SEC-1168: Added filter-security-metadat-source to namespace.

config/src/main/java/org/springframework/security/config/Elements.java

@@ -44,6 +44,8 @@ public abstract class Elements {
     public static final String CUSTOM_AUTH_PROVIDER = "custom-authentication-provider";
     public static final String CUSTOM_AFTER_INVOCATION_PROVIDER = "custom-after-invocation-provider";
     public static final String X509 = "x509";
+    public static final String FILTER_SECURITY_METADATA_SOURCE = "filter-security-metadata-source";
+    @Deprecated
     public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
     public static final String LDAP_PASSWORD_COMPARE = "password-compare";
 }

config/src/main/java/org/springframework/security/config/HttpSecurityBeanDefinitionParser.java

@@ -409,8 +409,7 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
             new DefaultFilterInvocationSecurityMetadataSource(matcher, channelRequestMap);
         channelFilterInvDefSource.setStripQueryStringFromUrls(matcher instanceof AntUrlPathMatcher);
 
-        channelFilter.getPropertyValues().addPropertyValue("filterInvocationSecurityMetadataSource",
-                channelFilterInvDefSource);
+        channelFilter.getPropertyValues().addPropertyValue("securityMetadataSource", channelFilterInvDefSource);
         RootBeanDefinition channelDecisionManager = new RootBeanDefinition(ChannelDecisionManagerImpl.class);
         ManagedList channelProcessors = new ManagedList(3);
         RootBeanDefinition secureChannelProcessor = new RootBeanDefinition(SecureChannelProcessor.class);

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -12,6 +12,7 @@ import org.springframework.beans.factory.xml.NamespaceHandlerSupport;
  */
 public class SecurityNamespaceHandler extends NamespaceHandlerSupport {
 
+    @SuppressWarnings("deprecation")
     public void init() {
         // Parsers
         registerBeanDefinitionParser(Elements.LDAP_PROVIDER, new LdapProviderBeanDefinitionParser());
@@ -24,12 +25,13 @@ public class SecurityNamespaceHandler extends NamespaceHandlerSupport {
         registerBeanDefinitionParser(Elements.GLOBAL_METHOD_SECURITY, new GlobalMethodSecurityBeanDefinitionParser());
         registerBeanDefinitionParser(Elements.AUTHENTICATION_MANAGER, new AuthenticationManagerBeanDefinitionParser());
         registerBeanDefinitionParser(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceBeanDefinitionParser());
+        registerBeanDefinitionParser(Elements.FILTER_SECURITY_METADATA_SOURCE, new FilterInvocationSecurityMetadataSourceBeanDefinitionParser());
 
         // Decorators
         registerBeanDefinitionDecorator(Elements.INTERCEPT_METHODS, new InterceptMethodsBeanDefinitionDecorator());
         registerBeanDefinitionDecorator(Elements.FILTER_CHAIN_MAP, new FilterChainMapBeanDefinitionDecorator());
         registerBeanDefinitionDecorator(Elements.CUSTOM_FILTER, new OrderedFilterBeanDefinitionDecorator());
         registerBeanDefinitionDecorator(Elements.CUSTOM_AUTH_PROVIDER, new CustomAuthenticationProviderBeanDefinitionDecorator());
-        registerBeanDefinitionDecorator(Elements.CUSTOM_AFTER_INVOCATION_PROVIDER, new CustomAfterInvocationProviderBeanDefinitionDecorator());        
+        registerBeanDefinitionDecorator(Elements.CUSTOM_AFTER_INVOCATION_PROVIDER, new CustomAfterInvocationProviderBeanDefinitionDecorator());
     }
 }

config/src/main/resources/org/springframework/security/config/spring-security-3.0.rnc

@@ -367,20 +367,24 @@ filter-chain.attlist &=
 filter-chain.attlist &=
     attribute filters {xsd:token}
 
-filter-invocation-definition-source =
-    ## Used to explicitly configure a FilterInvocationDefinitionSource bean for use with a FilterSecurityInterceptor. Usually only needed if you are configuring a FilterChainProxy explicitly, rather than using the <http> element. The intercept-url elements used should only contain pattern, method and access attributes. Any others will result in a configuration error. 
-    element filter-invocation-definition-source {fids.attlist, intercept-url+}
-fids.attlist &=
+filter-security-metadata-source =
+    ## Used to explicitly configure a FilterSecurityMetadataSource bean for use with a FilterSecurityInterceptor. Usually only needed if you are configuring a FilterChainProxy explicitly, rather than using the <http> element. The intercept-url elements used should only contain pattern, method and access attributes. Any others will result in a configuration error. 
+    element filter-security-metadata-source {fsmds.attlist, intercept-url+}
+fsmds.attlist &=
     use-expressions?
-fids.attlist &=
+fsmds.attlist &=
     id?
-fids.attlist &=
+fsmds.attlist &=
     ## as for http element
     attribute lowercase-comparisons {boolean}?
-fids.attlist &=
+fsmds.attlist &=
     ## as for http element
     path-type?
 
+filter-invocation-definition-source = 
+    ## Deprecated synonym for filter-security-metadata-source
+    element filter-invocation-definition-source {fsmds.attlist, intercept-url+}
+
 http-basic =
     ## Adds support for basic authentication (this is an element to permit future expansion, such as supporting an "ignoreFailure" attribute)
     element http-basic {empty}

