spring-security xml exploded configuration

spring-security-3.0.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns="http://www.springframework.org/schema/beans"
	xmlns:ctx="http://www.springframework.org/schema/context"
	xmlns:sec="http://www.springframework.org/schema/security"
	xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<!-- 
		http://static.springsource.org/spring-security/site/docs/3.0.x/reference/security-filter-chain.html
		http://static.springsource.org/spring-security/site/docs/3.0.x/reference/ns-config.html#filter-stack 
	-->
	<bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy">
		<sec:filter-chain-map path-type="ant">
			<!--
			<sec:filter-chain pattern="/**" filters="none"/>
			-->
			<sec:filter-chain pattern="/js/**" filters="none"/>
			<sec:filter-chain pattern="/images/**" filters="none"/>
			<sec:filter-chain pattern="/css/**" filters="none"/>

			<sec:filter-chain pattern="/ws/cert/**" filters="
				WsSecurityContextPersistenceFilter,
				X509AuthenticationFilter,
				Http403ExceptionTranslationFilter,
				FilterSecurityInterceptor" />
			<sec:filter-chain pattern="/ws/basic/**" filters="
				WsSecurityContextPersistenceFilter,
				BasicAuthenticationFilter,
				BasicAuthenticationExceptionTranslationFilter,
				FilterSecurityInterceptor" />

			<sec:filter-chain pattern="/ui/access-denied.htm" filters="none"/>
			
			<sec:filter-chain pattern="/ui/**" filters="
					UiSecurityContextPersistenceFilter,
					LogoutFilter,
					NtlmExceptionTranslationFilter,
					NtlmFilter,
					FilterSecurityInterceptor" />
		  </sec:filter-chain-map>
		
			<!--
			<sec:filter-chain pattern="/ui/**" filters="
					UiSecurityContextPersistenceFilter,
					LogoutFilter,
					FormLoginFilter,
					AnonymousAuthenticationFilter,
					FormExceptionTranslationFilter,
					FilterSecurityInterceptor" />
			-->
		
	</bean>

	<!-- http://static.springsource.org/spring-security/site/docs/3.0.x/reference/core-web-filters.html -->
	<bean id="FilterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
		<property name="authenticationManager" ref="FullAuthenticationManager"/>
		<property name="accessDecisionManager" ref="WebAccessDecisionManager"/>
		<property name="messageSource" ref="messageSource"/>
		
		<property name="securityMetadataSource">
			<sec:filter-security-metadata-source path-type="ant" use-expressions="false">
				<sec:intercept-url pattern="/" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" />
				<sec:intercept-url pattern="/ui/welcome*" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" />
				<sec:intercept-url pattern="/ui/account/login*" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" />
				<sec:intercept-url pattern="/ui/j_spring_security_check" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" />
				<sec:intercept-url pattern="/ui/access-denied.htm" access="ROLE_ANONYMOUS,ROLE_AUTHENTICATED" />
				<sec:intercept-url pattern="/**" access="ROLE_AUTHENTICATED" />
			</sec:filter-security-metadata-source>
		</property>
	</bean>
	
	<bean id="FormExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<bean id="FormAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
				<property name="loginFormUrl" value="/ui/account/login.htm"/>
			</bean>
		</property>
		<property name="accessDeniedHandler" ref="AccessDeniedHandler"/>
	</bean>

	<bean id="AccessDeniedHandler" class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
		<property name="errorPage" value="/ui/access-denied.htm"/>
	</bean>

	<!--
	<bean id="SessionManagementFilter" class="org.springframework.security.web.session.SessionManagementFilter">
		<property name="authenticationFailureHandler">
			<bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
				<property name="defaultFailureUrl" value="/account/login.htm?login_error=1"/>
			</bean>
		</property>
	</bean>
	-->
	
	<bean id="UiSecurityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
		<property name="securityContextRepository">
			<bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository">
				<property name="allowSessionCreation" value="true" />
			</bean>
		</property>
	</bean>
	
	<bean id="NtlmFilter" class="org.springframework.security.ui.ntlm.NtlmAuthenticationFilter">  
		<property name="retryOnAuthFailure" value="false" />
		<property name="stripDomain" value="true"/>
		<property name="defaultDomain" value="${jcifs.smb.client.domain}"/>
		<property name="netbiosWINS" value="${jcifs.netbios.wins}"/>
		<property name="authenticationManager">
			<bean class="org.springframework.security.authentication.ProviderManager">
				<property name="providers">
					<list>
						<ref bean="LdapAuthenticationProvider"/>
					</list>
				</property>
			</bean>
		</property>
	</bean>
	
