<commit_before>#
# Licensed to Jasig under one or more contributor license
# agreements. See the NOTICE file distributed with this work
# for additional information regarding copyright ownership.
# Jasig licenses this file to you under the Apache License,
# Version 2.0 (the "License"); you may not use this file
# except in compliance with the License. You may obtain a
# copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#

##
##  CAS & Local Authentication
##  
##  The following is an example of configuring uPortal to use both CAS
##  and local user authentication (authentication by username and password
##  hash stored in the uPortal database).  It uses the UnionSecurityContext
##  to consider both these authentication methods and declares the required
##  tokens for all.  This approach requires the corresponding filter mappings
##  in web.xml (mapping both the CASValidateFilter and the StaticCasReceiptCacher
##  filter in front of the LoginServlet).
##
##  The bundled cas instance (http://localhost:8080/cas) also uses the user in
##  the uPortal database for authentication.
##

## This is the factory that supplies the concrete authentication class
root=org.jasig.portal.security.provider.UnionSecurityContextFactory
root.cas=org.jasig.portal.security.provider.cas.CasAssertionSecurityContextFactory
#root.cas=org.jasig.portal.security.provider.cas.clearpass.PasswordCachingCasAssertionSecurityContextFactory
root.simple=org.jasig.portal.security.provider.SimpleSecurityContextFactory

## Answers what tokens are examined in the request for each context during authentication.
## A subcontext only needs to set its tokens if it differs from those of the root context.
principalToken.root=userName
credentialToken.root=password
credentialToken.root.cas=ticket

## Answers where the user will be redirected when log out occurs. Each security context can have one.
## (See comments in the LogoutController class)
## It would be better to escape the value of the url parameter, but since there are no parameters on the
## unescaped URL and since there are no further parameters on the logout URL, this does work.
logoutRedirect.root=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/logout?url=${environment.build.uportal.protocol}://${environment.build.uportal.server}${environment.build.uportal.context}/Login

## This is the factory that supplies the concrete authorization class
authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## Login URL, if specified the CLogin channel will display a Login link with
## this URL instead of the standard userName/password form.
org.jasig.portal.channels.CLogin.CasLoginUrl=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/login?service=${environment.build.uportal.protocol}://${environment.build.uportal.server}${environment.build.uportal.context}/Login

## URL of the CAS clearPass password service
org.jasig.portal.security.provider.cas.clearpass.PasswordCachingCasAssertionSecurityContextFactory.clearPassCasUrl=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/clearPass

##
##  Local Only Authentication
##  
##  The following is an example of configuring uPortal local user authentication
##  (authentication by username and password hash stored in the uPortal database).
##
##  Comment out all other properties in this file and then uncomment the lines
##  prefixed with a single # below.
## 

## This is the factory that supplies the concrete authentication class
#root=org.jasig.portal.security.provider.SimpleSecurityContextFactory

## Answers what tokens are examined in the request for each context during authentication.
#principalToken.root=userName
#credentialToken.root=password

## This is the factory that supplies the concrete authorization class
#authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## This property must be defined, but empty, when local-only authentication is used to satisfy bean configuration
## of RequireValidSessionFilter.java, or you can edit contexts/mvcContext.xml to not pass in this property
#org.jasig.portal.channels.CLogin.CasLoginUrl=


##
##  Multiple LDAP & Local Authentication
##  
##  The following is an example of configuring uPortal to use multiple LDAP
##  directories  and local user authentication (authentication by username and
##  password hash stored in the uPortal database).  It uses the UnionSecurityContext
##  to consider all authentication methods and declares the required tokens for all. 
##
##  Comment out all other properties in this file and then uncomment the lines
##  prefixed with a single # below.
## 

## This is the factory that supplies the concrete authentication class
#root=org.jasig.portal.security.provider.UnionSecurityContextFactory
#root.simple=org.jasig.portal.security.provider.SimpleSecurityContextFactory
#root.ldap_stu=org.jasig.portal.security.provider.SimpleLdapSecurityContextFactory
#root.ldap_fac=org.jasig.portal.security.provider.SimpleLdapSecurityContextFactory

