sec-primitives.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd">
<!--
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#
# Copyright 2008 Glencoe Software, Inc. All rights reserved.
# Use is subject to license terms supplied in LICENSE.txt
#
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Written by:  Josh Moore, josh at glencoesoftware.com
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-->

<beans>

  <description>
  sec-primitives.xml defines the low-level decision makers and state holders
  for security questions. These classes can safely be used by the hibernate
  layer, such as via the EventListener.
  </description>

  <bean id="keystore" class="ome.security.KeyAndTrustStoreConfiguration" lazy-init="false">
    <description>Sets the keystore and truststore System properties on start-up</description>
    <property name="keyStore" value="${omero.security.keyStore}" />
    <property name="keyStorePassword" value="${omero.security.keyStorePassword}" />
    <property name="trustStore" value="${omero.security.trustStore}" />
    <property name="trustStorePassword" value="${omero.security.trustStorePassword}" />
  </bean>

  <bean id="currentDetails" class="ome.security.basic.CurrentDetails">
    <constructor-arg ref="sessionCache"/>
    <constructor-arg ref="roles"/>
  </bean>

  <alias name="currentDetails" alias="principalHolder"/>

  <bean id="internalServiceFactory" class="ome.tools.spring.InternalServiceFactory"/>

  <bean id="roles" factory-bean="dbUserCheck" factory-method="getRoles"/>

  <bean id="securityFilterHolder" class="ome.security.SecurityFilterHolder">
    <constructor-arg ref="currentDetails"/>
    <constructor-arg ref="&amp;OneGroupSecurityFilter"/><!-- filter is a factory -->
    <constructor-arg ref="&amp;AllGroupsSecurityFilter"/><!-- filter is a factory -->
    <constructor-arg ref="&amp;SharingSecurityFilter"/><!-- filter is a factory -->
  </bean>

  <bean id="OneGroupSecurityFilter" class="ome.security.basic.OneGroupSecurityFilter">
    <constructor-arg ref="roles"/>
  </bean>

  <bean id="AllGroupsSecurityFilter" class="ome.security.basic.AllGroupsSecurityFilter">
    <constructor-arg ref="simpleSqlAction"/>
    <constructor-arg ref="roles"/>
  </bean>

  <bean id="SharingSecurityFilter" class="ome.security.basic.SharingSecurityFilter">
    <constructor-arg ref="roles"/>
    <constructor-arg ref="shareStore"/>
  </bean>

  <alias name="${omero.security.chmod_strategy}" alias="chmodStrategy"/>

  <bean id="groupChmodStrategy" class="ome.security.basic.GroupChmodStrategy">
    <constructor-arg ref="basicACLVoter"/>
    <constructor-arg ref="omeroSessionFactory"/>
    <constructor-arg ref="simpleSqlAction"/>
    <constructor-arg ref="extendedMetadata"/>
  </bean>

  <bean id="systemTypes" class="ome.security.SystemTypes"/>

  <bean id="tokenHolder" class="ome.security.basic.TokenHolder"/>

  <alias name="${omero.policy.bean}" alias="policyService"/>

  <bean id="defaultPolicyService" class="ome.security.policy.DefaultPolicyService"/>

  <bean id="RESTRICT-BINARY-ACCESS" class="ome.security.policy.BinaryAccessPolicy">
    <constructor-arg>
      <set>
        <value>ome.model.annotations.FileAnnotation</value>
        <value>ome.model.core.Image</value>
        <value>ome.model.core.OriginalFile</value>
        <value>ome.model.screen.Plate</value>
        <value>ome.model.screen.Well</value>
      </set>
    </constructor-arg>
    <constructor-arg ref="aclVoter"/>
    <constructor-arg value="${omero.policy.binary_access}"/>
  </bean>

  <bean id="aclVoter" class="ome.security.CompositeACLVoter">
    <constructor-arg ref="currentDetails"/>
    <constructor-arg ref="sharingACLVoter"/>
    <constructor-arg ref="basicACLVoter"/>
  </bean>

  <bean id="sharingACLVoter" class="ome.security.sharing.SharingACLVoter">
    <constructor-arg ref="systemTypes"/>
    <constructor-arg ref="currentDetails"/>
    <constructor-arg ref="shareStore"/>
    <constructor-arg ref="tokenHolder"/>
  </bean>

  <bean id="basicACLVoter" class="ome.security.basic.BasicACLVoter">
    <constructor-arg ref="currentDetails"/>
    <constructor-arg ref="systemTypes"/>
    <constructor-arg ref="tokenHolder"/>
    <constructor-arg ref="securityFilterHolder"/>
    <constructor-arg ref="policyService"/>
    <constructor-arg ref="roles"/>
  </bean>

  <bean name="sessionCache" class="ome.services.sessions.state.SessionCache">
    <property name="cacheManager"  ref="cacheManager"/>
    <property name="updateInterval" value="${omero.sessions.sync_force}"/><!-- ms -->
  </bean>

  <bean name="sessionManager" class="ome.services.sessions.SessionManagerImpl"
    depends-on="dbPatchCheck"
    init-method="init"><!-- Init called to add root login method. -->
    <property name="uuid"            ref="uuid"/>
    <property name="principalHolder" ref="principalHolder"/>
    <property name="sessionCache"    ref="sessionCache"/>
    <property name="roles"           ref="roles"/>
    <property name="executor"        ref="executor"/>
    <property name="defaultTimeToIdle" value="${omero.sessions.timeout}"/>
    <property name="defaultTimeToLive" value="${omero.sessions.maximum}"/>
    <property name="counterFactory" ref="sessionCounterFactory"/>
    <property name="readOnly"       value="${omero.cluster.read_only}"/>
  </bean>

  <bean id="methodSecurity" class="ome.security.basic.BasicMethodSecurity">
    <property name="sessionManager" ref="sessionManager"/>
  </bean>

  <!-- Throttling primitives -->

  <bean id="threadCounterFactory" class="ome.services.sessions.stats.CounterFactory">
    <property name="objectsReadHardLimit" value="64000"/>
    <property name="objectsWrittenHardLimit" value="64000"/>
  </bean>

  <!-- Uses Integer.MAX_VALUE -->
  <bean id="sessionCounterFactory" class="ome.services.sessions.stats.CounterFactory"/>

  <!--
  The following stats types
  -->

  <bean id="perSessionStats" class="ome.services.sessions.stats.PerSessionStats">
    <constructor-arg ref="currentDetails"/>
  </bean>

  <bean id="perThreadStats" class="ome.services.sessions.stats.PerThreadStats">
    <constructor-arg ref="currentDetails"/>
  </bean>

  <bean id="delegatingStats" class="ome.services.sessions.stats.DelegatingStats">
    <constructor-arg>
      <list>
        <ref bean="perThreadStats"/>
        <ref bean="perSessionStats"/>
      </list>
    </constructor-arg>
  </bean>

</beans>