<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">

<beans>
    <!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
    <bean id="userDetailsService" class="ae.dxbpolice.eps.business.service.UserDetailsServiceImpl"/>

    <!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
    <bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>
    
    <bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /**=httpSessionContextIntegrationFilter,logoutFilter,casProcessingFilter,exceptionTranslationFilter,filterInvocationInterceptor
            </value>
        </property>
    </bean>
    
    <bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
    
    <bean id="logoutFilter" class="org.acegisecurity.ui.logout.LogoutFilter">
        <constructor-arg value="/index.jsp"/><!-- URL redirected to after logout -->
        <constructor-arg>
            <list>
                <bean class="org.acegisecurity.ui.logout.SecurityContextLogoutHandler"/>
            </list>
        </constructor-arg>
    </bean>
    
    <!-- Authorization in Acegi Security is performed mainly by the FilterSecurityInterceptor filter. 
         This filter identifies a user-role relationship for a URL. 
          -->
    <bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
        <property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager">
             <!-- The AffirmativeBased voter allows access if at least one voter votes
                  to grant access. Use the UnanimousBased voter if you only want to
                  grant access if no voter votes to deny access. -->
            <bean class="org.acegisecurity.vote.AffirmativeBased">
                <property name="allowIfAllAbstainDecisions" value="false"/>
                
                <property name="decisionVoters">
                    <list>
                        <bean class="org.acegisecurity.vote.RoleVoter">
                            <!--  Reset the role prefix to "EPS_", default is ROLE_ -->
                            <property name="rolePrefix">
                                <value>EPS_</value>
                            </property>
                        </bean>
                        <!-- The authenticated voter grant access if e.g.
                             IS_AUTHENTICATED_FULLY is an attribute -->
                        <bean class="org.acegisecurity.vote.AuthenticatedVoter" />
                    </list>
                </property>
            </bean>
        </property>
        
        <!-- Start the Dinamic URL-ROLe Mapping -->
        <property name="objectDefinitionSource">
            <ref local="dbDrivenFilterInvocationDefinitionSource" />
        </property>
    </bean>     
    
    <bean id="dbDrivenFilterInvocationDefinitionSource"
          class="ae.dxbpolice.eps.business.service.DatabaseDrivenFilterInvocationDefinitionSource">
        <property name="securityService">
            <ref bean="securityService" />
        </property>
    </bean>
    
    <bean id="rememberMeServices" class="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices">
        <property name="userDetailsService" ref="userDetailsService"/>
        <property name="key" value="changeThis"/>
    </bean>
    <!-- End Acegi Configuration for web -->
    
    <!-- ===================== Start of CAS SECURITY CONFIGURATIOS ==================== -->
    <bean id="serviceProperties" class="org.acegisecurity.ui.cas.ServiceProperties">
		<property name="service"><value>http://localhost:8889/eps/j_acegi_cas_security_check</value></property>		
		<property name="sendRenew"><value>false</value></property>
	</bean>

	<bean id="casProcessingFilter" class="org.acegisecurity.ui.cas.CasProcessingFilter">
		<property name="authenticationManager"><ref bean="authenticationManager"/></property>
		<property name="authenticationFailureUrl"><value>/casfailed.jsp</value></property>
		<property name="defaultTargetUrl"><value>/</value></property>
		<property name="filterProcessesUrl"><value>/j_acegi_cas_security_check</value></property>
	</bean>
    
    <bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
        <property name="authenticationEntryPoint"><ref local="casProcessingFilterEntryPoint"/></property>
        <property name="accessDeniedHandler">
            <bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
                <property name="errorPage" value="/jsps/login/access-denied.jsf"/>
            </bean>
        </property>
    </bean>
    
    <bean id="casProcessingFilterEntryPoint" class="org.acegisecurity.ui.cas.CasProcessingFilterEntryPoint">
        <property name="loginUrl"><value>https://localhost:8443/cas/login</value></property>
        <property name="serviceProperties"><ref bean="serviceProperties"/></property>
    </bean>
    
    <bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
        <property name="providers">
            <list>
                <ref bean="casAuthenticationProvider"/>
                
                <bean class="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider">
                    <property name="key" value="changeThis"/>
                </bean>
                <bean class="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider">
                    <property name="key" value="changeThis"/>
                </bean>
            </list>
        </property>
    </bean>
    
