spring-oauth2-context.xml

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xmlns:oauth="http://www.springframework.org/schema/security/oauth2" xmlns:sec="http://www.springframework.org/schema/security"
	xmlns:mvc="http://www.springframework.org/schema/mvc"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:context="http://www.springframework.org/schema/context"
	xmlns:jdbc="http://www.springframework.org/schema/jdbc"
    
	xsi:schemaLocation="http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2-1.0.xsd
		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc-3.1.xsd
		">

<!--     <context:component-scan base-package="com.ecs.latify.api"/> -->
<!--     <mvc:annotation-driven/> -->
    
	<!-- Just for testing... -->
	<http pattern="/oauth/cache_approvals" security="none" xmlns="http://www.springframework.org/schema/security" />
	<http pattern="/oauth/uncache_approvals" security="none" xmlns="http://www.springframework.org/schema/security" />

	<http pattern="/oauth/token" create-session="stateless" authentication-manager-ref="clientAuthenticationManager"
		xmlns="http://www.springframework.org/schema/security">
		<intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
		<anonymous enabled="false" />
		<http-basic entry-point-ref="clientAuthenticationEntryPoint" />
		<!-- include this only if you need to authenticate clients via request parameters -->
		<custom-filter ref="clientCredentialsTokenEndpointFilter" after="BASIC_AUTH_FILTER" />
		<access-denied-handler ref="oauthAccessDeniedHandler" />
	</http>

	<!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
		separately. This isn't mandatory, but it makes it easier to control the behaviour. -->
	<http pattern="/oauth/(users|clients)/.*" request-matcher="regex" create-session="stateless" entry-point-ref="oauthAuthenticationEntryPoint"
		use-expressions="true" xmlns="http://www.springframework.org/schema/security">
		<anonymous enabled="false" />
		<intercept-url pattern="/oauth/users/([^/].*?)/tokens/.*"
			access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('write')"
			method="DELETE" />
		<intercept-url pattern="/oauth/users/.*"
			access="#oauth2.clientHasRole('ROLE_CLIENT') and (hasRole('ROLE_USER') or #oauth2.isClient()) and #oauth2.hasScope('read')"
			method="GET" />
		<intercept-url pattern="/oauth/clients/.*"
			access="#oauth2.clientHasRole('ROLE_CLIENT') and #oauth2.isClient() and #oauth2.hasScope('read')" method="GET" />
		<intercept-url pattern="/**" access="denyAll()"/>
		<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
		<access-denied-handler ref="oauthAccessDeniedHandler" />
		<expression-handler ref="oauthWebExpressionHandler" />
	</http>

	<!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
		separately. This isn't mandatory, but it makes it easier to control the behaviour. -->
	<http pattern="/locations/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
		access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
		<anonymous enabled="false" />
		<intercept-url pattern="/locations" access="ROLE_USER,SCOPE_READ" />
		<intercept-url pattern="/locations/trusted/**" access="ROLE_CLIENT,SCOPE_TRUST" />
		<intercept-url pattern="/locations/user/**" access="ROLE_USER,SCOPE_TRUST" />
		<intercept-url pattern="/locations/**" access="ROLE_USER,SCOPE_READ" />
		<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
		<access-denied-handler ref="oauthAccessDeniedHandler" />
	</http>

	<!-- The OAuth2 protected resources are separated out into their own block so we can deal with authorization and error handling 
		separately. This isn't mandatory, but it makes it easier to control the behaviour. -->
	<http pattern="/me/**" create-session="never" entry-point-ref="oauthAuthenticationEntryPoint"
		access-decision-manager-ref="accessDecisionManager" xmlns="http://www.springframework.org/schema/security">
		<anonymous enabled="false" />
		<intercept-url pattern="/me" access="ROLE_USER,SCOPE_READ" />
		<custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
		<access-denied-handler ref="oauthAccessDeniedHandler" />
	</http>

	<http access-denied-page="/login.jsp?authorization_error=true" disable-url-rewriting="true"
		xmlns="http://www.springframework.org/schema/security">
		<intercept-url pattern="/oauth/**" access="ROLE_USER" />
		<intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />

		<form-login authentication-failure-url="/login.jsp?authentication_error=true" default-target-url="/index.jsp"
			login-page="/login.jsp" login-processing-url="/login.do" />
		<logout logout-success-url="/index.jsp" logout-url="/logout.do" />
		<anonymous />
	</http>

	<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
		<property name="realmName" value="com.ecs.latify.api" />
	</bean>

	<bean id="clientAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
		<property name="realmName" value="com.ecs.latify.api/client" />
		<property name="typeName" value="Basic" />
	</bean>

	<bean id="oauthAccessDeniedHandler" class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />

	<bean id="clientCredentialsTokenEndpointFilter" class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
		<property name="authenticationManager" ref="clientAuthenticationManager" />
	</bean>

	<bean id="accessDecisionManager" class="org.springframework.security.access.vote.UnanimousBased" xmlns="http://www.springframework.org/schema/beans">
		<constructor-arg>
			<list>
				<bean class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
				<bean class="org.springframework.security.access.vote.RoleVoter" />
				<bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
			</list>
		</constructor-arg>
	</bean>

	<authentication-manager id="clientAuthenticationManager" xmlns="http://www.springframework.org/schema/security">
		<authentication-provider user-service-ref="clientDetailsUserService" />
	</authentication-manager>

	<authentication-manager alias="authenticationManager" xmlns="http://www.springframework.org/schema/security">
		<authentication-provider>
			<user-service id="userDetailsService">
				<user name="marissa" password="koala" authorities="ROLE_USER" />
				<user name="paul" password="emu" authorities="ROLE_USER" />
			</user-service>
		</authentication-provider>
	</authentication-manager>

