168 lines
8.9 KiB
XML
Executable File
168 lines
8.9 KiB
XML
Executable File
<!--
|
|
~ Copyright © 2005 - 2018 TIBCO Software Inc.
|
|
~ http://www.jaspersoft.com.
|
|
~
|
|
~ This program is free software: you can redistribute it and/or modify
|
|
~ it under the terms of the GNU Affero General Public License as published by
|
|
~ the Free Software Foundation, either version 3 of the License, or
|
|
~ (at your option) any later version.
|
|
~
|
|
~ This program is distributed in the hope that it will be useful,
|
|
~ but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
~ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
~ GNU Affero General Public License for more details.
|
|
~
|
|
~ You should have received a copy of the GNU Affero General Public License
|
|
~ along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
-->
|
|
|
|
<!--
|
|
- This file is a sample of PreAuthentication API configuration. The API deals with cases
|
|
- when the external user comes to Jasper Server already authenticated & authorized. Very
|
|
- often the user name, roles, etc. is encrypted as a token parameter in the request; so, there is
|
|
- no need to redirect user to SSO servers or extract user details from external datasources.
|
|
-->
|
|
<beans xmlns="http://www.springframework.org/schema/beans"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
|
|
|
|
<!-- marker disabling JIAuthenticationSynchronizer: pre-5.1 external auth config-->
|
|
<alias name="${bean.authenticationProcessingFilter}" alias="proxyAuthenticationProcessingFilter"/>
|
|
|
|
<bean id="proxyPreAuthenticatedProcessingFilter" class="com.jaspersoft.jasperserver.api.security.externalAuth.preauth.BasePreAuthenticatedProcessingFilter">
|
|
<!-- request parameter containing pre-authenticated token with user info -->
|
|
<property name="principalParameter" value="pp"/>
|
|
<!-- tokenInRequestParam=false - principalParameter is read from header only.
|
|
tokenInRequestParam=true - principalParameter is read from request url parameters only.
|
|
If tokenInRequestParam is not specified, the authentication token is looked up in request header
|
|
and, then, if not found, in request params -->
|
|
<property name="tokenInRequestParam" value="true"/>
|
|
|
|
<!-- Check if there's a new token in the request -->
|
|
<property name="checkForPrincipalChanges" value="true"/>
|
|
|
|
<!-- DevelopmentPlainTextNonCipher works with the plain-text tokens by default. It should be used in the development phase only.-->
|
|
<!-- In prod., substitute with your token decryption implementation of com.jaspersoft.jasperserver.api.common.crypto.CipherI interface -->
|
|
<property name="tokenDecryptor">
|
|
<bean class="com.jaspersoft.jasperserver.api.common.crypto.DevelopmentPlainTextNonCipher"/>
|
|
</property>
|
|
|
|
<property name="externalDataSynchronizer">
|
|
<ref local="externalDataSynchronizer"/>
|
|
</property>
|
|
|
|
<property name="authenticationManager">
|
|
<ref local="preAuthenticatedManager"/>
|
|
</property>
|
|
|
|
<property name="authenticationDetailsSource">
|
|
<bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSAuthenticationDetailsSourceImpl">
|
|
<property name="clazz">
|
|
<value>com.jaspersoft.jasperserver.api.security.externalAuth.preauth.BasePreAuthenticatedGrantesAuthorityDetails</value>
|
|
</property>
|
|
</bean>
|
|
</property>
|
|
<property name="jsonRedirectUrl" ref="authSuccessJsonRedirectUrl"/>
|
|
</bean>
|
|
|
|
<bean id="preAuthenticatedManager" class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.JSProviderManager">
|
|
<property name="providers">
|
|
<list>
|
|
<!-- This bean calls upon preAuthenticatedUserDetailsService to create user details based on
|
|
a token extracted from request by proxyPreAuthenticatedProcessingFilter -->
|
|
