applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.3.xsd
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">

    <http auto-config="true" realm="Felleskatalogen Nedlastingsområde">
<!--        <intercept-url pattern="/resources/css/**" filters="none"/>
        <intercept-url pattern="/resources/images/**" filters="none"/>
        <intercept-url pattern="/resources/javascript/**" filters="none"/>
        <intercept-url pattern="/accessdenied.html" access='IS_AUTHENTICATED_ANONYMOUSLY'/>
        <intercept-url pattern="/webcd**" access='IS_AUTHENTICATED_ANONYMOUSLY' />-->
        <intercept-url pattern="/**" access="ROLE_WEB,ROLE_DIPS,ROLE_CSV,ROLE_XML"/>
        <anonymous/>
        <http-basic/>
        <logout/>
    </http>

    <authentication-manager>
        <authentication-provider user-service-ref="userDetailsService" />
    </authentication-manager>
    <!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
    <beans:bean id="userDetailsService" class="org.springframework.security.core.userdetails.memory.InMemoryDaoImpl">
        <beans:property name="userProperties">
            <beans:bean class="org.springframework.beans.factory.config.PropertiesFactoryBean">
                <beans:property name="location" value="classpath:users.properties"/>
            </beans:bean>
        </beans:property>
    </beans:bean>

    <!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
    <beans:bean id="loggerListener" class="org.springframework.security.access.event.LoggerListener"/>

</beans:beans>

web.xml

<!DOCTYPE web-app PUBLIC
        "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
        "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
    <display-name>Downloadable Web</display-name>
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath*:applicationContext.xml
            classpath*:applicationContext-security.xml
        </param-value>
    </context-param>
    <context-param>
        <param-name>webAppRootKey</param-name>
        <param-value>tjenester.root</param-value>
    </context-param>

    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>classpath:log4j.properties</param-value>
    </context-param>

    <context-param>
        <param-name>defaultHtmlEscape</param-name>
        <param-value>true</param-value>
    </context-param>

    <filter>
        <filter-name>CharacterEncodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>

    <filter>
        <filter-name>UrlRewriteFilter</filter-name>
        <filter-class>org.tuckey.web.filters.urlrewrite.UrlRewriteFilter</filter-class>
    </filter>
    
    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>CharacterEncodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <filter-mapping>
        <filter-name>UrlRewriteFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <filter-mapping>
        <filter-name>springSecurityFilterChain</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    <listener>
        <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>springdispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/springdispatcher-servlet.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>

    <servlet>
        <servlet-name>Resource Servlet</servlet-name>
        <servlet-class>org.springframework.js.resource.ResourceServlet</servlet-class>
    </servlet>

    <servlet-mapping>
        <servlet-name>Resource Servlet</servlet-name>
        <url-pattern>/resources/*</url-pattern>
    </servlet-mapping>
    <servlet-mapping>
        <servlet-name>springdispatcher</servlet-name>
        <url-pattern>*.html</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>springdispatcher</servlet-name>
        <url-pattern>/index.html</url-pattern>
    </servlet-mapping>

    <!-- This next one is required because legacy installers (CD-ROM)
 out there in the wild will be looking for download.do. Adding this
 means that the app will serve the DownloadController for both
 download.html and download.do -->
    <servlet-mapping>
        <servlet-name>springdispatcher</servlet-name>
        <url-pattern>*.do</url-pattern>
    </servlet-mapping>

    <servlet-mapping>
        <servlet-name>springdispatcher</servlet-name>
        <url-pattern>/app/*</url-pattern>
    </servlet-mapping>

    <welcome-file-list>
        <welcome-file>index.html</welcome-file>
    </welcome-file-list>
</web-app>