

    -->

    <bean class="org.mitre.openid.connect.client.service.impl.StaticServerConfigurationService" id="staticServerConfigurationService">

        <property name="servers">

            <map>

                <entry key="${oidc.issuer}">

                    <bean class="org.mitre.openid.connect.config.ServerConfiguration">

                        <property name="issuer" value="${oidc.issuer}" />

                        <property name="authorizationEndpointUri"	value="${oidc.issuer}authorize" />

                        <property name="tokenEndpointUri"	value="${oidc.issuer}token" />

                        <property name="userInfoUri" value="${oidc.issuer}userinfo" />

                        <property name="jwksUri" value="${oidc.issuer}jwk" />

                        <property name="revocationEndpointUri" value="${oidc.issuer}revoke" />

                    </bean>

                </entry>

            </map>

        </property>

    </bean>

    <!--

       Static Client Configuration. Configures a client statically by storing configuration on a per-issuer basis.

    <bean class="org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService" id="staticClientConfigurationService">

        <property name="clients">

            <map>

                <entry key="${oidc.issuer}">

                    <bean class="org.mitre.oauth2.model.RegisteredClient">

                        <property name="clientId" value="${oidc.id}" />

                        <property name="clientSecret" value="${oidc.secret}" />

                        <property name="scope">

                            <set value-type="java.lang.String">

                                <value>openid</value>

                            </set>

                        </property>       xmlns:oauth="http://www.springframework.org/schema/security/oauth2"

                        <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />

                        <property name="redirectUris">

                            <set>

                                <value>${oidc.home}</value>

                            </set>

                        </property>

                    </bean>

                </entry>

            </map>

        </property>

    </bean>

-->

    <bean class="org.mitre.openid.connect.client.service.impl.StaticClientConfigurationService" id="staticClientConfigurationService">

        <property name="clients">

            <map>

                <entry key="${oidc.issuer}">

                    <bean class="org.mitre.oauth2.model.RegisteredClient">

                        <property name="clientId" value="${oidc.id}" />

                        <property name="clientSecret" value="${oidc.secret}" />

                        <property name="scope">

                            <set value-type="java.lang.String">

                                <value>openid</value>

                            </set>

                        </property>

                        <property name="tokenEndpointAuthMethod" value="SECRET_BASIC" />

                        <property name="redirectUris">

                            <set>

                                <value>${oidc.home}</value>

                            </set>

                        </property>

                    </bean>

                </entry>

            </map>

        </property>

    </bean>

    <!--

      -

      -	Auth request options service: returns the optional components of the request

      -

      -->

    <bean class="org.mitre.openid.connect.client.service.impl.StaticAuthRequestOptionsService" id="staticAuthRequestOptionsService">

        <property name="options">

            <map>

                <!-- Entries in this map are sent as key-value parameters to the auth request -->

                <!--

                <entry key="display" value="page" />

                <entry key="max_age" value="30" />

                <entry key="prompt" value="none" />

                -->

            </map>

        </property>

    </bean>

    <!--

        Plain authorization request builder, puts all options as query parameters on the GET request

    -->

    <bean class="org.mitre.openid.connect.client.service.impl.PlainAuthRequestUrlBuilder" id="plainAuthRequestUrlBuilder" />

    <context:component-scan base-package="eu.dnetlib.openaire.usermanagement.registry.beans" />

    <import resource="classpath*:/eu/dnetlib/openaire/user/springContext-userManagementService.xml" />

    <bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration"/>

    <bean class="org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory"/>

		        <value>classpath*:/eu/**/springContext-dnetOpenaireUsersService.properties</value>

                <value>classpath*:/eu/**/redis.properties</value>

log4j.rootLogger = INFO, R

log4j.logger.eu.dnetlib = INFO

log4j.logger.org.springframework = INFO, S

        <init-param>

            <param-name>cors.support.credentials</param-name>

            <param-value>true</param-value>

        </init-param>

            <groupId>org.mitre</groupId>

            <artifactId>openid-connect-client</artifactId>

            <version>1.3.0</version>

        <!-- About redis -->

            <groupId>org.springframework.session</groupId>

            <artifactId>spring-session-data-redis</artifactId>

            <version>1.3.1.RELEASE</version>

            <type>pom</type>

        <dependency>

            <groupId>biz.paluch.redis</groupId>

            <artifactId>lettuce</artifactId>

            <version>3.5.0.Final</version>

        </dependency>

        <dependency>

            <groupId>org.springframework</groupId>

            <artifactId>spring-web</artifactId>

            <version>4.3.4.RELEASE</version>

        </dependency>