fixture-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<!--
  - Copyright 2013 Martin Lau
  -
  - Licensed under the Apache License, Version 2.0 (the "License");
  - you may not use this file except in compliance with the License.
  - You may obtain a copy of the License at
  -
  -    http://www.apache.org/licenses/LICENSE-2.0
  -
  - Unless required by applicable law or agreed to in writing, software
  - distributed under the License is distributed on an "AS IS" BASIS,
  - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  - See the License for the specific language governing permissions and
  - limitations under the License.
  -->
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:security="http://www.springframework.org/schema/security"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <context:component-scan base-package="io.fixture.security"/>

    <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

    <security:authentication-manager id="authenticationManager">
        <security:authentication-provider user-service-ref="userDetailsManagerImpl">
            <security:password-encoder ref="passwordEncoder"/>
        </security:authentication-provider>
    </security:authentication-manager>

    <security:global-method-security authentication-manager-ref="authenticationManager"
                                     secured-annotations="enabled"/>

    <security:http authentication-manager-ref="authenticationManager"
                   use-expressions="true">
        <security:intercept-url pattern="/secure/**"
                                access="isAuthenticated()"/>
        <security:intercept-url pattern="/administration/**"
                                access="hasRole('administrator')"/>
        <security:access-denied-handler error-page="/access-denied" />
        <security:anonymous/>
        <security:form-login login-page="/login"
                             login-processing-url="/login/authenticate"/>
        <security:remember-me user-service-ref="userDetailsManagerImpl"
                              key="fixture-dot-io"
                              token-repository-ref="persistentTokenRepositoryImpl"/>
        <security:logout logout-url="/logout"/>
        <security:session-management>
            <security:concurrency-control max-sessions="1"/>
        </security:session-management>
    </security:http>

</beans>