<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<http pattern="/login.jsp" security="none" />

	<http entry-point-ref="aep" use-expressions="false">
		<intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />

		<session-management session-authentication-strategy-ref="sas"/>
		<logout />

		<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
		<custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" />

		<csrf disabled="true"/>
	</http>

	<beans:bean id="aep" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
		<beans:constructor-arg value="/login.jsp" />
	</beans:bean>

	<beans:bean id="myAuthFilter" class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
		<beans:property name="sessionAuthenticationStrategy" ref="sas" />
		<beans:property name="authenticationManager" ref="authenticationManager" />
	</beans:bean>

	<beans:bean id="concurrencyFilter" class="org.springframework.security.web.session.ConcurrentSessionFilter">
		<beans:constructor-arg ref="sessionRegistry" />
		<beans:constructor-arg value="/session-expired.htm" />
	</beans:bean>

	<beans:bean id="sas" class="org.springframework.security.web.authentication.session.CompositeSessionAuthenticationStrategy">
		<beans:constructor-arg>
			<beans:list>
				<beans:bean class="org.springframework.security.web.authentication.session.ConcurrentSessionControlAuthenticationStrategy">
					<beans:constructor-arg ref="sessionRegistry"/>
					<beans:property name="maximumSessions" value="1" />
					<beans:property name="exceptionIfMaximumExceeded" value="true" />
				</beans:bean>
				<beans:bean class="org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy">
				</beans:bean>
				<beans:bean class="org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy">
					<beans:constructor-arg ref="sessionRegistry"/>
				</beans:bean>
			</beans:list>
		</beans:constructor-arg>
	</beans:bean>

	<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />

</beans:beans>
