<!-- ############################# -->
    <!-- # LOGIN / LOGOUT MECHANISMS # -->
    <!-- ############################# -->

    <!-- Uncomment to enable x509 client certificates for identifying clients -->
    <!-- sec:x509 subject-principal-regex="CN=(.*?)," user-service-ref="userDetailsService" / -->

    <!-- Enable and configure the failure URL for form-based logins -->
    <!-- CAS Auth: Comment this if using CAS authentication -->
    <sec:form-login authentication-failure-url="/login.html?error" authentication-success-handler-ref="authSuccessHandler" />

    <!-- (Pre-)Authentication filter chain(s) -->
    <sec:custom-filter position="BASIC_AUTH_FILTER" ref="authenticationFilters" />
    <sec:custom-filter position="PRE_AUTH_FILTER" ref="preAuthenticationFilters" />

    <sec:custom-filter ref="asyncTimeoutRedirectFilter" after="EXCEPTION_TRANSLATION_FILTER"/>

    <!-- Opencast is shipping its own implementation of the anonymous filter -->
    <sec:custom-filter ref="anonymousFilter" position="ANONYMOUS_FILTER" />

    <!-- CAS Auth:  Uncomment this if using CAS authentication
    <sec:custom-filter position="FORM_LOGIN_FILTER" ref="casFilter" />
    -->

    <!-- Enables "remember me" functionality -->
    <sec:remember-me services-ref="rememberMeServices" />

    <!-- Set the request cache -->
    <sec:request-cache ref="requestCache" />

    <!-- If any URLs are to be exposed to anonymous users, the "sec:anonymous" filter must be present -->
    <sec:anonymous enabled="false" />

    <!-- CAS Auth:  Uncomment this if using CAS authentication  -->
    <!-- Enables CAS Single Sign Out
    <sec:logout logout-success-url="/cas-logout.jsp"/>
    <sec:custom-filter ref="requestSingleLogoutFilter" before="LOGOUT_FILTER"/>
    <sec:custom-filter ref="singleLogoutFilter" before="FORM_LOGIN_FILTER"/>
    -->

    <!-- Enables log out -->
    <sec:logout success-handler-ref="logoutSuccessHandler" />

    <!-- JWT single log out
         Please specify the URL to return to after logging out. Comment out the logoutSuccessHandler above.
    <sec:logout logout-success-url="https://auth.example.org/sign_out?rd=http://www.opencast.org" />
    -->

  </sec:http>

  <bean id="rememberMeServices" class="org.opencastproject.kernel.security.SystemTokenBasedRememberMeService">
    <property name="userDetailsService" ref="userDetailsService"/>
    <!-- All following settings are optional -->
    <property name="tokenValiditySeconds" value="1209600"/>
    <property name="cookieName" value="oc-remember-me"/>
    <!-- The following key will be augmented by system properties if left at the default value.
         Thus, leaving this untouched is okay. This key must be equal to the key passed to
         rememberMeAuthenticationProvider (s. below). To generate cookies which are valid for the whole cluster,
         set this manually. The key won't be augmented/randomized if you use something different than 'opencast'. -->
    <property name="key" value="opencast"/>
  </bean>

  <bean id="rememberMeAuthenticationProvider"
        class="org.opencastproject.kernel.security.SystemTokenBasedRememberMeAuthenticationProvider">
    <!-- This key must be equal to the key passed to rememberMeServices (s. above) -->
    <property name="key" value="opencast"/>
  </bean>

  <!-- ############################# -->
  <!-- # Authentication Filters    # -->
  <!-- ############################# -->

  <bean id="authenticationFilters" class="org.springframework.web.filter.CompositeFilter">
    <property name="filters">
      <list>
        <!-- Digest auth is used by capture agents and is used to enable transparent clustering of services -->
        <!-- ATTENTION! Do not deactivate the digest filter, otherwise the distributed setup would not work -->
        <ref bean="digestFilter" />

