spring-security/itest/web/src/main/webapp/WEB-INF/http-security.xml

<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.2.xsd">

    <!--
       Http App Context to test form login, remember-me and concurrent session control.
       Needs to be supplemented with authentication provider(s)
    -->

    <http>
        <intercept-url pattern="/login.jsp*" filters="none" />
        <intercept-url pattern="/secure/**" access="ROLE_DEVELOPER,ROLE_USER" />
        <intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />

        <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
        <http-basic/>

        <!-- Default logout configuration -->
        <logout logout-url="/logout"/>

        <concurrent-session-control max-sessions="1" />

        <remember-me key="doesntmatter" token-repository-ref="tokenRepo"/>
    </http>

    <beans:bean name="tokenRepo" class="org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl"/>

    <!-- bean name="rememberMeServices" class="org.springframework.security.ui.rememberme.NullRememberMeServices"/ -->

</beans:beans>