<!-- For deployment-time modifications ensure that you are editing greenstone3.xml.in, found in resources/tomcat. -->
<!-- set allowLinking to true if you want to use symlinks to files or directories outside the docBase directory -->
<!-- set reloadable to false for a production version. if true, automatically reloads the webapp if it detects changes in classes or lib directories -->
<!-- see http://tomcat.apache.org/tomcat-8.5-doc/config/context.html for more Context attributes -->
		
<Context
	docBase="@gsdl3webwritablehome@" 
	reloadable="true" 
	privileged="true"
	xmlBlockExternal="false">

  <!-- if greenstone is to be run in an iframe, need to use the -->
  <!-- sameSiteCookies=none version of the CookieProcessor -->
        <!--<CookieProcessor sameSiteCookies="none" partitioned="true"/>-->
        <CookieProcessor sameSiteCookies="strict"/>
        
	<!-- increase the cacheMaxSize if you get errors like the following in packages/tomcat/logs/catalina.out-->
	<!-- org.apache.catalina.webresources.Cache.getResource Unable to add the resource at [... class name ...] to the cache for web application [/greenstone3] because there was insufficient free space available after evicting expired cache entries - consider increasing the maximum size of the cache -->
	<Resources allowLinking="@allowlinking@" cacheMaxSize="51200">
          <PostResources base="@gsdl3webhome@/interfaces"
                         webAppMount="/interfaces"
                         className="org.apache.catalina.webresources.DirResourceSet"/>
          <PostResources base="@gsdl3webhome@/sites"
                         webAppMount="/sites"
                         className="org.apache.catalina.webresources.DirResourceSet"/>
        </Resources>

	<!--
		For embedded derby db:
		driverName="org.apache.derby.jdbc.EmbeddedDriver"
		connectionURL="jdbc:derby:@gsdl3webhome@/etc/usersDB"
	-->
	<!--
		JNDI resources require the validationQuery parameter if you are using validations (which we are).
		A list of values for this parameter, depending on your database driver, can be found here:
		https://stackoverflow.com/questions/10684244/dbcp-validationquery-for-different-databases
		For more info about why you need the parameter value, see here:
		https://stackoverflow.com/a/41232124

		Because the derby networked server is now launched with the
		derby.system.home JAVA_OPT property set to the folder containing
		usersDB, we don't need url set to the full GS3 path to the usersDB.
	-->

    <Resource 
        name="jdbc/realmGSDL3"
        auth="Container"
        type="javax.sql.DataSource"
        maxTotal="10"
        maxIdle="4"
        maxWaitMillis="10000"
	validationQuery="values 1"
        driverClassName="org.apache.derby.jdbc.ClientDriver"
        url="jdbc:derby://@derbyserver@:@derbyserverport@/usersDB"
	/>

<!--    <Resource
	name="jdbc/realmWordpress"
	auth="Container"
        type="javax.sql.DataSource"
        factory="org.apache.tomcat.jdbc.pool.DataSourceFactory"
        driverClassName="com.mysql.cj.jdbc.Driver"
        url="jdbc:mysql://localhost:3306/wordpress?useUnicode=true&amp;characterEncoding=utf8&amp;useSSL=false&amp;serverTimezone=UTC"
        username="wp_dbuser"
        password="changeme"
        maxTotal="50" maxIdle="10" maxWaitMillis="10000"
	/>
    -->   
    <Realm className="org.apache.catalina.realm.LockOutRealm">

      <!-- The follow Realm JDBC connects to Greenstone's internal userDatabase -->
      <Realm
	  className="org.greenstone.gsdl3.GoogleSigninJDBCRealm"
	  dataSourceName="jdbc/realmGSDL3"
	  userTable="USERS" userNameCol="USERNAME" userCredCol="PASSWORD"
	  userRoleTable="ROLES" roleNameCol="ROLE"
	  userEmailCol="email"
	  googlesigninClientId="@googlesigninclientid@"
	  localDataSource="true"
	  >
	<CredentialHandler className="org.greenstone.gsdl3.auth.realm.GreenstoneCredentialHandler"/>	  
      </Realm>

      <!-- The following Realm JDBC connects to the MySQL (e.g. MariaDB) database that a WordPress
	   installation operates.  To operate, comment out the Greenstone userDatabase realm
	   and uncomment the following.
	   
	   You will also want to review the <Resource> element above, and set the credentials
	   (username and password) that have been setup for the WordPress Database 
      -->
      
      <!--
      <Realm
	  className="org.greenstone.gsdl3.GoogleSigninJDBCRealm"
	  dataSourceName="jdbc/realmWordpress"
	     userTable="wp_users" userNameCol="user_login" userCredCol="user_pass"
	     userRoleTable="wp_user_roles" userRoleNameCol="user_name" roleNameCol="role"
	     userEmailCol="email"
	     googlesigninClientId="@googlesigninclientid@"
	     localDataSource="true"
	     >
	<CredentialHandler className="org.greenstone.gsdl3.auth.realm.WordpressCredentialHandler"/>
      </Realm>
      -->
            
    </Realm>

        <!-- Session Manager. Default values are used. See
	     packages/tomcat/webapps/docs/config/manager.html for more info.
	     Pathname may be absolute, or relative to greenstone3 context work 
	     directory: packages/tomcat/work/Catalina/localhost/greenstone3.
	     Set pathname="" to disable storing session info between restarts. 
	     To manually clear session info, stop Tomcat and delete the session
	     file. -->
	<Manager pathname="SESSIONS.ser" />

	<!-- Allow all machines or just this machine: 127.0.0.1 (IPv4) and 0:0:0:0:0:0:0:1 (IPv6, needed on windows)
	     https://tomcat.apache.org/tomcat-7.0-doc/config/valve.html -->
	<Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="@allowedIPs@"/>

	<!-- Allows us to include the file:
	       <GSDL3SRCHOME>/web/WEB-INF/rewrite.config
	     Currently used (by default) to monitor for GS3 DL calls that use:
	       &href=... and rl=0 ...
	     and rewrite them so they are forbidden by the server.
	     This is because malicious users can use this form of CGI URL supported by Greenstone3
	     to mount an Open Redirect attack -->
	<Valve className="org.apache.catalina.valves.rewrite.RewriteValve"/>
	
</Context>