        <!-- Basic authentication  -->
        <ref bean="basicAuthenticationFilter" />

        <!-- 2-legged OAuth is used by trusted 3rd party applications, including LTI. -->
        <!-- Uncomment the line below to support LTI or other OAuth clients.          -->
        <!-- <ref bean="oauthProtectedResourceFilter" /> -->
      </list>
    </property>
  </bean>

  <!-- ################################ -->
  <!-- # Pre-Aauthentication Filters    # -->
  <!-- ################################ -->

  <bean id="preAuthenticationFilters" class="org.springframework.web.filter.CompositeFilter">
    <property name="filters">
      <list>
        <!-- Uncomment the line below to support Shibboleth. -->
        <!-- <ref bean="shibbolethHeaderFilter" /> -->

        <!-- Uncomment the line below to support JWT. -->
        <ref bean="jwtHeaderFilter" />
        <!-- Additionally/alternatively uncomment this to support passing a JWT in a URL parameter. -->
        <ref bean="jwtRequestParameterFilter" />
      </list>
    </property>
  </bean>

  <!-- ########################################### -->
  <!-- # Custom ajax timeout Filter Definition   # -->
  <!-- ########################################### -->

  <bean id="asyncTimeoutRedirectFilter" class="org.opencastproject.kernel.security.AsyncTimeoutRedirectFilter" />

  <!-- ######################################## -->
  <!-- # Custom Anonymous Filter Definition   # -->
  <!-- ######################################## -->

  <bean id="anonymousFilter" class="org.opencastproject.kernel.security.TrustedAnonymousAuthenticationFilter">
    <property name="userAttribute" ref="anonymousUserAttributes" />
    <property name="key" value="anonymousKey" />
  </bean>

  <bean id="anonymousUserAttributes" class="org.springframework.security.core.userdetails.memory.UserAttribute">
    <property name="authoritiesAsString" value="ROLE_ANONYMOUS"/>
    <property name="password" value="empty"/>
  </bean>

  <!-- ######################################## -->
  <!-- # Authentication Entry and Exit Points # -->
  <!-- ######################################## -->

  <!-- Differentiates between "normal" user requests and those requesting digest auth -->
  <bean id="opencastEntryPoint" class="org.opencastproject.kernel.security.DelegatingAuthenticationEntryPoint">
    <!-- CAS Auth:  Comment this if using CAS authentication -->
    <property name="userEntryPoint" ref="userEntryPoint" />
    <!-- CAS Auth:  Uncomment this if using CAS authentication -->
    <!-- <property name="userEntryPoint" ref="casEntryPoint" /> -->
    <property name="digestAuthenticationEntryPoint" ref="digestEntryPoint" />
    <property name="basicAuthenticationEntryPoint" ref="basicEntryPoint" />
  </bean>

  <!-- Redirects unauthenticated requests to the login form -->
  <bean id="userEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
    <property name="loginFormUrl" value="/login.html" />
  </bean>

  <!-- Redirect unauthenticated requests to custom login url with configurable redirect query parameter
       Example: http://localhost/Shibboleth.sso/Login?target=<RELATIVE_REQUEST_URL> -->
  <!--bean id="userEntryPoint" class="org.opencastproject.kernel.security.RedirectQueryParamAuthenticationEntryPoint">
    <constructor-arg index="0" value="/Shibboleth.sso/Login" />
    <constructor-arg index="1" value="target" />
  </bean-->

  <!-- Returns a 401 request for authentication via digest auth -->
  <bean id="digestEntryPoint" class="org.springframework.security.web.authentication.www.DigestAuthenticationEntryPoint">
    <property name="realmName" value="Opencast" />
    <property name="key" value="opencast" />
    <property name="nonceValiditySeconds" value="300" />
  </bean>

  <bean id="basicEntryPoint" class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
    <property name="realmName" value="Opencast"/>
  </bean>

  <bean id="authSuccessHandler" class="org.opencastproject.kernel.security.AuthenticationSuccessHandler">
    <property name="securityService" ref="securityService" />
    <property name="welcomePages">
      <map>
        <entry key="ROLE_ADMIN" value="/index.html" />
        <entry key="ROLE_ADMIN_UI" value="/index.html" />
        <entry key="*" value="/engage/ui/index.html" /> <!-- Any role not listed explicitly will redirect here -->
      </map>
    </property>
  </bean>

