SEC-1125: Further refactoring of web packages following creation of web module. Fixing samples.

2026-08-05 01:36:56 +00:00 · 2009-03-26 07:18:36 +00:00
parent 2a9a8a41db
commit bec84f874a
275 changed files with 834 additions and 798 deletions
@@ -1,5 +0,0 @@
-<html>
-<body>
-Authenticates HTTP BASIC authentication requests.
-</body>
-</html>
@@ -1,5 +0,0 @@
-<html>
-<body>
-Authenticates HTTP Digest authentication requests.
-</body>
-</html>
@@ -1,5 +0,0 @@
-<html>
-<body>
-Authenticates users via HTTP properties, headers and session.
-</body>
-</html>
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web;

 import java.io.IOException;
 import java.io.UnsupportedEncodingException;
@@ -11,7 +11,8 @@ import javax.servlet.http.HttpServletResponse;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.Authentication;
-import org.springframework.security.ui.logout.LogoutHandler;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.logout.LogoutHandler;
 import org.springframework.security.web.util.RedirectUtils;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.springframework.security.AccessDeniedException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

 import java.io.IOException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.springframework.security.AuthenticationException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.springframework.security.AccessDeniedException;
 import org.springframework.security.SpringSecurityException;
@@ -22,11 +22,9 @@ import org.springframework.security.AuthenticationTrustResolver;
 import org.springframework.security.AuthenticationTrustResolverImpl;
 import org.springframework.security.InsufficientAuthenticationException;
 import org.springframework.security.context.SecurityContextHolder;
-import org.springframework.security.ui.savedrequest.SavedRequest;
 import org.springframework.security.util.ThrowableAnalyzer;
 import org.springframework.security.util.ThrowableCauseExtractor;
-import org.springframework.security.web.util.PortResolver;
-import org.springframework.security.web.util.PortResolverImpl;
+import org.springframework.security.web.savedrequest.SavedRequest;
 import org.springframework.beans.factory.InitializingBean;

 import org.springframework.util.Assert;
@@ -51,8 +49,8 @@ import javax.servlet.http.HttpServletResponse;
 * <p>
 * If an {@link AccessDeniedException} is detected, the filter will determine whether or not the user is an anonymous
 * user. If they are an anonymous user, the <code>authenticationEntryPoint</code> will be launched. If they are not
- * an anonymous user, the filter will delegate to the {@link org.springframework.security.ui.AccessDeniedHandler}.
- * By default the filter will use {@link org.springframework.security.ui.AccessDeniedHandlerImpl}.
+ * an anonymous user, the filter will delegate to the {@link org.springframework.security.web.AccessDeniedHandler}.
+ * By default the filter will use {@link org.springframework.security.web.AccessDeniedHandlerImpl}.
 * <p>
 * To use this filter, it is necessary to specify the following properties:
 * <ul>
@@ -176,7 +174,7 @@ public class ExceptionTranslationFilter extends SpringSecurityFilter implements
     * <code>false</code>.
     * <p>
     * Remember to also set
-     * {@link org.springframework.security.context.web.HttpSessionSecurityContextRepository#setAllowSessionCreation(boolean)}
+     * {@link org.springframework.security.web.context.HttpSessionSecurityContextRepository#setAllowSessionCreation(boolean)}
     * to <code>false</code> if you set this property to <code>false</code>.
     *
     * @return <code>true</code> if the <code>HttpSession</code> will be
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.springframework.util.Assert;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.util;
+package org.springframework.security.web;

 import java.io.IOException;
 import java.util.Collection;
@@ -34,10 +34,10 @@ import javax.servlet.ServletResponse;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
-import org.springframework.security.intercept.web.FilterInvocation;
-import org.springframework.security.intercept.web.FilterInvocationSecurityMetadataSource;
 import org.springframework.security.util.AntUrlPathMatcher;
 import org.springframework.security.util.UrlMatcher;
+import org.springframework.security.web.intercept.FilterInvocation;
+import org.springframework.security.web.intercept.FilterInvocationSecurityMetadataSource;
 import org.springframework.util.Assert;
 import org.springframework.web.filter.DelegatingFilterProxy;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.util;
+package org.springframework.security.web;

