<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
       http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

	<bean id="myApplication" class="com.foo.bar.MyApplication" />

        <bean id="filterChainProxy" class="org.springframework.security.util.FilterChainProxy">
            <property name="filterInvocationDefinitionSource">
                <value>
                    CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                    PATTERN_TYPE_APACHE_ANT
                    /**=httpSessionContextIntegrationFilter
                </value>
            </property>
        </bean>

        <bean id="httpSessionContextIntegrationFilter"
              class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
            <property name="allowSessionCreation" value="false"/>
        </bean>

	<security:authentication-provider alias="authenticationManager">
		<security:user-service>
			<security:user password="admin" name="admin" authorities="ROLE_ADMIN" />
		</security:user-service>
	</security:authentication-provider>

</beans>

<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
	http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">


	<security:http create-session="never" auto-config="true" >
		<security:remember-me/>
		<security:intercept-url pattern="/**"/>
	</security:http>


	<security:authentication-manager alias="authenticationManager">
		<security:authentication-provider>

			<!--  TODO change this to reference our real user service -->
			<security:user-service>
				<security:user name="admin" password="admin"
					authorities="ROLE_ADMIN, ROLE_USER" />
				<security:user name="user" password="user"
					authorities="ROLE_USER" />

			</security:user-service>
		</security:authentication-provider>

	</security:authentication-manager>

	<security:global-method-security secured-annotations="enabled" />
</beans>

public class MyAuthenticatedWebSession extends AuthenticatedWebSession {

    private static final Logger logger = Logger.getLogger(MyAuthenticatedWebSession.class);

    @SpringBean(name="authenticationManager")
    private AuthenticationManager authenticationManager;

    public MyAuthenticatedWebSession(Request request) {
        super(request);
        injectDependencies();
        ensureDependenciesNotNull();
    }

    private void ensureDependenciesNotNull() {
        if (authenticationManager == null) {
            throw new IllegalStateException("AdminSession requires an authenticationManager.");
        }
    }

    private void injectDependencies() {
        InjectorHolder.getInjector().inject(this);
    }

    @Override
    public boolean authenticate(String username, String password) {
        boolean authenticated = false;
        try {
            Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
            SecurityContextHolder.getContext().setAuthentication(authentication);
            authenticated = authentication.isAuthenticated();
        } catch (AuthenticationException e) {
            logger.warn(format("User '%s' failed to login. Reason: %s", username, e.getMessage()));
            authenticated = false;
        }
        return authenticated;
    }

    @Override
    public Roles getRoles(

public class MyAuthenticatedWebSession extends AuthenticatedWebSession {
    
    private static final Logger logger = Logger.getLogger(MyAuthenticatedWebSession.class);

    @SpringBean
    private AuthenticationManager authenticationManager;

    public MyAuthenticatedWebSession(Request request) {
        super(requestRoles roles = new Roles();
        injectDependenciesgetRolesIfSignedIn(roles);
        return ensureDependenciesNotNull()roles;
    }

    private void ensureDependenciesNotNullgetRolesIfSignedIn(Roles roles) {
        if (authenticationManager == null(isSignedIn()) {
            Authentication throwauthentication new= IllegalStateException("AdminSession requires an authenticationManager."SecurityContextHolder.getContext().getAuthentication();
        }
    }

    private void injectDependencies() {
        InjectorHolder.getInjector().inject(thisaddRolesFromAuthentication(roles, authentication);
        }

    @Override}

    publicprivate booleanvoid authenticateaddRolesFromAuthentication(StringRoles usernameroles, StringAuthentication passwordauthentication) {
        booleanfor authenticated(GrantedAuthority =authority false;
        try : authentication.getAuthorities()) {
            Authentication authentication = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, passwordroles.add(authority.getAuthority());
        }
    SecurityContextHolder.getContext().setAuthentication(authentication);}

}

public class MyWebApplication extends AuthenticatedWebApplication implements ApplicationContextAware {
    private ApplicationContext context;

    boolean  authenticatedisInitialized = authentication.isAuthenticated()false;

    @Override
    }protected catchvoid init(AuthenticationException e) {
        if (!isInitialized) {
    logger.warn(format("User '%s' failed to login. Reason: %s", username, esuper.getMessageinit()));
            authenticated = falsesetListeners();
        }
    isInitialized = true;
   return authenticated;
    }

    @Override}

    publicprivate Rolesvoid getRolessetListeners() {
        Roles roles = new Roles();addComponentInstantiationListener(new SpringComponentInjector(this, context));
    }

    @Override
    public    getRolesIfSignedIn(roles);Class<?> getHomePage() {
        return rolesHomePage.class;
    }

    privatepublic void getRolesIfSignedInsetApplicationContext(RolesApplicationContext rolescontext) {
throws        if (isSignedIn()) BeansException {
        this.context = context;
  Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); }

    @Override
    protected Class<? extends WebPage> addRolesFromAuthenticationgetSignInPageClass(roles, authentication);) {
        }
    }

    private void addRolesFromAuthentication(Roles roles, Authentication authentication) {return LoginPage.class;
    }

    @Override
    forprotected (GrantedAuthorityClass<? authorityextends :AuthenticatedWebSession> authentication.getAuthoritiesgetWebSessionClass()) {
        return    roles.add(authority.getAuthority())MyAuthenticatedWebSession.class;
        }
    }

}