  <bean id="logoutSuccessHandler" class="org.opencastproject.kernel.security.LogoutSuccessHandler">
    <property name="userDirectoryService" ref="userDirectoryService" />
    <!-- Shibboleth log out
    <property name="defaultTargetUrl" value="/Shibboleth.sso/Logout?return=www.opencast.org"/>
    -->
  </bean>

  <!-- ################# -->
  <!-- # Digest Filter # -->
  <!-- ################# -->

  <!-- Handles the details of the digest authentication dance -->
  <bean id="digestFilter" class="org.springframework.security.web.authentication.www.DigestAuthenticationFilter">
    <!--  Use only the in-memory users, as these have passwords that are not hashed -->
    <property name="userDetailsService" ref="userDetailsService" />
    <property name="authenticationEntryPoint" ref="digestEntryPoint" />
    <property name="createAuthenticatedToken" value="true" />
    <property name="userCache">
      <bean class="org.springframework.security.core.userdetails.cache.NullUserCache" />
    </property>
  </bean>

  <!-- ############################### -->
  <!-- # Basic Authentication Filter # -->
  <!-- ############################### -->

  <!-- Handles the details of the basic authentication dance -->
  <bean id="basicAuthenticationFilter" class="org.springframework.security.web.authentication.www.BasicAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationEntryPoint" ref="basicEntryPoint"/>
  </bean>

  <!-- ####################### -->
  <!-- # OAuth (LTI) Support # -->
  <!-- ####################### -->

  <bean name="oauthProtectedResourceFilter" class="org.opencastproject.kernel.security.LtiProcessingFilter">
    <property name="consumerDetailsService" ref="oAuthConsumerDetailsService" />
    <property name="tokenServices">
      <bean class="org.springframework.security.oauth.provider.token.InMemoryProviderTokenServices" />
    </property>
    <property name="nonceServices">
      <bean class="org.springframework.security.oauth.provider.nonce.InMemoryNonceServices" />
    </property>
    <property name="authHandler" ref="ltiLaunchAuthenticationHandler" />
  </bean>

  <!-- ############### -->
  <!-- # CAS Support # -->
  <!-- ############### -->
  <!--
  <bean id="casFilter"
    class="org.springframework.security.cas.web.CasAuthenticationFilter">
    <property name="authenticationManager" ref="authenticationManager"/>
    <property name="authenticationSuccessHandler" ref="authSuccessHandler" />
    <property name="serviceProperties" ref="serviceProperties" />
    <property name="authenticationDetailsSource">
      <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
    </property>
  </bean>

  <bean id="casEntryPoint"
    class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
    <property name="loginUrl" value="https://auth-test.berkeley.edu/cas/login"/>
    <property name="serviceProperties" ref="serviceProperties"/>
  </bean>

  <bean id="serviceProperties"
    class="org.springframework.security.cas.ServiceProperties">
    <property name="service" value="https://localhost/j_spring_cas_security_check"/>
    <property name="sendRenew" value="false"/>
  </bean>

  <bean id="casAuthenticationProvider"
    class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
    <property name="serviceProperties" ref="serviceProperties" />
    <property name="authenticationUserDetailsService">
      <bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
          <constructor-arg ref="userDetailsService" />
      </bean>
    </property>
    <property name="ticketValidator">
      <bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
        <constructor-arg index="0" value="https://auth-test.berkeley.edu/cas" />
      </bean>
    </property>
    <property name="key" value="cas"/>
  </bean>

  <bean id="singleLogoutFilter" class="org.jasig.cas.client.session.SingleSignOutFilter"/>

  <bean id="requestSingleLogoutFilter" class="org.springframework.security.web.authentication.logout.LogoutFilter">
    <constructor-arg value="https://auth-test.berkeley.edu/cas/logout"/>
    <constructor-arg>
      <bean class= "org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/>
    </constructor-arg>
    <property name="filterProcessesUrl" value="https://localhost/j_spring_security_logout"/>
  </bean>
  -->