config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd

@@ -1,1636 +1,1671 @@
 <?xml version="1.0" encoding="utf-8"?>
 <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
-  xmlns:security="http://www.springframework.org/schema/security" elementFormDefault="qualified"
-  targetNamespace="http://www.springframework.org/schema/security">
-  <xs:attributeGroup name="hash">
-    <xs:attribute name="hash" use="required">
-      <xs:annotation>
-        <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
-          strongly against using MD4, as it is a very weak hashing algorithm.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="plaintext"/>
-          <xs:enumeration value="sha"/>
-          <xs:enumeration value="sha-256"/>
-          <xs:enumeration value="md5"/>
-          <xs:enumeration value="md4"/>
-          <xs:enumeration value="{sha}"/>
-          <xs:enumeration value="{ssha}"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="base64">
-    <xs:attribute name="base64" use="required">
-      <xs:annotation>
-        <xs:documentation>Whether a string should be base64 encoded</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="true"/>
-          <xs:enumeration value="false"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="path-type">
-    <xs:attribute name="path-type" use="required">
-      <xs:annotation>
-        <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
-          1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
-          unspecified.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="ant"/>
-          <xs:enumeration value="regex"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="port">
-    <xs:attribute name="port" use="required" type="xs:positiveInteger">
-      <xs:annotation>
-        <xs:documentation>Specifies an IP port number. Used to configure an embedded LDAP server,
-          for example.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="url">
-    <xs:attribute name="url" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Specifies a URL.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="id">
-    <xs:attribute name="id" use="required" type="xs:ID">
-      <xs:annotation>
-        <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-          context.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="ref">
-    <xs:attribute name="ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="cache-ref">
-    <xs:attribute name="cache-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a cache for use with a
-          UserDetailsService.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="user-service-ref">
-    <xs:attribute name="user-service-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to a user-service (or UserDetailsService bean)
-          Id</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="data-source-ref">
-    <xs:attribute name="data-source-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to a DataSource bean</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="password-encoder.attlist">
-    <xs:attribute name="ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="hash">
-      <xs:annotation>
-        <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
-          strongly against using MD4, as it is a very weak hashing algorithm.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="plaintext"/>
-          <xs:enumeration value="sha"/>
-          <xs:enumeration value="sha-256"/>
-          <xs:enumeration value="md5"/>
-          <xs:enumeration value="md4"/>
-          <xs:enumeration value="{sha}"/>
-          <xs:enumeration value="{ssha}"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="base64">
-      <xs:annotation>
-        <xs:documentation>Whether a string should be base64 encoded</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="true"/>
-          <xs:enumeration value="false"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="user-property">
-    <xs:attribute name="user-property" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A property of the UserDetails object which will be used as salt by a
-          password encoder. Typically something like "username" might be used. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="system-wide">
-    <xs:attribute name="system-wide" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A single value that will be used as the salt for a password encoder.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:simpleType name="boolean">
-    <xs:restriction base="xs:token">
-      <xs:enumeration value="true"/>
-      <xs:enumeration value="false"/>
-    </xs:restriction>
-  </xs:simpleType>
-  <xs:attributeGroup name="role-prefix">
-    <xs:attribute name="role-prefix" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A non-empty string prefix that will be added to role strings loaded from
-          persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the
-          default is non-empty.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="use-expressions">
-    <xs:attribute name="use-expressions" use="required" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Enables the use of expressions in the 'access' attributes in
-          &lt;intercept-url&gt; elements rather than the traditional list of configuration
-          attributes. Defaults to 'false'. If enabled, each attribute should contain a single
-          boolean expression. If the expression evaluates to 'true', access will be granted.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="ldap-server">
-    <xs:annotation>
-      <xs:documentation>Defines an LDAP server location or starts an embedded server. The url
-        indicates the location of a remote server. If no url is given, an embedded server will be
-        started, listening on the supplied port number. The port is optional and defaults to 33389.
-        A Spring LDAP ContextSource bean will be registered for the server with the id supplied.
-      </xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attributeGroup ref="security:ldap-server.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="ldap-server.attlist">
-    <xs:attribute name="id" type="xs:ID">
-      <xs:annotation>
-        <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-          context.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Specifies a URL.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="port" type="xs:positiveInteger">
-      <xs:annotation>
-        <xs:documentation>Specifies an IP port number. Used to configure an embedded LDAP server,
-          for example.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="manager-dn" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>Username (DN) of the "manager" user identity which will be used to
-          authenticate to a (non-embedded) LDAP server. If omitted, anonymous access will be used.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="manager-password" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>The password for the manager DN.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="ldif" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>Explicitly specifies an ldif file resource to load into an embedded LDAP
-          server</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="root" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>Optional root suffix for the embedded LDAP server. Default is
-          "dc=springframework,dc=org"</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="ldap-server-ref-attribute">
-    <xs:attribute name="server-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
-          registered (using &lt;ldap-server&gt; with no Id), that server will be used.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="group-search-filter-attribute">
-    <xs:attribute name="group-search-filter" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
-          parameter is the DN of the user.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="group-search-base-attribute">
-    <xs:attribute name="group-search-base" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for group membership searches. Defaults to "" (searching from
-          the root).</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="user-search-filter-attribute">
-    <xs:attribute name="user-search-filter" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP filter used to search for users (optional). For example
-          "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="user-search-base-attribute">
-    <xs:attribute name="user-search-base" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for user searches. Defaults to "". Only used with a
-          'user-search-filter'.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="group-role-attribute-attribute">
-    <xs:attribute name="group-role-attribute" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP attribute name which contains the role name which will be used
-          within Spring Security. Defaults to "cn".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="user-details-class-attribute">
-    <xs:attribute name="user-details-class" use="required">
-      <xs:annotation>
-        <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
-          framework will attempt to load standard attributes for the defined class into the returned
-          UserDetails object</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="person"/>
-          <xs:enumeration value="inetOrgPerson"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="ldap-user-service" substitutionGroup="security:any-user-service">
-    <xs:complexType>
-      <xs:attributeGroup ref="security:ldap-us.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="ldap-us.attlist">
-    <xs:attribute name="id" type="xs:ID">
-      <xs:annotation>
-        <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-          context.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="server-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
-          registered (using &lt;ldap-server&gt; with no Id), that server will be used.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-search-filter" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP filter used to search for users (optional). For example
-          "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-search-base" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for user searches. Defaults to "". Only used with a
-          'user-search-filter'.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-search-filter" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
-          parameter is the DN of the user.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-search-base" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for group membership searches. Defaults to "" (searching from
-          the root).</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-role-attribute" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP attribute name which contains the role name which will be used
-          within Spring Security. Defaults to "cn".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="cache-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a cache for use with a
-          UserDetailsService.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="role-prefix" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A non-empty string prefix that will be added to role strings loaded from
-          persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the
-          default is non-empty.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-details-class">
-      <xs:annotation>
-        <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
-          framework will attempt to load standard attributes for the defined class into the returned
-          UserDetails object</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="person"/>
-          <xs:enumeration value="inetOrgPerson"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="ldap-authentication-provider">
-    <xs:annotation>
-      <xs:documentation>Sets up an ldap authentication provider</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element minOccurs="0" name="password-compare">
-          <xs:annotation>
-            <xs:documentation>Specifies that an LDAP provider should use an LDAP compare operation
-              of the user's password to authenticate the user</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:sequence>
-              <xs:element minOccurs="0" name="password-encoder">
-                <xs:annotation>
-                  <xs:documentation>element which defines a password encoding strategy. Used by an
-                    authentication provider to convert submitted passwords to hashed versions, for
-                    example.</xs:documentation>
-                </xs:annotation>
-                <xs:complexType>
+   xmlns:security="http://www.springframework.org/schema/security" elementFormDefault="qualified"
+   targetNamespace="http://www.springframework.org/schema/security">
+   <xs:attributeGroup name="hash">
+      <xs:attribute name="hash" use="required">
+         <xs:annotation>
+            <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
+               strongly against using MD4, as it is a very weak hashing
+               algorithm.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="plaintext"/>
+               <xs:enumeration value="sha"/>
+               <xs:enumeration value="sha-256"/>
+               <xs:enumeration value="md5"/>
+               <xs:enumeration value="md4"/>
+               <xs:enumeration value="{sha}"/>
+               <xs:enumeration value="{ssha}"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="base64">
+      <xs:attribute name="base64" use="required">
+         <xs:annotation>
+            <xs:documentation>Whether a string should be base64 encoded</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="true"/>
+               <xs:enumeration value="false"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="path-type">
+      <xs:attribute name="path-type" use="required">
+         <xs:annotation>
+            <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
+               1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
+               unspecified.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="ant"/>
+               <xs:enumeration value="regex"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="port">
+      <xs:attribute name="port" use="required" type="xs:positiveInteger">
+         <xs:annotation>
+            <xs:documentation>Specifies an IP port number. Used to configure an embedded LDAP
+               server, for example.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="url">
+      <xs:attribute name="url" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Specifies a URL.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="id">
+      <xs:attribute name="id" use="required" type="xs:ID">
+         <xs:annotation>
+            <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+               context.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="ref">
+      <xs:attribute name="ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="cache-ref">
+      <xs:attribute name="cache-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a cache for use with a
+               UserDetailsService.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="user-service-ref">
+      <xs:attribute name="user-service-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a user-service (or UserDetailsService bean)
+               Id</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="data-source-ref">
+      <xs:attribute name="data-source-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a DataSource bean</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="password-encoder.attlist">
+      <xs:attribute name="ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="hash">
+         <xs:annotation>
+            <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
+               strongly against using MD4, as it is a very weak hashing
+               algorithm.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="plaintext"/>
+               <xs:enumeration value="sha"/>
+               <xs:enumeration value="sha-256"/>
+               <xs:enumeration value="md5"/>
+               <xs:enumeration value="md4"/>
+               <xs:enumeration value="{sha}"/>
+               <xs:enumeration value="{ssha}"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="base64">
+         <xs:annotation>
+            <xs:documentation>Whether a string should be base64 encoded</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="true"/>
+               <xs:enumeration value="false"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="user-property">
+      <xs:attribute name="user-property" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A property of the UserDetails object which will be used as salt by a
+               password encoder. Typically something like "username" might be used.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="system-wide">
+      <xs:attribute name="system-wide" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A single value that will be used as the salt for a password encoder.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:simpleType name="boolean">
+      <xs:restriction base="xs:token">
+         <xs:enumeration value="true"/>
+         <xs:enumeration value="false"/>
+      </xs:restriction>
+   </xs:simpleType>
+   <xs:attributeGroup name="role-prefix">
+      <xs:attribute name="role-prefix" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A non-empty string prefix that will be added to role strings loaded
+               from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases
+               where the default is non-empty.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="use-expressions">
+      <xs:attribute name="use-expressions" use="required" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Enables the use of expressions in the 'access' attributes in
+               &lt;intercept-url&gt; elements rather than the traditional list of
+               configuration attributes. Defaults to 'false'. If enabled, each attribute should
+               contain a single boolean expression. If the expression evaluates to 'true', access
+               will be granted. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="ldap-server">
+      <xs:annotation>
+         <xs:documentation>Defines an LDAP server location or starts an embedded server. The url
+            indicates the location of a remote server. If no url is given, an embedded server will
+            be started, listening on the supplied port number. The port is optional and defaults to
+            33389. A Spring LDAP ContextSource bean will be registered for the server with the id
+            supplied. </xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:attributeGroup ref="security:ldap-server.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="ldap-server.attlist">
+      <xs:attribute name="id" type="xs:ID">
+         <xs:annotation>
+            <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+               context.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Specifies a URL.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="port" type="xs:positiveInteger">
+         <xs:annotation>
+            <xs:documentation>Specifies an IP port number. Used to configure an embedded LDAP
+               server, for example.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="manager-dn" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>Username (DN) of the "manager" user identity which will be used to
+               authenticate to a (non-embedded) LDAP server. If omitted, anonymous access will be
+               used. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="manager-password" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>The password for the manager DN.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="ldif" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>Explicitly specifies an ldif file resource to load into an embedded
+               LDAP server</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="root" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>Optional root suffix for the embedded LDAP server. Default is
+               "dc=springframework,dc=org"</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="ldap-server-ref-attribute">
+      <xs:attribute name="server-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
+               registered (using &lt;ldap-server&gt; with no Id), that server will be used.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="group-search-filter-attribute">
+      <xs:attribute name="group-search-filter" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
+               parameter is the DN of the user.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="group-search-base-attribute">
+      <xs:attribute name="group-search-base" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for group membership searches. Defaults to "" (searching
+               from the root).</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="user-search-filter-attribute">
+      <xs:attribute name="user-search-filter" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP filter used to search for users (optional). For example
+               "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="user-search-base-attribute">
+      <xs:attribute name="user-search-base" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for user searches. Defaults to "". Only used with a
+               'user-search-filter'.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="group-role-attribute-attribute">
+      <xs:attribute name="group-role-attribute" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP attribute name which contains the role name which will be
+               used within Spring Security. Defaults to "cn".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="user-details-class-attribute">
+      <xs:attribute name="user-details-class" use="required">
+         <xs:annotation>
+            <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
+               framework will attempt to load standard attributes for the defined class into the
+               returned UserDetails object</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="person"/>
+               <xs:enumeration value="inetOrgPerson"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="ldap-user-service" substitutionGroup="security:any-user-service">
+      <xs:complexType>
+         <xs:attributeGroup ref="security:ldap-us.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="ldap-us.attlist">
+      <xs:attribute name="id" type="xs:ID">
+         <xs:annotation>
+            <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+               context.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="server-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
+               registered (using &lt;ldap-server&gt; with no Id), that server will be used.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-search-filter" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP filter used to search for users (optional). For example
+               "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-search-base" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for user searches. Defaults to "". Only used with a
+               'user-search-filter'.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-search-filter" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
+               parameter is the DN of the user.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-search-base" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for group membership searches. Defaults to "" (searching
+               from the root).</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-role-attribute" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP attribute name which contains the role name which will be
+               used within Spring Security. Defaults to "cn".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="cache-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a cache for use with a
+               UserDetailsService.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="role-prefix" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A non-empty string prefix that will be added to role strings loaded
+               from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases
+               where the default is non-empty.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-details-class">
+         <xs:annotation>
+            <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
+               framework will attempt to load standard attributes for the defined class into the
+               returned UserDetails object</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="person"/>
+               <xs:enumeration value="inetOrgPerson"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="ldap-authentication-provider">
+      <xs:annotation>
+         <xs:documentation>Sets up an ldap authentication provider</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element minOccurs="0" name="password-compare">
+               <xs:annotation>
+                  <xs:documentation>Specifies that an LDAP provider should use an LDAP compare
+                     operation of the user's password to authenticate the user</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
                   <xs:sequence>
-                    <xs:element minOccurs="0" name="salt-source">
-                      <xs:annotation>
-                        <xs:documentation>Password salting strategy. A system-wide constant or a
-                          property from the UserDetails object can be used.</xs:documentation>
-                      </xs:annotation>
-                      <xs:complexType>
-                        <xs:attribute name="user-property" type="xs:token">
-                          <xs:annotation>
-                            <xs:documentation>A property of the UserDetails object which will be
-                              used as salt by a password encoder. Typically something like
-                              "username" might be used. </xs:documentation>
-                          </xs:annotation>
-                        </xs:attribute>
-                        <xs:attribute name="system-wide" type="xs:token">
-                          <xs:annotation>
-                            <xs:documentation>A single value that will be used as the salt for a
-                              password encoder. </xs:documentation>
-                          </xs:annotation>
-                        </xs:attribute>
-                        <xs:attribute name="ref" type="xs:token">
-                          <xs:annotation>
-                            <xs:documentation>Defines a reference to a Spring bean
-                              Id.</xs:documentation>
-                          </xs:annotation>
-                        </xs:attribute>
-                      </xs:complexType>
-                    </xs:element>
+                     <xs:element minOccurs="0" name="password-encoder">
+                        <xs:annotation>
+                           <xs:documentation>element which defines a password encoding strategy.
+                              Used by an authentication provider to convert submitted passwords to
+                              hashed versions, for example.</xs:documentation>
+                        </xs:annotation>
+                        <xs:complexType>
+                           <xs:sequence>
+                              <xs:element minOccurs="0" name="salt-source">
+                                 <xs:annotation>
+                                    <xs:documentation>Password salting strategy. A system-wide
+                                       constant or a property from the UserDetails object can be
+                                       used.</xs:documentation>
+                                 </xs:annotation>
+                                 <xs:complexType>
+                                    <xs:attribute name="user-property" type="xs:token">
+                                       <xs:annotation>
+                                          <xs:documentation>A property of the UserDetails object
+                                             which will be used as salt by a password encoder.
+                                             Typically something like "username" might be used.
+                                          </xs:documentation>
+                                       </xs:annotation>
+                                    </xs:attribute>
+                                    <xs:attribute name="system-wide" type="xs:token">
+                                       <xs:annotation>
+                                          <xs:documentation>A single value that will be used as the
+                                             salt for a password encoder. </xs:documentation>
+                                       </xs:annotation>
+                                    </xs:attribute>
+                                    <xs:attribute name="ref" type="xs:token">
+                                       <xs:annotation>
+                                          <xs:documentation>Defines a reference to a Spring bean
+                                             Id.</xs:documentation>
+                                       </xs:annotation>
+                                    </xs:attribute>
+                                 </xs:complexType>
+                              </xs:element>
+                           </xs:sequence>
+                           <xs:attributeGroup ref="security:password-encoder.attlist"/>
+                        </xs:complexType>
+                     </xs:element>
                   </xs:sequence>
-                  <xs:attributeGroup ref="security:password-encoder.attlist"/>
-                </xs:complexType>
-              </xs:element>
-            </xs:sequence>
-            <xs:attributeGroup ref="security:password-compare.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:sequence>
-      <xs:attributeGroup ref="security:ldap-ap.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="ldap-ap.attlist">
-    <xs:attribute name="server-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
-          registered (using &lt;ldap-server&gt; with no Id), that server will be used.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-search-base" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for user searches. Defaults to "". Only used with a
-          'user-search-filter'.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-search-filter" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP filter used to search for users (optional). For example
-          "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-search-base" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Search base for group membership searches. Defaults to "" (searching from
-          the root).</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-search-filter" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
-          parameter is the DN of the user.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-role-attribute" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The LDAP attribute name which contains the role name which will be used
-          within Spring Security. Defaults to "cn".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-dn-pattern" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A specific pattern used to build the user's DN, for example
-          "uid={0},ou=people". The key "{0}" must be present and will be substituted with the
-          username.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="role-prefix" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A non-empty string prefix that will be added to role strings loaded from
-          persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the
-          default is non-empty.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-details-class">
-      <xs:annotation>
-        <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
-          framework will attempt to load standard attributes for the defined class into the returned
-          UserDetails object</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="person"/>
-          <xs:enumeration value="inetOrgPerson"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="password-compare.attlist">
-    <xs:attribute name="password-attribute" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The attribute in the directory which contains the user password. Defaults
-          to "userPassword".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="hash">
-      <xs:annotation>
-        <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
-          strongly against using MD4, as it is a very weak hashing algorithm.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="plaintext"/>
-          <xs:enumeration value="sha"/>
-          <xs:enumeration value="sha-256"/>
-          <xs:enumeration value="md5"/>
-          <xs:enumeration value="md4"/>
-          <xs:enumeration value="{sha}"/>
-          <xs:enumeration value="{ssha}"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="intercept-methods">
-    <xs:annotation>
-      <xs:documentation>Can be used inside a bean definition to add a security interceptor to the
-        bean and set up access configuration attributes for the bean's methods</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element maxOccurs="unbounded" name="protect">
-          <xs:annotation>
-            <xs:documentation>Defines a protected method and the access control configuration
-              attributes that apply to it. We strongly advise you NOT to mix "protect" declarations
-              with any services provided "global-method-security".</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:protect.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:sequence>
-      <xs:attributeGroup ref="security:intercept-methods.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="intercept-methods.attlist">
-    <xs:attribute name="access-decision-manager-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Optional AccessDecisionManager bean ID to be used by the created method
-          security interceptor.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="protect.attlist">
-    <xs:attribute name="method" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A method name</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="access" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Access configuration attributes list that applies to the method, e.g.
-          "ROLE_A,ROLE_B".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="global-method-security">
-    <xs:annotation>
-      <xs:documentation>Provides method security for all beans registered in the Spring application
-        context. Specifically, beans will be scanned for matches with the ordered list of
-        "protect-pointcut" sub-elements, Spring Security annotations and/or. Where there is a match,
-        the beans will automatically be proxied and security authorization applied to the methods
-        accordingly. If you use and enable all four sources of method security metadata (ie
-        "protect-pointcut" declarations, expression annotations, @Secured and also JSR250 security
-        annotations), the metadata sources will be queried in that order. In practical terms, this
-        enables you to use XML to override method security metadata expressed in annotations. If
-        using annotations, the order of precedence is EL-based (@PreAuthorize etc.), @Secured and
-        finally JSR-250.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:sequence>
-        <xs:choice minOccurs="0">
-          <xs:element name="pre-post-annotation-handling">
-            <xs:annotation>
-              <xs:documentation>Allows the default expression-based mechanism for handling Spring
-                Security's pre and post invocation annotations (@PreFilter, @PreAuthorize,
-                @PostFilter, @PostAuthorize) to be replace entirely. Only applies if these
-                annotations are enabled. </xs:documentation>
-            </xs:annotation>
-            <xs:complexType>
-              <xs:sequence>
-                <xs:element name="invocation-attribute-factory">
+                  <xs:attributeGroup ref="security:password-compare.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:ldap-ap.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="ldap-ap.attlist">
+      <xs:attribute name="server-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The optional server to use. If omitted, and a default LDAP server is
+               registered (using &lt;ldap-server&gt; with no Id), that server will be used.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-search-base" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for user searches. Defaults to "". Only used with a
+               'user-search-filter'.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-search-filter" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP filter used to search for users (optional). For example
+               "(uid={0})". The substituted parameter is the user's login name.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-search-base" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Search base for group membership searches. Defaults to "" (searching
+               from the root).</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-search-filter" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Group search filter. Defaults to (uniqueMember={0}). The substituted
+               parameter is the DN of the user.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-role-attribute" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The LDAP attribute name which contains the role name which will be
+               used within Spring Security. Defaults to "cn".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-dn-pattern" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A specific pattern used to build the user's DN, for example
+               "uid={0},ou=people". The key "{0}" must be present and will be substituted with the
+               username.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="role-prefix" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A non-empty string prefix that will be added to role strings loaded
+               from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases
+               where the default is non-empty.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-details-class">
+         <xs:annotation>
+            <xs:documentation>Allows the objectClass of the user entry to be specified. If set, the
+               framework will attempt to load standard attributes for the defined class into the
+               returned UserDetails object</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="person"/>
+               <xs:enumeration value="inetOrgPerson"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="password-compare.attlist">
+      <xs:attribute name="password-attribute" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The attribute in the directory which contains the user password.
+               Defaults to "userPassword".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="hash">
+         <xs:annotation>
+            <xs:documentation>Defines the hashing algorithm used on user passwords. We recommend
+               strongly against using MD4, as it is a very weak hashing
+               algorithm.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="plaintext"/>
+               <xs:enumeration value="sha"/>
+               <xs:enumeration value="sha-256"/>
+               <xs:enumeration value="md5"/>
+               <xs:enumeration value="md4"/>
+               <xs:enumeration value="{sha}"/>
+               <xs:enumeration value="{ssha}"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="intercept-methods">
+      <xs:annotation>
+         <xs:documentation>Can be used inside a bean definition to add a security interceptor to the
+            bean and set up access configuration attributes for the bean's
+            methods</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element maxOccurs="unbounded" name="protect">
+               <xs:annotation>
+                  <xs:documentation>Defines a protected method and the access control configuration
+                     attributes that apply to it. We strongly advise you NOT to mix "protect"
+                     declarations with any services provided
+                     "global-method-security".</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:protect.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:intercept-methods.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="intercept-methods.attlist">
+      <xs:attribute name="access-decision-manager-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Optional AccessDecisionManager bean ID to be used by the created
+               method security interceptor.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="protect.attlist">
+      <xs:attribute name="method" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A method name</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="access" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Access configuration attributes list that applies to the method, e.g.
+               "ROLE_A,ROLE_B".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="global-method-security">
+      <xs:annotation>
+         <xs:documentation>Provides method security for all beans registered in the Spring
+            application context. Specifically, beans will be scanned for matches with the ordered
+            list of "protect-pointcut" sub-elements, Spring Security annotations and/or. Where there
+            is a match, the beans will automatically be proxied and security authorization applied
+            to the methods accordingly. If you use and enable all four sources of method security
+            metadata (ie "protect-pointcut" declarations, expression annotations, @Secured and also
+            JSR250 security annotations), the metadata sources will be queried in that order. In
+            practical terms, this enables you to use XML to override method security metadata
+            expressed in annotations. If using annotations, the order of precedence is EL-based
+            (@PreAuthorize etc.), @Secured and finally JSR-250.</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:choice minOccurs="0">
+               <xs:element name="pre-post-annotation-handling">
                   <xs:annotation>
-                    <xs:documentation>Defines the PrePostInvocationAttributeFactory instance which
-                      is used to generate pre and post invocation metadata from the annotated
-                      methods. </xs:documentation>
+                     <xs:documentation>Allows the default expression-based mechanism for handling
+                        Spring Security's pre and post invocation annotations (@PreFilter,
