231 lines
11 KiB
XML
231 lines
11 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<!--
|
|
|
|
Licensed to the Apache Software Foundation (ASF) under one
|
|
or more contributor license agreements. See the NOTICE file
|
|
distributed with this work for additional information
|
|
regarding copyright ownership. The ASF licenses this file
|
|
to you under the Apache License, Version 2.0 (the
|
|
"License"); you may not use this file except in compliance
|
|
with the License. You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing,
|
|
software distributed under the License is distributed on an
|
|
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
KIND, either express or implied. See the License for the
|
|
specific language governing permissions and limitations
|
|
under the License.
|
|
|
|
-->
|
|
|
|
<beans:beans xmlns="http://www.springframework.org/schema/security"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:beans="http://www.springframework.org/schema/beans"
|
|
xmlns:oauth="http://www.springframework.org/schema/security/oauth2"
|
|
xsi:schemaLocation="
|
|
http://www.springframework.org/schema/beans
|
|
http://www.springframework.org/schema/beans/spring-beans.xsd
|
|
http://www.springframework.org/schema/security/oauth2
|
|
http://www.springframework.org/schema/security/spring-security-oauth2.xsd
|
|
http://www.springframework.org/schema/security
|
|
http://www.springframework.org/schema/security/spring-security.xsd">
|
|
|
|
<beans:beans profile="basicauth">
|
|
<http create-session="stateless" use-expressions="true" pattern="/api/**"
|
|
entry-point-ref="basicAuthenticationEntryPoint">
|
|
<csrf disabled="true"/>
|
|
<intercept-url pattern="/api/*/authentication" access="permitAll"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/self/authentication" access="permitAll"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/self/registration" access="permitAll"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/self/registration/user" access="permitAll"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
|
method="GET" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor/validate" access="isFullyAuthenticated()"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="GET" requires-channel="https" />
|
|
<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="PUT" requires-channel="https" />
|
|
<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="DELETE" requires-channel="https" />
|
|
<intercept-url pattern="/api/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="HEAD" requires-channel="https" />
|
|
|
|
<custom-filter after="SECURITY_CONTEXT_FILTER" ref="basicAuthenticationProcessingFilter" />
|
|
<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
|
|
</http>
|
|
|
|
<beans:bean id="basicAuthenticationEntryPoint"
|
|
class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
|
|
<beans:property name="realmName" value="Fineract Platform API" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
|
|
factory-method="createDelegatingPasswordEncoder">
|
|
</beans:bean>
|
|
|
|
<beans:bean id="customAuthenticationProvider"
|
|
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
|
|
<beans:property name="userDetailsService" ref="userDetailsService" />
|
|
<beans:property name="passwordEncoder" ref="passwordEncoder" />
|
|
</beans:bean>
|
|
|
|
<authentication-manager alias="authenticationManager"
|
|
erase-credentials="false">
|
|
<authentication-provider ref="customAuthenticationProvider" />
|
|
</authentication-manager>
|
|
</beans:beans>
|
|
<beans:beans profile="oauth">
|
|
<http create-session="stateless" use-expressions="true" pattern="/api/v1/**"
|
|
entry-point-ref="oauthAuthenticationEntryPoint"
|
|
access-decision-manager-ref="accessDecisionManager">
|
|
<csrf disabled="true"/>
|
|
<anonymous enabled="false" />
|
|
<intercept-url pattern="/api//v1/**" method="OPTIONS"
|
|
access="permitAll" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
|
method="GET" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor" access="isFullyAuthenticated()"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/*/twofactor/validate" access="isFullyAuthenticated()"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="GET" requires-channel="https" />
|
|
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="POST" requires-channel="https" />
|
|
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="PUT" requires-channel="https" />
|
|
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="DELETE" requires-channel="https" />
|
|
<intercept-url pattern="/api/v1/**" access="isFullyAuthenticated() and hasAuthority('TWOFACTOR_AUTHENTICATED')"
|
|
method="HEAD" requires-channel="https" />
|
|
<custom-filter ref="tenantIdentifierProcessingFilter"
|
|
position="FIRST" />
|
|
<custom-filter before="PRE_AUTH_FILTER" ref="resourceServerFilter" />
|
|
<custom-filter ref="twoFactorAuthFilter" after="BASIC_AUTH_FILTER" />
|
|
<access-denied-handler ref="oauthAccessDeniedHandler" />
|
|
</http>
|
|
|
|
<http pattern="/api/oauth/token" create-session="stateless"
