TASKPM/libreplan-webapp/src/main/resources/libreplan-webapp-spring-security-config.xml

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:p="http://www.springframework.org/schema/p"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
                        http://www.springframework.org/schema/security
                        http://www.springframework.org/schema/security/spring-security-4.2.xsd">

    <!--
    NOTE: see

    http://static.springsource.org/spring-security/site/docs/2.0.x/apidocs/org/springframework/security/vote/AuthenticatedVoter.html

    for an explanation of the meaning of IS_AUTHENTICATED_ANONYMOUSLY and IS_AUTHENTICATED_FULLY. -->

    <http auto-config="false" realm="LibrePlan Web Application" >

        <!-- In Spring Security 4.1.0 it is useless to use hasRole() for single role because Spring is calling hasAnyRole() anyway -->

        <!-- Web services -->
        <intercept-url pattern="/ws/rest/bounduser/**" access="hasAnyRole('ROLE_BOUND_USER')" method="GET" />
        <intercept-url pattern="/ws/rest/bounduser/**" access="hasAnyRole('ROLE_BOUND_USER')" method="POST" />
        <intercept-url pattern="/ws/rest/subcontracting/**" access="hasAnyRole('ROLE_WS_SUBCONTRACTING')" method="GET" />
        <intercept-url pattern="/ws/rest/subcontracting/**" access="hasAnyRole('ROLE_WS_SUBCONTRACTING')" method="POST" />
        <intercept-url pattern="/ws/rest/**" access="hasAnyRole('ROLE_WS_READER')" method="GET" />
        <intercept-url pattern="/ws/rest/**" access="hasAnyRole('ROLE_WS_WRITER')" method="POST" />
        <intercept-url pattern="/ws/rest/**" access="hasAnyRole('ROLE_WS_WRITER')" method="DELETE" />

        <!-- Web application -->
        <intercept-url pattern="/common/img/**" access="permitAll" />
        <intercept-url pattern="/common/css/**" access="permitAll" />
        <intercept-url pattern="/planner/css/**" access="permitAll" />
        <intercept-url pattern="/callback/**" access="permitAll" />
        <intercept-url pattern="/zkau/**" access="permitAll" />
        <intercept-url pattern="/help/**" access="permitAll" />
        <intercept-url pattern="/common/layout/login.zul" access="isAnonymous()" />
        <intercept-url pattern="/common/layout/timeout.zul" access="permitAll" />

        <!-- Pages -->
        <intercept-url pattern="/templates/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TEMPLATES')" />
        <intercept-url pattern="/email/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_EDIT_EMAIL_TEMPLATES')"/>
        <intercept-url pattern="/resources/worker/worker.zul" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_WORKERS')" />
        <intercept-url pattern="/resources/machine/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_MACHINES')" />

        <intercept-url pattern="/resources/worker/virtualWorkers.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_VIRTUAL_WORKERS')" />

        <intercept-url pattern="/calendars/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_CALENDARS')" />

        <intercept-url pattern="/excetiondays/*"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_CALENDAR_EXCEPTION_DAYS')" />

        <intercept-url pattern="/resources/criterions/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_CRITERIA')" />
        <intercept-url pattern="/advance/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_PROGRESS_TYPES')" />
        <intercept-url pattern="/labels/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_LABELS')" />
        <intercept-url pattern="/materials/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_MATERIALS')" />
        <intercept-url pattern="/unittypes/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_MATERIAL_UNITS')" />
        <intercept-url pattern="/qualityforms/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_QUALITY_FORMS')" />
        <intercept-url pattern="/workreports/workReport.zul" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TIMESHEETS')" />

        <intercept-url pattern="/workreports/workReportTypes.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TIMESHEETS_TEMPLATES')" />

        <intercept-url pattern="/expensesheet/*"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_EXPENSES', 'ROLE_BOUND_USER')" />

        <intercept-url pattern="/costcategories/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_COST_CATEGORIES')" />
        <intercept-url pattern="/typeofworkhours/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_HOURS_TYPES')" />

        <intercept-url pattern="/common/configuration.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_MAIN_SETTINGS')" />

        <intercept-url pattern="/users/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_USER_ACCOUNTS')" />
        <intercept-url pattern="/profiles/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_PROFILES')" />
        <intercept-url pattern="/externalcompanies/*" access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_COMPANIES')" />

        <intercept-url pattern="/subcontract/subcontractedTasks.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_SEND_TO_SUBCONTRACTORS')" />

        <intercept-url pattern="/subcontract/subcontractorCommunications.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_RECEIVED_FROM_SUBCONTRACTORS')" />

        <intercept-url pattern="/subcontract/reportAdvances.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_SEND_TO_CUSTOMERS')" />

        <intercept-url pattern="/subcontract/customerCommunications.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_RECEIVED_FROM_CUSTOMERS')" />

        <intercept-url pattern="/workreports/workReportQuery.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TIMESHEET_LINES_LIST')" />

        <intercept-url pattern="/reports/hoursWorkedPerWorkerReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_HOURS_WORKED_PER_RESOURCE_REPORT')" />

        <intercept-url pattern="/reports/hoursWorkedPerWorkerInAMonthReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TOTAL_WORKED_HOURS_BY_RESOURCE_IN_A_MONTH_REPORT')" />

