spring-security/samples/contacts/war/WEB-INF/contacts-servlet.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">

<!--
  - Application context definition for "contacts" DispatcherServlet.
  - $Id$
  -->

<beans>

	<!-- ========================== WEB DEFINITIONS ======================= -->

    <bean id="publicIndexController" class="sample.contact.PublicIndexController">
    	<property name="contactManager"><ref bean="contactManager"/></property>
 	</bean>

    <bean id="secureIndexController" class="sample.contact.SecureIndexController">
    	<property name="contactManager"><ref bean="contactManager"/></property>
 	</bean>

    <bean id="secureDeleteController" class="sample.contact.DeleteController">
    	<property name="contactManager"><ref bean="contactManager"/></property>
 	</bean>

    <bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
        <property name="mappings">
            <props>
                <prop key="/hello.htm">publicIndexController</prop>
                <prop key="/secure/add.htm">secureAddForm</prop>
                <prop key="/secure/index.htm">secureIndexController</prop>
                <prop key="/secure/del.htm">secureDeleteController</prop>
			</props>
        </property>
    </bean>

    <bean id="addValidator" class="sample.contact.WebContactValidator"/>
    <bean id="secureAddForm" class="sample.contact.WebContactAddController">
        <property name="sessionForm"><value>true</value></property>
        <property name="commandName"><value>webContact</value></property>
        <property name="commandClass"><value>sample.contact.WebContact</value></property>
        <property name="validator"><ref bean="addValidator"/></property>
        <property name="formView"><value>add</value></property>
        <property name="successView"><value>index.htm</value></property>
        <property name="contactManager">
            <ref bean="contactManager"/>
        </property>
    </bean>

	<bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="prefix"><value>/WEB-INF/jsp/</value></property>
		<property name="suffix"><value>.jsp</value></property>
	</bean>

	<!-- =================== SECURITY SYSTEM DEFINITIONS ================== -->
	
	<!-- RunAsManager -->
	<bean id="runAsManager" class="net.sf.acegisecurity.runas.RunAsManagerImpl">
     	<property name="key"><value>my_run_as_password</value></property>
 	</bean>

	<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHENTICATION DEFINITIONS ~~~~~~~~~~~~~~~~~~ -->
	
	<!-- We rely on the Because the web container to authenticate the user -->

	<!-- Authentication provider that accepts as valid our RunAsManagerImpl created tokens -->
	<bean id="runAsAuthenticationProvider" class="net.sf.acegisecurity.runas.RunAsImplAuthenticationProvider">
     	<property name="key"><value>my_run_as_password</value></property>
 	</bean>

	<!-- Authentication provider that accepts as valid any adapter-created Authentication token  -->
	<bean id="authByAdapterProvider" class="net.sf.acegisecurity.adapters.AuthByAdapterProvider">
  		<property name="key"><value>my_password</value></property>
 	</bean>

	<!-- The authentication manager that iterates through our authentication providers -->
	<bean id="providerManager" class="net.sf.acegisecurity.providers.ProviderManager">
		<property name="providers">
		  <list>
		    <ref bean="runAsAuthenticationProvider"/>
		    <ref bean="authByAdapterProvider"/>
		  </list>
		</property>
	</bean>

	<!-- ~~~~~~~~~~~~~~~~~~~~ AUTHORIZATION DEFINITIONS ~~~~~~~~~~~~~~~~~~~ -->

	<!-- An access decision voter that reads ROLE_* configuaration settings -->
	<bean id="roleVoter" class="net.sf.acegisecurity.vote.RoleVoter"/>

	<!-- An access decision voter that reads CONTACT_OWNED_BY_CURRENT_USER configuaration settings -->
	<bean id="contactSecurityVoter" class="sample.contact.ContactSecurityVoter"/>

	<!-- An affirmative access decision manager -->
	<bean id="affirmativeBased" class="net.sf.acegisecurity.vote.AffirmativeBased">
   		<property name="allowIfAllAbstainDecisions"><value>false</value></property>
		<property name="decisionVoters">
		  <list>
		    <ref bean="roleVoter"/>
		    <ref bean="contactSecurityVoter"/>
		  </list>
		</property>
	</bean>

	<!-- ===================== SECURITY DEFINITIONS ======================= -->
	
	<bean id="publicContactManagerSecurity" class="net.sf.acegisecurity.SecurityInterceptor">
    	<property name="authenticationManager"><ref bean="providerManager"/></property>
    	<property name="accessDecisionManager"><ref bean="affirmativeBased"/></property>
    	<property name="runAsManager"><ref bean="runAsManager"/></property>
 		<property name="methodDefinitionSource">
			<value>
				sample.contact.ContactManager.delete=ROLE_SUPERVISOR,RUN_AS_SERVER
				sample.contact.ContactManager.getAllByOwner=CONTACT_OWNED_BY_CURRENT_USER,RUN_AS_SERVER
				sample.contact.ContactManager.save=CONTACT_OWNED_BY_CURRENT_USER,RUN_AS_SERVER
				sample.contact.ContactManager.getById=ROLE_TELLER,RUN_AS_SERVER
			</value>
		</property>
	</bean>

	<!-- We expect all callers of the backend object to hold the role ROLE_RUN_AS_SERVER -->
	<bean id="backendContactManagerSecurity" class="net.sf.acegisecurity.SecurityInterceptor">
    	<property name="authenticationManager"><ref bean="providerManager"/></property>
    	<property name="accessDecisionManager"><ref bean="affirmativeBased"/></property>
    	<property name="runAsManager"><ref bean="runAsManager"/></property>
 		<property name="methodDefinitionSource">
			<value>
				sample.contact.ContactManager.delete=ROLE_RUN_AS_SERVER
				sample.contact.ContactManager.getAllByOwner=ROLE_RUN_AS_SERVER
				sample.contact.ContactManager.save=ROLE_RUN_AS_SERVER
				sample.contact.ContactManager.getById=ROLE_RUN_AS_SERVER
			</value>
		</property>
	</bean>

	<!-- ======================= BUSINESS DEFINITIONS ===================== -->

	<bean id="contactManager" class="org.springframework.aop.framework.ProxyFactoryBean">
    	<property name="proxyInterfaces"><value>sample.contact.ContactManager</value></property>
	    <property name="interceptorNames">
      	<list>
        	<value>publicContactManagerSecurity</value>
 	        <value>publicContactManagerTarget</value>
    	</list>
	    </property>
  	</bean>

	<bean id="publicContactManagerTarget" class="sample.contact.ContactManagerFacade">
    	<property name="backend"><ref bean="backendContactManager"/></property>
	</bean>

	<bean id="backendContactManager" class="org.springframework.aop.framework.ProxyFactoryBean">
    	<property name="proxyInterfaces"><value>sample.contact.ContactManager</value></property>
	    <property name="interceptorNames">
      	<list>
        	<value>backendContactManagerSecurity</value>
 	        <value>backendContactManagerTarget</value>
    	</list>
	    </property>
  	</bean>

	<bean id="backendContactManagerTarget" class="sample.contact.ContactManagerBackend"/>

</beans>