<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:util="http://www.springframework.org/schema/util"
	xsi:schemaLocation="
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd
		http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">

	<!-- <debug /> -->

	<http pattern="/resources/**" security="none" />
	<http pattern="/favicon.ico" security="none" />
	<http pattern="/api/**" security="none" />
	<http pattern="/sjs/common/store/Common.js" security="none" />

	<http access-decision-manager-ref="accessDecisionManager" use-expressions="false">
		<form-login login-page="/index"
			authentication-success-handler-ref="authenticationSuccessHandler"
			authentication-failure-handler-ref="authenticationFailureHandler" />

		<logout logout-url="/logout" />

		<intercept-url pattern="/index" access="IS_AUTHENTICATED_ANONYMOUSLY,ROLE_USER" />
		<intercept-url pattern="/locale" access="IS_AUTHENTICATED_ANONYMOUSLY" />

		<intercept-url pattern="/**" access="ROLE_USER" />
<!--
		<custom-filter after="BASIC_AUTH_FILTER" ref="authTokenFilter" />
-->
		<session-management invalid-session-url="/index"> <!--  session-authentication-strategy-ref="sas" -->
			<concurrency-control max-sessions="50" error-if-maximum-exceeded="false" session-registry-alias="sessionRegistry" /><!-- max-sessions should be set to a reasonable value on production -->
		</session-management>

		<headers>
			<frame-options policy="SAMEORIGIN" />
		</headers>

<!--
		<csrf disabled="true" />
-->
	</http>
<!--
	<beans:bean id="authTokenFilter" class="com.ffii.core.security.filter.AuthTokenFilter" />
-->
	<!--
	<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" />
	-->

	<authentication-manager>
		<authentication-provider user-service-ref="userDetailsService">
			<password-encoder ref="passwordEncoder" />
		</authentication-provider>
	</authentication-manager>

	<!-- Standard Password Encoder -->
	<beans:bean id="passwordEncoder" class="org.springframework.security.crypto.password.StandardPasswordEncoder" />

	<!-- org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl -->
	<beans:bean id="userDetailsService" class="com.ffii.core.security.userdetails.UserDetailsServiceImpl">
		<beans:property name="dataSource" ref="dataSource" />
		<!-- <beans:property name="userDao" ref="userDao" /> -->
		<beans:property name="enableGroups" value="true" />
	</beans:bean>

	<!-- <beans:bean id="redirectStrategy" class="com.ffii.core.security.web.AjaxRedirectStrategy" /> -->

	<beans:bean id="authenticationSuccessHandler" class="com.ffii.core.security.web.authentication.JsonAuthenticationSuccessHandler">
		<beans:property name="defaultTargetUrl" value="/home" />
		<!-- <beans:property name="redirectStrategy" ref="redirectStrategy" /> -->
	</beans:bean>

	<beans:bean id="authenticationFailureHandler" class="com.ffii.core.security.web.authentication.JsonAuthenticationFailureHandler" />

	<beans:bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter">
		<beans:property name="rolePrefix" value="" />
	</beans:bean>

	<beans:bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased" >
		<beans:constructor-arg index="0" type="java.util.List">
			<beans:list value-type="org.springframework.security.access.AccessDecisionVoter">
				<beans:ref bean="roleVoter" />
				<beans:bean class="org.springframework.security.access.vote.AuthenticatedVoter" />
				<beans:bean class="org.springframework.security.web.access.expression.WebExpressionVoter" />
			</beans:list>
		</beans:constructor-arg>
	</beans:bean>

</beans:beans>