+                        @PreAuthorize, @PostFilter, @PostAuthorize) to be replace entirely. Only
+                        applies if these annotations are enabled. </xs:documentation>
                   </xs:annotation>
                   <xs:complexType>
-                    <xs:attributeGroup ref="security:ref"/>
-                  </xs:complexType>
-                </xs:element>
-                <xs:element name="pre-invocation-advice">
-                  <xs:complexType>
-                    <xs:attributeGroup ref="security:ref"/>
+                     <xs:sequence>
+                        <xs:element name="invocation-attribute-factory">
+                           <xs:annotation>
+                              <xs:documentation>Defines the PrePostInvocationAttributeFactory
+                                 instance which is used to generate pre and post invocation metadata
+                                 from the annotated methods. </xs:documentation>
+                           </xs:annotation>
+                           <xs:complexType>
+                              <xs:attributeGroup ref="security:ref"/>
+                           </xs:complexType>
+                        </xs:element>
+                        <xs:element name="pre-invocation-advice">
+                           <xs:complexType>
+                              <xs:attributeGroup ref="security:ref"/>
+                           </xs:complexType>
+                        </xs:element>
+                        <xs:element name="post-invocation-advice">
+                           <xs:complexType>
+                              <xs:attributeGroup ref="security:ref"/>
+                           </xs:complexType>
+                        </xs:element>
+                     </xs:sequence>
                   </xs:complexType>
-                </xs:element>
-                <xs:element name="post-invocation-advice">
-                  <xs:complexType>
-                    <xs:attributeGroup ref="security:ref"/>
-                  </xs:complexType>
-                </xs:element>
-              </xs:sequence>
-            </xs:complexType>
-          </xs:element>
-          <xs:element ref="security:expression-handler"/>
-        </xs:choice>
-        <xs:element minOccurs="0" maxOccurs="unbounded" name="protect-pointcut">
-          <xs:annotation>
-            <xs:documentation>Defines a protected pointcut and the access control configuration
-              attributes that apply to it. Every bean registered in the Spring application context
-              that provides a method that matches the pointcut will receive security
-              authorization.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:protect-pointcut.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:sequence>
-      <xs:attributeGroup ref="security:global-method-security.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="global-method-security.attlist">
-    <xs:attribute name="pre-post-annotations">
-      <xs:annotation>
-        <xs:documentation>Specifies whether the use of Spring Security's pre and post invocation
-          annotations (@PreFilter, @PreAuthorize, @PostFilter, @PostAuthorize) should be enabled for
-          this application context. Defaults to "disabled".</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="disabled"/>
-          <xs:enumeration value="enabled"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="secured-annotations">
-      <xs:annotation>
-        <xs:documentation>Specifies whether the use of Spring Security's @Secured annotations should
-          be enabled for this application context. Defaults to "disabled".</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="disabled"/>
-          <xs:enumeration value="enabled"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="jsr250-annotations">
-      <xs:annotation>
-        <xs:documentation>Specifies whether JSR-250 style attributes are to be used (for example
-          "RolesAllowed"). This will require the javax.annotation.security classes on the classpath.
-          Defaults to "disabled".</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="disabled"/>
-          <xs:enumeration value="enabled"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="access-decision-manager-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Optional AccessDecisionManager bean ID to override the default used for
-          method security.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="run-as-manager-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Optional RunAsmanager implementation which will be used by the configured
-          MethodSecurityInterceptor</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="expression-handler">
-    <xs:annotation>
-      <xs:documentation>Defines the SecurityExpressionHandler instance which will be used if
-        expression-based access-control is enabled. A default implementation (with no ACL support)
-        will be used if not supplied.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attributeGroup ref="security:ref"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="custom-after-invocation-provider">
-    <xs:annotation>
-      <xs:documentation>Used to decorate an AfterInvocationProvider to specify that it should be
-        used with method security.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType/>
-  </xs:element>
-  <xs:attributeGroup name="protect-pointcut.attlist">
-    <xs:attribute name="expression" use="required" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>An AspectJ expression, including the 'execution' keyword. For example,
-          'execution(int com.foo.TargetObject.countLength(String))' (without the
-          quotes).</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="access" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Access configuration attributes list that applies to all methods matching
-          the pointcut, e.g. "ROLE_A,ROLE_B"</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="http">
-    <xs:annotation>
-      <xs:documentation>Container element for HTTP security configuration</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:choice minOccurs="0" maxOccurs="unbounded">
-        <xs:element name="intercept-url">
-          <xs:annotation>
-            <xs:documentation>Specifies the access attributes and/or filter list for a particular
-              set of URLs.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:intercept-url.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="access-denied-handler">
-          <xs:annotation>
-            <xs:documentation>Defines the access-denied strategy that should be used. An access
-              denied page can be defined or a reference to an AccessDeniedHandler instance.
+               </xs:element>
+               <xs:element ref="security:expression-handler"/>
+            </xs:choice>
+            <xs:element minOccurs="0" maxOccurs="unbounded" name="protect-pointcut">
+               <xs:annotation>
+                  <xs:documentation>Defines a protected pointcut and the access control
+                     configuration attributes that apply to it. Every bean registered in the Spring
+                     application context that provides a method that matches the pointcut will
+                     receive security authorization.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:protect-pointcut.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:global-method-security.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="global-method-security.attlist">
+      <xs:attribute name="pre-post-annotations">
+         <xs:annotation>
+            <xs:documentation>Specifies whether the use of Spring Security's pre and post invocation
+               annotations (@PreFilter, @PreAuthorize, @PostFilter, @PostAuthorize) should be
+               enabled for this application context. Defaults to "disabled".</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="disabled"/>
+               <xs:enumeration value="enabled"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="secured-annotations">
+         <xs:annotation>
+            <xs:documentation>Specifies whether the use of Spring Security's @Secured annotations
+               should be enabled for this application context. Defaults to
+               "disabled".</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="disabled"/>
+               <xs:enumeration value="enabled"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="jsr250-annotations">
+         <xs:annotation>
+            <xs:documentation>Specifies whether JSR-250 style attributes are to be used (for example
+               "RolesAllowed"). This will require the javax.annotation.security classes on the
+               classpath. Defaults to "disabled".</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="disabled"/>
+               <xs:enumeration value="enabled"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="access-decision-manager-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Optional AccessDecisionManager bean ID to override the default used
+               for method security.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="run-as-manager-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Optional RunAsmanager implementation which will be used by the
+               configured MethodSecurityInterceptor</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="expression-handler">
+      <xs:annotation>
+         <xs:documentation>Defines the SecurityExpressionHandler instance which will be used if
+            expression-based access-control is enabled. A default implementation (with no ACL
+            support) will be used if not supplied.</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:attributeGroup ref="security:ref"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:element name="custom-after-invocation-provider">
+      <xs:annotation>
+         <xs:documentation>Used to decorate an AfterInvocationProvider to specify that it should be
+            used with method security.</xs:documentation>
+      </xs:annotation>
+      <xs:complexType/>
+   </xs:element>
+   <xs:attributeGroup name="protect-pointcut.attlist">
+      <xs:attribute name="expression" use="required" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>An AspectJ expression, including the 'execution' keyword. For example,
+               'execution(int com.foo.TargetObject.countLength(String))' (without the
+               quotes).</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="access" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Access configuration attributes list that applies to all methods
+               matching the pointcut, e.g. "ROLE_A,ROLE_B"</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="http">
+      <xs:annotation>
+         <xs:documentation>Container element for HTTP security configuration</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:choice minOccurs="0" maxOccurs="unbounded">
+            <xs:element name="intercept-url">
+               <xs:annotation>
+                  <xs:documentation>Specifies the access attributes and/or filter list for a
+                     particular set of URLs.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:intercept-url.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="access-denied-handler">
+               <xs:annotation>
+                  <xs:documentation>Defines the access-denied strategy that should be used. An
+                     access denied page can be defined or a reference to an AccessDeniedHandler
+                     instance. </xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:access-denied-handler.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="form-login">
+               <xs:annotation>
+                  <xs:documentation>Sets up a form login configuration for authentication with a
+                     username and password</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:form-login.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element ref="security:openid-login"/>
+            <xs:element name="x509">
+               <xs:annotation>
+                  <xs:documentation>Adds support for X.509 client authentication.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:x509.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="http-basic">
+               <xs:annotation>
+                  <xs:documentation>Adds support for basic authentication (this is an element to
+                     permit future expansion, such as supporting an "ignoreFailure"
+                     attribute)</xs:documentation>
+               </xs:annotation>
+               <xs:complexType/>
+            </xs:element>
+            <xs:element name="logout">
+               <xs:annotation>
+                  <xs:documentation>Incorporates a logout processing filter. Most web applications
+                     require a logout filter, although you may not require one if you write a
+                     controller to provider similar logic.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:logout.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="concurrent-session-control">
+               <xs:annotation>
+                  <xs:documentation>Adds support for concurrent session control, allowing limits to
+                     be placed on the number of sessions a user can have.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:concurrent-sessions.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="remember-me">
+               <xs:annotation>
+                  <xs:documentation>Sets up remember-me authentication. If used with the "key"
+                     attribute (or no attributes) the cookie-only implementation will be used.
+                     Specifying "token-repository-ref" or "remember-me-data-source-ref" will use the
+                     more secure, persisten token approach. </xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:remember-me.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="anonymous">
+               <xs:annotation>
+                  <xs:documentation>Adds support for automatically granting all anonymous web
+                     requests a particular principal identity and a corresponding granted
+                     authority.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:anonymous.attlist"/>
+               </xs:complexType>
+            </xs:element>
+            <xs:element name="port-mappings">
+               <xs:annotation>
+                  <xs:documentation>Defines the list of mappings between http and https ports for
+                     use in redirects</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:sequence>
+                     <xs:element maxOccurs="unbounded" ref="security:port-mapping"/>
+                  </xs:sequence>
+               </xs:complexType>
+            </xs:element>
+         </xs:choice>
+         <xs:attributeGroup ref="security:http.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="http.attlist">
+      <xs:attribute name="auto-config" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Automatically registers a login form, BASIC authentication, anonymous
+               authentication, logout services, remember-me and servlet-api-integration. If set to
+               "true", all of these capabilities are added (although you can still customize the
+               configuration of each by providing the respective element). If unspecified, defaults
+               to "false".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="use-expressions" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Enables the use of expressions in the 'access' attributes in
+               &lt;intercept-url&gt; elements rather than the traditional list of
+               configuration attributes. Defaults to 'false'. If enabled, each attribute should
+               contain a single boolean expression. If the expression evaluates to 'true', access
+               will be granted. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="create-session">
+         <xs:annotation>
+            <xs:documentation>Controls the eagerness with which an HTTP session is created. If not
+               set, defaults to "ifRequired". Note that if a custom SecurityContextRepository is set
+               using security-context-repository-ref, then the only value which can be set is
+               "always". Otherwise the session creation behaviour will be determined by the
+               repository bean implementation.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="ifRequired"/>
+               <xs:enumeration value="always"/>
+               <xs:enumeration value="never"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="security-context-repository-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a SecurityContextRepository bean. This can be used to
+               customize how the SecurityContext is stored between requests.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="path-type">
+         <xs:annotation>
+            <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
+               1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
+               unspecified.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="ant"/>
+               <xs:enumeration value="regex"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="lowercase-comparisons" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Whether test URLs should be converted to lower case prior to comparing
+               with defined path patterns. If unspecified, defaults to "true".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="servlet-api-provision" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Provides versions of HttpServletRequest security methods such as
+               isUserInRole() and getPrincipal() which are implemented by accessing the Spring
+               SecurityContext. Defaults to "true".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="access-decision-manager-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Optional attribute specifying the ID of the AccessDecisionManager
+               implementation which should be used for authorizing HTTP requests.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="realm" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Optional attribute specifying the realm name that will be used for all
+               authentication features that require a realm name (eg BASIC and Digest
+               authentication). If unspecified, defaults to "Spring Security
+               Application".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="session-fixation-protection">
+         <xs:annotation>
+            <xs:documentation>Indicates whether an existing session should be invalidated when a
+               user authenticates and a new session started. If set to "none" no change will be
+               made. "newSession" will create a new empty session. "migrateSession" will create a
+               new session and copy the session attributes to the new session. Defaults to
+               "migrateSession".</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="none"/>
+               <xs:enumeration value="newSession"/>
+               <xs:enumeration value="migrateSession"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="entry-point-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Allows a customized AuthenticationEntryPoint to be
+               used.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="once-per-request" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Corresponds to the observeOncePerRequest property of
+               FilterSecurityInterceptor. Defaults to "true"</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="access-denied-page" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Deprecated in favour of the access-denied-handler
+               element.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="disable-url-rewriting" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation> </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="access-denied-handler.attlist">
+      <xs:attribute name="ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="error-page" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The access denied page that an authenticated user will be redirected
+               to if they request a page which they don't have the authority to access.
             </xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:access-denied-handler.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="form-login">
-          <xs:annotation>
-            <xs:documentation>Sets up a form login configuration for authentication with a username
-              and password</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:form-login.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element ref="security:openid-login"/>
-        <xs:element name="x509">
-          <xs:annotation>
-            <xs:documentation>Adds support for X.509 client authentication.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:x509.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="http-basic">
-          <xs:annotation>
-            <xs:documentation>Adds support for basic authentication (this is an element to permit
-              future expansion, such as supporting an "ignoreFailure" attribute)</xs:documentation>
-          </xs:annotation>
-          <xs:complexType/>
-        </xs:element>
-        <xs:element name="logout">
-          <xs:annotation>
-            <xs:documentation>Incorporates a logout processing filter. Most web applications require
-              a logout filter, although you may not require one if you write a controller to
-              provider similar logic.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:logout.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="concurrent-session-control">
-          <xs:annotation>
-            <xs:documentation>Adds support for concurrent session control, allowing limits to be
-              placed on the number of sessions a user can have.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:concurrent-sessions.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="remember-me">
-          <xs:annotation>
-            <xs:documentation>Sets up remember-me authentication. If used with the "key" attribute
-              (or no attributes) the cookie-only implementation will be used. Specifying
-              "token-repository-ref" or "remember-me-data-source-ref" will use the more secure,
-              persisten token approach. </xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:remember-me.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="anonymous">
-          <xs:annotation>
-            <xs:documentation>Adds support for automatically granting all anonymous web requests a
-              particular principal identity and a corresponding granted
-              authority.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:anonymous.attlist"/>
-          </xs:complexType>
-        </xs:element>
-        <xs:element name="port-mappings">
-          <xs:annotation>
-            <xs:documentation>Defines the list of mappings between http and https ports for use in
-              redirects</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:sequence>
-              <xs:element maxOccurs="unbounded" ref="security:port-mapping"/>
-            </xs:sequence>
-          </xs:complexType>
-        </xs:element>
-      </xs:choice>
-      <xs:attributeGroup ref="security:http.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="http.attlist">
-    <xs:attribute name="auto-config" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Automatically registers a login form, BASIC authentication, anonymous
-          authentication, logout services, remember-me and servlet-api-integration. If set to
-          "true", all of these capabilities are added (although you can still customize the
-          configuration of each by providing the respective element). If unspecified, defaults to
-          "false".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="use-expressions" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Enables the use of expressions in the 'access' attributes in
-          &lt;intercept-url&gt; elements rather than the traditional list of configuration
-          attributes. Defaults to 'false'. If enabled, each attribute should contain a single
-          boolean expression. If the expression evaluates to 'true', access will be granted.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="create-session">
-      <xs:annotation>
-        <xs:documentation>Controls the eagerness with which an HTTP session is created. If not set,
-          defaults to "ifRequired". Note that if a custom SecurityContextRepository is set using
-          security-context-repository-ref, then the only value which can be set is "always".
-          Otherwise the session creation behaviour will be determined by the repository bean
-          implementation.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="ifRequired"/>
-          <xs:enumeration value="always"/>
-          <xs:enumeration value="never"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="security-context-repository-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to a SecurityContextRepository bean. This can be used to
-          customize how the SecurityContext is stored between requests.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="path-type">
-      <xs:annotation>
-        <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
-          1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
-          unspecified.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="ant"/>
-          <xs:enumeration value="regex"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="lowercase-comparisons" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Whether test URLs should be converted to lower case prior to comparing
-          with defined path patterns. If unspecified, defaults to "true".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="servlet-api-provision" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Provides versions of HttpServletRequest security methods such as
-          isUserInRole() and getPrincipal() which are implemented by accessing the Spring
-          SecurityContext. Defaults to "true".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="access-decision-manager-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Optional attribute specifying the ID of the AccessDecisionManager
-          implementation which should be used for authorizing HTTP requests.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="realm" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Optional attribute specifying the realm name that will be used for all
-          authentication features that require a realm name (eg BASIC and Digest authentication). If
-          unspecified, defaults to "Spring Security Application".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="session-fixation-protection">
-      <xs:annotation>
-        <xs:documentation>Indicates whether an existing session should be invalidated when a user
-          authenticates and a new session started. If set to "none" no change will be made.
-          "newSession" will create a new empty session. "migrateSession" will create a new session
-          and copy the session attributes to the new session. Defaults to
-          "migrateSession".</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="none"/>
-          <xs:enumeration value="newSession"/>
-          <xs:enumeration value="migrateSession"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="entry-point-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Allows a customized AuthenticationEntryPoint to be
-          used.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="once-per-request" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Corresponds to the observeOncePerRequest property of
-          FilterSecurityInterceptor. Defaults to "true"</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="access-denied-page" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Deprecated in favour of the access-denied-handler
-          element.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="disable-url-rewriting" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation> </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="access-denied-handler.attlist">
-    <xs:attribute name="ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="error-page" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The access denied page that an authenticated user will be redirected to if
-          they request a page which they don't have the authority to access. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="access-denied-handler-page">
-    <xs:attribute name="error-page" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The access denied page that an authenticated user will be redirected to if
-          they request a page which they don't have the authority to access. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="intercept-url.attlist">
-    <xs:attribute name="pattern" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The pattern which defines the URL path. The content will depend on the
-          type set in the containing http element, so will default to ant path
-          syntax.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="access" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The access configuration attributes that apply for the configured
-          path.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="method">
-      <xs:annotation>
-        <xs:documentation>The HTTP Method for which the access configuration attributes should
-          apply. If not specified, the attributes will apply to any method.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="GET"/>
-          <xs:enumeration value="DELETE"/>
-          <xs:enumeration value="HEAD"/>
-          <xs:enumeration value="OPTIONS"/>
-          <xs:enumeration value="POST"/>
-          <xs:enumeration value="PUT"/>
-          <xs:enumeration value="TRACE"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="filters">
-      <xs:annotation>
-        <xs:documentation>The filter list for the path. Currently can be set to "none" to remove a
-          path from having any filters applied. The full filter stack (consisting of all filters
-          created by the namespace configuration, and any added using 'custom-filter'), will be
-          applied to any other paths.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="none"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-    <xs:attribute name="requires-channel">
-      <xs:annotation>
-        <xs:documentation>Used to specify that a URL must be accessed over http or https, or that
-          there is no preference.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="http"/>
-          <xs:enumeration value="https"/>
-          <xs:enumeration value="any"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="logout.attlist">
-    <xs:attribute name="logout-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
-          initialize a filter that responds to this particular URL. Defaults to
-          /j_spring_security_logout if unspecified.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="logout-success-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Specifies the URL to display once the user has logged out. If not
-          specified, defaults to /.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="invalidate-session" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Specifies whether a logout also causes HttpSession invalidation, which is
-          generally desirable. If unspecified, defaults to true.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="form-login.attlist">
-    <xs:attribute name="login-processing-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /j_spring_security_check.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="default-target-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The URL that will be redirected to after successful authentication, if the
-          user's previous action could not be resumed. This generally happens if the user visits a
-          login page without having first requested a secured operation that triggers
-          authentication. If unspecified, defaults to the root of the
-          application.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="always-use-default-target" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Whether the user should always be redirected to the default-target-url
-          after login. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="login-page" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The URL for the login page. If no login URL is specified, Spring Security
-          will automatically create a login URL at /spring_security_login and a corresponding filter
-          to render that login URL when requested.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="authentication-failure-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The URL for the login failure page. If no login failure URL is specified,
-          Spring Security will automatically create a failure login URL at
-          /spring_security_login?login_error and a corresponding filter to render that login failure
-          URL when requested.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="authentication-success-handler-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Reference to an AuthenticationSuccessHandler bean which should be used to
-          handle a successful authentication request. Should not be used in combination with
-          default-target-url (or always-use-default-target-url) as the implementation should always
-          deal with navigation to the subsequent destination</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="authentication-failure-handler-ref" type="xs:token">
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="access-denied-handler-page">
+      <xs:attribute name="error-page" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The access denied page that an authenticated user will be redirected
+               to if they request a page which they don't have the authority to access.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="intercept-url.attlist">
+      <xs:attribute name="pattern" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The pattern which defines the URL path. The content will depend on the
+               type set in the containing http element, so will default to ant path
+               syntax.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="access" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The access configuration attributes that apply for the configured
+               path.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="method">
+         <xs:annotation>
+            <xs:documentation>The HTTP Method for which the access configuration attributes should
+               apply. If not specified, the attributes will apply to any method.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="GET"/>
+               <xs:enumeration value="DELETE"/>
+               <xs:enumeration value="HEAD"/>
+               <xs:enumeration value="OPTIONS"/>
+               <xs:enumeration value="POST"/>
+               <xs:enumeration value="PUT"/>
+               <xs:enumeration value="TRACE"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="filters">
+         <xs:annotation>
+            <xs:documentation>The filter list for the path. Currently can be set to "none" to remove
+               a path from having any filters applied. The full filter stack (consisting of all
+               filters created by the namespace configuration, and any added using 'custom-filter'),
+               will be applied to any other paths.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="none"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+      <xs:attribute name="requires-channel">
+         <xs:annotation>
+            <xs:documentation>Used to specify that a URL must be accessed over http or https, or
+               that there is no preference.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="http"/>
+               <xs:enumeration value="https"/>
+               <xs:enumeration value="any"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="logout.attlist">
+      <xs:attribute name="logout-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
+               initialize a filter that responds to this particular URL. Defaults to
+               /j_spring_security_logout if unspecified.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="logout-success-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Specifies the URL to display once the user has logged out. If not
+               specified, defaults to /.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="invalidate-session" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Specifies whether a logout also causes HttpSession invalidation, which
+               is generally desirable. If unspecified, defaults to true.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="form-login.attlist">
+      <xs:attribute name="login-processing-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults
+               to /j_spring_security_check.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="default-target-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The URL that will be redirected to after successful authentication, if
+               the user's previous action could not be resumed. This generally happens if the user
+               visits a login page without having first requested a secured operation that triggers
+               authentication. If unspecified, defaults to the root of the
+               application.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="always-use-default-target" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Whether the user should always be redirected to the default-target-url
+               after login. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="login-page" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The URL for the login page. If no login URL is specified, Spring
+               Security will automatically create a login URL at /spring_security_login and a
+               corresponding filter to render that login URL when requested.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="authentication-failure-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The URL for the login failure page. If no login failure URL is
+               specified, Spring Security will automatically create a failure login URL at
+               /spring_security_login?login_error and a corresponding filter to render that login
+               failure URL when requested.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="authentication-success-handler-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Reference to an AuthenticationSuccessHandler bean which should be used
+               to handle a successful authentication request. Should not be used in combination with
+               default-target-url (or always-use-default-target-url) as the implementation should
+               always deal with navigation to the subsequent destination</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="authentication-failure-handler-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Reference to an AuthenticationFailureHandler bean which should be used
+               to handle a failed authentication request. Should not be used in combination with
+               authentication-failure-url as the implementation should always deal with navigation
+               to the subsequent destination</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="openid-login">
       <xs:annotation>
-        <xs:documentation>Reference to an AuthenticationFailureHandler bean which should be used to
-          handle a failed authentication request. Should not be used in combination with
-          authentication-failure-url as the implementation should always deal with navigation to the
-          subsequent destination</xs:documentation>
+         <xs:documentation>Sets up form login for authentication with an Open ID
+            identity</xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="openid-login">
-    <xs:annotation>
-      <xs:documentation>Sets up form login for authentication with an Open ID
-        identity</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attributeGroup ref="security:form-login.attlist"/>
+      <xs:complexType>
+         <xs:attributeGroup ref="security:form-login.attlist"/>
+         <xs:attribute name="user-service-ref" type="xs:token">
+            <xs:annotation>
+               <xs:documentation>A reference to a user-service (or UserDetailsService bean)
+                  Id</xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+      </xs:complexType>
+   </xs:element>
+   <xs:element name="filter-chain-map">
+      <xs:annotation>
+         <xs:documentation>Used to explicitly configure a FilterChainProxy instance with a
+            FilterChainMap</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element maxOccurs="unbounded" name="filter-chain">
+               <xs:annotation>
+                  <xs:documentation>Used within filter-chain-map to define a specific URL pattern
+                     and the list of filters which apply to the URLs matching that pattern. When
+                     multiple filter-chain elements are used within a filter-chain-map element, the
+                     most specific patterns must be placed at the top of the list, with most general
+                     ones at the bottom.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:filter-chain.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:filter-chain-map.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="filter-chain-map.attlist">
+      <xs:attributeGroup ref="security:path-type"/>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="filter-chain.attlist">
+      <xs:attribute name="pattern" use="required" type="xs:token"/>
+      <xs:attribute name="filters" use="required" type="xs:token"/>
+   </xs:attributeGroup>
+   <xs:element name="filter-security-metadata-source">
+      <xs:annotation>
+         <xs:documentation>Used to explicitly configure a FilterSecurityMetadataSource bean for use
+            with a FilterSecurityInterceptor. Usually only needed if you are configuring a
+            FilterChainProxy explicitly, rather than using the &lt;http&gt; element. The
+            intercept-url elements used should only contain pattern, method and access attributes.
+            Any others will result in a configuration error. </xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element maxOccurs="unbounded" name="intercept-url">
+               <xs:annotation>
+                  <xs:documentation>Specifies the access attributes and/or filter list for a
+                     particular set of URLs.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:intercept-url.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:fsmds.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="fsmds.attlist">
+      <xs:attribute name="use-expressions" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Enables the use of expressions in the 'access' attributes in