 /**
 * <code>PortMapper</code> implementations provide callers with information
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.util;
+package org.springframework.security.web;

 import org.springframework.util.Assert;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.util;
+package org.springframework.security.web;

 import javax.servlet.ServletRequest;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.web.util;
+package org.springframework.security.web;

 import org.springframework.util.Assert;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web;

 import java.io.IOException;

@@ -14,7 +14,7 @@ import org.springframework.security.AuthenticationTrustResolverImpl;
 import org.springframework.security.concurrent.SessionRegistry;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
-import org.springframework.security.context.web.HttpSessionSecurityContextRepository;
+import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
 import org.springframework.security.web.util.SessionUtils;

 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

 import org.springframework.security.concurrent.SessionIdentifierAware;

@@ -13,8 +13,9 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web;

+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.util.Assert;
 import org.springframework.util.ReflectionUtils;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -30,14 +30,17 @@ import org.springframework.context.MessageSource;
 import org.springframework.context.MessageSourceAware;
 import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.AuthenticationManager;
 import org.springframework.security.SpringSecurityMessageSource;
 import org.springframework.security.concurrent.SessionRegistry;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.event.authentication.InteractiveAuthenticationSuccessEvent;
-import org.springframework.security.ui.rememberme.NullRememberMeServices;
-import org.springframework.security.ui.rememberme.RememberMeServices;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
+import org.springframework.security.web.authentication.rememberme.NullRememberMeServices;
+import org.springframework.security.web.authentication.rememberme.RememberMeServices;
 import org.springframework.security.web.util.SessionUtils;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
@@ -13,18 +13,18 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.anonymous;
+package org.springframework.security.web.authentication;

 import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationDetailsSource;

 import org.springframework.security.context.SecurityContextHolder;

-import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
+import org.springframework.security.providers.AnonymousAuthenticationToken;
 import org.springframework.security.userdetails.memory.UserAttribute;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;

@@ -140,7 +140,7 @@ public class AnonymousProcessingFilter  extends SpringSecurityFilter  implements
    /**
     * Controls whether the filter will remove the Anonymous token after the request is complete. Generally
     * this is desired to avoid the expense of a session being created by {@link
-     * org.springframework.security.context.web.HttpSessionContextIntegrationFilter HttpSessionContextIntegrationFilter} simply to
+     * org.springframework.security.web.context.HttpSessionContextIntegrationFilter HttpSessionContextIntegrationFilter} simply to
     * store the Anonymous authentication token.<p>Defaults to <code>true</code>, being the most optimal and
     * appropriate option (ie <code>AnonymousProcessingFilter</code> will clear the token at the end of each request,
     * thus avoiding the session creation overhead in a typical configuration.</p>
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.webapp;
+package org.springframework.security.web.authentication;

 import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationException;
@@ -21,9 +21,8 @@ import org.springframework.security.AuthenticationServiceException;

 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;

-import org.springframework.security.ui.AbstractProcessingFilter;
-import org.springframework.security.ui.FilterChainOrder;
 import org.springframework.security.util.TextUtils;
+import org.springframework.security.web.FilterChainOrder;
 import org.springframework.util.Assert;

 import javax.servlet.http.HttpServletRequest;
@@ -13,17 +13,17 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.webapp;
+package org.springframework.security.web.authentication;

 import org.springframework.security.AuthenticationException;

-import org.springframework.security.ui.AuthenticationEntryPoint;
-import org.springframework.security.ui.ExceptionTranslationFilter;

