mirror of
https://github.com/eclipse-sailing-analytics/sailing-analytics.git
synced 2026-09-20 04:35:32 +00:00
88 lines
4.3 KiB
INI
Executable File
88 lines
4.3 KiB
INI
Executable File
[main]
|
|
invalidRequest = org.apache.shiro.web.filter.InvalidRequestFilter
|
|
invalidRequest.blockBackslash = false
|
|
invalidRequest.blockSemicolon = false
|
|
invalidRequest.blockNonAscii = false
|
|
credentialsMatcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher
|
|
credentialsMatcher.storedCredentialsHexEncoded = false
|
|
credentialsMatcher.hashIterations = 1024
|
|
|
|
# Realm configuration:
|
|
# --------------------
|
|
|
|
upRealm = com.sap.sse.security.UsernamePasswordRealm
|
|
upRealm.credentialsMatcher = $credentialsMatcher
|
|
oauthRealm = com.sap.sse.security.OAuthRealm
|
|
bearerTokenRealm = com.sap.sse.security.BearerTokenRealm
|
|
|
|
# Putting it all together:
|
|
sessionManager = com.sap.sse.security.SecurityWebSessionManager
|
|
securityManager.sessionManager = $sessionManager
|
|
sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO
|
|
securityManager.sessionManager.sessionDAO = $sessionDAO
|
|
subjectDAO = com.sap.sse.security.NoSessionStorageSessionDAO
|
|
securityManager.subjectDAO = $subjectDAO
|
|
# 1y timeout
|
|
securityManager.sessionManager.globalSessionTimeout = 31536000000
|
|
cacheManager = com.sap.sse.security.SessionCacheManager
|
|
securityManager.cacheManager = $cacheManager
|
|
authenticationStrategy = com.sap.sse.security.AtLeastOneSuccessfulStrategyWithLockingAndBanning
|
|
securityManager.authenticator.authenticationStrategy = $authenticationStrategy
|
|
|
|
# Support for anonymous user permissions
|
|
webSubjectFactoryWithAnonymousPrincipalSupport=com.sap.sse.security.WebSubjectFactoryWithAnonymousPrincipalSupport
|
|
securityManager.subjectFactory=$webSubjectFactoryWithAnonymousPrincipalSupport
|
|
|
|
# Authentication Filter Configurations
|
|
# ------------------------------------
|
|
|
|
# A filter that requires the user to have at least one of the roles specified as
|
|
# filter parameter. This makes it different from the default roles[...] filter
|
|
# which requires the user to have ALL of the roles specified as parameters.
|
|
anyofroles = com.sap.sse.security.AnyOfRolesFilter
|
|
|
|
# A custom filter for GWT pages that require an authenticated user.
|
|
# Forwards unauthenticated users to the default login page. When
|
|
# addressed directly (and not based on a redirect), users who logged
|
|
# on successfully will be redirected to the UserManagement.html page
|
|
# where they can adjust their profile.
|
|
customGwt = com.sap.sse.security.CustomFilter
|
|
customGwt.loginUrl = /security/ui/Login.html
|
|
customGwt.successUrl = /UserManagement.html
|
|
|
|
# Configuration for the default shiro HTTP form authentication filter.
|
|
# It assumes that form-based login parameters are sent to the
|
|
# /api/restsecurity/login RESTlet and forwards successful login attempts
|
|
# to the /api/restsecurity/hello service which is expected to respond
|
|
# with a JSON document containing the authenticated subject's properties.
|
|
authc = com.sap.sse.security.CustomFilter
|
|
authc.loginUrl = /api/restsecurity/login
|
|
authc.successUrl = /api/restsecurity/hello
|
|
|
|
# This authentication filter accepts a bearer access token in the HTTP
|
|
# Authorization header field, as in
|
|
# Authorization: Bearer 1029741026501365024376093245
|
|
# If no such bearer token is provided, the filter falls back to basic HTTP
|
|
# authentication ("Authentication: Basic ...") and then regular form-based
|
|
# authentication with POST parameters "username" and "password".
|
|
bearerToken = com.sap.sailing.shared.server.security.BearerTokenOrBasicOrFormAuthenticationFilterSAPSailing
|
|
|
|
# The same as bearerToken, but with additional fallback to anonymous authentication.
|
|
# In this case sufficient permission checks have to be done on the application side.
|
|
bearerTokenOrAnonymous = com.sap.sailing.shared.server.security.BearerTokenOrBasicOrFormOrAnonymousAuthenticationFilterSAPSailing
|
|
|
|
# Chargebee subscription permissions filter
|
|
chargebeeSubscriptionPermissions = com.sap.sailing.server.gateway.subscription.chargebee.ChargebeeSubscriptionPermissionsAuthorizationFilter
|
|
|
|
# Specifying filter chains for URL patterns
|
|
|
|
[urls]
|
|
# Since depending on the permissions set, even an anonymous user can do everything or nothing, it might be valid for every call
|
|
/api/v1/** = bearerTokenOrAnonymous
|
|
/api/v2/** = bearerTokenOrAnonymous
|
|
/spi/v1/** = bearerTokenOrAnonymous
|
|
/rc/** = bearerTokenOrAnonymous
|
|
/orc-certificate-import = bearerTokenOrAnonymous
|
|
/subscription/hooks/chargebee = bearerToken,chargebeeSubscriptionPermissions
|
|
/windStatus = bearerTokenOrAnonymous
|
|
/windStatus/** = bearerTokenOrAnonymous |