<?xml version="1.0" encoding="UTF-8"?>

<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans-3.0.xsd
						http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd">

	<!--
	   Http App Context to test form login, remember-me and concurrent session control.
	   Needs to be supplemented with authentication provider(s)
	-->
	<http pattern="/login.jsp" security="none" />

	<http>
		<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
		<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />

		<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
		<http-basic/>

		<!-- Default logout configuration -->
		<logout logout-url="/logout"/>

		<session-management>
			<concurrency-control max-sessions="1" />
		</session-management>

		<remember-me key="doesntmatter" token-repository-ref="tokenRepo"/>
	</http>

	<beans:bean name="tokenRepo" class="org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl"/>

</beans:beans>
