<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:security="http://www.springframework.org/schema/security"
 xsi:schemaLocation="http://www.springframework.org/schema/beans 
      http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
   http://www.springframework.org/schema/security 
   http://www.springframework.org/schema/security/spring-security-3.1.xsd">
  
 <security:global-method-security pre-post-annotations="enabled" />
  
 <!-- This is where we configure Spring-Security  -->
 <security:http auto-config="true" use-expressions="true" access-denied-page="/denied" >
     
  <security:intercept-url pattern="/user/login" access="permitAll"/>
  <security:intercept-url pattern="/user/register" access="permitAll"/>
  <security:intercept-url pattern="/favicon.ico" access="permitAll"/>
  <security:intercept-url pattern="/welcome" access="permitAll"/>
  <security:intercept-url pattern="/" access="permitAll"/>
  
  <security:intercept-url pattern="/workspace/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*/*/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*/*/*/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*/*/*/*/*" access="isAuthenticated()"/>
  <security:intercept-url pattern="/*/*/*/*/*/*/*/*" access="isAuthenticated()"/>
  
  
  <security:intercept-url pattern="/WEB-CONTENT/CSS/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/CSS/aristo/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/CSS/icons/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/IMAGES/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/JAVASCRIPT/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/draw2d/*" access="permitAll"/>
  <security:intercept-url pattern="/WEB-CONTENT/draw2d/lib/*" access="permitAll"/>
  
   
  <security:form-login
    login-page="/user/login"
    authentication-failure-url="/user/login?error=true"
    default-target-url="/user"/>
    
  <security:logout
    invalidate-session="true"
    logout-success-url="/user/login"
    logout-url="/user/logout"/>
  
 </security:http>
 
 <bean id="passwordEncoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>
  
 <!-- Declare an authentication-manager to use a custom userDetailsService -->
 <security:authentication-manager>
         <security:authentication-provider user-service-ref="customUserDetailsService">
             <security:password-encoder ref="passwordEncoder"/>
         </security:authentication-provider>
 </security:authentication-manager>
 
 
 <!-- A custom service where Spring will retrieve users and their corresponding access levels  -->
 <bean id="customUserDetailsService" class="com.mason.server.security.service.CustomUserDetailsService"/>
  
</beans>