    <bean id="casAuthenticationProvider" class="org.acegisecurity.providers.cas.CasAuthenticationProvider">
        <property name="casAuthoritiesPopulator"><ref bean="casAuthoritiesPopulator"/></property>
        <property name="casProxyDecider"><ref bean="casProxyDecider"/></property>
        <property name="ticketValidator"><ref bean="casProxyTicketValidator"/></property>
        <property name="statelessTicketCache"><ref bean="statelessTicketCache"/></property>
        <property name="key"><value>my_password_for_this_auth_provider_only</value></property>
    </bean>
    
    <bean id="casProxyTicketValidator" class="org.acegisecurity.providers.cas.ticketvalidator.CasProxyTicketValidator">
        <property name="casValidate"><value>https://localhost:8443/cas/proxyValidate</value></property>
        <!--property name="proxyCallbackUrl"><value>http://localhost:8888/eps//casProxy/receptor</value></property-->
        <property name="serviceProperties"><ref bean="serviceProperties"/></property>
        <property name="trustStore"><value>C:\ProgramFiles\Java\jdk1.5.0_06\jre\lib\security\cacerts</value></property>
    </bean>
    
    <bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean">
        <property name="configLocation">
            <value>classpath:/ehcache-failsafe.xml</value>
        </property>
    </bean>
    
    <bean id="ticketCacheBackend" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
        <property name="cacheManager">
            <ref local="cacheManager"/>
        </property>
        <property name="cacheName">
            <value>ticketCache</value>
        </property>
    </bean>
    
    <bean id="statelessTicketCache" class="org.acegisecurity.providers.cas.cache.EhCacheBasedTicketCache">
        <property name="cache"><ref local="ticketCacheBackend"/></property>
    </bean>
    
    <bean id="casAuthoritiesPopulator" class="org.acegisecurity.providers.cas.populator.DaoCasAuthoritiesPopulator">
        <!--property name="userDetailsService"><ref bean="inMemoryDaoImpl"/></property-->
        <property name="userDetailsService" ref="userDetailsService"/>
    </bean>
    
    <bean id="inMemoryDaoImpl" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
  		<property name="userMap">
			<value>
                aabdelaziz=PASSWORD_NOT_USED,EPS_SYSTEM_ADMIN
				marissa=PASSWORD_NOT_USED,ROLE_TELLER,ROLE_SUPERVISOR
				dianne=PASSWORD_NOT_USED,ROLE_TELLER
				scott=PASSWORD_NOT_USED,ROLE_TELLER
				peter=PASSWORD_NOT_USED_AND_DISABLED_IGNORED,disabled,ROLE_TELLER
			</value>
		</property>
	</bean>
    
    <bean id="casProxyDecider" class="org.acegisecurity.providers.cas.proxy.RejectProxyTickets"/>
    
    <!-- ===================== HTTP CHANNEL REQUIREMENTS ==================== -->

    <!-- Enabled by default for CAS, as a CAS deployment uses HTTPS -->
    <!--bean id="channelProcessingFilter" class="org.acegisecurity.securechannel.ChannelProcessingFilter">
        <property name="channelDecisionManager"><ref local="channelDecisionManager"/></property>
        <property name="filterInvocationDefinitionSource">
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                \A/secure/.*\Z=REQUIRES_SECURE_CHANNEL
                \A/j_acegi_cas_security_check.*\Z=REQUIRES_SECURE_CHANNEL
                \A.*\Z=REQUIRES_INSECURE_CHANNEL
            </value>
        </property>
    </bean>
    
    <bean id="channelDecisionManager" class="org.acegisecurity.securechannel.ChannelDecisionManagerImpl">
        <property name="channelProcessors">
            <list>
               <ref local="secureChannelProcessor"/>
              <ref local="insecureChannelProcessor"/>
            </list>
        </property>
    </bean>
    
    <bean id="secureChannelProcessor" class="org.acegisecurity.securechannel.SecureChannelProcessor"/>
    <bean id="insecureChannelProcessor" class="org.acegisecurity.securechannel.InsecureChannelProcessor"/-->
    <!-- ====================== End of CAS SECURITY CONFIGURATIOS ===================== -->
     
</beans>
