<?xml version="1.0" encoding="UTF-8"?>
<!--
  - Application context containing authentication, channel
  - security and web URI beans.
  -
  - Only used by "filter" artifact.
  -
  -->

<b:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:b="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled">
        <expression-handler ref="expressionHandler"/>
    </global-method-security>

    <http realm="Contacts Realm">
        <intercept-url pattern="/" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <intercept-url pattern="/hello.htm" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <intercept-url pattern="/switchuser.jsp" access="ROLE_SUPERVISOR"/>
        <intercept-url pattern="/j_spring_security_switch_user" access="ROLE_SUPERVISOR"/>
        <intercept-url pattern="/**" access="ROLE_USER"/>

        <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"/>
        <http-basic/>
        <logout logout-success-url="/index.jsp"/>
        <remember-me />
        <custom-filter ref="switchUserProcessingFilter" position="SWITCH_USER_FILTER"/>
    </http>

    <authentication-manager>
        <authentication-provider>
           <password-encoder hash="md5"/>
           <jdbc-user-service data-source-ref="dataSource"/>
        </authentication-provider>
    </authentication-manager>

    <!-- Automatically receives AuthenticationEvent messages -->
    <b:bean id="loggerListener" class="org.springframework.security.authentication.event.LoggerListener"/>

    <!-- Filter used to switch the user context. Note: the switch and exit url must be secured
        based on the role granted the ability to 'switch' to another user -->
    <!-- In this example 'rod' has ROLE_SUPERVISOR that can switch to regular ROLE_USER(s) -->
    <b:bean id="switchUserProcessingFilter" class="org.springframework.security.web.authentication.switchuser.SwitchUserFilter" autowire="byType">
       <b:property name="targetUrl" value="/secure/index.htm"/>
    </b:bean>

    <b:bean id="expressionHandler" class="org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler">
        <b:property name="permissionEvaluator" ref="permissionEvaluator"/>
    </b:bean>

    <b:bean id="permissionEvaluator" class="org.springframework.security.acls.AclPermissionEvaluator">
        <b:constructor-arg ref="aclService"/>
    </b:bean>
</b:beans>