-import org.springframework.security.web.util.PortMapper;
-import org.springframework.security.web.util.PortMapperImpl;
-import org.springframework.security.web.util.PortResolver;
-import org.springframework.security.web.util.PortResolverImpl;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.ExceptionTranslationFilter;
+import org.springframework.security.web.PortMapper;
+import org.springframework.security.web.PortMapperImpl;
+import org.springframework.security.web.PortResolver;
+import org.springframework.security.web.PortResolverImpl;
 import org.springframework.security.web.util.RedirectUrlBuilder;
 import org.springframework.security.web.util.UrlUtils;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.webapp;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -10,10 +10,9 @@ import javax.servlet.http.HttpSession;

 import org.springframework.beans.BeanWrapperImpl;
 import org.springframework.security.AuthenticationException;
-import org.springframework.security.ui.AbstractProcessingFilter;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
-import org.springframework.security.ui.rememberme.AbstractRememberMeServices;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;

 /**
 * For internal use with namespace configuration in the case where a user doesn't configure a login page.
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;
 import java.util.HashMap;
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -8,9 +8,10 @@ import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;

 import org.springframework.security.Authentication;
-import org.springframework.security.ui.savedrequest.SavedRequest;
+import org.springframework.security.web.ExceptionTranslationFilter;
+import org.springframework.security.web.savedrequest.SavedRequest;
 import org.springframework.security.web.util.RedirectUtils;
-import org.springframework.security.wrapper.SavedRequestAwareWrapper;
+import org.springframework.security.web.wrapper.SavedRequestAwareWrapper;
 import org.springframework.util.StringUtils;

 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.authentication;

 import java.io.IOException;

@@ -7,6 +7,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.Authentication;
+import org.springframework.security.web.AbstractAuthenticationTargetUrlRequestHandler;

 public class SimpleUrlAuthenticationSuccessHandler extends AbstractAuthenticationTargetUrlRequestHandler implements AuthenticationSuccessHandler {

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth;
+package org.springframework.security.web.authentication.preauth;

 import java.io.IOException;

@@ -8,14 +8,14 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationToken;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationManager;
 import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.event.authentication.InteractiveAuthenticationSuccessEvent;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
-import org.springframework.security.ui.AbstractProcessingFilter;
-import org.springframework.security.ui.SpringSecurityFilter;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
+import org.springframework.security.web.authentication.AbstractProcessingFilter;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.ApplicationEventPublisher;
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth;
+package org.springframework.security.web.authentication.preauth;

 import org.springframework.security.AuthenticationException;

@@ -1,11 +1,11 @@
-package org.springframework.security.ui.preauth;
+package org.springframework.security.web.authentication.preauth;

 import java.util.Collections;
 import java.util.List;

+import org.springframework.security.AuthenticationDetails;
 import org.springframework.security.GrantedAuthority;
 import org.springframework.security.MutableGrantedAuthoritiesContainer;
-import org.springframework.security.ui.AuthenticationDetails;
 import org.springframework.util.Assert;

 /**
@@ -1,10 +1,10 @@
-package org.springframework.security.ui.preauth;
+package org.springframework.security.web.authentication.preauth;

 import java.util.List;

 import javax.servlet.http.HttpServletRequest;

-import org.springframework.security.ui.WebAuthenticationDetails;
+import org.springframework.security.web.WebAuthenticationDetails;
 import org.springframework.security.GrantedAuthoritiesContainerImpl;
 import org.springframework.security.GrantedAuthority;
 import org.springframework.security.MutableGrantedAuthoritiesContainer;
@@ -1,7 +1,7 @@
-package org.springframework.security.ui.preauth;
+package org.springframework.security.web.authentication.preauth;

 import org.springframework.security.AuthenticationException;
-import org.springframework.security.ui.AuthenticationEntryPoint;
+import org.springframework.security.web.AuthenticationEntryPoint;

 import java.io.IOException;

@@ -31,7 +31,7 @@ import org.springframework.core.Ordered;
 * This code is based on
 * {@link org.springframework.security.ui.x509.X509ProcessingFilterEntryPoint}.
 *
- * @see org.springframework.security.ui.ExceptionTranslationFilter
+ * @see org.springframework.security.web.ExceptionTranslationFilter
 *
 * @author Luke Taylor
 * @author Ruud Senden
@@ -1,10 +1,8 @@
-package org.springframework.security.ui.preauth.header;
+package org.springframework.security.web.authentication.preauth;

 import javax.servlet.http.HttpServletRequest;