## The following tells the SimpleLdapSecurityContextFactory with the similarly named
## property which named LDAP connection to use. Named LDAP connections are defined in
## properties/contexts/ldapContext.xml
#securityContextProperty.root.ldap_stu.connection=Students
#securityContextProperty.root.ldap_fac.connection=Faculty

## Answers what tokens are examined in the request for each context during authentication.
#principalToken.root=userName
#credentialToken.root=password

## This is the factory that supplies the concrete authorization class
#authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## This property must be defined, but empty, when local-only authentication is used to satisfy bean configuration
## of RequireValidSessionFilter.java, or you can edit contexts/mvcContext.xml to not pass in this property
#org.jasig.portal.channels.CLogin.CasLoginUrl=<commit_msg>UP-4192 CVE-2014-5059 block security vulnerability.<commit_after>#
# Licensed to Jasig under one or more contributor license
# agreements. See the NOTICE file distributed with this work
# for additional information regarding copyright ownership.
# Jasig licenses this file to you under the Apache License,
# Version 2.0 (the "License"); you may not use this file
# except in compliance with the License. You may obtain a
# copy of the License at:
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on
# an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.
#

## 
## WARNING: 
## The default and therefore example configuration prior to 
## uPortal 4.0.15
## was subtly but terribly broken as regards 
## security context token configuration.  This file includes updated
## default and example configuration.
## IT IS ESSENTIAL THAT YOU UNDERSTAND THIS AND UPDATE YOUR CONFIGURATION
## if you are using CAS authentication in concert with Simple
## (uPortal-local-user) authentication.

##
##  CAS & Local Authentication
##  
##  The following is an example of configuring uPortal to use both CAS
##  and local user authentication (authentication by username and password
##  hash stored in the uPortal database).  It uses the UnionSecurityContext
##  to consider both these authentication methods and declares the required
##  tokens for all.  This approach requires the corresponding filter mappings
##  in web.xml (mapping both the CASValidateFilter and the StaticCasReceiptCacher
##  filter in front of the LoginServlet).
##
##  The bundled cas instance (http://localhost:8080/cas) also uses the user in
##  the uPortal database for authentication.
##

## This is the factory that supplies the concrete authentication class
root=org.jasig.portal.security.provider.UnionSecurityContextFactory
root.cas=org.jasig.portal.security.provider.cas.CasAssertionSecurityContextFactory
#root.cas=org.jasig.portal.security.provider.cas.clearpass.PasswordCachingCasAssertionSecurityContextFactory
root.simple=org.jasig.portal.security.provider.SimpleSecurityContextFactory

## principalToken and crednetialToken declare what tokens 
## are examined in the request for each context during authentication.
##
## A subcontext only needs to set its tokens 
## if it differs from those of the root context. (Tokens are inherited).
## The entries principalToken.root and credentialToken.root must be present,
## but they can be blank.

## WARNING
## THIS IS REALLY REALLY IMPORTANT.
## You MUST NOT set a principalToken on a CAS security context.
## You MUST NOT set a principalToken where it is not expected and needed.
## You MUST ONLY set a principalToken on a context that expects it, i.e.
## the SimpleSecurityContextFactory.
## Setting a principalToken on a root Union context with CAS as a subcontext
## has the effect of setting that principalToken on that CAS subcontext 
## AND YOU MUST NOT DO THAT.

