<?xml version="1.0" encoding="UTF-8"?><!--suppress SpringSecurityFiltersConfiguredInspection -->
<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.springframework.org/schema/beans"
       xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
       http://www.springframework.org/schema/context https://www.springframework.org/schema/context/spring-context.xsd">

    <context:annotation-config/>
    <context:component-scan base-package="com.armedia.acm.auth.oidc"/>

    <bean id="acmAuthoritiesMapper" class="com.armedia.acm.auth.AcmGrantedAuthoritiesMapper" init-method="initBean">
        <property name="roleToGroupMapping" ref="acmRoleToGroupConfig"/>
        <property name="groupService" ref="groupService"/>
    </bean>

    <bean id="acmAuthenticationManager" class="com.armedia.acm.auth.AcmAuthenticationManager">
        <property name="springContextHolder" ref="acmContextHolder"/>
        <property name="authenticationEventPublisher" ref="ssAuthenticationEventPublisher"/>
        <property name="userDao" ref="userJpaDao"/>
        <property name="authenticationMapper" ref="acmAuthenticationMapper"/>
    </bean>

    <bean id="acmAuthenticationMapper" class="com.armedia.acm.auth.AcmAuthenticationMapper">
        <property name="userDao" ref="userJpaDao"/>
        <property name="authoritiesMapper" ref="acmAuthoritiesMapper"/>
    </bean>

    <bean id="acmAuthenticationDetailsFactory" class="com.armedia.acm.auth.AcmAuthenticationDetailsFactory"/>

    <bean id="acmLoginSuccessListener" class="com.armedia.acm.auth.AcmLoginSuccessEventListener"/>

    <bean id="acmBasicAndTokenAuthenticationFilter" class="com.armedia.acm.auth.AcmBasicAndTokenAuthenticationFilter">
        <constructor-arg ref="acmAuthenticationManager"/>
        <property name="loginSuccessOperations" ref="acmLoginSuccessOperations"/>
        <property name="authenticationDetailsSource" ref="acmAuthenticationDetailsFactory"/>
        <property name="loginSuccessEventListener" ref="acmLoginSuccessListener"/>
        <property name="authenticationTokenService" ref="authenticationTokenService"/>
        <property name="acmGrantedAuthoritiesMapper" ref="acmAuthoritiesMapper"/>
        <property name="userDao" ref="userJpaDao"/>
    </bean>

    <bean id="acmAuditPropertyInterceptor" class="com.armedia.acm.auth.AcmAuditPropertyInterceptor">
        <property name="entityAdapter" ref="auditPropertyEntityAdapter"/>
    </bean>

    <bean id="acmLoginSuccessOperations" class="com.armedia.acm.auth.AcmLoginSuccessOperations">
        <property name="acmApplication" ref="acmApplication"/>
        <property name="userDao" ref="userJpaDao"/>
        <property name="auditPropertyEntityAdapter" ref="auditPropertyEntityAdapter"/>
        <property name="objectConverter" ref="objectConverter"/>
        <property name="applicationConfig" ref="applicationProperties"/>
        <property name="externalAuthenticationUtils" ref="externalAuthenticationUtils"/>
        <property name="rolesToPrivilegesConfig" ref="rolesToPrivileges"/>
    </bean>

    <bean id="acmLoginFailureListener" class="com.armedia.acm.auth.AcmLoginFailureEventListener"/>

    <bean id="ssAuthenticationEventPublisher"
        class="org.springframework.security.authentication.DefaultAuthenticationEventPublisher"/>

    <!-- REST services security beans -->
    <bean id="acmRestAuthenticationSuccessHandler" class="com.armedia.acm.auth.AcmRestAuthenticationSuccessHandler"/>

    <bean id="acmRestAuthenticationFailureHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"/>

    <bean id="acmRestAuthenticationEntryPoint" class="com.armedia.acm.auth.AcmRestAuthenticationEntryPoint"/>

    <bean id="acmStaticResourcesAuthenticationEntryPoint" class="com.armedia.acm.auth.AcmRestAuthenticationEntryPoint"/>

    <bean id="acmLoginSuccessHandler" class="com.armedia.acm.auth.AcmLoginSuccessHandler">
        <property name="loginSuccessOperations" ref="acmLoginSuccessOperations"/>
        <property name="defaultTargetUrl" value="#{loginConfig.defaultTargetUrl}"/>
        <property name="sessionRegistry" ref="sessionRegistry"/>
        <property name="sessionAuthenticationStrategy" ref="concurrentSessionControlAuthenticationStrategy"/>
        <property name="loginConfig" ref="loginConfig"/>
    </bean>

    <bean id="acmRedirectStrategy" class="com.armedia.acm.auth.AcmRedirectStrategy"/>

    <bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
        <constructor-arg name="expiredUrl" ref="expiredUrl"/>
        <property name="redirectStrategy" ref="acmRedirectStrategy"/>
    </bean>

