<?xml version="1.0" encoding="UTF-8"?>
<!--
cchtSecurity.xml - Spring namespace-based configuration for security
-->
<beans:beans default-lazy-init="false"  
	xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/security 
    					http://www.springframework.org/schema/security/spring-security-4.2.xsd
    					http://www.springframework.org/schema/beans 
    					http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
    					http://www.springframework.org/schema/util 
    					http://www.springframework.org/schema/util/spring-util-4.2.xsd">

	<!-- Automatically receives AuthenticationEvent messages -->
    <beans:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>

   	<beans:bean id="testAuthProvider" class="org.springframework.security.authentication.TestingAuthenticationProvider"/>
    
 	<beans:bean id="authenticationManager" class="gov.va.med.fw.security.AuthenticationManagerImpl">
	    <beans:constructor-arg>
	        <util:list>
	        	<beans:ref bean="preAuthenticationProvider" />
			    <beans:ref bean="anonymousAuthenticationProvider" />
	        </util:list>
	    </beans:constructor-arg> 
    </beans:bean>
    
    <beans:bean id="preAuthenticationProvider"
	class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
		<beans:property name="preAuthenticatedUserDetailsService">
			 <beans:bean id="userDetailsServiceWrapper"
					class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
				   <beans:property name="userDetailsService" ref="securityDAOImpl" />
			 </beans:bean>
		</beans:property>
		<beans:property name="throwExceptionWhenTokenRejected" value="false" />
	</beans:bean>
    
    <beans:bean id="anonymousAuthenticationProvider"
		class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
		<beans:constructor-arg value="cchtAnonAuthKey"/>
	</beans:bean>
    
    <beans:bean id="siteMinderFilter" class="gov.va.med.ccht.ui.CchtRequestHeaderAuthenticationFilter">
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="principalRequestHeader" value="adSamAccountName"/>
		<beans:property name="exceptionIfHeaderMissing" value="false" />
		<beans:property name="excludedPrefixes">
			<util:list value-type="java.lang.String">
			    <beans:value>/ccht/images/</beans:value>
				<beans:value>/ccht/packages/</beans:value>
				<beans:value>/ccht/scripts/</beans:value>
				<beans:value>/ccht/css/</beans:value>
				<beans:value>/ccht/loudev/</beans:value>
				<beans:value>/ccht/DataTables/</beans:value>
				<beans:value>/ccht/stylesheets/</beans:value>
				<beans:value>/images/</beans:value>
				<beans:value>/packages/</beans:value>
				<beans:value>/scripts/</beans:value>
				<beans:value>/css/</beans:value>
				<beans:value>/loudev/</beans:value>
				<beans:value>/DataTables/</beans:value>
				<beans:value>/stylesheets/</beans:value>
			</util:list>
		</beans:property>
	</beans:bean>
        
	<beans:bean id="filterSecurityInterceptor" 
        class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
	  <beans:property name="authenticationManager" ref="authenticationManager"/>	  
	  <beans:property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
	  
	  <beans:property name="securityMetadataSource">
		<filter-security-metadata-source use-expressions="false">
	      <intercept-url pattern="/" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/images/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/packages/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/css/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/scripts/**" access="ROLE_ANONYMOUS,CCHT_USER"/>      
	      <intercept-url pattern="/favicon.ico" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/stylesheets/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/home.jsp" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/links.jsp" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/help.jsp" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/terms.jsp" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/regist*" access="permitAll"/>
	      <intercept-url pattern="/register_1.html" access="permitAll"/>
	      <intercept-url pattern="/register_2.html" access="permitAll"/>
	      <!-- <intercept-url pattern="/registrationConfirm.html" access="permitAll"/> -->
	      <intercept-url pattern="/display.action" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/registerVAUser.action" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/registerVendor.action" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/registerPatient.action" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/registrationconfirm.jsp" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/ccht" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/ccht/searchAllQirs.html" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/searchAllQirs.html" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/login.action" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/framework/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
	      <intercept-url pattern="/**" access="CCHT_USER"/>
	      <intercept-url pattern="/docs/**" access="ROLE_ANONYMOUS,CCHT_USER"/>
		</filter-security-metadata-source>
	</beans:property>

	</beans:bean>
	        			
</beans:beans> 