[main]
credentialsMatcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
credentialsMatcher.storedCredentialsHexEncoded = false
credentialsMatcher.hashIterations = 1024

# Realm configuration:
# --------------------

permissionsForRoleProvider = com.sap.sailing.domain.common.security.SailingPermissionsForRoleProvider
upRealm = com.sap.sse.security.UsernamePasswordRealm
upRealm.credentialsMatcher = $credentialsMatcher
upRealm.permissionsForRoleProvider = $permissionsForRoleProvider
oauthRealm = com.sap.sse.security.OAuthRealm
oauthRealm.permissionsForRoleProvider = $permissionsForRoleProvider
bearerTokenRealm = com.sap.sse.security.BearerTokenRealm
bearerTokenRealm.permissionsForRoleProvider = $permissionsForRoleProvider

# Putting it all together:
sessionManager = com.sap.sse.security.SecurityWebSessionManager
securityManager.sessionManager = $sessionManager
sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO
securityManager.sessionManager.sessionDAO = $sessionDAO
# 24h timeout
securityManager.sessionManager.globalSessionTimeout = 86400000
cacheManager = com.sap.sse.security.SessionCacheManager
securityManager.cacheManager = $cacheManager

# Authentication Filter Configurations
# ------------------------------------

# A filter that requires the user to have at least one of the roles specified as
# filter parameter. This makes it different from the default roles[...] filter
# which requires the user to have ALL of the roles specified as parameters.
anyofroles = com.sap.sse.security.AnyOfRolesFilter

# A custom filter for GWT pages that require an authenticated user.
# Forwards unauthenticated users to the default login page. When
# addressed directly (and not based on a redirect), users who logged
# on successfully will be redirected to the UserManagement.html page
# where they can adjust their profile.
customGwt = com.sap.sse.security.CustomFilter
customGwt.loginUrl = /security/ui/Login.html
customGwt.successUrl  = /UserManagement.html

# Configuration for the default shiro HTTP form authentication filter.
# It assumes that form-based login parameters are sent to the
# /api/restsecurity/login RESTlet and forwards successful login attempts
# to the /api/restsecurity/hello service which is expected to respond
# with a JSON document containing the authenticated subject's properties.
authc.loginUrl = /api/restsecurity/login
authc.successUrl = /api/restsecurity/hello

# This authentication filter accepts a bearer access token in the HTTP
# Authorization header field, as in
#   Authorization: Bearer 1029741026501365024376093245
# If no such bearer token is provided, the filter falls back to basic HTTP
# authentication ("Authentication: Basic ...") and then regular form-based
# authentication with POST parameters "username" and "password".
bearerToken = com.sap.sse.security.BearerTokenOrBasicOrFormAuthenticationFilter

# Specifying filter chains for URL patterns

[urls]
# Uncomment the following to require the permission "event:view" in order to use /api/v1/events:
#/api/v1/events = bearerToken

# Example: Secure access to leaderboard race column factor updates; read access should require no permissions
#/api/v1/leaderboards/*/racecolumnfactors/** = bearerToken

# Example: Secure the access (in particular the POST/write access) to posting race log events
#/rc/racelog = bearerToken