+               &lt;intercept-url&gt; elements rather than the traditional list of
+               configuration attributes. Defaults to 'false'. If enabled, each attribute should
+               contain a single boolean expression. If the expression evaluates to 'true', access
+               will be granted. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="id" type="xs:ID">
+         <xs:annotation>
+            <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+               context.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="lowercase-comparisons" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>as for http element</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="path-type">
+         <xs:annotation>
+            <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
+               1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
+               unspecified.</xs:documentation>
+         </xs:annotation>
+         <xs:simpleType>
+            <xs:restriction base="xs:token">
+               <xs:enumeration value="ant"/>
+               <xs:enumeration value="regex"/>
+            </xs:restriction>
+         </xs:simpleType>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="filter-invocation-definition-source">
+      <xs:annotation>
+         <xs:documentation>Deprecated synonym for filter-security-metadata-source</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element maxOccurs="unbounded" name="intercept-url">
+               <xs:annotation>
+                  <xs:documentation>Specifies the access attributes and/or filter list for a
+                     particular set of URLs.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:attributeGroup ref="security:intercept-url.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:sequence>
+         <xs:attributeGroup ref="security:fsmds.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="concurrent-sessions.attlist">
+      <xs:attribute name="max-sessions" type="xs:positiveInteger">
+         <xs:annotation>
+            <xs:documentation>The maximum number of sessions a single user can have open at the same
+               time. Defaults to "1".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="expired-url" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The URL a user will be redirected to if they attempt to use a session
+               which has been "expired" by the concurrent session controller because they have
+               logged in again.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="exception-if-maximum-exceeded" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Specifies that an exception should be raised when a user attempts to
+               login when they already have the maximum configured sessions open. The default
+               behaviour is to expire the original session.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="session-registry-alias" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Allows you to define an alias for the SessionRegistry bean in order to
+               access it in your own configuration</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="session-registry-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to an external SessionRegistry implementation which will
+               be used in place of the standard one. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="remember-me.attlist">
+      <xs:attribute name="key" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The "key" used to identify cookies from a specific token-based
+               remember-me application. You should set this to a unique value for your
+               application.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="token-repository-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Reference to a PersistentTokenRepository bean for use with the
+               persistent token remember-me implementation. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="data-source-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a DataSource bean</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attributeGroup ref="security:remember-me-services-ref"/>
       <xs:attribute name="user-service-ref" type="xs:token">
-        <xs:annotation>
-          <xs:documentation>A reference to a user-service (or UserDetailsService bean)
-            Id</xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-    </xs:complexType>
-  </xs:element>
-  <xs:element name="filter-chain-map">
-    <xs:annotation>
-      <xs:documentation>Used to explicitly configure a FilterChainProxy instance with a
-        FilterChainMap</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element maxOccurs="unbounded" name="filter-chain">
-          <xs:annotation>
-            <xs:documentation>Used within filter-chain-map to define a specific URL pattern and the
-              list of filters which apply to the URLs matching that pattern. When multiple
-              filter-chain elements are used within a filter-chain-map element, the most specific
-              patterns must be placed at the top of the list, with most general ones at the
-              bottom.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:filter-chain.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:sequence>
-      <xs:attributeGroup ref="security:filter-chain-map.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="filter-chain-map.attlist">
-    <xs:attributeGroup ref="security:path-type"/>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="filter-chain.attlist">
-    <xs:attribute name="pattern" use="required" type="xs:token"/>
-    <xs:attribute name="filters" use="required" type="xs:token"/>
-  </xs:attributeGroup>
-  <xs:element name="filter-invocation-definition-source">
-    <xs:annotation>
-      <xs:documentation>Used to explicitly configure a FilterInvocationDefinitionSource bean for use
-        with a FilterSecurityInterceptor. Usually only needed if you are configuring a
-        FilterChainProxy explicitly, rather than using the &lt;http&gt; element. The
-        intercept-url elements used should only contain pattern, method and access attributes. Any
-        others will result in a configuration error. </xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:sequence>
-        <xs:element maxOccurs="unbounded" name="intercept-url">
-          <xs:annotation>
-            <xs:documentation>Specifies the access attributes and/or filter list for a particular
-              set of URLs.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:attributeGroup ref="security:intercept-url.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:sequence>
-      <xs:attributeGroup ref="security:fids.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="fids.attlist">
-    <xs:attribute name="use-expressions" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Enables the use of expressions in the 'access' attributes in
-          &lt;intercept-url&gt; elements rather than the traditional list of configuration
-          attributes. Defaults to 'false'. If enabled, each attribute should contain a single
-          boolean expression. If the expression evaluates to 'true', access will be granted.
-        </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="id" type="xs:ID">
-      <xs:annotation>
-        <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-          context.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="lowercase-comparisons" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>as for http element</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="path-type">
-      <xs:annotation>
-        <xs:documentation>Defines the type of pattern used to specify URL paths (either JDK
-          1.4-compatible regular expressions, or Apache Ant expressions). Defaults to "ant" if
-          unspecified.</xs:documentation>
-      </xs:annotation>
-      <xs:simpleType>
-        <xs:restriction base="xs:token">
-          <xs:enumeration value="ant"/>
-          <xs:enumeration value="regex"/>
-        </xs:restriction>
-      </xs:simpleType>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="concurrent-sessions.attlist">
-    <xs:attribute name="max-sessions" type="xs:positiveInteger">
-      <xs:annotation>
-        <xs:documentation>The maximum number of sessions a single user can have open at the same
-          time. Defaults to "1".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="expired-url" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The URL a user will be redirected to if they attempt to use a session
-          which has been "expired" by the concurrent session controller because they have logged in
-          again.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="exception-if-maximum-exceeded" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Specifies that an exception should be raised when a user attempts to login
-          when they already have the maximum configured sessions open. The default behaviour is to
-          expire the original session.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="session-registry-alias" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Allows you to define an alias for the SessionRegistry bean in order to
-          access it in your own configuration</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="session-registry-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to an external SessionRegistry implementation which will be
-          used in place of the standard one. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="remember-me.attlist">
-    <xs:attribute name="key" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The "key" used to identify cookies from a specific token-based remember-me
-          application. You should set this to a unique value for your
-          application.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="token-repository-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Reference to a PersistentTokenRepository bean for use with the persistent
-          token remember-me implementation. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="data-source-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to a DataSource bean</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attributeGroup ref="security:remember-me-services-ref"/>
-    <xs:attribute name="user-service-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A reference to a user-service (or UserDetailsService bean)
-          Id</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="token-validity-seconds" type="xs:integer">
-      <xs:annotation>
-        <xs:documentation>The period (in seconds) for which the remember-me cookie should be valid.
-          If set to a negative value</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="token-repository-ref">
-    <xs:attribute name="token-repository-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Reference to a PersistentTokenRepository bean for use with the persistent
-          token remember-me implementation. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="remember-me-services-ref">
-    <xs:attribute name="services-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Allows a custom implementation of RememberMeServices to be used. Note that
-          this implementation should return RememberMeAuthenticationToken instances with the same
-          "key" value as specified in the remember-me element. Alternatively it should register its
-          own AuthenticationProvider. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="remember-me-data-source-ref">
-    <xs:attributeGroup ref="security:data-source-ref"/>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="anonymous.attlist">
-    <xs:attribute name="key" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The key shared between the provider and filter. This generally does not
-          need to be set. If unset, it will default to "doesNotMatter".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="username" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The username that should be assigned to the anonymous request. This allows
-          the principal to be identified, which may be important for logging and auditing. if unset,
-          defaults to "anonymousUser".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="granted-authority" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The granted authority that should be assigned to the anonymous request.
-          Commonly this is used to assign the anonymous request particular roles, which can
-          subsequently be used in authorization decisions. If unset, defaults to
-          "ROLE_ANONYMOUS".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="enabled" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>With the default namespace setup, the anonymous "authentication" facility
-          is automatically enabled. You can disable it using this property. </xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="port-mapping">
-    <xs:complexType>
-      <xs:attributeGroup ref="security:http-port"/>
-      <xs:attributeGroup ref="security:https-port"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="http-port">
-    <xs:attribute name="http" use="required" type="xs:token"/>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="https-port">
-    <xs:attribute name="https" use="required" type="xs:token"/>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="x509.attlist">
-    <xs:attribute name="subject-principal-regex" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The regular expression used to obtain the username from the certificate's
-          subject. Defaults to matching on the common name using the pattern
-          "CN=(.*?),".</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="user-service-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a user-service (or UserDetailsService bean)
+               Id</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="token-validity-seconds" type="xs:integer">
+         <xs:annotation>
+            <xs:documentation>The period (in seconds) for which the remember-me cookie should be
+               valid. If set to a negative value</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="token-repository-ref">
+      <xs:attribute name="token-repository-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Reference to a PersistentTokenRepository bean for use with the
+               persistent token remember-me implementation. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="remember-me-services-ref">
+      <xs:attribute name="services-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Allows a custom implementation of RememberMeServices to be used. Note
+               that this implementation should return RememberMeAuthenticationToken instances with
+               the same "key" value as specified in the remember-me element. Alternatively it should
+               register its own AuthenticationProvider. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="remember-me-data-source-ref">
+      <xs:attributeGroup ref="security:data-source-ref"/>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="anonymous.attlist">
+      <xs:attribute name="key" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The key shared between the provider and filter. This generally does
+               not need to be set. If unset, it will default to "doesNotMatter".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="username" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The username that should be assigned to the anonymous request. This
+               allows the principal to be identified, which may be important for logging and
+               auditing. if unset, defaults to "anonymousUser".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="granted-authority" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The granted authority that should be assigned to the anonymous
+               request. Commonly this is used to assign the anonymous request particular roles,
+               which can subsequently be used in authorization decisions. If unset, defaults to
+               "ROLE_ANONYMOUS".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="enabled" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>With the default namespace setup, the anonymous "authentication"
+               facility is automatically enabled. You can disable it using this property.
+            </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="port-mapping">
+      <xs:complexType>
+         <xs:attributeGroup ref="security:http-port"/>
+         <xs:attributeGroup ref="security:https-port"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="http-port">
+      <xs:attribute name="http" use="required" type="xs:token"/>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="https-port">
+      <xs:attribute name="https" use="required" type="xs:token"/>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="x509.attlist">
+      <xs:attribute name="subject-principal-regex" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The regular expression used to obtain the username from the
+               certificate's subject. Defaults to matching on the common name using the pattern
+               "CN=(.*?),".</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="user-service-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a user-service (or UserDetailsService bean)
+               Id</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="authentication-manager">
+      <xs:annotation>
+         <xs:documentation>If you are using namespace configuration with Spring Security, an
+            AuthenticationManager will automatically be registered. This element allows you to
+            define an alias to allow you to reference the authentication-manager in your own beans.
+         </xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:attributeGroup ref="security:authman.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="authman.attlist">
+      <xs:attribute name="alias" use="required" type="xs:ID">
+         <xs:annotation>
+            <xs:documentation>The alias you wish to use for the AuthenticationManager
+               bean</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="session-controller-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Allows the session controller to be set on the internal
+               AuthenticationManager. This should not be used with the
+               &lt;concurrent-session-control /&gt; element</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="authentication-provider">
       <xs:annotation>
-        <xs:documentation>A reference to a user-service (or UserDetailsService bean)
-          Id</xs:documentation>
+         <xs:documentation>Indicates that the contained user-service should be used as an
+            authentication source. </xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="authentication-manager">
-    <xs:annotation>
-      <xs:documentation>If you are using namespace configuration with Spring Security, an
-        AuthenticationManager will automatically be registered. This element allows you to define an
-        alias to allow you to reference the authentication-manager in your own beans.
-      </xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attributeGroup ref="security:authman.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="authman.attlist">
-    <xs:attribute name="alias" use="required" type="xs:ID">
+      <xs:complexType>
+         <xs:choice minOccurs="0" maxOccurs="unbounded">
+            <xs:element ref="security:any-user-service"/>
+            <xs:element name="password-encoder">
+               <xs:annotation>
+                  <xs:documentation>element which defines a password encoding strategy. Used by an
+                     authentication provider to convert submitted passwords to hashed versions, for
+                     example.</xs:documentation>
+               </xs:annotation>
+               <xs:complexType>
+                  <xs:sequence>
+                     <xs:element minOccurs="0" name="salt-source">
+                        <xs:annotation>
+                           <xs:documentation>Password salting strategy. A system-wide constant or a
+                              property from the UserDetails object can be used.</xs:documentation>
+                        </xs:annotation>
+                        <xs:complexType>
+                           <xs:attribute name="user-property" type="xs:token">
+                              <xs:annotation>
+                                 <xs:documentation>A property of the UserDetails object which will
+                                    be used as salt by a password encoder. Typically something like
+                                    "username" might be used. </xs:documentation>
+                              </xs:annotation>
+                           </xs:attribute>
+                           <xs:attribute name="system-wide" type="xs:token">
+                              <xs:annotation>
+                                 <xs:documentation>A single value that will be used as the salt for
+                                    a password encoder. </xs:documentation>
+                              </xs:annotation>
+                           </xs:attribute>
+                           <xs:attribute name="ref" type="xs:token">
+                              <xs:annotation>
+                                 <xs:documentation>Defines a reference to a Spring bean
+                                    Id.</xs:documentation>
+                              </xs:annotation>
+                           </xs:attribute>
+                        </xs:complexType>
+                     </xs:element>
+                  </xs:sequence>
+                  <xs:attributeGroup ref="security:password-encoder.attlist"/>
+               </xs:complexType>
+            </xs:element>
+         </xs:choice>
+         <xs:attributeGroup ref="security:ap.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="ap.attlist">
+      <xs:attribute name="user-service-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A reference to a user-service (or UserDetailsService bean)
+               Id</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="custom-authentication-provider">
       <xs:annotation>
-        <xs:documentation>The alias you wish to use for the AuthenticationManager
-          bean</xs:documentation>
+         <xs:documentation>Element used to decorate an AuthenticationProvider bean to add it to the
+            internal AuthenticationManager maintained by the namespace.</xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="session-controller-ref" type="xs:token">
+      <xs:complexType/>
+   </xs:element>
+   <xs:element name="user-service" substitutionGroup="security:any-user-service">
       <xs:annotation>
-        <xs:documentation>Allows the session controller to be set on the internal
-          AuthenticationManager. This should not be used with the &lt;concurrent-session-control
-          /&gt; element</xs:documentation>
+         <xs:documentation>Creates an in-memory UserDetailsService from a properties file or a list
+            of "user" child elements.</xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="authentication-provider">
-    <xs:annotation>
-      <xs:documentation>Indicates that the contained user-service should be used as an
-        authentication source. </xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:choice minOccurs="0" maxOccurs="unbounded">
-        <xs:element ref="security:any-user-service"/>
-        <xs:element name="password-encoder">
-          <xs:annotation>
-            <xs:documentation>element which defines a password encoding strategy. Used by an
-              authentication provider to convert submitted passwords to hashed versions, for
-              example.</xs:documentation>
-          </xs:annotation>
-          <xs:complexType>
-            <xs:sequence>
-              <xs:element minOccurs="0" name="salt-source">
-                <xs:annotation>
-                  <xs:documentation>Password salting strategy. A system-wide constant or a property
-                    from the UserDetails object can be used.</xs:documentation>
-                </xs:annotation>
-                <xs:complexType>
-                  <xs:attribute name="user-property" type="xs:token">
-                    <xs:annotation>
-                      <xs:documentation>A property of the UserDetails object which will be used as
-                        salt by a password encoder. Typically something like "username" might be
-                        used. </xs:documentation>
-                    </xs:annotation>
-                  </xs:attribute>
-                  <xs:attribute name="system-wide" type="xs:token">
-                    <xs:annotation>
-                      <xs:documentation>A single value that will be used as the salt for a password
-                        encoder. </xs:documentation>
-                    </xs:annotation>
-                  </xs:attribute>
-                  <xs:attribute name="ref" type="xs:token">
-                    <xs:annotation>
-                      <xs:documentation>Defines a reference to a Spring bean Id.</xs:documentation>
-                    </xs:annotation>
-                  </xs:attribute>
-                </xs:complexType>
-              </xs:element>
-            </xs:sequence>
-            <xs:attributeGroup ref="security:password-encoder.attlist"/>
-          </xs:complexType>
-        </xs:element>
-      </xs:choice>
-      <xs:attributeGroup ref="security:ap.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="ap.attlist">
-    <xs:attribute name="user-service-ref" type="xs:token">
+      <xs:complexType>
+         <xs:sequence>
+            <xs:element minOccurs="0" maxOccurs="unbounded" ref="security:user"/>
+         </xs:sequence>
+         <xs:attribute name="id" type="xs:ID">
+            <xs:annotation>
+               <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+                  context.</xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+         <xs:attributeGroup ref="security:properties-file"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="properties-file">
+      <xs:attribute name="properties" type="xs:token"/>
+   </xs:attributeGroup>
+   <xs:element name="user">
+      <xs:annotation>
+         <xs:documentation>Represents a user in the application.</xs:documentation>
+      </xs:annotation>
+      <xs:complexType>
+         <xs:attributeGroup ref="security:user.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="user.attlist">
+      <xs:attribute name="name" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The username assigned to the user.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="password" use="required" type="xs:string">
+         <xs:annotation>
+            <xs:documentation>The password assigned to the user. This may be hashed if the
+               corresponding authentication provider supports hashing (remember to set the "hash"
+               attribute of the "user-service" element).</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="authorities" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>One of more authorities granted to the user. Separate authorities with
+               a comma (but no space). For example,
+               "ROLE_USER,ROLE_ADMINISTRATOR"</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="locked" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Can be set to "true" to mark an account as locked and
+               unusable.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="disabled" type="security:boolean">
+         <xs:annotation>
+            <xs:documentation>Can be set to "true" to mark an account as disabled and
+               unusable.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="jdbc-user-service" substitutionGroup="security:any-user-service">
       <xs:annotation>
-        <xs:documentation>A reference to a user-service (or UserDetailsService bean)
-          Id</xs:documentation>
+         <xs:documentation>Causes creation of a JDBC-based UserDetailsService.</xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="custom-authentication-provider">
-    <xs:annotation>
-      <xs:documentation>Element used to decorate an AuthenticationProvider bean to add it to the
-        internal AuthenticationManager maintained by the namespace.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType/>
-  </xs:element>
-  <xs:element name="user-service" substitutionGroup="security:any-user-service">
-    <xs:annotation>
-      <xs:documentation>Creates an in-memory UserDetailsService from a properties file or a list of
-        "user" child elements.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
+      <xs:complexType>
+         <xs:attribute name="id" type="xs:ID">
+            <xs:annotation>
+               <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
+                  context.</xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+         <xs:attributeGroup ref="security:jdbc-user-service.attlist"/>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="jdbc-user-service.attlist">
+      <xs:attribute name="data-source-ref" use="required" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>The bean ID of the DataSource which provides the required
+               tables.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="cache-ref" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>Defines a reference to a cache for use with a
+               UserDetailsService.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="users-by-username-query" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>An SQL statement to query a username, password, and enabled status
+               given a username</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="authorities-by-username-query" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>An SQL statement to query for a user's granted authorities given a
+               username.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="group-authorities-by-username-query" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>An SQL statement to query user's group authorities given a
+               username.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+      <xs:attribute name="role-prefix" type="xs:token">
+         <xs:annotation>
+            <xs:documentation>A non-empty string prefix that will be added to role strings loaded
+               from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases
+               where the default is non-empty.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:element name="any-user-service" abstract="true"/>
+   <xs:group name="custom-filter">
       <xs:sequence>
-        <xs:element minOccurs="0" maxOccurs="unbounded" ref="security:user"/>
+         <xs:element minOccurs="0" ref="security:custom-filter"/>
       </xs:sequence>
-      <xs:attribute name="id" type="xs:ID">
-        <xs:annotation>
-          <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-            context.</xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-      <xs:attributeGroup ref="security:properties-file"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="properties-file">
-    <xs:attribute name="properties" type="xs:token"/>
-  </xs:attributeGroup>
-  <xs:element name="user">
-    <xs:annotation>
-      <xs:documentation>Represents a user in the application.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attributeGroup ref="security:user.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="user.attlist">
-    <xs:attribute name="name" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The username assigned to the user.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="password" use="required" type="xs:string">
-      <xs:annotation>
-        <xs:documentation>The password assigned to the user. This may be hashed if the corresponding
-          authentication provider supports hashing (remember to set the "hash" attribute of the
-          "user-service" element).</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="authorities" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>One of more authorities granted to the user. Separate authorities with a
-          comma (but no space). For example, "ROLE_USER,ROLE_ADMINISTRATOR"</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="locked" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Can be set to "true" to mark an account as locked and
-          unusable.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="disabled" type="security:boolean">
-      <xs:annotation>
-        <xs:documentation>Can be set to "true" to mark an account as disabled and
-          unusable.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="jdbc-user-service" substitutionGroup="security:any-user-service">
-    <xs:annotation>
-      <xs:documentation>Causes creation of a JDBC-based UserDetailsService.</xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attribute name="id" type="xs:ID">
-        <xs:annotation>
-          <xs:documentation>A bean identifier, used for referring to the bean elsewhere in the
-            context.</xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-      <xs:attributeGroup ref="security:jdbc-user-service.attlist"/>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="jdbc-user-service.attlist">
-    <xs:attribute name="data-source-ref" use="required" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>The bean ID of the DataSource which provides the required
-          tables.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="cache-ref" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>Defines a reference to a cache for use with a
-          UserDetailsService.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="users-by-username-query" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>An SQL statement to query a username, password, and enabled status given a
-          username</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="authorities-by-username-query" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>An SQL statement to query for a user's granted authorities given a
-          username.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="group-authorities-by-username-query" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>An SQL statement to query user's group authorities given a
-          username.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-    <xs:attribute name="role-prefix" type="xs:token">
-      <xs:annotation>
-        <xs:documentation>A non-empty string prefix that will be added to role strings loaded from
-          persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the
-          default is non-empty.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:element name="any-user-service" abstract="true"/>
-  <xs:group name="custom-filter">
-    <xs:sequence>
-      <xs:element minOccurs="0" ref="security:custom-filter"/>
-    </xs:sequence>
-  </xs:group>
-  <xs:element name="custom-filter">
-    <xs:annotation>
-      <xs:documentation>Used to indicate that a filter bean declaration should be incorporated into
-        the security filter chain. If neither the 'after' or 'before' options are supplied, then the
-        filter must implement the Ordered interface directly. </xs:documentation>
-    </xs:annotation>
-    <xs:complexType>
-      <xs:attribute name="after" type="security:named-security-filter">
-        <xs:annotation>
-          <xs:documentation>The filter immediately after which the custom-filter should be placed in
-            the chain. This feature will only be needed by advanced users who wish to mix their own
-            filters into the security filter chain and have some knowledge of the standard Spring
-            Security filters. The filter names map to specific Spring Security implementation
-            filters. </xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-      <xs:attribute name="before" type="security:named-security-filter">
-        <xs:annotation>
-          <xs:documentation>The filter immediately before which the custom-filter should be placed
-            in the chain</xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-      <xs:attribute name="position" type="security:named-security-filter">
-        <xs:annotation>
-          <xs:documentation>The explicit position at which the custom-filter should be placed in the
-            chain. Use if you are replacing a standard filter.</xs:documentation>
-        </xs:annotation>
-      </xs:attribute>
-    </xs:complexType>
-  </xs:element>
-  <xs:attributeGroup name="after">
-    <xs:attribute name="after" use="required" type="security:named-security-filter">
+   </xs:group>
+   <xs:element name="custom-filter">
       <xs:annotation>
-        <xs:documentation>The filter immediately after which the custom-filter should be placed in
-          the chain. This feature will only be needed by advanced users who wish to mix their own
-          filters into the security filter chain and have some knowledge of the standard Spring
-          Security filters. The filter names map to specific Spring Security implementation filters.
-        </xs:documentation>
+         <xs:documentation>Used to indicate that a filter bean declaration should be incorporated
+            into the security filter chain. If neither the 'after' or 'before' options are supplied,
+            then the filter must implement the Ordered interface directly. </xs:documentation>
       </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="before">
-    <xs:attribute name="before" use="required" type="security:named-security-filter">
-      <xs:annotation>
-        <xs:documentation>The filter immediately before which the custom-filter should be placed in
-          the chain</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:attributeGroup name="position">
-    <xs:attribute name="position" use="required" type="security:named-security-filter">
-      <xs:annotation>
-        <xs:documentation>The explicit position at which the custom-filter should be placed in the
-          chain. Use if you are replacing a standard filter.</xs:documentation>
-      </xs:annotation>
-    </xs:attribute>
-  </xs:attributeGroup>
-  <xs:simpleType name="named-security-filter">
-    <xs:restriction base="xs:token">
-      <xs:enumeration value="FIRST"/>
-      <xs:enumeration value="CHANNEL_FILTER"/>
-      <xs:enumeration value="CONCURRENT_SESSION_FILTER"/>
-      <xs:enumeration value="SESSION_CONTEXT_INTEGRATION_FILTER"/>
-      <xs:enumeration value="LOGOUT_FILTER"/>
-      <xs:enumeration value="X509_FILTER"/>
-      <xs:enumeration value="PRE_AUTH_FILTER"/>
-      <xs:enumeration value="CAS_PROCESSING_FILTER"/>
-      <xs:enumeration value="AUTHENTICATION_PROCESSING_FILTER"/>
-      <xs:enumeration value="OPENID_PROCESSING_FILTER"/>
-      <xs:enumeration value="BASIC_PROCESSING_FILTER"/>
-      <xs:enumeration value="SERVLET_API_SUPPORT_FILTER"/>
-      <xs:enumeration value="REMEMBER_ME_FILTER"/>
-      <xs:enumeration value="ANONYMOUS_FILTER"/>
-      <xs:enumeration value="EXCEPTION_TRANSLATION_FILTER"/>
-      <xs:enumeration value="NTLM_FILTER"/>
-      <xs:enumeration value="FILTER_SECURITY_INTERCEPTOR"/>
-      <xs:enumeration value="SWITCH_USER_FILTER"/>
-      <xs:enumeration value="LAST"/>
-    </xs:restriction>
-  </xs:simpleType>
+      <xs:complexType>
+         <xs:attribute name="after" type="security:named-security-filter">
+            <xs:annotation>
+               <xs:documentation>The filter immediately after which the custom-filter should be
+                  placed in the chain. This feature will only be needed by advanced users who wish
+                  to mix their own filters into the security filter chain and have some knowledge of
+                  the standard Spring Security filters. The filter names map to specific Spring
+                  Security implementation filters. </xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+         <xs:attribute name="before" type="security:named-security-filter">
+            <xs:annotation>
+               <xs:documentation>The filter immediately before which the custom-filter should be
+                  placed in the chain</xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+         <xs:attribute name="position" type="security:named-security-filter">
+            <xs:annotation>
+               <xs:documentation>The explicit position at which the custom-filter should be placed
+                  in the chain. Use if you are replacing a standard filter.</xs:documentation>
+            </xs:annotation>
+         </xs:attribute>
+      </xs:complexType>
+   </xs:element>
+   <xs:attributeGroup name="after">
+      <xs:attribute name="after" use="required" type="security:named-security-filter">
+         <xs:annotation>
+            <xs:documentation>The filter immediately after which the custom-filter should be placed
+               in the chain. This feature will only be needed by advanced users who wish to mix
+               their own filters into the security filter chain and have some knowledge of the
+               standard Spring Security filters. The filter names map to specific Spring Security
+               implementation filters. </xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="before">
+      <xs:attribute name="before" use="required" type="security:named-security-filter">
+         <xs:annotation>
+            <xs:documentation>The filter immediately before which the custom-filter should be placed
+               in the chain</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:attributeGroup name="position">
+      <xs:attribute name="position" use="required" type="security:named-security-filter">
+         <xs:annotation>
+            <xs:documentation>The explicit position at which the custom-filter should be placed in
+               the chain. Use if you are replacing a standard filter.</xs:documentation>
+         </xs:annotation>
+      </xs:attribute>
+   </xs:attributeGroup>
+   <xs:simpleType name="named-security-filter">
+      <xs:restriction base="xs:token">
+         <xs:enumeration value="FIRST"/>
+         <xs:enumeration value="CHANNEL_FILTER"/>
+         <xs:enumeration value="CONCURRENT_SESSION_FILTER"/>
+         <xs:enumeration value="SESSION_CONTEXT_INTEGRATION_FILTER"/>
+         <xs:enumeration value="LOGOUT_FILTER"/>
+         <xs:enumeration value="X509_FILTER"/>
+         <xs:enumeration value="PRE_AUTH_FILTER"/>
+         <xs:enumeration value="CAS_PROCESSING_FILTER"/>
+         <xs:enumeration value="AUTHENTICATION_PROCESSING_FILTER"/>
+         <xs:enumeration value="OPENID_PROCESSING_FILTER"/>
+         <xs:enumeration value="BASIC_PROCESSING_FILTER"/>
+         <xs:enumeration value="SERVLET_API_SUPPORT_FILTER"/>
+         <xs:enumeration value="REMEMBER_ME_FILTER"/>
+         <xs:enumeration value="ANONYMOUS_FILTER"/>
+         <xs:enumeration value="EXCEPTION_TRANSLATION_FILTER"/>
+         <xs:enumeration value="NTLM_FILTER"/>
+         <xs:enumeration value="FILTER_SECURITY_INTERCEPTOR"/>
+         <xs:enumeration value="SWITCH_USER_FILTER"/>
+         <xs:enumeration value="LAST"/>
+      </xs:restriction>
+   </xs:simpleType>
 </xs:schema>

