From 1490fe0b0a62ffa4e1f66c1308bf0b2a4339834e Mon Sep 17 00:00:00 2001
From: Ben Alex <ben.alex@springsource.com>
Date: Fri, 28 Mar 2008 00:47:08 +0000
Subject: [PATCH] Various fine-tuning so people can see AspectJ expressions and
 a simple, minimal configuration.

---
 .../applicationContext-security-ns.xml        | 28 +++++++++++++------
 1 file changed, 19 insertions(+), 9 deletions(-)

diff --git a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
index 8bb8cbf51d..7d13a6379c 100644
--- a/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
+++ b/samples/tutorial/src/main/webapp/WEB-INF/applicationContext-security-ns.xml
@@ -12,30 +12,37 @@
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
                         http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">
 
-	<global-method-security secured-annotations="enabled"/>
+	<global-method-security secured-annotations="enabled">
+		<!-- AspectJ pointcut expression that locates our "post" method and applies security that way
+		<protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>
+		-->
+	</global-method-security>
 
-    <http>
+    <http auto-config="true">
         <intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
         <intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
-		<!-- Disable web URI authorization, as we're using <annotation-driven> and have @Secured the services layer instead
+		<!-- Disable web URI authorization, as we're using <global-method-security> and have @Secured the services layer instead
         <intercept-url pattern="/listAccounts.html" access="IS_AUTHENTICATED_REMEMBERED" />
         <intercept-url pattern="/post.html" access="ROLE_TELLER" />
         -->
         <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
 <!--
-    Uncomment to enable X509 client authentication support -->
-        <x509 />
+    Uncomment to enable X509 client authentication support
+        <x509 /> -->
 
-        <!-- All of this is unnecessary if auto-config="true" -->
+        <!-- All of this is unnecessary if auto-config="true"
         <form-login />
         <anonymous />
         <http-basic />
         <logout />
-        <remember-me />
+        <remember-me /> -->
 
+        <!--
         <concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true"/>
-
+		-->
+		
     </http>
+
 <!--
     Uncomment to add X509 support as an external filter definition (an alternative to the <x509 /> element).
 
@@ -50,11 +57,13 @@
         </beans:property>
     </beans:bean>
 -->
+
     <!--
     Usernames/Passwords are
         rod/koala
         dianne/emu
-        scott/wombat
+        scott/wombat
+        peter/opal
     -->
     <authentication-provider>
         <password-encoder hash="md5"/>
@@ -62,6 +71,7 @@
             <user name="rod" password="a564de63c2d0da68cf47586ee05984d7" authorities="ROLE_SUPERVISOR, ROLE_USER, ROLE_TELLER" />
 	        <user name="dianne" password="65d15fe9156f9c4bbffd98085992a44e" authorities="ROLE_USER,ROLE_TELLER" />
             <user name="scott" password="2b58af6dddbd072ed27ffc86725d7d3a" authorities="ROLE_USER" />
+            <user name="peter" password="22b5c9accc6e1ba628cedc63a72d57f8" authorities="ROLE_USER" />
 	    </user-service>
 	</authentication-provider>