	<!-- Providers are checked sequentially, if it is problem, multiple dedicated AuthenticationManages can be configured -->
	<bean id="FullAuthenticationManager" class="org.springframework.security.authentication.ProviderManager">
		<property name="providers">
			<list>
				<ref local="PreAuthenticatedAuthenticationProvider"/>
				<ref local="BasicAuthenticationProvider"/>
				<ref bean="LdapAuthenticationProvider"/>
			</list>
		</property>
	</bean>

	<bean id="NullRequestCacheAwareFilter" class="org.springframework.security.web.savedrequest.NullRequestCache"/>
	
	<bean id="NtlmEntryPoint" class="org.springframework.security.ui.ntlm.NtlmAuthenticationFilterEntryPoint">
		<property name="authenticationFailureUrl" value="/ui/access-denied.htm"/>
	</bean>
	
	<bean id="NtlmExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint" ref="NtlmEntryPoint"/>
	</bean>
	
	<bean id="FormLoginFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
		<property name="authenticationManager">
			<bean class="org.springframework.security.authentication.ProviderManager">
				<property name="providers">
					<list>
						<ref local="BasicAuthenticationProvider"/>
					</list>
				</property>
			</bean>
		</property>
		<property name="filterProcessesUrl" value="/ui/j_spring_security_check"/>
		<property name="authenticationSuccessHandler">
			<bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
			</bean>
		</property>
		<property name="authenticationFailureHandler">
			<bean class="org.springframework.security.web.authentication.ExceptionMappingAuthenticationFailureHandler">
				<property name="defaultFailureUrl" value="/ui/account/login.htm?authfailed=true"/>
				<property name="exceptionMappings">
					<map>
						<entry key="org.springframework.security.core.userdetails.UsernameNotFoundException" value="/ui/account/login.htm?errusername=true"/>
						<entry key="org.springframework.security.authentication.BadCredentialsException" value="/ui/account/login.htm?errpassword=true"/>
						<entry key="org.springframework.security.authentication.CredentialsExpiredException" value="/ui/account/login.htm?newpassword=true"/>
						<entry key="org.springframework.security.authentication.LockedException" value="/ui/account/login.htm?acclocked=true"/>
						<entry key="org.springframework.security.authentication.DisabledException" value="/ui/account/login.htm?accdisabled=true"/>
					</map>
				</property>
			</bean>
		</property>
		<property name="sessionAuthenticationStrategy">
			<bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
				<constructor-arg ref="SessionRegistry"/>
				<property name="maximumSessions" value="1"/>
				<property name="exceptionIfMaximumExceeded" value="true"/>
			</bean>
		</property>
	</bean>
	
	<bean id="SessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
	
	<bean id="LogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
		<constructor-arg name="logoutSuccessHandler" ref="LogoutSuccessHandler"/>
		<constructor-arg name="handlers">
			<array>
				<bean class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler">
					<property name="invalidateHttpSession" value="true"/>
				</bean>
			</array>
		</constructor-arg>
		<property name="filterProcessesUrl" value="/ui/account/logout"/>
	</bean>
	
	<bean id="LogoutSuccessHandler" class="org.springframework.security.web.authentication.logout.SimpleUrlLogoutSuccessHandler">
		<!--
		<property name="defaultTargetUrl" value="/ui/account/login.htm?loggedout=true"/>
		-->
		<property name="defaultTargetUrl" value="/ui/index.htm"/>
	</bean>
	
	<!-- 12. Anonymous Authentication http://static.springsource.org/spring-security/site/docs/3.0.x/reference/anonymous.html -->
	
	<bean id="AnonymousAuthenticationFilter" class="org.springframework.security.web.authentication.AnonymousAuthenticationFilter">
		<property name="key" value="anonymous-key"/>
		<property name="userAttribute" value="anonymous,ROLE_ANONYMOUS"/>
	</bean>
	
	<!-- WebSvc -->
	
	<bean id="WsSecurityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter">
		<property name="securityContextRepository">
			<bean class="org.springframework.security.web.context.HttpSessionSecurityContextRepository">
				<property name="allowSessionCreation" value="false" />
			</bean>
		</property>
	</bean>

	<bean id="X509AuthenticationFilter" class="org.springframework.security.web.authentication.preauth.x509.X509AuthenticationFilter">
		<property name="authenticationManager">
			<bean class="org.springframework.security.authentication.ProviderManager">
				<property name="providers">
					<list>
						<ref local="PreAuthenticatedAuthenticationProvider"/>
					</list>
				</property>
			</bean>
		</property>
		<property name="principalExtractor">
			<bean class="org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor">
				<property name="subjectDnRegex" value="CN=([^,]+)"/>
			</bean>
		</property>
	</bean>
	
