diff --git a/samples/tutorial/keystore b/samples/tutorial/keystore
new file mode 100644
index 0000000000..f5faa867d4
Binary files /dev/null and b/samples/tutorial/keystore differ
diff --git a/samples/tutorial/pom.xml b/samples/tutorial/pom.xml
index 762d1dd5ca..472adf1299 100644
--- a/samples/tutorial/pom.xml
+++ b/samples/tutorial/pom.xml
@@ -96,6 +96,18 @@
                 <version>6.1.5</version>
                 <configuration>
                     <contextPath>/tutorial</contextPath>
+                    <connectors>
+                        <connector implementation="org.mortbay.jetty.nio.SelectChannelConnector">
+                            <port>8080</port>
+                            <confidentialPort>8443</confidentialPort>
+                        </connector>
+                        <connector implementation="org.mortbay.jetty.security.SslSocketConnector">
+                            <port>8443</port>
+                            <keystore>keystore</keystore>
+                            <password>password</password>
+                            <keyPassword>password</keyPassword>
+                        </connector>
+                    </connectors>
                 </configuration>
             </plugin>
         </plugins>
diff --git a/samples/tutorial/readme.txt b/samples/tutorial/readme.txt
new file mode 100644
index 0000000000..f14e775c8c
--- /dev/null
+++ b/samples/tutorial/readme.txt
@@ -0,0 +1,6 @@
+Run the application directly from the checked out source tree, using the command
+
+mvn jetty:run
+
+This will start jetty on port 8080, with SSL support on port 8443.
+
diff --git a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
index d0f35b1d59..67e0eb4c75 100644
--- a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
+++ b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
@@ -15,7 +15,7 @@
 	<annotation-driven/>
 
     <http>
-        <intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
+        <intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR" requires-channel="https"/>
         <intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
 		<!-- Disable web URI authorization, as we're using <annotation-driven> and have @Secured the services layer instead
         <intercept-url pattern="/listAccounts.html" access="IS_AUTHENTICATED_REMEMBERED" />