# =======================
# Shiro INI configuration
# =======================

[main]
# Objects and their properties are defined here,
# Such as the securityManager, Realms and anything
# else needed to build the SecurityManager

# Cache Manager
builtInCacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager

# Security Manager
securityManager.cacheManager = $builtInCacheManager

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
securityManager.sessionManager = $sessionManager
securityManager.sessionMode = native
# User session timeout in milliseconds
securityManager.sessionManager.globalSessionTimeout = 1800000
securityManager.sessionManager.sessionIdUrlRewritingEnabled = false
securityManager.sessionManager.sessionIdCookie.secure = true
securityManager.rememberMeManager.cookie.secure = true
securityManager.rememberMeManager.cookie.httpOnly = true

# Notice how we didn't define the class for the FormAuthenticationFilter ('authc') - it is instantiated and available already:
authc.loginUrl = /#!/login

# credentialsMatcher
sha256Matcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher

iniRealm.credentialsMatcher = $sha256Matcher


x509 = fr.gouv.vitam.common.auth.web.filter.X509AuthenticationFilter
x509.useHeader = False
x509credentialsMatcher = fr.gouv.vitam.common.auth.core.authc.X509CredentialsSha256Matcher


securityManager.realms = $iniRealm
[users]
# The 'users' section is for simple deployments
# when you only need a small number of statically-defined set of User accounts.
# username = password
aadmin=54694c459527b1daf23eb6fcdaa6dc6f76744fbcf1aa9a7b2f7a623d572e4a23, admin
uuser=ce5cc8712b38ad9dae0013de1dc7356b7f83ee311925cdb89b0cb1412148d936, user
gguest=1a4a3c5ac5e29d2a4556ce34f81dea65bf2919f1048ce648c31593f278b5af3e, guest
techadmin=eeca5c76b1a42b7890e0ccab757d77810d6396c2dd56adedc6bd0471245ba501, admin

[roles]
admin = *
user = messages:*, archivesearch:*, logbook:*, ingest:*, archiveupdate:*, archiveunit:*, ingests:read, admin:formats:read, admin:rules:read, admin:accession-register:read, logbookunitlifecycles:*, logbookobjectslifecycles:*, clear:delete, check:read, traceability:content:read, accesscontracts:read, profiles:read, contracts:read, contexts:read, archiveunitprofiles:read, ontologies:read, accessionregisterssymbolic:read
guest = archivesearch:*, archiveunit:*, units:*, unit:*, admin:accession-register:read, accesscontracts:read

[urls]
# make sure the end-user is authenticated. If not, redirect to the 'authc.loginUrl' above,
# and after successful authentication, redirect them back to the original account page they
# were trying to view:
/v1/api/login = anon
/v1/api/logout = logout
/v1/api/messages/logbook = anon
/v1/api/tenants = anon
/v1/api/securemode = anon
/v1/api/admintenant = anon
/v1/api/permissions = x509
/v1/api/** = authc, x509
/#/** = authc