<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:oauth2="http://www.springframework.org/schema/security/oauth2"
	xmlns:p="http://www.springframework.org/schema/p"
	xmlns:security="http://www.springframework.org/schema/security"
	xmlns:tx="http://www.springframework.org/schema/tx"
	xmlns:util="http://www.springframework.org/schema/util"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
		http://www.springframework.org/schema/security/oauth2 http://www.springframework.org/schema/security/spring-security-oauth2.xsd
		http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd
		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
		http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd">


	<security:global-method-security pre-post-annotations="enabled" proxy-target-class="true" authentication-manager-ref="authenticationManager">
		<!--you could also wire in the expression handler up at the layer of the http filters. See https://jira.springsource.org/browse/SEC-1452 -->
		<security:expression-handler ref="oauthExpressionHandler" />
	</security:global-method-security>

	<oauth2:expression-handler id="oauthExpressionHandler" />

	<oauth2:web-expression-handler id="oauthWebExpressionHandler" />

	<security:authentication-manager alias="authenticationManager">
		<security:authentication-provider>
			<security:user-service id="userDetailsService">
				<security:user name="jricher" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="mfranklin" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="dcuomo" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="mjett" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="aanganes" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="mjwalsh" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
				<security:user name="srmoore" password="password" authorities="ROLE_USER, ROLE_ADMIN" />
		  	</security:user-service>
		</security:authentication-provider>
	</security:authentication-manager>
		
	<security:http auto-config="true" disable-url-rewriting="true" use-expressions="true"> <!-- authentication-manager-ref="springSecurityAuthenticationManager" -->
		<security:intercept-url pattern="/oauth/**" access="hasRole('ROLE_USER')" />
		<security:intercept-url pattern="/**" access="permitAll" />
		<security:custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
		<security:anonymous />
		<security:expression-handler ref="oauthWebExpressionHandler" />
	</security:http>	

</beans>