## The UnionSecurityContext does not itself expect or need tokens and
## so should be configured not to have them, like this:
principalToken.root=
credentialToken.root=

## The SimpleSecurityContext expects a principal and credential token.
principalToken.root.simple=userName
credentialToken.root.simple=password

## Whereas one presents password credentials to the SimpleSecurityContext,
## one presents ticket credentials to a CAS security context.
credentialToken.root.cas=ticket

## Answers where the user will be redirected when log out occurs. Each security context can have one.
## (See comments in the LogoutController class)
## It would be better to escape the value of the url parameter, but since there are no parameters on the
## unescaped URL and since there are no further parameters on the logout URL, this does work.
logoutRedirect.root=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/logout?url=${environment.build.uportal.protocol}://${environment.build.uportal.server}${environment.build.uportal.context}/Login

## This is the factory that supplies the concrete authorization class
authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## Login URL, if specified the CLogin channel will display a Login link with
## this URL instead of the standard userName/password form.
org.jasig.portal.channels.CLogin.CasLoginUrl=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/login?service=${environment.build.uportal.protocol}://${environment.build.uportal.server}${environment.build.uportal.context}/Login

## URL of the CAS clearPass password service
org.jasig.portal.security.provider.cas.clearpass.PasswordCachingCasAssertionSecurityContextFactory.clearPassCasUrl=${environment.build.cas.protocol}://${environment.build.cas.server}/cas/clearPass

##
##  Local Only Authentication
##  
##  The following is an example of configuring uPortal local user authentication
##  (authentication by username and password hash stored in the uPortal database).
##
##  Comment out all other properties in this file and then uncomment the lines
##  prefixed with a single # below.
## 

## This is the factory that supplies the concrete authentication class
#root=org.jasig.portal.security.provider.SimpleSecurityContextFactory

## Answers what tokens are examined in the request for each context during authentication.
## WARNING: setting principalToken.root=userName is only okay because
## in this configuration root is the SimpleSecurityContextFactory AND
## there are no other security contexts in this configuration that would inherit
## that principalToken configuration.
#principalToken.root=userName
#credentialToken.root=password

## This is the factory that supplies the concrete authorization class
#authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## This property must be defined, but empty, when local-only authentication is used to satisfy bean configuration
## of RequireValidSessionFilter.java, or you can edit contexts/mvcContext.xml to not pass in this property
#org.jasig.portal.channels.CLogin.CasLoginUrl=


##
##  Multiple LDAP & Local Authentication
##  
##  The following is an example of configuring uPortal to use multiple LDAP
##  directories  and local user authentication (authentication by username and
##  password hash stored in the uPortal database).  It uses the UnionSecurityContext
##  to consider all authentication methods and declares the required tokens for all. 
##
##  Comment out all other properties in this file and then uncomment the lines
##  prefixed with a single # below.
## 

## This is the factory that supplies the concrete authentication class
#root=org.jasig.portal.security.provider.UnionSecurityContextFactory
#root.simple=org.jasig.portal.security.provider.SimpleSecurityContextFactory
#root.ldap_stu=org.jasig.portal.security.provider.SimpleLdapSecurityContextFactory
#root.ldap_fac=org.jasig.portal.security.provider.SimpleLdapSecurityContextFactory

## The following tells the SimpleLdapSecurityContextFactory with the similarly named
## property which named LDAP connection to use. Named LDAP connections are defined in
## properties/contexts/ldapContext.xml
#securityContextProperty.root.ldap_stu.connection=Students
#securityContextProperty.root.ldap_fac.connection=Faculty

## Answers what tokens are examined in the request for each context during authentication.
## WARNING - setting the root principalToken to userName
## WOULD NOT BE OKAY if a CAS security context were a sub-context of root.
#principalToken.root=userName
#credentialToken.root=password

## This is the factory that supplies the concrete authorization class
#authorizationProvider=org.jasig.portal.security.provider.AuthorizationServiceFactoryImpl

## This property must be defined, but empty, when local-only authentication is used to satisfy bean configuration
## of RequireValidSessionFilter.java, or you can edit contexts/mvcContext.xml to not pass in this property
#org.jasig.portal.channels.CLogin.CasLoginUrl=
{'fraction_non_alphanumeric': 0.07298317885341572, 'fraction_numerical': 0.0021970477171301063, 'mean_word_length': 5.514311270125224, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 2, 'xml': 8}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2274862', 'n_tokens_mistral': 3700, 'n_tokens_neox': 3636, 'n_words': 1470}