-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter;
-import org.springframework.security.ui.preauth.PreAuthenticatedCredentialsNotFoundException;
+import org.springframework.security.web.FilterChainOrder;
 import org.springframework.util.Assert;

 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.j2ee;
+package org.springframework.security.web.authentication.preauth.j2ee;

 import java.util.Collection;
 import java.util.List;
@@ -6,12 +6,12 @@ import java.util.Set;

 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
+import org.springframework.security.AuthenticationDetailsSourceImpl;
 import org.springframework.security.GrantedAuthority;
 import org.springframework.security.MutableGrantedAuthoritiesContainer;
 import org.springframework.security.authoritymapping.Attributes2GrantedAuthoritiesMapper;
 import org.springframework.security.authoritymapping.MappableAttributesRetriever;
 import org.springframework.security.authoritymapping.SimpleAttributes2GrantedAuthoritiesMapper;
-import org.springframework.security.ui.AuthenticationDetailsSourceImpl;
 import org.springframework.util.Assert;

 /**
@@ -47,7 +47,7 @@ public abstract class AbstractPreAuthenticatedAuthenticationDetailsSource extend
     * list of pre-authenticated Granted Authorities will be set based on the
     * roles for the current user.
     *
-     * @see org.springframework.security.ui.AuthenticationDetailsSource#buildDetails(Object)
+     * @see org.springframework.security.AuthenticationDetailsSource#buildDetails(Object)
     */
    public Object buildDetails(Object context) {
        Object result = super.buildDetails(context);
@@ -1,6 +1,6 @@
-package org.springframework.security.ui.preauth.j2ee;
+package org.springframework.security.web.authentication.preauth.j2ee;

-import org.springframework.security.ui.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
+import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
 import org.springframework.security.authoritymapping.SimpleAttributes2GrantedAuthoritiesMapper;

 import java.util.ArrayList;
@@ -1,8 +1,8 @@
-package org.springframework.security.ui.preauth.j2ee;
+package org.springframework.security.web.authentication.preauth.j2ee;

 import javax.servlet.http.HttpServletRequest;

-import org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter;
+import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;

 /**
 * This AbstractPreAuthenticatedProcessingFilter implementation is based on the
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.j2ee;
+package org.springframework.security.web.authentication.preauth.j2ee;

 import java.io.InputStream;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.websphere;
+package org.springframework.security.web.authentication.preauth.websphere;

 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
@@ -1,14 +1,14 @@
-package org.springframework.security.ui.preauth.websphere;
+package org.springframework.security.web.authentication.preauth.websphere;

 import org.aopalliance.intercept.MethodInterceptor;
 import org.aopalliance.intercept.MethodInvocation;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationManager;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.preauth.PreAuthenticatedAuthenticationToken;
-import org.springframework.security.ui.AuthenticationDetailsSource;
 import org.springframework.util.Assert;

 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.websphere;
+package org.springframework.security.web.authentication.preauth.websphere;

 import java.util.Arrays;
 import java.util.List;
@@ -6,12 +6,12 @@ import java.util.List;
 import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
+import org.springframework.security.AuthenticationDetailsSourceImpl;
 import org.springframework.security.GrantedAuthority;
 import org.springframework.security.MutableGrantedAuthoritiesContainer;
 import org.springframework.security.authoritymapping.Attributes2GrantedAuthoritiesMapper;
 import org.springframework.security.authoritymapping.SimpleAttributes2GrantedAuthoritiesMapper;
-import org.springframework.security.ui.AuthenticationDetailsSourceImpl;
-import org.springframework.security.ui.preauth.PreAuthenticatedGrantedAuthoritiesAuthenticationDetails;
+import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesAuthenticationDetails;
 import org.springframework.util.Assert;