<bean class="com.jaspersoft.jasperserver.api.security.externalAuth.wrappers.spring.preauth.JSPreAuthenticatedAuthenticationProvider">
|
|
<property name="preAuthenticatedUserDetailsService">
|
|
<bean class="com.jaspersoft.jasperserver.api.security.externalAuth.preauth.JSPreAuthenticatedUserDetailsService">
|
|
<!-- Token format configuration example for token: u=obama|r=PRESIDENT,HUSBAND|pa1=USA,Kenya|pa2=Washington -->
|
|
<property name="tokenPairSeparator" value="|"/>
|
|
<property name="tokenFormatMapping">
|
|
<map>
|
|
<entry key="username" value="u" />
|
|
<entry key="roles" value="r" />
|
|
<entry key="expireTime" value="exp" />
|
|
<entry key="profile.attribs" >
|
|
<map>
|
|
<entry key="profileAttrib1" value="pa1" />
|
|
<entry key="profileAttrib2" value="pa2" />
|
|
</map>
|
|
</entry>
|
|
</map>
|
|
</property>
|
|
<property name="tokenExpireTimestampFormat" value="yyyyMMddHHmmssZ"/>
|
|
</bean>
|
|
</property>
|
|
</bean>
|
|
</list>
|
|
</property>
|
|
</bean>
|
|
|
|
<!-- ############ Synchronizer ############ -->
|
|
<bean id="externalDataSynchronizer"
|
|
class="com.jaspersoft.jasperserver.api.security.externalAuth.ExternalDataSynchronizerImpl">
|
|
<property name="externalUserProcessors">
|
|
<list>
|
|
<ref local="externalUserSetupProcessor"/> <!-- REQUIRED processor -->
|
|
<ref local="externalProfileAttributeProcessor"/> <!-- OPTIONAL processor: comment out if no profile attributes are expected -->
|
|
<!-- Example processor for creating user folder.
|
|
Other custom processors can be created and
|
|
added to the list.-->
|
|
<!--<ref local="externalUserFolderProcessor"/>-->
|
|
</list>
|
|
</property>
|
|
</bean>
|
|
|
|
<bean id="abstractExternalProcessor" class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.AbstractExternalUserProcessor" abstract="true">
|
|
<property name="repositoryService" ref="${bean.repositoryService}"/>
|
|
<property name="userAuthorityService" ref="${bean.userAuthorityService}"/>
|
|
<property name="tenantService" ref="${bean.tenantService}"/>
|
|
<property name="profileAttributeService" ref="profileAttributeService"/>
|
|
<property name="objectPermissionService" ref="objectPermissionService"/>
|
|
</bean>
|
|
|
|
<bean id="externalUserSetupProcessor" class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.ExternalUserSetupProcessor" parent="abstractExternalProcessor">
|
|
<property name="userAuthorityService">
|
|
<ref bean="${bean.internalUserAuthorityService}"/>
|
|
</property>
|
|
<property name="defaultInternalRoles">
|
|
<list>
|
|
<value>ROLE_USER</value>
|
|
</list>
|
|
</property>
|
|
|
|
<property name="organizationRoleMap">
|
|
<map>
|
|
<!-- Example of mapping customer roles to JRS roles -->
|
|
<entry>
|
|
<key>
|
|
<value>ROLE_ADMIN_EXTERNAL_ORGANIZATION</value>
|
|
</key>
|
|
<!-- JRS role that the <key> external role is mapped to-->
|
|
<value>ROLE_ADMINISTRATOR</value>
|
|
</entry>
|
|
</map>
|
|
</property>
|
|
|
|
<property name="permittedRolesRegex">
|
|
<list>
|
|
<!-- Used to set regex's to limit what external roles are imported into Jasper Server.
|
|
By default, all roles are imported.
|
|
Examples of the regex's importing only roles starting with JRS_ and EXT_:
|
|
<value>JRS_.*</value>
|
|
<value>EXT_.*</value>
|
|
-->
|
|
</list>
|
|
</property>
|
|
</bean>
|
|
|
|
<bean id="externalProfileAttributeProcessor" class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.ExternalProfileAttributeProcessor" parent="abstractExternalProcessor">
|
|
</bean>
|
|
|
|
<!-- EXAMPLE Processor
|
|
<bean id="externalUserFolderProcessor"
|
|
class="com.jaspersoft.jasperserver.api.security.externalAuth.processors.ExternalUserFolderProcessor"
|
|
parent="abstractExternalProcessor">
|
|
<property name="repositoryService" ref="${bean.unsecureRepositoryService}"/>
|
|
</bean>
|
|
-->
|
|
</beans>
|