        <intercept-url pattern="/reports/schedulingProgressPerOrderReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_WORK_AND_PROGRESS_PER_PROJECT_REPORT')" />

        <intercept-url pattern="/reports/workingProgressPerTaskReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_WORK_AND_PROGRESS_PER_TASK_REPORT')" />

        <intercept-url pattern="/reports/completedEstimatedHoursPerTask.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_ESTIMATED_PLANNED_HOURS_PER_TASK_REPORT')" />

        <intercept-url pattern="/reports/orderCostsPerResource.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_PROJECT_COSTS_REPORT')" />

        <intercept-url pattern="/reports/workingArrangementsPerOrderReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TASK_SCHEDULING_STATUS_IN_PROJECT_REPORT')" />

        <intercept-url pattern="/reports/timeLineMaterialReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_MATERIALS_NEED_AT_DATE_REPORT')" />

        <intercept-url pattern="/reports/projectStatusReport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_PROJECT_STATUS_REPORT')" />

        <intercept-url pattern="/myaccount/userDashboard.zul" access="hasAnyRole('ROLE_BOUND_USER')" />

        <intercept-url pattern="/myaccount/monthlyTimesheet.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_TIMESHEETS', 'ROLE_BOUND_USER')" />

        <intercept-url pattern="/orders/imports/projectImport.zul"
                       access="hasAnyRole('ROLE_SUPERUSER', 'ROLE_IMPORT_PROJECTS')" />


        <intercept-url pattern="/**" access="isFullyAuthenticated()" />

        <!--
        These have been added because of auto-config is false now in order to use a custom authentication filter.
        See: http://static.springsource.org/spring-security/site/docs/2.0.x/reference/ns-config.html#ns-auto-config
        -->
        <anonymous />
        <form-login login-page="/common/layout/login.zul"
                    default-target-url="/common/index.zul"
                    authentication-failure-url="/common/layout/login.zul?login_error=true"
                    login-processing-url="/j_spring_security_check"
                    username-parameter="j_username"
                    password-parameter="j_password"/>
        <http-basic />
        <logout logout-url="/j_spring_security_logout" />

        <!--
        In Spring Security 4 by default frame option policy became DENY.
        See: http://forum.zkoss.org/question/99483/fileupload-not-worked/
        -->
        <headers>
            <frame-options policy="SAMEORIGIN"/>
        </headers>

        <remember-me />
        <csrf disabled="true"/>

    </http>

    <!-- Beans used by Spring Security (current configuration assumes users are registered in the database). -->
    <beans:bean id="passwordEncoder"
        class="org.springframework.security.authentication.encoding.ShaPasswordEncoder">
        <beans:constructor-arg value="512" />
    </beans:bean>

    <beans:bean id="saltSource"
        class="org.springframework.security.authentication.dao.ReflectionSaltSource"
        p:userPropertyToUse="username" />

    <!--
    Beans used by the LibrePlan Web application when users are registered in the database.
    When users are registered externally (e.g. in a LDAP server),these lines may be commented.
    -->
    <beans:bean id="dbPasswordEncoderService"
        class="org.libreplan.web.users.services.DBPasswordEncoderService"
        p:passwordEncoder-ref="passwordEncoder" p:saltSource-ref="saltSource" />

    <beans:bean id="usersBootstrapInDB"
        class="org.libreplan.web.users.bootstrap.UsersBootstrapInDB"
        p:dbPasswordEncoderService-ref="dbPasswordEncoderService" />
    <!--
    Beans used by the LibrePlan Web Application when users are registerd in LDAP.
    At this moment users MUST be also in database with same username.
    This will be changed in the near future.
    The url, base, userDN and password properties must be set with the proper values -->
    <beans:bean id="contextSource"
        class="org.libreplan.web.users.services.LDAPCustomContextSource">
    </beans:bean>

    <beans:bean id="ldapTemplate"
        class="org.springframework.ldap.core.LdapTemplate"
        p:contextSource-ref="contextSource">
    </beans:bean>

    <!-- This authentication provider will make possible all the login process when an LDAP is used.
    Also will allow authenticate users in database.
    The property strUserId must be set with the proper value.
    It represents the property of the user in LDAP which will be used to check the username. -->
    <beans:bean id="realAuthenticationProvider"
        class="org.libreplan.web.users.services.LDAPCustomAuthenticationProvider"
        p:userDetailsService-ref="ldapUserDetailsService"
        p:ldapTemplate-ref="ldapTemplate"
        p:passwordEncoderService-ref="dbPasswordEncoderService">
    </beans:bean>

    <beans:bean id="authenticationProvider"
                class="org.libreplan.web.users.services.AuthenticationProviderLoggingDecorator">
        <beans:property name="decoratedProvider" ref="realAuthenticationProvider"/>
    </beans:bean>

    <!-- This bean is used to implement UserDetailsService with LDAP authentication Provider -->
    <beans:bean id="ldapUserDetailsService" class="org.libreplan.web.users.services.LDAPUserDetailsService" />

    <authentication-manager>
        <authentication-provider ref="authenticationProvider"/>
    </authentication-manager>

</beans:beans>