  <!-- ###################### -->
  <!-- # Shibboleth Support # -->
  <!-- ###################### -->

  <!-- General Shibboleth header extration filter
  <bean id="shibbolethHeaderFilter"
        class="org.opencastproject.security.shibboleth.ShibbolethRequestHeaderAuthenticationFilter">
    <property name="principalRequestHeader" value="<this need to be configured>"/>
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="userDetailsService" ref="userDetailsService" />
    <property name="userDirectoryService" ref="userDirectoryService" />
    <property name="shibbolethLoginHandler" ref="aaiLoginHandler" />
    <property name="exceptionIfHeaderMissing" value="false" />
  </bean>-->

  <!-- AAI header extractor and user generator
  <bean id="aaiLoginHandler" class="org.opencastproject.security.aai.ConfigurableLoginHandler">
    <property name="securityService" ref="securityService" />
    <property name="userReferenceProvider" ref="userReferenceProvider" />
  </bean>-->

  <!-- Dynamic AAI Loginhandler
  <bean id="aaiLoginHandler" class="org.opencastproject.security.aai.DynamicLoginHandler">
    <property name="securityService" ref="securityService" />
    <property name="userReferenceProvider" ref="userReferenceProvider" />
    <property name="attributeMapper" ref="attributeMapper" />
  </bean>

  <bean id="attributeMapper" class="org.opencastproject.security.aai.api.AttributeMapper">
    <property name="useHeader" value="true" />
    <property name="multiValueDelimiter" value=";" />
    <property name="attributeMap" ref="attributeMap" />
    <property name="aaiAttributes" ref="aaiAttributes" />
  </bean>

  <util:list id="aaiAttributes" value-type="java.lang.String">
    <value>sn</value>
    <value>givenName</value>
    <value>mail</value>
    <value>homeOrganization</value>
    <value>eduPersonEntitlement</value>
    <value>eduPersonPrincipalName</value>
    <value>homeOrganization</value>
  </util:list>

  <util:map id="attributeMap" map-class="java.util.HashMap">
    <entry key="roles" value-ref="roleMapping" />
    <entry key="displayName" value-ref="displayNameMapping" />
    <entry key="mail" value-ref="mailMapping" />
  </util:map>

  <util:list id="displayNameMapping" value-type="java.lang.String">
    <value>['givenName'][0] + ' ' + ['sn'][0]</value>
  </util:list>

  <util:list id="mailMapping" value-type="java.lang.String">
    <value>['mail'][0]</value>
  </util:list>

  <util:list id="roleMapping" value-type="java.lang.String">
    <value>'ROLE_AAI_USER'</value>
    <value>'ROLE_AAI_USER_' + ['eduPersonPrincipalName']</value>
    <value>('ROLE_AAI_OWNER_' + ['eduPersonPrincipalName']).replaceAll("[^a-zA-Z0-9]","_").toUpperCase()</value>
    <value>['homeOrganization'] != null ? 'ROLE_AAI_ORG_' + ['homeOrganization'] + '_MEMBER' : null</value>
    <value>['eduPersonEntitlement'].contains('urn:mace:opencast.org:permission:shibboleth:opencast_admin') ? 'ROLE_ADMIN' : null</value>
    <value>['eduPersonPrincipalName'].contains('[email protected]') ? 'ROLE_ADMIN' : null</value>
    <value>['eduPersonScopedAffiliation'].contains('[email protected]') ? 'ROLE_GROUP_AAI_TRAINER' : null</value>
  </util:list>

   -->

  <bean id="preauthAuthProvider"
        class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
    <property name="preAuthenticatedUserDetailsService">
      <bean id="userDetailsServiceWrapper" class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
        <property name="userDetailsService" ref="userDetailsService"/>
      </bean>
    </property>
  </bean>

  <!-- ################ -->
  <!-- # JWT Support # -->
  <!-- ################ -->

  <!-- General JWT header extraction filter -->
  <bean id="jwtHeaderFilter" class="org.opencastproject.security.jwt.JWTRequestHeaderAuthenticationFilter">
    <property name="principalRequestHeader" value="Authorization"/>
    <property name="principalPrefix" value="Bearer "/>
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="loginHandler" ref="jwtLoginHandler" />
    <property name="exceptionIfHeaderMissing" value="false" />
  </bean>