config/src/main/resources/org/springframework/security/config/spring-security.xsl

@@ -10,7 +10,7 @@
     <xsl:output method="xml" indent="yes"/>
 
     <xsl:variable name="elts-to-inline">
-        <xsl:text>,access-denied-handler,anonymous,concurrent-session-control,filter-chain,form-login,http-basic,intercept-url,logout,password-encoder,port-mappings,port-mapper,password-compare,protect,protect-pointcut,pre-post-annotation-handling,pre-invocation-advice,post-invocation-advice,invocation-attribute-factory,remember-me,salt-source,x509,</xsl:text>
+        <xsl:text>,access-denied-handler,anonymous,concurrent-session-control,user,port-mapping,openid-login,expression-handler,filter-chain,form-login,http-basic,intercept-url,logout,password-encoder,port-mappings,port-mapper,password-compare,protect,protect-pointcut,pre-post-annotation-handling,pre-invocation-advice,post-invocation-advice,invocation-attribute-factory,remember-me,salt-source,x509,</xsl:text>
     </xsl:variable>
 
     <xsl:template match="xs:element">

config/src/test/java/org/springframework/security/config/FilterInvocationSecurityMetadataSourceBeanDefinitionParserTests.java → config/src/test/java/org/springframework/security/config/FilterSecurityMetadataSourceBeanDefinitionParserTests.java

@@ -23,7 +23,7 @@ import org.w3c.dom.Element;
  * @author Luke Taylor
  * @version $Id$
  */
-public class FilterInvocationSecurityMetadataSourceBeanDefinitionParserTests {
+public class FilterSecurityMetadataSourceBeanDefinitionParserTests {
     private AbstractXmlApplicationContext appContext;
 
