X-Git-Url: http://source.jalview.org/gitweb/?a=blobdiff_plain;f=WEB-INF%2Fspring-security.xml;h=4e8b52cbd81c5ba36de946b0145e642fddb8dad5;hb=6b59d49dbcca1616d74c2814d87faf47e3aa7cf2;hp=b5f0040fcd1d01969a9059f1aaba15c77d450fa6;hpb=95f270e6b3ec72bd29b5ac6e09f803dbaa64380e;p=proteocache.git

diff --git a/WEB-INF/spring-security.xml b/WEB-INF/spring-security.xml
index b5f0040..4e8b52c 100644
--- a/WEB-INF/spring-security.xml
+++ b/WEB-INF/spring-security.xml
@@ -1,4 +1,5 @@
-<beans:beans xmlns="http://www.springframework.org/schema/security"
+<beans:beans 
+	xmlns="http://www.springframework.org/schema/security"
 	xmlns:beans="http://www.springframework.org/schema/beans" 
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xsi:schemaLocation="http://www.springframework.org/schema/beans
@@ -6,17 +7,46 @@
 	http://www.springframework.org/schema/security
 	http://www.springframework.org/schema/security/spring-security-3.1.xsd">
 
-	<http auto-config="true">
-		<intercept-url pattern="/home/*" access="ROLE_USER" />
-		<form-login login-page="/login" default-target-url="/welcome"
-			authentication-failure-url="/loginfailed" />
+	<http auto-config="true" use-expressions="true" access-denied-page="/denied">
+		<intercept-url pattern="/stat/**" access="hasRole('ROLE_USER')" />
+		<intercept-url pattern="/sequence/**" access="hasRole('ROLE_USER')" />
+		<intercept-url pattern="/admin/**" access="hasRole('ROLE_ADMIN')" />
+		<intercept-url pattern="/database/**" access="hasRole('ROLE_ADMIN')" />
+		<intercept-url pattern="/public*" access="permitAll"/>
+		<intercept-url pattern="/login*" access="permitAll"/>
+		<intercept-url pattern="/index*" access="permitAll"/>
+		<intercept-url pattern="/register*" access="permitAll"/>
+		<form-login 
+			login-page="/login"
+			default-target-url="/home"
+			authentication-failure-url="/loginfailed"
+		/>
 		<logout logout-success-url="/logout" />
 	</http>
 
+	<global-method-security secured-annotations="enabled">
+	</global-method-security>	
+
+<!-- 
+	<http access-denied-page="/denied.xhtml"  auto-config="true" use-expressions="false" >
+		<form-login 
+			login-page="/login.xhtml"
+			default-target-url="/"
+			authentication-failure-url="/denied.xhtml"
+		login-processing-url="/static/j_spring_security_check"
+		/>
+		<intercept-url pattern="/PANEL/**" access="ROLE_GENERALT"></intercept-url>
+		<logout invalidate-session="true" logout-url="/index.xhtml"/>
+	</http>
+
+	<global-method-security secured-annotations="enabled" jsr250-annotations="enabled"></global-method-security>
+-->
+
 	<authentication-manager>
 		<authentication-provider>
 			<user-service>
-				<user name="sherstnev" password="sasha12345" authorities="ROLE_USER" />
+				<user name="sherstnev" password="sasha" authorities="ROLE_USER" />
+				<user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" />
 			</user-service>
 		</authentication-provider>
 	</authentication-manager>