 /**
@@ -50,7 +50,7 @@ public class WebSpherePreAuthenticatedAuthenticationDetailsSource extends Authen
     * list of pre-authenticated Granted Authorities will be set based on the
     * WebSphere groups for the current user.
     *
-     * @see org.springframework.security.ui.AuthenticationDetailsSource#buildDetails(Object)
+     * @see org.springframework.security.AuthenticationDetailsSource#buildDetails(Object)
     */
    public Object buildDetails(Object context) {
        Object result = super.buildDetails(context);
@@ -1,8 +1,8 @@
-package org.springframework.security.ui.preauth.websphere;
+package org.springframework.security.web.authentication.preauth.websphere;

 import javax.servlet.http.HttpServletRequest;

-import org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter;
+import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;

 /**
 * This AbstractPreAuthenticatedProcessingFilter implementation is based on
@@ -1,6 +1,6 @@
-package org.springframework.security.ui.preauth.websphere;
+package org.springframework.security.web.authentication.preauth.websphere;

-import org.springframework.security.ui.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;
+import org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesWebAuthenticationDetails;

 /**
 * This AuthenticationDetailsSource implementation, when configured with a MutableGrantedAuthoritiesContainer,
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.x509;
+package org.springframework.security.web.authentication.preauth.x509;

 import org.springframework.security.BadCredentialsException;
 import org.springframework.security.SpringSecurityMessageSource;
@@ -1,7 +1,7 @@
-package org.springframework.security.ui.preauth.x509;
+package org.springframework.security.web.authentication.preauth.x509;

-import org.springframework.security.ui.preauth.AbstractPreAuthenticatedProcessingFilter;
-import org.springframework.security.ui.FilterChainOrder;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;

 import javax.servlet.http.HttpServletRequest;
 import java.security.cert.X509Certificate;
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.preauth.x509;
+package org.springframework.security.web.authentication.preauth.x509;

 import java.security.cert.X509Certificate;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.logging.Log;
@@ -6,17 +6,17 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.SpringSecurityMessageSource;
 import org.springframework.security.AccountStatusException;
-import org.springframework.security.providers.rememberme.RememberMeAuthenticationToken;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
-import org.springframework.security.ui.logout.LogoutHandler;
+import org.springframework.security.providers.RememberMeAuthenticationToken;
 import org.springframework.security.userdetails.UserDetails;
 import org.springframework.security.userdetails.UserDetailsService;
 import org.springframework.security.userdetails.UsernameNotFoundException;
 import org.springframework.security.userdetails.UserDetailsChecker;
 import org.springframework.security.userdetails.checker.AccountStatusUserDetailsChecker;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
+import org.springframework.security.web.logout.LogoutHandler;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 /**
 * @author Luke Taylor
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.dao.DataIntegrityViolationException;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 /**
 * Exception thrown by a RememberMeServices implementation to indicate
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.dao.DataAccessException;
 import org.springframework.dao.IncorrectResultSizeDataAccessException;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.security.Authentication;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import java.util.Date;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import java.security.SecureRandom;
 import java.util.Arrays;
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import java.util.Date;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.security.AuthenticationException;

@@ -13,15 +13,15 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.AuthenticationManager;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.event.authentication.InteractiveAuthenticationSuccessEvent;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.ApplicationEventPublisher;
 import org.springframework.context.ApplicationEventPublisherAware;
@@ -36,9 +36,9 @@ import java.io.IOException;

 /**
 * Detects if there is no <code>Authentication</code> object in the <code>SecurityContext</code>, and populates it
- * with a remember-me authentication token if a {@link org.springframework.security.ui.rememberme.RememberMeServices}
+ * with a remember-me authentication token if a {@link org.springframework.security.web.authentication.rememberme.RememberMeServices}
 * implementation so requests.<p>Concrete <code>RememberMeServices</code> implementations will have their {@link
- * org.springframework.security.ui.rememberme.RememberMeServices#autoLogin(HttpServletRequest, HttpServletResponse)} method
+ * org.springframework.security.web.authentication.rememberme.RememberMeServices#autoLogin(HttpServletRequest, HttpServletResponse)} method
 * called by this filter. The <code>Authentication</code> or <code>null</code> returned by that method will be placed
 * into the <code>SecurityContext</code>. The <code>AuthenticationManager</code> will be used, so that any concurrent
 * session management or other authentication-specific behaviour can be achieved. This is the same pattern as with
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.security.Authentication;