     @After
@@ -46,9 +46,9 @@ public class FilterInvocationSecurityMetadataSourceBeanDefinitionParserTests {
     @Test
     public void parsingMinimalConfigurationIsSuccessful() {
         setContext(
-                "<filter-invocation-definition-source id='fids'>" +
+                "<filter-security-metadata-source id='fids'>" +
                 "   <intercept-url pattern='/**' access='ROLE_A'/>" +
-                "</filter-invocation-definition-source>");
+                "</filter-security-metadata-source>");
         DefaultFilterInvocationSecurityMetadataSource fids = (DefaultFilterInvocationSecurityMetadataSource) appContext.getBean("fids");
         List<? extends ConfigAttribute> cad = fids.getAttributes(createFilterInvocation("/anything", "GET"));
         assertNotNull(cad);
@@ -61,11 +61,11 @@ public class FilterInvocationSecurityMetadataSourceBeanDefinitionParserTests {
                 "<http auto-config='true'/>" +
                 "<b:bean id='fsi' class='org.springframework.security.web.access.intercept.FilterSecurityInterceptor' autowire='byType'>" +
                 "   <b:property name='securityMetadataSource'>" +
-                "       <filter-invocation-definition-source>" +
+                "       <filter-security-metadata-source>" +
                 "           <intercept-url pattern='/secure/extreme/**' access='ROLE_SUPERVISOR'/>" +
                 "           <intercept-url pattern='/secure/**' access='ROLE_USER'/>" +
                 "           <intercept-url pattern='/**' access='ROLE_USER'/>" +
-                "       </filter-invocation-definition-source>" +
+                "       </filter-security-metadata-source>" +
                 "   </b:property>" +
                 "</b:bean>" + ConfigTestUtils.AUTH_PROVIDER_XML);
 

config/src/test/resources/namespace-usage.xml

@@ -16,10 +16,17 @@
 
     <global-method-security run-as-manager-ref="myRunAsManager">
         <pre-post-annotation-handling>
-            <
+            <invocation-attribute-factory ref=""/>
+            <pre-invocation-advice ref=""/>
+            <post-invocation-advice ref=""/>
         </pre-post-annotation-handling>
     </global-method-security>
 
+    <filter-security-metadata-source>
+        <intercept-url pattern=""/>
+    </filter-security-metadata-source>
+    
+    
     <http>
         <access-denied-handler error-page="/go-away.html"/>
         <intercept-url pattern="/**" access="ROLE_USER" />

docs/manual/src/docbook/anon-auth-provider.xml

@@ -1,47 +1,41 @@
 <chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="anonymous">
-
-<info><title>Anonymous Authentication</title></info>
-
-
-<section xml:id="anonymous-overview">
-    <info><title>Overview</title></info>
-
-    <para>Particularly in the case of web request URI security, sometimes
-        it is more convenient to assign configuration attributes against every
-        possible secure object invocation. Put differently, sometimes it is
-        nice to say <literal>ROLE_SOMETHING</literal> is required by default
-        and only allow certain exceptions to this rule, such as for login,
-        logout and home pages of an application. There are also other
-        situations where anonymous authentication would be desired, such as
-        when an auditing interceptor queries the
-        <classname>SecurityContextHolder</classname> to identify which principal
-        was responsible for a given operation. Such classes can be authored
-        with more robustness if they know the
-        <classname>SecurityContextHolder</classname> always contains an
-        <interfacename>Authentication</interfacename> object, and never
-        <literal>null</literal>.</para>
-</section>
-
-<section xml:id="anonymous-config">
-    <info><title>Configuration</title></info>
-
-    <para>Spring Security provides three classes that together provide an
-        anonymous authentication feature.
-        <literal>AnonymousAuthenticationToken</literal> is an implementation
-        of <interfacename>Authentication</interfacename>, and stores the
-        <interfacename>GrantedAuthority</interfacename>[]s which apply to the anonymous
-        principal. There is a corresponding
-        <literal>AnonymousAuthenticationProvider</literal>, which is chained
-        into the <literal>ProviderManager</literal> so that
-        <literal>AnonymousAuthenticationTokens</literal> are accepted.
-        Finally, there is an AnonymousProcessingFilter, which is chained after
-        the normal authentication mechanisms and automatically add an
-        <literal>AnonymousAuthenticationToken</literal> to the
-        <classname>SecurityContextHolder</classname> if there is no existing
-        <interfacename>Authentication</interfacename> held there. The definition of the
-        filter and authentication provider appears as follows:</para>
-
-    <para><programlisting>
+    <info>
+        <title>Anonymous Authentication</title>
+    </info>
+    <section xml:id="anonymous-overview">
+        <info>
+            <title>Overview</title>
+        </info>
+        <para>Particularly in the case of web request URI security, sometimes it is more convenient
+            to assign configuration attributes against every possible secure object invocation. Put
+            differently, sometimes it is nice to say <literal>ROLE_SOMETHING</literal> is required
+            by default and only allow certain exceptions to this rule, such as for login, logout and
+            home pages of an application. There are also other situations where anonymous
+            authentication would be desired, such as when an auditing interceptor queries the
+                <classname>SecurityContextHolder</classname> to identify which principal was
+            responsible for a given operation. Such classes can be authored with more robustness if
+            they know the <classname>SecurityContextHolder</classname> always contains an
+                <interfacename>Authentication</interfacename> object, and never
+                <literal>null</literal>.</para>
+    </section>
+    <section xml:id="anonymous-config">
+        <info>
+            <title>Configuration</title>
+        </info>
+        <para>Spring Security provides three classes that together provide an anonymous
+            authentication feature. <literal>AnonymousAuthenticationToken</literal> is an
+            implementation of <interfacename>Authentication</interfacename>, and stores the
+                <interfacename>GrantedAuthority</interfacename>[]s which apply to the anonymous
+            principal. There is a corresponding <literal>AnonymousAuthenticationProvider</literal>,
+            which is chained into the <literal>ProviderManager</literal> so that
+                <literal>AnonymousAuthenticationTokens</literal> are accepted. Finally, there is an
+            AnonymousProcessingFilter, which is chained after the normal authentication mechanisms
+            and automatically add an <literal>AnonymousAuthenticationToken</literal> to the
+                <classname>SecurityContextHolder</classname> if there is no existing
+                <interfacename>Authentication</interfacename> held there. The definition of the
+            filter and authentication provider appears as follows:</para>
+        <para>
+            <programlisting>
 <![CDATA[
 <bean id="anonymousProcessingFilter"
     class="org.springframework.security.web.authentication.AnonymousProcessingFilter">
@@ -53,53 +47,44 @@
     class="org.springframework.security.authentication.AnonymousAuthenticationProvider">
   <property name="key" value="foobar"/>
 </bean>]]>
-    </programlisting></para>
-
-    <para>The <literal>key</literal> is shared between the filter and
-        authentication provider, so that tokens created by the former are
-        accepted by the latter. The <literal>userAttribute</literal> is
-        expressed in the form of
-        <literal>usernameInTheAuthenticationToken,grantedAuthority[,grantedAuthority]</literal>.
-        This is the same syntax as used after the equals sign for
-        <literal>InMemoryDaoImpl</literal>'s <literal>userMap</literal>
-        property.</para>
-
-    <para>As explained earlier, the benefit of anonymous authentication is
-        that all URI patterns can have security applied to them. For
-        example:</para>
-
-    <para><programlisting>
+    </programlisting>
+        </para>
+        <para>The <literal>key</literal> is shared between the filter and authentication provider,
+            so that tokens created by the former are accepted by the latter. The
+                <literal>userAttribute</literal> is expressed in the form of
+                <literal>usernameInTheAuthenticationToken,grantedAuthority[,grantedAuthority]</literal>.
+            This is the same syntax as used after the equals sign for
+                <literal>InMemoryDaoImpl</literal>'s <literal>userMap</literal> property.</para>
+        <para>As explained earlier, the benefit of anonymous authentication is that all URI patterns
+            can have security applied to them. For example:</para>
+        <para><programlisting>
 <![CDATA[
 <bean id="filterInvocationInterceptor"
     class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor">
   <property name="authenticationManager" ref="authenticationManager"/>
   <property name="accessDecisionManager" ref="httpRequestAccessDecisionManager"/>
-  <property name="objectDefinitionSource">
-    <security:filter-invocation-definition-source>
+  <property name="securityMetadata">
+    <security:filter-security-metadata-source>
       <security:intercept-url pattern='/index.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
       <security:intercept-url pattern='/hello.htm' access='ROLE_ANONYMOUS,ROLE_USER'/>
       <security:intercept-url pattern='/logoff.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
       <security:intercept-url pattern='/login.jsp' access='ROLE_ANONYMOUS,ROLE_USER'/>
       <security:intercept-url pattern='/**' access='ROLE_USER'/>
-    </security:filter-invocation-definition-source>" +
+    </security:filter-security-metadata-source>" +
   </property>
 </bean>]]>
-    </programlisting>Rounding out the anonymous authentication discussion
-        is the <literal>AuthenticationTrustResolver</literal> interface, with
-        its corresponding <literal>AuthenticationTrustResolverImpl</literal>
-        implementation. This interface provides an
-        <literal>isAnonymous(Authentication)</literal> method, which allows
-        interested classes to take into account this special type of
-        authentication status. The
-        <classname>ExceptionTranslationFilter</classname> uses this interface in
-        processing <literal>AccessDeniedException</literal>s. If an
-        <literal>AccessDeniedException</literal> is thrown, and the
-        authentication is of an anonymous type, instead of throwing a 403
-        (forbidden) response, the filter will instead commence the
-        <interfacename>AuthenticationEntryPoint</interfacename> so the principal can
-        authenticate properly. This is a necessary distinction, otherwise
-        principals would always be deemed "authenticated" and never be given
-        an opportunity to login via form, basic, digest or some other normal
-        authentication mechanism</para>
-</section>
+    </programlisting>Rounding out the anonymous authentication discussion is the
+                <literal>AuthenticationTrustResolver</literal> interface, with its corresponding
+                <literal>AuthenticationTrustResolverImpl</literal> implementation. This interface
+            provides an <literal>isAnonymous(Authentication)</literal> method, which allows
+            interested classes to take into account this special type of authentication status. The
+                <classname>ExceptionTranslationFilter</classname> uses this interface in processing
+                <literal>AccessDeniedException</literal>s. If an
+                <literal>AccessDeniedException</literal> is thrown, and the authentication is of an
+            anonymous type, instead of throwing a 403 (forbidden) response, the filter will instead
+            commence the <interfacename>AuthenticationEntryPoint</interfacename> so the principal
+            can authenticate properly. This is a necessary distinction, otherwise principals would
+            always be deemed "authenticated" and never be given an opportunity to login via form,
+            basic, digest or some other normal authentication mechanism</para>
+    </section>
 </chapter>

docs/manual/src/docbook/channel-security.xml

@@ -1,52 +1,49 @@
-<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="channel-security" xmlns:xlink="http://www.w3.org/1999/xlink">
-
-<info><title>Channel Security</title></info>
-
-<section xml:id="channel-security-overview">
-    <info><title>Overview</title></info>
-    
-    <para>In addition to coordinating the authentication and authorization
-        requirements of your application, Spring Security is also able to
-        ensure unauthenticated web requests have certain properties. These
-        properties may include being of a particular transport type, having a
-        particular <literal>HttpSession</literal> attribute set and so on. The
-        most common requirement is for your web requests to be received using
-        a particular transport protocol, such as HTTPS.</para>
-    
-    <para>An important issue in considering transport security is that of
-        session hijacking. Your web container manages a
-        <literal>HttpSession</literal> by reference to a
-        <literal>jsessionid</literal> that is sent to user agents either via a
-        cookie or URL rewriting. If the <literal>jsessionid</literal> is ever
-        sent over HTTP, there is a possibility that session identifier can be
-        intercepted and used to impersonate the user after they complete the
-        authentication process. This is because most web containers maintain
-        the same session identifier for a given user, even after they switch
-        from HTTP to HTTPS pages.</para>
-    
-    <para>If session hijacking is considered too significant a risk for
-        your particular application, the only option is to use HTTPS for every
-        request. This means the <literal>jsessionid</literal> is never sent
-        across an insecure channel. You will need to ensure your
-        <literal>web.xml</literal>-defined
-        <literal>&lt;welcome-file&gt;</literal> points to an HTTPS location,
-        and the application never directs the user to an HTTP location. Spring
-        Security provides a solution to assist with the latter.</para>
-</section>
-
-<section xml:id="channel-security-config">
-    <info><title>Configuration</title></info>
-    <para>Channel security is supported by the <link xlink:href="#ns-requires-channel">security namespace</link>
-        by means of the <literal>requires-channel</literal> attribute on the <literal>&lt;intercept-url&gt;</literal>
-        element and this is the simplest (and recommended approach).</para>
-    <para>To confiure channel security explicitly, you would define the following the filter in your application
-        context:
-<programlisting><![CDATA[
+<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="channel-security"
+    xmlns:xlink="http://www.w3.org/1999/xlink">
+    <info>
+        <title>Channel Security</title>
+    </info>
+    <section xml:id="channel-security-overview">
+        <info>
+            <title>Overview</title>
+        </info>
+        <para>In addition to coordinating the authentication and authorization requirements of your
+            application, Spring Security is also able to ensure unauthenticated web requests have
+            certain properties. These properties may include being of a particular transport type,
+            having a particular <literal>HttpSession</literal> attribute set and so on. The most
+            common requirement is for your web requests to be received using a particular transport
+            protocol, such as HTTPS.</para>
+        <para>An important issue in considering transport security is that of session hijacking.
+            Your web container manages a <literal>HttpSession</literal> by reference to a
+                <literal>jsessionid</literal> that is sent to user agents either via a cookie or URL
+            rewriting. If the <literal>jsessionid</literal> is ever sent over HTTP, there is a
+            possibility that session identifier can be intercepted and used to impersonate the user
+            after they complete the authentication process. This is because most web containers
+            maintain the same session identifier for a given user, even after they switch from HTTP
+            to HTTPS pages.</para>
+        <para>If session hijacking is considered too significant a risk for your particular
+            application, the only option is to use HTTPS for every request. This means the
+                <literal>jsessionid</literal> is never sent across an insecure channel. You will
+            need to ensure your <literal>web.xml</literal>-defined
+                <literal>&lt;welcome-file&gt;</literal> points to an HTTPS location, and the
+            application never directs the user to an HTTP location. Spring Security provides a
+            solution to assist with the latter.</para>
+    </section>
+    <section xml:id="channel-security-config">
+        <info>
+            <title>Configuration</title>
+        </info>
+        <para>Channel security is supported by the <link xlink:href="#ns-requires-channel">security
+                namespace</link> by means of the <literal>requires-channel</literal> attribute on
+            the <literal>&lt;intercept-url&gt;</literal> element and this is the simplest (and
+            recommended approach).</para>
+        <para>To confiure channel security explicitly, you would define the following the filter in
+            your application context: <programlisting><![CDATA[
 <bean id="channelProcessingFilter" 
     class="org.springframework.security.web.access.channel.ChannelProcessingFilter">
   <property name="channelDecisionManager" ref="channelDecisionManager"/>
-  <property name="filterInvocationSecurityMetadataSource">
-    <security:filter-invocation-definition-source path-type="regex">
+  <property name="securityMetadataSource">
+    <security:filter-security-metadata-source path-type="regex">
       <security:intercept-url pattern="\A/secure/.*\Z" 
           access="REQUIRES_SECURE_CHANNEL"/>
       <security:intercept-url pattern="\A/acegilogin.jsp.*\Z" 
@@ -54,7 +51,7 @@
       <security:intercept-url pattern="\A/j_spring_security_check.*\Z" 
           access="REQUIRES_SECURE_CHANNEL"/>
       <security:intercept-url pattern="\A/.*\Z" access="ANY_CHANNEL"/>
-    </security:filter-invocation-definition-source>                
+    </security:filter-security-metadata-source>                
   </property>
 </bean>
     
