<?xml version="1.0" encoding="UTF-8"?>

<!--
- Sample namespace-based configuration
-
-->

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<debug />

	<global-method-security pre-post-annotations="enabled" />

	<http pattern="/static/**" security="none"/>
	<http pattern="/loggedout.jsp" security="none"/>

	<http>
		<intercept-url pattern="/secure/extreme/**" access="hasAuthority('supervisor')"/>
		<intercept-url pattern="/secure/**" access="authenticated" />
		<!--
			Allow all other requests. In a real application you should
			adopt a whitelisting approach where access is not allowed by default
		-->
		<intercept-url pattern="/**" access="permitAll" />
		<form-login />
		<logout logout-success-url="/loggedout.jsp" delete-cookies="JSESSIONID"/>
		<remember-me />
<!--
	Uncomment to enable X509 client authentication support
		<x509 />
-->
		<!-- Uncomment to limit the number of sessions a user can have -->
		<session-management invalid-session-url="/timeout.jsp">
			<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
		</session-management>

	</http>

	<!--
	Usernames/Passwords are
		rod/koala
		dianne/emu
		scott/wombat
		peter/opal
	-->
	<beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

	<authentication-manager>
		<authentication-provider>
			<password-encoder ref="encoder"/>
			<user-service>
				<user name="rod" password="$2a$10$75pBjapg4Nl8Pzd.3JRnUe7PDJmk9qBGwNEJDAlA3V.dEJxcDKn5O" authorities="supervisor, user, teller" />
				<user name="dianne" password="$2a$04$bCMEyxrdF/7sgfUiUJ6Ose2vh9DAMaVBldS1Bw2fhi1jgutZrr9zm" authorities="user,teller" />
				<user name="scott" password="$2a$06$eChwvzAu3TSexnC3ynw4LOSw1qiEbtNItNeYv5uI40w1i3paoSfLu" authorities="user" />
				<user name="peter" password="$2a$04$8.H8bCMROLF4CIgd7IpeQ.tcBXLP5w8iplO0n.kCIkISwrIgX28Ii" authorities="user" />
			</user-service>
		</authentication-provider>
	</authentication-manager>

</beans:beans>