  <!-- General JWT request parameter extraction filter -->
  <bean id="jwtRequestParameterFilter" class="org.opencastproject.security.jwt.JWTRequestParameterAuthenticationFilter">
    <property name="parameterName" value="jwt" />
    <property name="authenticationManager" ref="authenticationManager" />
    <property name="loginHandler" ref="jwtLoginHandler" />
    <property name="exceptionIfParameterMissing" value="false" />
  </bean>

  <!-- JWT login handler -->
  <bean id="jwtLoginHandler" class="org.opencastproject.security.jwt.DynamicLoginHandler">
    <property name="userDetailsService" ref="userDetailsService" />
    <property name="userDirectoryService" ref="userDirectoryService" />
    <property name="securityService" ref="securityService" />
    <property name="userReferenceProvider" ref="userReferenceProvider" />
    <property name="jwksUrl" value="https://tobira.opencast.org/.well-known/jwks.json" />
    <property name="jwksCacheExpiresIn" value="1440" />
    <property name="expectedAlgorithms" ref="jwtExpectedAlgorithms" />
    <property name="claimConstraints" ref="jwtClaimConstraints" />
    <property name="usernameMapping" value="['username'].asString()" />
    <property name="nameMapping" value="['name'].asString()" />
    <property name="emailMapping" value="['username'].asString() + '@tobira.invalid'" />
    <property name="roleMappings" ref="jwtRoleMappings" />
    <property name="jwtCacheSize" value="500" />
    <property name="jwtCacheExpiresIn" value="60" />
  </bean>

  <!-- The signing algorithms expected for the JWT signature -->
  <util:list id="jwtExpectedAlgorithms" value-type="java.lang.String">
    <value>ES256</value>
    <value>ES384</value>
  </util:list>

  <!-- The claim constraints that are expected to be fulfilled by the JWT
       If you are using JWTs for OpenID Connect, see the specification for claims that must be validated:
       https://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation -->
  <util:list id="jwtClaimConstraints" value-type="java.lang.String">
    <value>containsKey('username')</value>
    <value>containsKey('name')</value>
    <value>containsKey('exp')</value>
  </util:list>

  <!-- The mapping from JWT claims to Opencast roles -->
  <util:list id="jwtRoleMappings" value-type="java.lang.String">
    <value>'ROLE_JWT_USER'</value>
    <value>'ROLE_JWT_USER_' + ['username'].asString()</value>
    <value>'ROLE_STUDIO'</value>
    <value>'ROLE_ANONYMOUS'</value>
  </util:list>

  <!-- ################ -->
  <!-- # LDAP Support # -->
  <!-- ################ -->

  <!--
  <bean id="contextSource"
    class="org.springframework.security.ldap.DefaultSpringSecurityContextSource">
    < ! - - URL of the LDAP server - - >
    <constructor-arg value="ldap://myldapserver:myport" />
    < ! - - "Distinguished name" for the unprivileged user - - >
    < ! - - This user is merely to perform searches in the LDAP to find the users to login - - >
    <property name="userDn" value="uid=user-id,dc=example,dc=com" />
    < ! - - Password of the user above - - >
    <property name="password" value="mypassword" />
  </bean>
  -->

  <!--
  <bean id="userDetailsMapper" class="org.opencastproject.security.ldap.OpencastUserDetailsMapper">
    <constructor-arg ref="userDetailsService" />
  </bean>
  -->