	<bean id="BasicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
		<property name="authenticationManager">
			<bean class="org.springframework.security.authentication.ProviderManager">
				<property name="providers">
					<list>
						<ref local="BasicAuthenticationProvider"/>
					</list>
				</property>
			</bean>
		</property>
		<property name="authenticationEntryPoint" ref="BasicAuthenticationEntryPoint"/>
	</bean>
	
	<bean id="BasicAuthenticationExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint" ref="BasicAuthenticationEntryPoint" />
		<property name="accessDeniedHandler">
			<bean class="org.springframework.security.web.access.AccessDeniedHandlerImpl" />
		</property>
	</bean>
	
	<bean id="BasicAuthenticationEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
		<property name="realmName" value="MyGreatRealm"/>
	</bean>
	
	<bean id="BasicAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
		<property name="userDetailsService" ref="WsUserDetailsService"/>
		<property name="hideUserNotFoundExceptions" value="false"/>
	</bean>
	
	<bean id="PreAuthenticatedAuthenticationProvider" class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
		<property name="preAuthenticatedUserDetailsService">
			<bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
				<property name="userDetailsService" ref="WsUserDetailsService"/>
			</bean>
		</property>
	</bean>
	
	<sec:user-service id="WsUserDetailsService">
		<!-- x509 certificate -->
		<sec:user name="localhost" password="" authorities="ROLE_SOMETHING, ROLE_WHATEVER, ROLE_REPORTER, ROLE_ADMIN"/>
		<!-- http basic -->
		<sec:user name="wsclient" password="password" authorities="ROLE_SOMETHING, ROLE_WHATEVER, ROLE_REPORTER, ROLE_ADMIN" />
	</sec:user-service>
	
	<bean id="Http403ExceptionTranslationFilter" class="org.springframework.security.web.access.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<bean class="org.springframework.security.web.authentication.Http403ForbiddenEntryPoint" />
		</property>
	</bean>

	<!-- common -->

	<bean id="WebAccessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased">
		<property name="allowIfAllAbstainDecisions" value="false"/>
		<property name="decisionVoters">
			<list>
				<bean id="RoleHierarchyVoter" class="org.springframework.security.access.vote.RoleHierarchyVoter">
					<constructor-arg ref="AppRoleHierarchy"/>
					<property name="rolePrefix" value="ROLE_"/>
				</bean>
				<bean id="WebPreInvocationAuthorizationAdviceVoter" class="org.springframework.security.web.access.expression.WebExpressionVoter">
					<property name="expressionHandler" ref="WebExpressionHandler" />
				</bean>
			</list>
		</property>
	</bean>
	
	<bean id="WebExpressionHandler" class="org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler">
		<property name="roleHierarchy" ref="AppRoleHierarchy" />
	</bean>	

  <bean id="AppRoleHierarchy" class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
		<property name="hierarchy">
			<value>
				ROLE_SOMETHING > ROLE_AUTHENTICATED
				ROLE_WHATEVER > ROLE_AUTHENTICATED
				ROLE_REPORTER > ROLE_AUTHENTICATED
				ROLE_ADMIN > ROLE_AUTHENTICATED
			</value>
		</property>
	</bean>
	
	<bean id="LdapAuthenticationProvider" class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
		<constructor-arg>
			<bean class="org.springframework.security.ui.ntlm.ldap.authenticator.NtlmAwareLdapAuthenticator">
				<constructor-arg ref="LdapContextSource"/>
				<property name="userSearch">  
					<bean id="LdapUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">  
						<constructor-arg index="0" value="${ldap.search.base}"/>  
						<constructor-arg index="1" value="${ldap.search.auth.user.filter}"/>  
						<constructor-arg index="2" ref="LdapContextSource" />
					</bean>                 
				</property>  
			</bean>
		</constructor-arg>
		<constructor-arg>
			<bean class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator">  
				<constructor-arg ref="LdapContextSource" />  
				<constructor-arg value="${ldap.search.base}" />
				<property name="searchSubtree" value="true"/>
				<property name="groupSearchFilter" value="${ldap.search.auth.role.filter}"/>  
				<property name="rolePrefix" value=""/>  
				<property name="convertToUpperCase" value="false"/>
			</bean>  
		</constructor-arg>
		<property name="userDetailsContextMapper">
			<bean class="x.y.z.services.user.UserDetailsContextMapper">
				<property name="emailAttribute" value="${ldap.user.email.attribute}"/>
			</bean>
		</property>
	</bean>
	
	<bean id="LdapContextSource" class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
		<constructor-arg value="${ldap.bind.url}"/>
		<property name="userDn" value="${ldap.bind.userDn}"/>
		<property name="password" value="${ldap.bind.password}"/>

	</bean>
</beans>