<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <security:authentication-manager>
        <security:authentication-provider>
            <security:user-service>
                <security:user name="user" password="userPass" authorities="ROLE_USER"/>
                <security:user name="admin" password="adminPass" authorities="ROLE_ADMIN"/>
            </security:user-service>
        </security:authentication-provider>
    </security:authentication-manager>
    
    <security:http pattern="/user/general/**" use-expressions="true" auto-config="true"
      entry-point-ref="loginUrlAuthenticationEntryPoint">
        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')" />
        <security:form-login login-processing-url="/user/general/login" 
          authentication-failure-url="/userLogin?error=loginError"
          default-target-url="/user/myUserPage"/>
        <security:csrf disabled="true"/>
        <security:access-denied-handler error-page="/403"/>
        <security:logout logout-url="/user/logout" delete-cookies="JSESSIONID" logout-success-url="/multipleHttpLinks"/>
    </security:http>
    
    <bean id="loginUrlAuthenticationEntryPoint"
      class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
      <constructor-arg name="loginFormUrl" value="/userLogin" />
    </bean>
     
     <security:http pattern="/user/private/**" use-expressions="true" auto-config="true"
       entry-point-ref="loginUrlAuthenticationEntryPointWithWarning">
        <security:intercept-url pattern="/**" access="hasRole('ROLE_USER')"/>
        <security:form-login login-processing-url="/user/private/login" 
          authentication-failure-url="/userLogin?error=loginError"
          default-target-url="/user/myUserPage" />
        <security:csrf disabled="true"/>
        <security:access-denied-handler error-page="/403"/>
        <security:logout logout-url="/user/logout" delete-cookies="JSESSIONID" logout-success-url="/multipleHttpLinks"/>
    </security:http>

    <bean id="loginUrlAuthenticationEntryPointWithWarning"
       class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <constructor-arg name="loginFormUrl" value="/userLoginWithWarning" />
     </bean>
    
    <security:http pattern="/admin/**" use-expressions="true" auto-config="true">
        <security:intercept-url pattern="/**" access="hasRole('ROLE_ADMIN')"/>
        <security:http-basic entry-point-ref="authenticationEntryPoint" />
        <security:access-denied-handler error-page="/403"/>
     </security:http>
     
     <bean id="authenticationEntryPoint"
       class="org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint">
       <property name="realmName" value="admin realm" />
     </bean>
    
     <security:http pattern="/**" use-expressions="true" auto-config="true">
        <security:intercept-url pattern="/guest/**" access="permitAll()"/>  
     </security:http>

    
</beans>