    <bean id="concurrentSessionControlAuthenticationStrategy"
        class="com.armedia.acm.auth.AcmConcurrentSessionControlAuthenticationStrategy">
        <constructor-arg name="sessionRegistry" ref="sessionRegistry"/>
        <constructor-arg name="authenticationTokenService" ref="authenticationTokenService"/>
        <property name="maximumSessions" value="#{sessionConfig.maximumSessions}"/>
        <property name="exceptionIfMaximumExceeded" value="#{sessionConfig.exceptionIfMaximumExceeded}"/>
    </bean>

    <bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>

    <!-- when Kerberos has been used, then the login success handler should not do any redirects, since Kerberos
         has already caused the redirect we would need. This Kerberos login handler bean only sets up the
         ArkCase session, it performs no redirects. -->
    <bean id="acmKerberosLoginSuccessHandler" class="com.armedia.acm.auth.AcmKerberosLoginSuccessHandler">
        <property name="loginSuccessOperations" ref="acmLoginSuccessOperations"/>
    </bean>

    <bean id="acmLoginStateProvider" class="com.armedia.acm.auth.state.AcmLoginStateProvider">
        <property name="auditDao" ref="auditDao"/>
    </bean>

    <bean id="sessionConfig" class="com.armedia.acm.auth.SessionControlConfig" scope="refresh">
        <aop:scoped-proxy/>
    </bean>

    <bean id="externalAuthenticationUtils" class="com.armedia.acm.auth.ExternalAuthenticationUtils">
        <property name="applicationConfig" ref="applicationProperties"/>
        <property name="userDao" ref="userJpaDao"/>
    </bean>

    <beans profile="ldap,kerberos,externalAuth,mfa-okta">
        <bean id="acmLogoutSuccessHandler" class="com.armedia.acm.auth.AcmLogoutSuccessHandler">
            <property name="authenticationDetailsFactory" ref="acmAuthenticationDetailsFactory"/>
            <property name="defaultTargetUrl" value="/login?logout"/>
            <property name="alwaysUseDefaultTargetUrl" value="false"/>
        </bean>
    </beans>

    <beans profile="oidc,externalOidc">
        <bean id="acmLogoutSuccessHandler" class="com.armedia.acm.auth.AcmLogoutSuccessHandler">
            <property name="authenticationDetailsFactory" ref="acmAuthenticationDetailsFactory"/>
            <property name="defaultTargetUrl" value="/oauth/loggedout"/>
            <property name="alwaysUseDefaultTargetUrl" value="false"/>
        </bean>
    </beans>

    <beans profile="ssoSaml,externalSaml">
        <bean id="ssoProperties" class="org.springframework.beans.factory.config.PropertiesFactoryBean">
            <!-- note: must leave "file:" at the start of the file name for spring
            to be able to read the file; otherwise it will try to read from the
            classpath -->
            <property name="location" value="file:${user.home}/.arkcase/acm/sso/spring-config-armedia-sso.properties"/>
            <property name="ignoreResourceNotFound" value="true"/>
            <property name="localOverride" value="false"/>
            <property name="properties">
                <props>
                    <prop key="sso.saml.authenticationCheckIntervalInSeconds">3600</prop>
                </props>
            </property>
        </bean>

        <bean id="acmSamlWebSSOProcessingFilter" class="com.armedia.acm.auth.AcmSamlProcessingFilter">
            <property name="authenticationManager" ref="acmAuthenticationManager"/>
            <property name="authenticationSuccessHandler" ref="acmLoginSuccessHandler"/>
            <property name="authenticationFailureHandler" ref="failureRedirectHandler"/>
            <property name="authenticationDetailsSource" ref="acmAuthenticationDetailsFactory"/>
        </bean>

        <bean id="acmSamlAuthenticationCheckFilter" class="com.armedia.acm.auth.AcmSamlAuthenticationCheckFilter">
            <property name="authenticationCheckIntervalInSeconds"
                value="${sso.saml.authenticationCheckIntervalInSeconds}"/>
        </bean>

        <bean id="acmSamlRestAuthenticationCheckFilter"
            class="com.armedia.acm.auth.AcmSamlRestAuthenticationCheckFilter">
            <property name="authenticationCheckIntervalInSeconds"
                value="${sso.saml.authenticationCheckIntervalInSeconds}"/>
        </bean>

        <bean id="acmLogoutSuccessHandler" class="com.armedia.acm.auth.AcmLogoutSuccessHandler">
            <property name="authenticationDetailsFactory" ref="acmAuthenticationDetailsFactory"/>
            <property name="defaultTargetUrl" value="/sso/loggedout"/>
            <property name="alwaysUseDefaultTargetUrl" value="false"/>
        </bean>
    </beans>
</beans>