@@ -25,8 +25,8 @@ import javax.servlet.http.HttpServletResponse;
 * Implement by a class that is capable of providing a remember-me service.
 *
 * <p>
- * Spring Security filters (namely {@link org.springframework.security.ui.AbstractProcessingFilter} and
- * {@link org.springframework.security.ui.rememberme.RememberMeProcessingFilter} will call
+ * Spring Security filters (namely {@link org.springframework.security.web.authentication.AbstractProcessingFilter} and
+ * {@link org.springframework.security.web.authentication.rememberme.RememberMeProcessingFilter} will call
 * the methods provided by an implementation of this interface.
 * <p>
 * Implementations may implement any type of remember-me capability they wish.
@@ -57,7 +57,7 @@ public interface RememberMeServices {
     * The returned <code>Authentication</code> must be acceptable to
     * {@link org.springframework.security.AuthenticationManager} or
     * {@link org.springframework.security.providers.AuthenticationProvider} defined by the web application.
-     * It is recommended {@link org.springframework.security.providers.rememberme.RememberMeAuthenticationToken} be
+     * It is recommended {@link org.springframework.security.providers.RememberMeAuthenticationToken} be
     * used in most cases, as it has a corresponding authentication provider.
     *
     * @param request to look for a remember-me token within
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.rememberme;
+package org.springframework.security.web.authentication.rememberme;

 import org.springframework.security.Authentication;
 import org.springframework.security.userdetails.UserDetails;
@@ -1,4 +1,4 @@
-package org.springframework.security.ui.switchuser;
+package org.springframework.security.web.authentication.switchuser;

 import java.util.List;

@@ -13,20 +13,20 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.switchuser;
+package org.springframework.security.web.authentication.switchuser;

 import org.springframework.security.Authentication;
 import org.springframework.security.GrantedAuthorityImpl;


 /**
- * Custom <code>GrantedAuthority</code> used by {@link org.springframework.security.ui.switchuser.SwitchUserProcessingFilter}<p>Stores
+ * Custom <code>GrantedAuthority</code> used by {@link org.springframework.security.web.authentication.switchuser.SwitchUserProcessingFilter}<p>Stores
 * the <code>Authentication</code> object of the original user to be used later when 'exiting' from a user switch.</p>
 *
 * @author Mark St.Godard
 * @version $Id$
 *
- * @see org.springframework.security.ui.switchuser.SwitchUserProcessingFilter
+ * @see org.springframework.security.web.authentication.switchuser.SwitchUserProcessingFilter
 */
 public class SwitchUserGrantedAuthority extends GrantedAuthorityImpl {
    //~ Instance fields ================================================================================================
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.switchuser;
+package org.springframework.security.web.authentication.switchuser;