  <!--
  <bean id="ldapAuthProvider"
    class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider">
    <constructor-arg>
      <bean
        class="org.springframework.security.ldap.authentication.BindAuthenticator">
        <constructor-arg ref="contextSource" />
        <property name="userDnPatterns">
          <list>
            < ! - - Dn patterns to search for valid users. Multiple "<value>" tags are allowed - - >
            <value>uid={0},dc=example,dc=com</value>
          </list>
        </property>
        < ! - - If your user IDs are not part of the user Dn's, you can use a search filter to find them - - >
        < ! - - This property can be used together with the "userDnPatterns" above - - >
        < ! - -
        <property name="userSearch">
          <bean name="filterUserSearch" class="org.springframework.security.ldap.search.FilterBasedLdapUserSearch">
            < ! - - Base Dn from where the users will be searched for - - >
            <constructor-arg index="0" value="ou=GroupName,dc=my-institution,dc=country" />
            < ! - - Filter to located valid users. Use {0} as a placeholder for the login name - - >
            <constructor-arg index="1" value="(uid={0})" />
            <constructor-arg ref="contextSource" />
          </bean>
        </property>
        - - >
      </bean>
    </constructor-arg>
    < ! - - Retrieve user and attributes from opencasts user details service - - >
    <property name="userDetailsContextMapper" ref="userDetailsMapper"/>
    < ! - - Defines how the user attributes are converted to authorities (roles) - - >
    < ! - - Output is ignored if used together with userDetailsMapper - - >
    < ! - - constructor-arg ref="authoritiesPopulator" /- - >
  </bean>
  -->

  <!-- #################### -->
  <!-- # OSGI Integration # -->
  <!-- #################### -->

  <!-- Obtain services from the OSGI service registry -->
  <osgi:reference id="userDetailsService" cardinality="1..1"
                  interface="org.springframework.security.core.userdetails.UserDetailsService" />

  <osgi:reference id="securityService" cardinality="1..1"
                  interface="org.opencastproject.security.api.SecurityService" />

  <!-- Uncomment to enable external users e.g. used together with shibboleth and JWT -->
  <osgi:reference id="userReferenceProvider" cardinality="1..1"
                  interface="org.opencastproject.userdirectory.api.UserReferenceProvider"  />

  <osgi:reference id="userDirectoryService" cardinality="1..1"
                  interface="org.opencastproject.security.api.UserDirectoryService" />

  <!-- Uncomment this as an alternative to the userDetailsMapper -->
  <!-- Make sure you provide the same instanceId you used in org.opencastproject.userdirectory.ldap-….cfg -->
  <!--
  <osgi:reference id="authoritiesPopulator" cardinality="1..1"
                  interface="org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator"
                  filter="(instanceId=theId)"/>
  -->

  <osgi:reference id="oAuthConsumerDetailsService" cardinality="1..1"
                  interface="org.springframework.security.oauth.provider.ConsumerDetailsService" />

  <osgi:reference id="ltiLaunchAuthenticationHandler" cardinality="1..1"
                  interface="org.springframework.security.oauth.provider.OAuthAuthenticationHandler" />


  <!-- ############################# -->
  <!-- # Spring Security Internals # -->
  <!-- ############################# -->

  <bean id="passwordEncoder" class="org.opencastproject.kernel.security.CustomPasswordEncoder" />

  <sec:authentication-manager alias="authenticationManager">
    <sec:authentication-provider ref="rememberMeAuthenticationProvider"/>
    <!-- CAS Auth: Uncomment this if using CAS authentication -->
    <!-- <sec:authentication-provider ref="casAuthenticationProvider" /> -->
    <!-- Uncomment this if using Shibboleth or JWT authentication -->
    <sec:authentication-provider ref="preauthAuthProvider" />
    <!-- Uncomment the following line if using LDAP -->
    <!-- <sec:authentication-provider ref="ldapAuthProvider" /> -->
    <sec:authentication-provider user-service-ref="userDetailsService">
      <!-- The JPA user directory stores bcrypt hashed passwords, but still works with legacy md5 hashes -->
      <sec:password-encoder ref="passwordEncoder">
        <!-- This salt is used only for decoding legacy MD5 hased passwords -->
        <sec:salt-source user-property="username" />
      </sec:password-encoder>
    </sec:authentication-provider>
  </sec:authentication-manager>

  <!-- Do not use a request cache -->
  <bean id="requestCache" class="org.springframework.security.web.savedrequest.NullRequestCache" />

</beans>