	<bean id="clientDetailsUserService" class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
		<constructor-arg ref="clientDetails" />
	</bean>

	<bean id="tokenStore" class="org.springframework.security.oauth2.provider.token.InMemoryTokenStore" />

	<bean id="tokenServices" class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
		<property name="tokenStore" ref="tokenStore" />
		<property name="supportRefreshToken" value="true" />
		<property name="clientDetailsService" ref="clientDetails" />
	</bean>

	<bean id="requestFactory" class="org.springframework.security.oauth2.provider.DefaultOAuth2RequestFactory">
		<constructor-arg name="clientDetailsService" ref="clientDetails" />
	</bean>

	<bean id="userApprovalHandler" class="com.ecs.latify.api.security.oauth.SparklrUserApprovalHandler">
		<property name="autoApproveClients">
			<set>
				<value>my-less-trusted-autoapprove-client</value>
			</set>
		</property>
		<property name="tokenServices" ref="tokenServices" />
		<property name="requestFactory" ref="requestFactory" />
	</bean>

	<oauth:authorization-server client-details-service-ref="clientDetails" token-services-ref="tokenServices"
		user-approval-handler-ref="userApprovalHandler">
		<oauth:authorization-code />
		<oauth:implicit />
		<oauth:refresh-token />
		<oauth:client-credentials />
		<oauth:password />
	</oauth:authorization-server>

	<oauth:resource-server id="resourceServerFilter" resource-id="latifyApi" token-services-ref="tokenServices" />

	<oauth:client-details-service id="clientDetails">
		<oauth:client client-id="my-trusted-client" authorized-grant-types="password,authorization_code,refresh_token,implicit"
			authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT" scope="read,write,trust" access-token-validity="60" />
		<oauth:client client-id="my-trusted-client-with-secret" authorized-grant-types="password,authorization_code,refresh_token,implicit"
			secret="somesecret" authorities="ROLE_CLIENT, ROLE_TRUSTED_CLIENT"  access-token-validity="60"/>
		<oauth:client client-id="my-client-with-secret" authorized-grant-types="client_credentials" authorities="ROLE_CLIENT"
			scope="read" secret="secret" />
		<oauth:client client-id="my-less-trusted-client" authorized-grant-types="authorization_code,implicit"
			authorities="ROLE_CLIENT" />
		<oauth:client client-id="my-less-trusted-autoapprove-client" authorized-grant-types="implicit"
			authorities="ROLE_CLIENT" scope="read,write,trust" />
		<oauth:client client-id="my-client-with-registered-redirect" authorized-grant-types="authorization_code,client_credentials"
			authorities="ROLE_CLIENT" redirect-uri="http://anywhere?key=value" scope="read,trust" />
		<oauth:client client-id="my-untrusted-client-with-registered-redirect" authorized-grant-types="authorization_code"
			authorities="ROLE_CLIENT" redirect-uri="http://anywhere" scope="read" />
		<oauth:client client-id="tonr" resource-ids="latifyApi" authorized-grant-types="authorization_code,implicit"
			authorities="ROLE_CLIENT" scope="read,write" secret="secret" />
	</oauth:client-details-service>

	<mvc:annotation-driven />

	<mvc:default-servlet-handler />

	<sec:global-method-security pre-post-annotations="enabled" proxy-target-class="true">
		<!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
		<sec:expression-handler ref="oauthExpressionHandler" />
	</sec:global-method-security>

	<oauth:expression-handler id="oauthExpressionHandler" />

	<oauth:web-expression-handler id="oauthWebExpressionHandler" />

	<!--Basic application beans. -->
	<bean id="viewResolver" class="org.springframework.web.servlet.view.ContentNegotiatingViewResolver">
		<property name="mediaTypes">
			<map>
				<entry key="json" value="application/json" />
			</map>
		</property>
		<property name="viewResolvers">
			<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
				<property name="prefix" value="/WEB-INF/jsp/"></property>
				<property name="suffix" value=".jsp"></property>
			</bean>
		</property>
		<property name="defaultViews">
			<bean class="org.springframework.web.servlet.view.json.MappingJacksonJsonView">
				<property name="extractValueFromSingleKeyModel" value="true" />
			</bean>
		</property>
	</bean>

	<bean id="adminController" class="com.ecs.latify.api.security.oauth.AdminController">
		<property name="tokenServices" ref="tokenServices" />
		<property name="userApprovalHandler" ref="userApprovalHandler" />
	</bean>

	<!-- Override the default mappings for approval and error pages -->
	<bean id="accessConfirmationController" class="com.ecs.latify.api.security.oauth.AccessConfirmationController">
		<property name="clientDetailsService" ref="clientDetails" />
	</bean>
	
	<bean id="locationService" class="com.ecs.latify.api.service.impl.LocationServiceImpl"/>
	
	<bean id="locationController" class="com.ecs.latify.api.controller.LocationController">
		<property name="locationService" ref="locationService" />
	</bean>
	
	
	<bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
        <property name="dataSource" ref="dataSource" />
        <property name="persistenceUnitName" value="spring-jpa" />
        <property name="jpaVendorAdapter">
            <bean class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter">
                <property name="showSql" value="true" />
                <property name="generateDdl" value="true" />
                <property name="database" value="HSQL" />
            </bean>
        </property>
    </bean>

    <bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">
        <property name="entityManagerFactory" ref="entityManagerFactory" />
    </bean>

    <jdbc:embedded-database id="dataSource" type="HSQL" />
		

</beans>