47 lines
2.6 KiB
XML
47 lines
2.6 KiB
XML
<beans:beans xmlns="http://www.springframework.org/schema/security"
|
|
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://www.springframework.org/schema/beans
|
|
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
|
|
http://www.springframework.org/schema/security
|
|
http://www.springframework.org/schema/security/spring-security-3.2.xsd">
|
|
|
|
<global-method-security pre-post-annotations="enabled" />
|
|
<!--
|
|
PCS 8/27/2012
|
|
NOTE: Without Spring security, HttpServletRequest.getUserPrincipal() returns null when called from pages under Spring's control.
|
|
That method is used extensively in legacy webgoat code. Integrating Spring security into the application resolves this issue.
|
|
-->
|
|
<http pattern="/css/**" security="none"/>
|
|
<http pattern="/images/**" security="none"/>
|
|
<http pattern="/javascript/**" security="none"/>
|
|
<http pattern="/favicon.ico" security="none"/>
|
|
<http use-expressions="true">
|
|
<intercept-url pattern="/login.mvc" access="permitAll" />
|
|
<intercept-url pattern="/logout.mvc" access="permitAll" />
|
|
<intercept-url pattern="/servlet/AdminServlet/**" access="hasAnyRole('ROLE_WEBGOAT_ADMIN','ROLE_SERVER_ADMIN')" />
|
|
<intercept-url pattern="/JavaSource/**" access="hasRole('ROLE_SERVER_ADMIN')" />
|
|
<intercept-url pattern="/**" access="hasAnyRole('ROLE_WEBGOAT_USER','ROLE_WEBGOAT_ADMIN','ROLE_SERVER_ADMIN')" />
|
|
<form-login
|
|
login-page="/login.mvc"
|
|
default-target-url="/welcome.mvc"
|
|
authentication-failure-url="/login.mvc?error"
|
|
username-parameter="username"
|
|
password-parameter="password" />
|
|
<logout logout-url="/j_spring_security_logout" logout-success-url="/logout.mvc" />
|
|
<!-- enable csrf protection -->
|
|
<!--csrf/-->
|
|
</http>
|
|
|
|
<!-- Authentication Manager -->
|
|
<authentication-manager alias="authenticationManager">
|
|
<authentication-provider>
|
|
<user-service>
|
|
<!-- TODO: credentials in the config - this isn't something I'm proud of - get rid of this ASAP -->
|
|
<user name="guest" password="guest" authorities="ROLE_WEBGOAT_USER" />
|
|
<user name="webgoat" password="webgoat" authorities="ROLE_WEBGOAT_ADMIN" />
|
|
<user name="server" password="server" authorities="ROLE_SERVER_ADMIN" />
|
|
</user-service>
|
|
</authentication-provider>
|
|
</authentication-manager>
|
|
|
|
</beans:beans> |