@@ -73,95 +70,73 @@
 <bean id="insecureChannelProcessor" 
   class="org.springframework.security.access.channel.InsecureChannelProcessor"/>]]>      
 </programlisting>
-        Like <classname>FilterSecurityInterceptor</classname>, Apache Ant
-        style paths are also supported by the
-        <literal>ChannelProcessingFilter</literal>.</para>
-    
-    <para>The <literal>ChannelProcessingFilter</literal> operates by
-        filtering all web requests and determining the configuration
-        attributes that apply. It then delegates to the
-        <literal>ChannelDecisionManager</literal>. The default implementation,
-        <literal>ChannelDecisionManagerImpl</literal>, should suffice in most
-        cases. It simply delegates to the list of configured
-        <literal>ChannelProcessor</literal> instances. The attribute <literal>ANY_CHANNEL</literal>
-        can be used to override this behaviour and skip a particular URL. Otherwise, a
-        <literal>ChannelProcessor</literal> will review the request, and if it
-        is unhappy with the request (e.g. if it was received across the incorrect
-        transport protocol), it will perform a redirect, throw an exception or
-        take whatever other action is appropriate.</para>
-    
-    <para>Included with Spring Security are two concrete
-        <literal>ChannelProcessor</literal> implementations:
-        <literal>SecureChannelProcessor</literal> ensures requests with a
-        configuration attribute of <literal>REQUIRES_SECURE_CHANNEL</literal>
-        are received over HTTPS, whilst
-        <literal>InsecureChannelProcessor</literal> ensures requests with a
-        configuration attribute of
-        <literal>REQUIRES_INSECURE_CHANNEL</literal> are received over HTTP.
-        Both implementations delegate to a
-        <literal>ChannelEntryPoint</literal> if the required transport
-        protocol is not used. The two <literal>ChannelEntryPoint</literal>
-        implementations included with Spring Security simply redirect the
-        request to HTTP and HTTPS as appropriate. Appropriate defaults are
-        assigned to the <literal>ChannelProcessor</literal> implementations
-        for the configuration attribute keywords they respond to and the
-        <interfacename>ChannelEntryPoint</interfacename> they delegate to, although you
-        have the ability to override these using the application
-        context.</para>
-    
-    <para>Note that the redirections are absolute (eg
-        <literal>http://www.company.com:8080/app/page</literal>), not relative
-        (eg <literal>/app/page</literal>). During testing it was discovered
-        that Internet Explorer 6 Service Pack 1 has a bug whereby it does not
-        respond correctly to a redirection instruction which also changes the
-        port to use. Accordingly, absolute URLs are used in conjunction with
-        bug detection logic in the <classname>PortResolverImpl</classname> that is
-        wired up by default to many Spring Security beans. Please refer to the
-        JavaDocs for <classname>PortResolverImpl</classname> for further
-        details.</para>
-    
-    <para>You should note that using a secure channel is recommended if
-        usernames and passwords are to be kept secure during the login
-        process. If you do decide to use
-        <classname>ChannelProcessingFilter</classname> with form-based login,
-        please ensure that your login page is set to
-        <literal>REQUIRES_SECURE_CHANNEL</literal>, and that the
-        <literal>LoginUrlAuthenticationEntryPoint.forceHttps</literal>
-        property is <literal>true</literal>.</para>
-</section>
-
-<section xml:id="channel-security-conclusion">
-    <info><title>Conclusion</title></info>
-
-    <para>Once configured, using the channel security filter is very easy.
-        Simply request pages without regard to the protocol (ie HTTP or HTTPS)
-        or port (eg 80, 8080, 443, 8443 etc). Obviously you'll still need a
-        way of making the initial request (probably via the
-        <literal>web.xml</literal> <literal>&lt;welcome-file&gt;</literal> or
-        a well-known home page URL), but once this is done the filter will
-        perform redirects as defined by your application context.</para>
-    
-    <para>You can also add your own <literal>ChannelProcessor</literal>
-        implementations to the <literal>ChannelDecisionManagerImpl</literal>.
-        For example, you might set a <literal>HttpSession</literal> attribute
-        when a human user is detected via a "enter the contents of this
-        graphic" procedure. Your <literal>ChannelProcessor</literal> would
-        respond to say <literal>REQUIRES_HUMAN_USER</literal> configuration
-        attributes and redirect to an appropriate entry point to start the
-        human user validation process if the <literal>HttpSession</literal>
-        attribute is not currently set.</para>
-    
-    <para>To decide whether a security check belongs in a
-        <literal>ChannelProcessor</literal> or an
-        <interfacename>AccessDecisionVoter</interfacename>, remember that the former is
-        designed to handle unauthenticated requests, whilst the latter is
-        designed to handle authenticated requests. The latter therefore has
-        access to the granted authorities of the authenticated principal. In
-        addition, problems detected by a <literal>ChannelProcessor</literal>
-        will generally cause an HTTP/HTTPS redirection so its requirements can
-        be met, whilst problems detected by an
-        <interfacename>AccessDecisionVoter</interfacename> will ultimately result in an
-        <literal>AccessDeniedException</literal> (depending on the governing
-        <interfacename>AccessDecisionManager</interfacename>).</para>
-</section>
-</chapter>
+            Like <classname>FilterSecurityInterceptor</classname>, Apache Ant style paths are also
+            supported by the <literal>ChannelProcessingFilter</literal>.</para>
+        <para>The <literal>ChannelProcessingFilter</literal> operates by filtering all web requests
+            and determining the configuration attributes that apply. It then delegates to the
+                <literal>ChannelDecisionManager</literal>. The default implementation,
+                <literal>ChannelDecisionManagerImpl</literal>, should suffice in most cases. It
+            simply delegates to the list of configured <literal>ChannelProcessor</literal>
+            instances. The attribute <literal>ANY_CHANNEL</literal> can be used to override this
+            behaviour and skip a particular URL. Otherwise, a <literal>ChannelProcessor</literal>
+            will review the request, and if it is unhappy with the request (e.g. if it was received
+            across the incorrect transport protocol), it will perform a redirect, throw an exception
+            or take whatever other action is appropriate.</para>
+        <para>Included with Spring Security are two concrete <literal>ChannelProcessor</literal>
+            implementations: <literal>SecureChannelProcessor</literal> ensures requests with a
+            configuration attribute of <literal>REQUIRES_SECURE_CHANNEL</literal> are received over
+            HTTPS, whilst <literal>InsecureChannelProcessor</literal> ensures requests with a
+            configuration attribute of <literal>REQUIRES_INSECURE_CHANNEL</literal> are received
+            over HTTP. Both implementations delegate to a <literal>ChannelEntryPoint</literal> if
+            the required transport protocol is not used. The two
+                <literal>ChannelEntryPoint</literal> implementations included with Spring Security
+            simply redirect the request to HTTP and HTTPS as appropriate. Appropriate defaults are
+            assigned to the <literal>ChannelProcessor</literal> implementations for the
+            configuration attribute keywords they respond to and the
+                <interfacename>ChannelEntryPoint</interfacename> they delegate to, although you have
+            the ability to override these using the application context.</para>
+        <para>Note that the redirections are absolute (eg
+                <literal>http://www.company.com:8080/app/page</literal>), not relative (eg
+                <literal>/app/page</literal>). During testing it was discovered that Internet
+            Explorer 6 Service Pack 1 has a bug whereby it does not respond correctly to a
+            redirection instruction which also changes the port to use. Accordingly, absolute URLs
+            are used in conjunction with bug detection logic in the
+                <classname>PortResolverImpl</classname> that is wired up by default to many Spring
+            Security beans. Please refer to the JavaDocs for <classname>PortResolverImpl</classname>
+            for further details.</para>
+        <para>You should note that using a secure channel is recommended if usernames and passwords
+            are to be kept secure during the login process. If you do decide to use
+                <classname>ChannelProcessingFilter</classname> with form-based login, please ensure
+            that your login page is set to <literal>REQUIRES_SECURE_CHANNEL</literal>, and that the
+                <literal>LoginUrlAuthenticationEntryPoint.forceHttps</literal> property is
+                <literal>true</literal>.</para>
+    </section>
+    <section xml:id="channel-security-conclusion">
+        <info>
+            <title>Conclusion</title>
+        </info>
+        <para>Once configured, using the channel security filter is very easy. Simply request pages
+            without regard to the protocol (ie HTTP or HTTPS) or port (eg 80, 8080, 443, 8443 etc).
+            Obviously you'll still need a way of making the initial request (probably via the
+                <literal>web.xml</literal>
+            <literal>&lt;welcome-file&gt;</literal> or a well-known home page URL), but once this is
+            done the filter will perform redirects as defined by your application context.</para>
+        <para>You can also add your own <literal>ChannelProcessor</literal> implementations to the
+                <literal>ChannelDecisionManagerImpl</literal>. For example, you might set a
+                <literal>HttpSession</literal> attribute when a human user is detected via a "enter
+            the contents of this graphic" procedure. Your <literal>ChannelProcessor</literal> would
+            respond to say <literal>REQUIRES_HUMAN_USER</literal> configuration attributes and
+            redirect to an appropriate entry point to start the human user validation process if the
+                <literal>HttpSession</literal> attribute is not currently set.</para>
+        <para>To decide whether a security check belongs in a <literal>ChannelProcessor</literal> or
+            an <interfacename>AccessDecisionVoter</interfacename>, remember that the former is
+            designed to handle unauthenticated requests, whilst the latter is designed to handle
+            authenticated requests. The latter therefore has access to the granted authorities of
+            the authenticated principal. In addition, problems detected by a
+                <literal>ChannelProcessor</literal> will generally cause an HTTP/HTTPS redirection
+            so its requirements can be met, whilst problems detected by an
+                <interfacename>AccessDecisionVoter</interfacename> will ultimately result in an
+                <literal>AccessDeniedException</literal> (depending on the governing
+                <interfacename>AccessDecisionManager</interfacename>).</para>
+    </section>
+</chapter>

docs/manual/src/docbook/secured-objects.xml

@@ -1,36 +1,32 @@
-<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="secure-object-impls" xmlns:xlink="http://www.w3.org/1999/xlink">
-  <info><title>Secure Object Implementations</title></info>
-
+<chapter xmlns="http://docbook.org/ns/docbook" version="5.0" xml:id="secure-object-impls"
+  xmlns:xlink="http://www.w3.org/1999/xlink">
+  <info>
+    <title>Secure Object Implementations</title>
+  </info>
   <section xml:id="aop-alliance">
     <info>
       <title>AOP Alliance (MethodInvocation) Security Interceptor</title>
     </info>
-
-    <para>
-      Prior to Spring Security 2.0, securing <classname>MethodInvocation</classname>s needed quite a
-      lot of boiler plate configuration. Now the recommended approach for method security
-      is to use <link xlink:href="#ns-method-security">namespace configuration</link>.
-      This way the method security infrastructure beans are configured automatically for you so you don't really need to
-      know about the implementation classes. We'll just provide a quick overview of the classes that are involved here.
-    </para>
-
-    <para>
-      Method security in enforced using a <classname>MethodSecurityInterceptor</classname>, which secures
-     <classname>MethodInvocation</classname>s. Depending on the configuration approach, an interceptor may be specific to a single
-      bean or shared between multiple beans. The interceptor uses a <interfacename>MethodDefinitionSource</interfacename>
-      instance to obtain the configuration attributes that apply to a particular method invocation.
-      <classname>MapBasedMethodDefinitionSource</classname> is used to store configuration attributes keyed by method names
-      (which can be wildcarded) and will be used internally when the attributes are defined in the application context using
-      the <literal>&lt;intercept-methods&gt;</literal> or <literal>&lt;protect-point&gt;</literal> elements. Other implementations
-      will be used to handle annotation-based configuration.
-    </para>
-
+    <para> Prior to Spring Security 2.0, securing <classname>MethodInvocation</classname>s needed
+      quite a lot of boiler plate configuration. Now the recommended approach for method security is
+      to use <link xlink:href="#ns-method-security">namespace configuration</link>. This way the
+      method security infrastructure beans are configured automatically for you so you don't really
+      need to know about the implementation classes. We'll just provide a quick overview of the
+      classes that are involved here. </para>
+    <para> Method security in enforced using a <classname>MethodSecurityInterceptor</classname>,
+      which secures <classname>MethodInvocation</classname>s. Depending on the configuration
+      approach, an interceptor may be specific to a single bean or shared between multiple beans.
+      The interceptor uses a <interfacename>MethodDefinitionSource</interfacename> instance to
+      obtain the configuration attributes that apply to a particular method invocation.
+        <classname>MapBasedMethodDefinitionSource</classname> is used to store configuration
+      attributes keyed by method names (which can be wildcarded) and will be used internally when
+      the attributes are defined in the application context using the
+        <literal>&lt;intercept-methods&gt;</literal> or <literal>&lt;protect-point&gt;</literal>
+      elements. Other implementations will be used to handle annotation-based configuration. </para>
     <section>
       <title>Explicit MethodSecurityIterceptor Configuration</title>
-      <para>
-        You can of course configure a <classname>MethodSecurityIterceptor</classname> directly in your application context
-        for use with one of Spring AOP's proxying mechanisms:
-<programlisting><![CDATA[
+      <para> You can of course configure a <classname>MethodSecurityIterceptor</classname> directly
+        in your application context for use with one of Spring AOP's proxying mechanisms: <programlisting><![CDATA[
 <bean id="bankManagerSecurity"
     class="org.springframework.security.intercept.aopalliance.MethodSecurityInterceptor">
   <property name="authenticationManager" ref="authenticationManager"/>
@@ -43,37 +39,26 @@
     </value>
   </property>
 </bean> ]]>
-</programlisting>
-      </para>
+</programlisting></para>
     </section>
-
   </section>
-
   <section xml:id="aspectj">
     <info>
       <title>AspectJ (JoinPoint) Security Interceptor</title>
     </info>
-
-    <para>The AspectJ security interceptor is very similar to the AOP
-    Alliance security interceptor discussed in the previous section.
-    Indeed we will only discuss the differences in this section.</para>
-
-    <para>The AspectJ interceptor is named
-    <literal>AspectJSecurityInterceptor</literal>. Unlike the AOP Alliance
-    security interceptor, which relies on the Spring application context
-    to weave in the security interceptor via proxying, the
-    <literal>AspectJSecurityInterceptor</literal> is weaved in via the
-    AspectJ compiler. It would not be uncommon to use both types of
-    security interceptors in the same application, with
-    <literal>AspectJSecurityInterceptor</literal> being used for domain
-    object instance security and the AOP Alliance
-    <classname>MethodSecurityInterceptor</classname> being used for services
-    layer security.</para>
-
-    <para>Let's first consider how the
-    <literal>AspectJSecurityInterceptor</literal> is configured in the
-    Spring application context:</para>
-
+    <para>The AspectJ security interceptor is very similar to the AOP Alliance security interceptor
+      discussed in the previous section. Indeed we will only discuss the differences in this
+      section.</para>
+    <para>The AspectJ interceptor is named <literal>AspectJSecurityInterceptor</literal>. Unlike the
+      AOP Alliance security interceptor, which relies on the Spring application context to weave in
+      the security interceptor via proxying, the <literal>AspectJSecurityInterceptor</literal> is
+      weaved in via the AspectJ compiler. It would not be uncommon to use both types of security
+      interceptors in the same application, with <literal>AspectJSecurityInterceptor</literal> being
+      used for domain object instance security and the AOP Alliance
+        <classname>MethodSecurityInterceptor</classname> being used for services layer
+      security.</para>
+    <para>Let's first consider how the <literal>AspectJSecurityInterceptor</literal> is configured
+      in the Spring application context:</para>
     <programlisting><![CDATA[
 <bean id="bankManagerSecurity"
      class="org.springframework.security.intercept.aspectj.AspectJSecurityInterceptor">
@@ -87,23 +72,18 @@
     </value>
 </property>
 </bean>]]>        </programlisting>
-
     <para>As you can see, aside from the class name, the
-    <literal>AspectJSecurityInterceptor</literal> is exactly the same as
-    the AOP Alliance security interceptor. Indeed the two interceptors can
-    share the same <literal>securityMetadataSource</literal>, as the
-    <interfacename>SecurityMetadataSource</interfacename> works with
-    <literal>java.lang.reflect.Method</literal>s rather than an AOP
-    library-specific class. Of course, your access decisions have access
-    to the relevant AOP library-specific invocation (ie
-    <classname>MethodInvocation</classname> or <literal>JoinPoint</literal>)
-    and as such can consider a range of addition criteria when making
-    access decisions (such as method arguments).</para>
-
-    <para>Next you'll need to define an AspectJ <literal>aspect</literal>.
-    For example:</para>
-
-    <programlisting>
+        <literal>AspectJSecurityInterceptor</literal> is exactly the same as the AOP Alliance
+      security interceptor. Indeed the two interceptors can share the same
+        <literal>securityMetadataSource</literal>, as the
+        <interfacename>SecurityMetadataSource</interfacename> works with
+        <literal>java.lang.reflect.Method</literal>s rather than an AOP library-specific class. Of
+      course, your access decisions have access to the relevant AOP library-specific invocation (ie
+        <classname>MethodInvocation</classname> or <literal>JoinPoint</literal>) and as such can
+      consider a range of addition criteria when making access decisions (such as method
+      arguments).</para>
+    <para>Next you'll need to define an AspectJ <literal>aspect</literal>. For example:</para>
+    <programlisting language="java">
 package org.springframework.security.samples.aspectj;
 
