<?xml version="1.0" encoding="UTF-8"?>
<!--
  Licensed to the Apache Software Foundation (ASF) under one or more
  contributor license agreements.  See the NOTICE file distributed with
  this work for additional information regarding copyright ownership.
  The ASF licenses this file to You under the Apache License, Version 2.0
  (the "License"); you may not use this file except in compliance with
  the License.  You may obtain a copy of the License at
  
  http://www.apache.org/licenses/LICENSE-2.0
  
  Unless required by applicable law or agreed to in writing, software
  distributed under the License is distributed on an "AS IS" BASIS,
  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  See the License for the specific language governing permissions and
  limitations under the License.
-->
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">

  <!-- ************** Security SPI Handlers ************** -->

  <!-- require a non-empty password -->
  <bean id="org.apache.jetspeed.security.spi.CredentialPasswordValidator"
    class="org.apache.jetspeed.security.spi.impl.DefaultCredentialPasswordValidator">
    <meta key="j2:cat" value="default or security" />

    <!-- UNCOMMENT TO TURN ON Regex-based password validation. The pattern below gives:
      * Must be at least 6 characters
      * Must contain at least one one lower case letter, one upper case letter, one digit and one special character
      * Valid special characters are @#$%^&+=   -->
      <constructor-arg index="0"><value><![CDATA[^.*(?=.{6,})(?=.*\d)(?=.*[a-z])(?=.*[A-Z])(?=.*[@#$%^&+=]).*$]]></value></constructor-arg>       
  
  </bean>

  <!-- MessageDigest encode passwords using SHA-1 -->
  <bean id="org.apache.jetspeed.security.spi.CredentialPasswordEncoder"
    class="org.apache.jetspeed.security.spi.impl.MessageDigestCredentialPasswordEncoder">
    <meta key="j2:cat" value="default or security" />
    <constructor-arg index="0">
      <value>SHA-1</value>
    </constructor-arg>
  </bean>

    <bean id="org.apache.jetspeed.security.spi.PasswordCredentialProvider"
    class="org.apache.jetspeed.security.spi.impl.UserPasswordCredentialPolicyManagerImpl">
    <meta key="j2:cat" value="default or security" />
 <constructor-arg index="0">
	   <ref bean="org.apache.jetspeed.security.spi.CredentialPasswordEncoder"/>
     </constructor-arg>       
     <constructor-arg index="1">
        <ref bean="org.apache.jetspeed.security.spi.CredentialPasswordValidator"/>
     </constructor-arg>  
<constructor-arg index="2">	 
    <list>
    
    <bean class="org.apache.jetspeed.security.spi.impl.ValidatePasswordOnLoadInterceptor" />
    
    
    <bean class="org.apache.jetspeed.security.spi.impl.EncodePasswordOnFirstLoadInterceptor" />
	
	<!-- remember the last 3 passwords used and require a new password to be different from those -->
         <bean class="org.apache.jetspeed.security.spi.impl.PasswordHistoryInterceptor">
           <constructor-arg index="0"><value>3</value></constructor-arg>       
         </bean>

         <!-- Automatically expire a password after 60 days -->
         <bean class="org.apache.jetspeed.security.spi.impl.PasswordExpirationInterceptor">
           <constructor-arg index="0"><value>60</value></constructor-arg>       
         </bean>

         <!-- Automatically disable a password after 3 invalid authentication attempts in a row --> 
         <bean class="org.apache.jetspeed.security.spi.impl.MaxPasswordAuthenticationFailuresInterceptor">
           <constructor-arg index="0"><value>3</value></constructor-arg>       
         </bean>
		 
    </list>
	     </constructor-arg> 
    </bean>


  <!-- allow multiple InternalPasswordCredentialInterceptors to be used for DefaultCredentialHandler -->

    <bean id="org.apache.jetspeed.security.spi.InternalPasswordCredentialInterceptor"
    class="org.apache.jetspeed.security.spi.impl.PasswordCredentialInterceptorsProxy">
    <meta key="j2:cat" value="default or security" />
    <constructor-arg index="0">
    <list>
    
    <bean class="org.apache.jetspeed.security.spi.impl.ValidatePasswordOnLoadInterceptor" />
    
    
    <bean class="org.apache.jetspeed.security.spi.impl.EncodePasswordOnFirstLoadInterceptor" />
	
	<!-- remember the last 3 passwords used and require a new password to be different from those -->
         <bean class="org.apache.jetspeed.security.spi.impl.PasswordHistoryInterceptor">
           <constructor-arg index="0"><value>3</value></constructor-arg>       
         </bean>

         <!-- Automatically expire a password after 60 days -->
         <bean class="org.apache.jetspeed.security.spi.impl.PasswordExpirationInterceptor">
           <constructor-arg index="0"><value>60</value></constructor-arg>       
         </bean>

