From d2f7e8edf9d78cf003b6817579e70dfecae13bc2 Mon Sep 17 00:00:00 2001
From: Stephen Moore <srmoore@mitre.org>
Date: Tue, 21 Aug 2012 12:53:17 -0400
Subject: [PATCH] Moved SPEL to app-context, and added enpoint permitAlls

---
 .../webapp/WEB-INF/application-context.xml    | 22 +++++++++++++++++++
 .../src/main/webapp/WEB-INF/user-context.xml  |  8 +++----
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/openid-connect-server/src/main/webapp/WEB-INF/application-context.xml b/openid-connect-server/src/main/webapp/WEB-INF/application-context.xml
index e04453b1e..10465d1c0 100644
--- a/openid-connect-server/src/main/webapp/WEB-INF/application-context.xml
+++ b/openid-connect-server/src/main/webapp/WEB-INF/application-context.xml
@@ -29,6 +29,16 @@
 	<!-- Import the data context -->
 	<import resource="data-context.xml" />
 
+	<!-- SPEL processors -->
+	<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager">
+	<!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
+		<security:expression-handler ref="oauthExpressionHandler" />
+	</security:global-method-security>
+
+	<oauth2:expression-handler id="oauthExpressionHandler" />
+
+	<oauth2:web-expression-handler id="oauthWebExpressionHandler" />
+
 	<!-- Spring Security configuration -->
 
 	<oauth:resource-server id="resourceServerFilter" token-services-ref="defaultOAuth2ProviderTokenService" />
@@ -46,6 +56,18 @@
 		<security:access-denied-handler ref="oauthAccessDeniedHandler" />
 	</security:http>
 
+	<!-- Allow open access to required endpoints -->
+	<security:http auto-config="true">
+		<security:intercept-url pattern="/jwk**" access="permitAll"/>
+		<security:intercept-url pattern="/.well-known**" access="permitAll"/>
+		<security:intercept-url pattern="/x509**" access="permitAll"/>	
+	</security:http>
+
+ 	<security:http auto-config="true" pattern="/userinfo**">
+		<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
+		<security:expression-handler ref="oauthWebExpressionHandler" />
+	</security:http>
+
 	<bean id="oauthAuthenticationEntryPoint" class="org.springframework.security.oauth2.provider.error.OAuth2AuthenticationEntryPoint">
 		<property name="realmName" value="openidconnect" />
 	</bean>
diff --git a/openid-connect-server/src/main/webapp/WEB-INF/user-context.xml b/openid-connect-server/src/main/webapp/WEB-INF/user-context.xml
index d8372b533..f2cdadab8 100644
--- a/openid-connect-server/src/main/webapp/WEB-INF/user-context.xml
+++ b/openid-connect-server/src/main/webapp/WEB-INF/user-context.xml
@@ -15,15 +15,15 @@
 		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd">
 
 
-	<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager">
-		<!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
-		<security:expression-handler ref="oauthExpressionHandler" />
+<!--	<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager">
+-->		<!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
+<!--		<security:expression-handler ref="oauthExpressionHandler" />
 	</security:global-method-security>
 
 	<oauth2:expression-handler id="oauthExpressionHandler" />
 
 	<oauth2:web-expression-handler id="oauthWebExpressionHandler" />
-
+-->
 	<security:authentication-manager alias="authenticationManager">
 		<security:authentication-provider>
 			<security:user-service id="userDetailsService">