 import org.springframework.security.intercept.aspectj.AspectJSecurityInterceptor;
@@ -144,22 +124,16 @@ public void afterPropertiesSet() throws Exception {
     throw new IllegalArgumentException("securityInterceptor required");
   }
 }</programlisting>
-
-    <para>In the above example, the security interceptor will be applied
-    to every instance of <literal>PersistableEntity</literal>, which is an
-    abstract class not shown (you can use any other class or
-    <literal>pointcut</literal> expression you like). For those curious,
-    <literal>AspectJCallback</literal> is needed because the
-    <literal>proceed();</literal> statement has special meaning only
-    within an <literal>around()</literal> body. The
-    <literal>AspectJSecurityInterceptor</literal> calls this anonymous
-    <literal>AspectJCallback</literal> class when it wants the target
-    object to continue.</para>
-
-    <para>You will need to configure Spring to load the aspect and wire it
-    with the <literal>AspectJSecurityInterceptor</literal>. A bean
-    declaration which achieves this is shown below:</para>
-
+    <para>In the above example, the security interceptor will be applied to every instance of
+        <literal>PersistableEntity</literal>, which is an abstract class not shown (you can use any
+      other class or <literal>pointcut</literal> expression you like). For those curious,
+        <literal>AspectJCallback</literal> is needed because the <literal>proceed();</literal>
+      statement has special meaning only within an <literal>around()</literal> body. The
+        <literal>AspectJSecurityInterceptor</literal> calls this anonymous
+        <literal>AspectJCallback</literal> class when it wants the target object to continue.</para>
+    <para>You will need to configure Spring to load the aspect and wire it with the
+        <literal>AspectJSecurityInterceptor</literal>. A bean declaration which achieves this is
+      shown below:</para>
     <programlisting><![CDATA[
 <bean id="domainObjectInstanceSecurityAspect"
    class="org.springframework.security.samples.aspectj.DomainObjectInstanceSecurityAspect"
@@ -167,23 +141,18 @@ public void afterPropertiesSet() throws Exception {
   <property name="securityInterceptor" ref="aspectJSecurityInterceptor"/>
 </bean>]]>
     </programlisting>
-
-    <para>That's it! Now you can create your beans from anywhere within
-    your application, using whatever means you think fit (eg <literal>new
-    Person();</literal>) and they will have the security interceptor
-    applied.</para>
+    <para>That's it! Now you can create your beans from anywhere within your application, using
+      whatever means you think fit (eg <literal>new Person();</literal>) and they will have the
+      security interceptor applied.</para>
   </section>
-
   <section xml:id="filter-invocation-authorization">
-    <info><title>FilterInvocation Security Interceptor</title></info>
-
-      <para>To secure <classname>FilterInvocation</classname>s, developers need
-    to add a <classname>FilterSecurityInterceptor</classname> to their filter chain.
-    A typical configuration example is provided below:</para>
-
-    <para>In the application context you will need to configure three
-    beans:</para>
-
+    <info>
+      <title>FilterInvocation Security Interceptor</title>
+    </info>
+    <para>To secure <classname>FilterInvocation</classname>s, developers need to add a
+        <classname>FilterSecurityInterceptor</classname> to their filter chain. A typical
+      configuration example is provided below:</para>
+    <para>In the application context you will need to configure three beans:</para>
     <programlisting>
 <![CDATA[
 <bean id="exceptionTranslationFilter"
@@ -202,93 +171,69 @@ public void afterPropertiesSet() throws Exception {
   <property name="authenticationManager" ref="authenticationManager"/>
   <property name="accessDecisionManager" ref="accessDecisionManager"/>
   <property name="securityMetadataSource">
-    <security:filter-invocation-definition-source>
+    <security:filter-security-metadata-source>
       <security:intercept-url pattern="/secure/super/**" access="ROLE_WE_DONT_HAVE"/>
       <security:intercept-url pattern="/secure/**" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
-    </security:filter-invocation-definition-source>
+    </security:filter-security-metadata-source>
   </property>
 </bean>]]>         </programlisting>
-
-    <para>The <classname>ExceptionTranslationFilter</classname> provides
-    the bridge between Java exceptions and HTTP responses. It is solely
-    concerned with maintaining the user interface. This filter does not do
-    any actual security enforcement. If an
-    <exceptionname>AuthenticationException</exceptionname> is detected,
-    the filter will call the AuthenticationEntryPoint to commence the
-    authentication process (e.g. a user login).</para>
-
-    <para>The <interfacename>AuthenticationEntryPoint</interfacename> will be called
-    if the user requests a secure HTTP resource but they are not
-    authenticated. The class handles presenting the appropriate response
-    to the user so that authentication can begin. Three concrete
-    implementations are provided with Spring Security:
-    <classname>LoginUrlAuthenticationEntryPoint</classname> for
-    commencing a form-based authentication,
-    <literal>BasicProcessingFilterEntryPoint</literal> for commencing a
-    HTTP Basic authentication process, and
-    <literal>CasProcessingFilterEntryPoint</literal> for commencing a
-    JA-SIG Central Authentication Service (CAS) login. The
-    <classname>LoginUrlAuthenticationEntryPoint</classname> and
-    <literal>CasProcessingFilterEntryPoint</literal> have optional
-    properties related to forcing the use of HTTPS, so please refer to the
-    JavaDocs if you require this.</para>
-
-    <para><classname>FilterSecurityInterceptor</classname> is responsible for
-    handling the security of HTTP resources. Like any other security
-    interceptor, it requires a reference to an
-    <interfacename>AuthenticationManager</interfacename> and an
-    <interfacename>AccessDecisionManager</interfacename>, which are both discussed in
-    separate sections below. The
-    <classname>FilterSecurityInterceptor</classname> is also configured with
-    configuration attributes that apply to different HTTP URL requests. A
-    full discussion of configuration attributes is provided in the High
-    Level Design section of this document.</para>
-
-    <para>The <classname>FilterSecurityInterceptor</classname> can be
-    configured with configuration attributes in two ways. The first,
-    which is shown above, is using the <literal>&lt;filter-invocation-definition-source&gt;</literal>
-    namespace element. This is similar to the <literal>&lt;filter-chain-map&gt;</literal>
-    used to configure a <classname>FilterChainProxy</classname> but the <literal>&lt;intercept-url&gt;</literal>
-    child elements only use the <literal>pattern</literal> and <literal>access</literal> attributes.
-    The second is by writing your own
-    <interfacename>SecurityMetadataSource</interfacename>, although this is beyond the
-    scope of this document. Irrespective of the approach used, the
-    <interfacename>SecurityMetadataSource</interfacename> is responsible for returning
-    a <literal>List&lt;ConfigAttribute&gt;</literal> containing
-    all of the configuration attributes associated with a single secure
-    HTTP URL.</para>
-
+    <para>The <classname>ExceptionTranslationFilter</classname> provides the bridge between Java
+      exceptions and HTTP responses. It is solely concerned with maintaining the user interface.
+      This filter does not do any actual security enforcement. If an
+        <exceptionname>AuthenticationException</exceptionname> is detected, the filter will call the
+      AuthenticationEntryPoint to commence the authentication process (e.g. a user login).</para>
+    <para>The <interfacename>AuthenticationEntryPoint</interfacename> will be called if the user
+      requests a secure HTTP resource but they are not authenticated. The class handles presenting
+      the appropriate response to the user so that authentication can begin. Three concrete
+      implementations are provided with Spring Security:
+        <classname>LoginUrlAuthenticationEntryPoint</classname> for commencing a form-based
+      authentication, <literal>BasicProcessingFilterEntryPoint</literal> for commencing a HTTP Basic
+      authentication process, and <literal>CasProcessingFilterEntryPoint</literal> for commencing a
+      JA-SIG Central Authentication Service (CAS) login. The
+        <classname>LoginUrlAuthenticationEntryPoint</classname> and
+        <literal>CasProcessingFilterEntryPoint</literal> have optional properties related to forcing
+      the use of HTTPS, so please refer to the JavaDocs if you require this.</para>
+    <para><classname>FilterSecurityInterceptor</classname> is responsible for handling the security
+      of HTTP resources. Like any other security interceptor, it requires a reference to an
+        <interfacename>AuthenticationManager</interfacename> and an
+        <interfacename>AccessDecisionManager</interfacename>, which are both discussed in separate
+      sections below. The <classname>FilterSecurityInterceptor</classname> is also configured with
+      configuration attributes that apply to different HTTP URL requests. A full discussion of
+      configuration attributes is provided in the High Level Design section of this document.</para>
+    <para>The <classname>FilterSecurityInterceptor</classname> can be configured with configuration
+      attributes in two ways. The first, which is shown above, is using the
+        <literal>&lt;filter-security-metadata-source&gt;</literal> namespace element. This is
+      similar to the <literal>&lt;filter-chain-map&gt;</literal> used to configure a
+        <classname>FilterChainProxy</classname> but the <literal>&lt;intercept-url&gt;</literal>
+      child elements only use the <literal>pattern</literal> and <literal>access</literal>
+      attributes. The second is by writing your own
+        <interfacename>SecurityMetadataSource</interfacename>, although this is beyond the scope of
+      this document. Irrespective of the approach used, the
+        <interfacename>SecurityMetadataSource</interfacename> is responsible for returning a
+        <literal>List&lt;ConfigAttribute&gt;</literal> containing all of the configuration
+      attributes associated with a single secure HTTP URL.</para>
     <para>It should be noted that the
-    <literal>FilterSecurityInterceptor.setSecurityMetadataSource()</literal>
-    method actually expects an instance of
-    <interfacename>FilterInvocationDefinitionSource</interfacename>. This is a marker
-    interface which subclasses <interfacename>SecurityMetadataSource</interfacename>.
-    It simply denotes the <interfacename>SecurityMetadataSource</interfacename>
-    understands <classname>FilterInvocation</classname>s. In the interests of
-    simplicity we'll continue to refer to the
-    <interfacename>FilterInvocationDefinitionSource</interfacename> as an
-    <interfacename>SecurityMetadataSource</interfacename>, as the distinction is of
-    little relevance to most users of the
-    <classname>FilterSecurityInterceptor</classname>.</para>
-
-    <para>When using the namespace option to configure the interceptor,
-        commas are used to delimit the different configuration
-    attributes that apply to each HTTP URL. Each configuration attribute
-    is assigned into its own <literal>SecurityConfig</literal> object. The
-    <literal>SecurityConfig</literal> object is discussed in the High
-    Level Design section. The <interfacename>SecurityMetadataSource</interfacename>
-    created by the property editor,
-    <interfacename>FilterInvocationDefinitionSource</interfacename>, matches
-    configuration attributes against <literal>FilterInvocations</literal>
-    based on expression evaluation of the request URL. Two standard
-    expression syntaxes are supported. The default is to treat all
-    expressions as Apache Ant paths and regular expressions are also supported
-    for ore complex cases. The <literal>path-type</literal> attribute is used
-    to specify the type of pattern being used. It is not possible to
-    mix expression syntaxes within the same definition. For example, the
-    previous configuration using regular expressions instead of Ant paths would be
-    written as follows:</para>
-
+        <literal>FilterSecurityInterceptor.setSecurityMetadataSource()</literal> method actually
+      expects an instance of <interfacename>FilterInvocationDefinitionSource</interfacename>. This
+      is a marker interface which subclasses <interfacename>SecurityMetadataSource</interfacename>.
+      It simply denotes the <interfacename>SecurityMetadataSource</interfacename> understands
+        <classname>FilterInvocation</classname>s. In the interests of simplicity we'll continue to
+      refer to the <interfacename>FilterInvocationDefinitionSource</interfacename> as an
+        <interfacename>SecurityMetadataSource</interfacename>, as the distinction is of little
+      relevance to most users of the <classname>FilterSecurityInterceptor</classname>.</para>
+    <para>When using the namespace option to configure the interceptor, commas are used to delimit
+      the different configuration attributes that apply to each HTTP URL. Each configuration
+      attribute is assigned into its own <literal>SecurityConfig</literal> object. The
+        <literal>SecurityConfig</literal> object is discussed in the High Level Design section. The
+        <interfacename>SecurityMetadataSource</interfacename> created by the property editor,
+        <interfacename>FilterInvocationDefinitionSource</interfacename>, matches configuration
+      attributes against <literal>FilterInvocations</literal> based on expression evaluation of the
+      request URL. Two standard expression syntaxes are supported. The default is to treat all
+      expressions as Apache Ant paths and regular expressions are also supported for ore complex
+      cases. The <literal>path-type</literal> attribute is used to specify the type of pattern being
+      used. It is not possible to mix expression syntaxes within the same definition. For example,
+      the previous configuration using regular expressions instead of Ant paths would be written as
+      follows:</para>
     <programlisting><![CDATA[
 <bean id="filterInvocationInterceptor"
      class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
@@ -296,32 +241,25 @@ public void afterPropertiesSet() throws Exception {
   <property name="accessDecisionManager" ref="accessDecisionManager"/>
   <property name="runAsManager" ref="runAsManager"/>
   <property name="securityMetadataSource">
-    <security:filter-invocation-definition-source path-type="regex">
+    <security:filter-security-metadata-source path-type="regex">
       <security:intercept-url pattern="\A/secure/super/.*\Z" access="ROLE_WE_DONT_HAVE"/>
       <security:intercept-url pattern="\A/secure/.*\" access="ROLE_SUPERVISOR,ROLE_TELLER"/>
-    </security:filter-invocation-definition-source>
+    </security:filter-security-metadata-source>
   </property>
 </bean>]]>        </programlisting>
-
-    <para>Irrespective of the type of expression syntax used, expressions
-    are always evaluated in the order they are defined. Thus it is
-    important that more specific expressions are defined higher in the
-    list than less specific expressions. This is reflected in our example
-    above, where the more specific <literal>/secure/super/</literal>
-    pattern appears higher than the less specific
-    <literal>/secure/</literal> pattern. If they were reversed, the
-    <literal>/secure/</literal> pattern would always match and the
-    <literal>/secure/super/</literal> pattern would never be
-    evaluated.</para>
-
-    <para>As with other security interceptors, the
-    <literal>validateConfigAttributes</literal> property is observed. When
-    set to <literal>true</literal> (the default), at startup time the
-    <classname>FilterSecurityInterceptor</classname> will evaluate if the
-    provided configuration attributes are valid. It does this by checking
-    each configuration attribute can be processed by either the
-    <interfacename>AccessDecisionManager</interfacename> or the
-    <literal>RunAsManager</literal>. If neither of these can process a
-    given configuration attribute, an exception is thrown.</para>
+    <para>Irrespective of the type of expression syntax used, expressions are always evaluated in
+      the order they are defined. Thus it is important that more specific expressions are defined
+      higher in the list than less specific expressions. This is reflected in our example above,
+      where the more specific <literal>/secure/super/</literal> pattern appears higher than the less
+      specific <literal>/secure/</literal> pattern. If they were reversed, the
+        <literal>/secure/</literal> pattern would always match and the
+        <literal>/secure/super/</literal> pattern would never be evaluated.</para>
+    <para>As with other security interceptors, the <literal>validateConfigAttributes</literal>
+      property is observed. When set to <literal>true</literal> (the default), at startup time the
+        <classname>FilterSecurityInterceptor</classname> will evaluate if the provided configuration
+      attributes are valid. It does this by checking each configuration attribute can be processed
+      by either the <interfacename>AccessDecisionManager</interfacename> or the
+        <literal>RunAsManager</literal>. If neither of these can process a given configuration
+      attribute, an exception is thrown.</para>
   </section>
 </chapter>

itest/context/src/test/resources/filter-chain-performance-app-context.xml

@@ -92,11 +92,11 @@
         <property name="authenticationManager" ref="authenticationManager"/>
         <property name="accessDecisionManager" ref="accessDecisionManager"/>
         <property name="securityMetadataSource">
-            <sec:filter-invocation-definition-source>
+            <sec:filter-security-metadata-source>
                 <sec:intercept-url pattern="/secure/extreme/**" access="ROLE_2"/>
                 <sec:intercept-url pattern="/secure/**" access="ROLE_1"/>
                 <sec:intercept-url pattern="/**" access="ROLE_0"/>
-            </sec:filter-invocation-definition-source>
+            </sec:filter-security-metadata-source>
         </property>
     </bean>
 

web/src/main/java/org/springframework/security/web/access/channel/ChannelProcessingFilter.java

@@ -51,15 +51,15 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
     //~ Instance fields ================================================================================================
 
     private ChannelDecisionManager channelDecisionManager;
-    private FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource;
+    private FilterInvocationSecurityMetadataSource securityMetadataSource;
 
     //~ Methods ========================================================================================================
 
     public void afterPropertiesSet() throws Exception {
-        Assert.notNull(filterInvocationSecurityMetadataSource, "filterInvocationSecurityMetadataSource must be specified");
+        Assert.notNull(securityMetadataSource, "securityMetadataSource must be specified");
         Assert.notNull(channelDecisionManager, "channelDecisionManager must be specified");
 
-        Collection<ConfigAttribute> attrDefs = this.filterInvocationSecurityMetadataSource.getAllConfigAttributes();
+        Collection<ConfigAttribute> attrDefs = this.securityMetadataSource.getAllConfigAttributes();
 
         if (attrDefs == null) {
             if (logger.isWarnEnabled()) {
@@ -91,7 +91,7 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
             throws IOException, ServletException {
 
         FilterInvocation fi = new FilterInvocation(request, response, chain);
-        List<ConfigAttribute> attr = this.filterInvocationSecurityMetadataSource.getAttributes(fi);
+        List<ConfigAttribute> attr = this.securityMetadataSource.getAttributes(fi);
 
         if (attr != null) {
             if (logger.isDebugEnabled()) {
@@ -112,16 +112,16 @@ public class ChannelProcessingFilter extends SpringSecurityFilter implements Ini
         return channelDecisionManager;
     }
 
-    public FilterInvocationSecurityMetadataSource getFilterInvocationSecurityMetadataSource() {
-        return filterInvocationSecurityMetadataSource;
+    public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
+        return securityMetadataSource;
     }
 
     public void setChannelDecisionManager(ChannelDecisionManager channelDecisionManager) {
         this.channelDecisionManager = channelDecisionManager;
     }
 
-    public void setFilterInvocationSecurityMetadataSource(FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource) {
-        this.filterInvocationSecurityMetadataSource = filterInvocationSecurityMetadataSource;
+    public void setSecurityMetadataSource(FilterInvocationSecurityMetadataSource filterInvocationSecurityMetadataSource) {
+        this.securityMetadataSource = filterInvocationSecurityMetadataSource;
     }
 
     public int getOrder() {

web/src/test/java/org/springframework/security/web/access/channel/ChannelProcessingFilterTests.java

@@ -15,7 +15,7 @@
 
 package org.springframework.security.web.access.channel;
 
-import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.*;
 import static org.mockito.Mockito.mock;
 
 import java.io.IOException;
@@ -31,8 +31,6 @@ import org.springframework.mock.web.MockHttpServletResponse;
 import org.springframework.security.access.ConfigAttribute;
 import org.springframework.security.access.SecurityConfig;
 import org.springframework.security.web.FilterInvocation;
-import org.springframework.security.web.access.channel.ChannelDecisionManager;
-import org.springframework.security.web.access.channel.ChannelProcessingFilter;
 import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
 
 
@@ -50,7 +48,7 @@ public class ChannelProcessingFilterTests {
         ChannelProcessingFilter filter = new ChannelProcessingFilter();
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "MOCK");
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
 
         filter.afterPropertiesSet();
     }
@@ -69,7 +67,7 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
 
         filter.afterPropertiesSet();
     }
@@ -81,7 +79,7 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SUPPORTS_MOCK_ONLY", "INVALID_ATTRIBUTE");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
         filter.afterPropertiesSet();
     }
 
@@ -92,7 +90,7 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
 
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.setQueryString("info=now");
@@ -110,7 +108,7 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "SOME_ATTRIBUTE");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
 
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.setQueryString("info=now");
@@ -129,7 +127,7 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", true, "NOT_USED");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
+        filter.setSecurityMetadataSource(fids);
 
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.setQueryString("info=now");
@@ -148,8 +146,8 @@ public class ChannelProcessingFilterTests {
 
         MockFilterInvocationDefinitionMap fids = new MockFilterInvocationDefinitionMap("/path", false, "MOCK");
 
-        filter.setFilterInvocationSecurityMetadataSource(fids);
-        assertTrue(filter.getFilterInvocationSecurityMetadataSource() != null);
+        filter.setSecurityMetadataSource(fids);
+        assertSame(fids, filter.getSecurityMetadataSource());
 
         filter.init(null);
         filter.afterPropertiesSet();