|
|
entry-point-ref="oauthAuthenticationEntryPoint" use-expressions="true"
|
|
authentication-manager-ref="clientAuthenticationManager">
|
|
<csrf disabled="true"/>
|
|
<intercept-url pattern="/api/oauth/token" method="OPTIONS"
|
|
access="permitAll" requires-channel="https" />
|
|
<intercept-url pattern="/api/oauth/token" method="POST"
|
|
access="isFullyAuthenticated()" requires-channel="https" />
|
|
<anonymous enabled="false" />
|
|
|
|
<custom-filter ref="tenantIdentifierProcessingFilter"
|
|
position="FIRST" />
|
|
<custom-filter ref="clientCredentialsTokenEndpointFilter"
|
|
before="BASIC_AUTH_FILTER" />
|
|
<access-denied-handler ref="oauthAccessDeniedHandler" />
|
|
</http>
|
|
|
|
<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.factory.PasswordEncoderFactories"
|
|
factory-method="createDelegatingPasswordEncoder">
|
|
</beans:bean>
|
|
|
|
<beans:bean id="oauthAuthenticationEntryPoint"
|
|
class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
|
|
<beans:property name="realmName" value="Fineract Platform API" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="oauthAccessDeniedHandler"
|
|
class="org.springframework.security.oauth2.provider.error.OAuth2AccessDeniedHandler" />
|
|
|
|
<beans:bean id="clientCredentialsTokenEndpointFilter"
|
|
class="org.springframework.security.oauth2.provider.client.ClientCredentialsTokenEndpointFilter">
|
|
<beans:constructor-arg value="/api/oauth/token" />
|
|
<beans:property name="authenticationManager" ref="clientAuthenticationManager" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="accessDecisionManager"
|
|
class="org.springframework.security.access.vote.UnanimousBased">
|
|
<beans:constructor-arg>
|
|
<beans:list>
|
|
<beans:bean
|
|
class="org.springframework.security.oauth2.provider.vote.ScopeVoter" />
|
|
<beans:bean class="org.springframework.security.access.vote.RoleVoter" />
|
|
<beans:bean
|
|
class="org.springframework.security.access.vote.AuthenticatedVoter" />
|
|
<beans:bean
|
|
class="org.springframework.security.web.access.expression.WebExpressionVoter" />
|
|
<beans:bean
|
|
class="org.apache.fineract.infrastructure.security.vote.SelfServiceUserAccessVote" />
|
|
</beans:list>
|
|
</beans:constructor-arg>
|
|
</beans:bean>
|
|
|
|
<authentication-manager id="clientAuthenticationManager" erase-credentials="false">
|
|
<authentication-provider user-service-ref="clientDetailsUserService" />
|
|
<authentication-provider ref="customAuthenticationProvider" />
|
|
</authentication-manager>
|
|
|
|
<beans:bean id="clientDetailsUserService"
|
|
class="org.springframework.security.oauth2.provider.client.ClientDetailsUserDetailsService">
|
|
<beans:constructor-arg ref="clientDetailsService" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="customAuthenticationProvider"
|
|
class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
|
|
<beans:property name="userDetailsService" ref="userDetailsService" />
|
|
<beans:property name="passwordEncoder" ref="passwordEncoder" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="clientDetailsService"
|
|
class="org.springframework.security.oauth2.provider.client.JdbcClientDetailsService">
|
|
<beans:constructor-arg ref="routingDataSource" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="tokenStore"
|
|
class="org.springframework.security.oauth2.provider.token.store.JdbcTokenStore">
|
|
<beans:constructor-arg ref="routingDataSource" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="tokenServices"
|
|
class="org.springframework.security.oauth2.provider.token.DefaultTokenServices">
|
|
<beans:property name="tokenStore" ref="tokenStore" />
|
|
<beans:property name="clientDetailsService" ref="clientDetailsService" />
|
|
<beans:property name="supportRefreshToken" value="true" />
|
|
<beans:property name="refreshTokenValiditySeconds"
|
|
value="86400" />
|
|
<beans:property name="accessTokenValiditySeconds"
|
|
value="3600" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="userApprovalHandler"
|
|
class="org.springframework.security.oauth2.provider.approval.TokenStoreUserApprovalHandler">
|
|
<beans:property name="tokenStore" ref="tokenStore" />
|
|
<beans:property name="clientDetailsService" ref="clientDetailsService" />
|
|
<beans:property name="requestFactory" ref="oAuth2RequestFactory" />
|
|
</beans:bean>
|
|
|
|
<beans:bean id="oAuth2RequestFactory"
|
|
class="org.springframework.security.oauth2.provider.request.DefaultOAuth2RequestFactory">
|
|
<beans:constructor-arg ref="clientDetailsService" />
|
|
</beans:bean>
|
|
|
|
<oauth:authorization-server
|
|
client-details-service-ref="clientDetailsService" token-services-ref="tokenServices"
|
|
user-approval-handler-ref="userApprovalHandler" token-endpoint-url="/api/oauth/token"
|
|
authorization-endpoint-url="/api/oauth/authorize">
|
|
<oauth:refresh-token />
|
|
<oauth:password />
|
|
</oauth:authorization-server>
|
|
|
|
<oauth:resource-server id="resourceServerFilter" stateless="false"
|
|
token-services-ref="tokenServices" />
|
|
</beans:beans>
|
|
</beans:beans>
|