         <!-- Automatically disable a password after 3 invalid authentication attempts in a row --> 
         <bean class="org.apache.jetspeed.security.spi.impl.MaxPasswordAuthenticationFailuresInterceptor">
           <constructor-arg index="0"><value>3</value></constructor-arg>       
         </bean>
		 
    </list>
    </constructor-arg>
    </bean>

    <!-- Alternate Password Encoder with Jetspeed-1 algorithm -->
  <!--
    <bean id="org.apache.jetspeed.security.spi.CredentialPasswordEncoder" 
    class="org.apache.jetspeed.security.spi.impl.Jetspeed1CredentialPasswordEncoder">
    <constructor-arg index="0"><value>SHA</value></constructor-arg>
    <constructor-arg index="1"><value>base64</value></constructor-arg>
    </bean>       
  -->
  
  <!-- A Two-way encoding password service which also implements CredentialPasswordEncoder
    this Service can be used instead of for example the default provided MessageDigestCredentialPasswordEncoder
    <bean id="org.apache.jetspeed.security.PasswordEncodingService"
    name="org.apache.jetspeed.security.spi.CredentialPasswordEncoder"
    class="org.apache.jetspeed.security.spi.impl.PBEPasswordService">
    <constructor-arg index="0">
    <!- secret PBE key password ->
    <value>********</value>
    </constructor-arg>       
    </bean>       
  -->

  <!-- A Two-way encoding password service which also implements CredentialPasswordEncoder
    Furthermore, this extension of the PBEPasswordService supports lazy upgrading from an old CredentialPasswordEncoder
    like the default provided MessageDigestCredentialPasswordEncoder
    ->
    <bean id="org.apache.jetspeed.security.PasswordEncodingService"
    name="org.apache.jetspeed.security.spi.CredentialPasswordEncoder"
    class="org.apache.jetspeed.security.spi.impl.AlgorithmUpgradePBEPasswordService">
    <constructor-arg index="0">
    <!- secret PBE key password ->
    <value>********</value>
    </constructor-arg>
    <constructor-arg index="1">
    <!- old MessageDigestCredentialPasswordEncoder to be upgrading from, using SHA-1 ->
    <bean class="org.apache.jetspeed.security.spi.impl.MessageDigestCredentialPasswordEncoder">
    <constructor-arg index="0"><value>SHA-1</value></constructor-arg>       
    </bean>       
    </constructor-arg>
    <constructor-arg index="2">
    <!- startPBEPasswordEncodingService: date before which old encoded passwords need to be recoded (on authentication)
    (SimpleDateFormat) format: yyyy-MM-dd HH:mm:ss
    ->
    <value>2006-07-02 15:00:00</value>
    </constructor-arg>
    </bean>
  -->
  
  <!-- Security SPI: CredentialHandler 

    <bean id="org.apache.jetspeed.security.spi.CredentialHandler"
    class="org.apache.jetspeed.security.spi.impl.BaseJetspeedPrincipalAssociationHandler">
    <meta key="j2:cat" value="default or security" />

    <constructor-arg index="0">
    <ref bean="org.apache.jetspeed.security.spi.PasswordCredentialProvider" />
    </constructor-arg>
    <constructor-arg index="1">
    <ref bean="org.apache.jetspeed.security.spi.InternalPasswordCredentialInterceptor" />
    </constructor-arg>
    </bean>
    -->
 
  <!-- Security SPI: UserSecurityHandler -->
  <!-- The DefaultUSerSecurityHandler uses the raw SecurityAccessImpl so that it
    may demarcate its own transactions -->
  <!--<bean id="org.apache.jetspeed.security.spi.UserSecurityHandlerImpl"
    class="org.apache.jetspeed.security.spi.impl.DefaultUserSecurityHandler">
    <meta key="j2:cat" value="default or security" />
    <constructor-arg>
    <ref bean="org.apache.jetspeed.security.spi.SecurityAccess" />
    </constructor-arg>
    </bean>
    
    <bean id="org.apache.jetspeed.security.spi.UserSecurityHandler" parent="baseTransactionProxy"
    name="userSecurityHandler">
    <meta key="j2:cat" value="default or security" />
    <property name="proxyInterfaces">
    <value>org.apache.jetspeed.security.spi.UserSecurityHandler</value>
    </property>
    <property name="target">
    <ref bean="org.apache.jetspeed.security.spi.UserSecurityHandlerImpl" />
    </property>
    <property name="transactionAttributes">
    <props>				
    <prop key="add*">PROPAGATION_REQUIRED</prop>
    <prop key="update*">PROPAGATION_REQUIRED</prop>
    <prop key="remove*">PROPAGATION_REQUIRED</prop>
    <prop key="*">PROPAGATION_SUPPORTS</prop>
    </props>
    </property>
    </bean>-->
</beans>