 import java.io.IOException;
 import java.util.ArrayList;
@@ -34,6 +34,7 @@ import org.springframework.context.support.MessageSourceAccessor;
 import org.springframework.security.AccountExpiredException;
 import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationCredentialsNotFoundException;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.CredentialsExpiredException;
 import org.springframework.security.DisabledException;
@@ -43,19 +44,18 @@ import org.springframework.security.SpringSecurityMessageSource;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.event.authentication.AuthenticationSwitchUserEvent;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.AuthenticationFailureHandler;
-import org.springframework.security.ui.AuthenticationSuccessHandler;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SimpleUrlAuthenticationFailureHandler;
-import org.springframework.security.ui.SimpleUrlAuthenticationSuccessHandler;
-import org.springframework.security.ui.SpringSecurityFilter;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
 import org.springframework.security.userdetails.UserDetails;
 import org.springframework.security.userdetails.UserDetailsChecker;
 import org.springframework.security.userdetails.UserDetailsService;
 import org.springframework.security.userdetails.UsernameNotFoundException;
 import org.springframework.security.userdetails.checker.AccountStatusUserDetailsChecker;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
+import org.springframework.security.web.authentication.AuthenticationFailureHandler;
+import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
+import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
@@ -77,7 +77,7 @@ import org.springframework.util.StringUtils;
 * <p>
 * On a successful switch, the user's  <code>SecurityContextHolder</code> will be updated to reflect the
 * specified user and will also contain an additional
- * {@link org.springframework.security.ui.switchuser.SwitchUserGrantedAuthority} which contains the original user.
+ * {@link org.springframework.security.web.authentication.switchuser.SwitchUserGrantedAuthority} which contains the original user.
 * <p>
 * To 'exit' from a user context, the user will then need to access a URL (see <code>exitUserUrl</code>)  that
 * will switch back to the original user as identified by the <code>ROLE_PREVIOUS_ADMINISTRATOR</code>.
@@ -97,7 +97,7 @@ import org.springframework.util.StringUtils;
 * @author Mark St.Godard
 * @version $Id$
 *
- * @see org.springframework.security.ui.switchuser.SwitchUserGrantedAuthority
+ * @see org.springframework.security.web.authentication.switchuser.SwitchUserGrantedAuthority
 */
 public class SwitchUserProcessingFilter extends SpringSecurityFilter implements InitializingBean,
        ApplicationEventPublisherAware, MessageSourceAware {
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.basicauth;
+package org.springframework.security.web.authentication.www;

 import java.io.IOException;

@@ -25,18 +25,18 @@ import javax.servlet.http.HttpServletResponse;
 import org.apache.commons.codec.binary.Base64;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.Authentication;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.AuthenticationManager;
 import org.springframework.security.context.SecurityContextHolder;
+import org.springframework.security.providers.AnonymousAuthenticationToken;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.providers.anonymous.AnonymousAuthenticationToken;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
-import org.springframework.security.ui.AuthenticationEntryPoint;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
-import org.springframework.security.ui.rememberme.NullRememberMeServices;
-import org.springframework.security.ui.rememberme.RememberMeServices;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
+import org.springframework.security.web.authentication.rememberme.NullRememberMeServices;
+import org.springframework.security.web.authentication.rememberme.RememberMeServices;
 import org.springframework.util.Assert;


@@ -76,7 +76,7 @@ import org.springframework.util.Assert;
 * Basic authentication is an attractive protocol because it is simple and widely deployed. However, it still
 * transmits a password in clear text and as such is undesirable in many situations. Digest authentication is also
 * provided by Spring Security and should be used instead of Basic authentication wherever possible. See {@link
- * org.springframework.security.ui.digestauth.DigestProcessingFilter}.
+ * org.springframework.security.web.authentication.www.DigestProcessingFilter}.
 * <p>
 * Note that if a {@link RememberMeServices} is set, this filter will automatically send back remember-me
 * details to the client. Therefore, subsequent requests will not need to present a BASIC authentication header as
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.basicauth;
+package org.springframework.security.web.authentication.www;

 import java.io.IOException;

@@ -22,7 +22,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.AuthenticationException;
-import org.springframework.security.ui.AuthenticationEntryPoint;
+import org.springframework.security.web.AuthenticationEntryPoint;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.digestauth;
+package org.springframework.security.web.authentication.www;

 import java.io.IOException;
 import java.util.Map;
@@ -32,22 +32,22 @@ import org.springframework.beans.factory.InitializingBean;
 import org.springframework.context.MessageSource;
 import org.springframework.context.MessageSourceAware;
 import org.springframework.context.support.MessageSourceAccessor;
+import org.springframework.security.AuthenticationDetailsSource;
 import org.springframework.security.AuthenticationException;
 import org.springframework.security.AuthenticationServiceException;
 import org.springframework.security.BadCredentialsException;
 import org.springframework.security.SpringSecurityMessageSource;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.providers.UsernamePasswordAuthenticationToken;
-import org.springframework.security.providers.dao.UserCache;
-import org.springframework.security.providers.dao.cache.NullUserCache;
-import org.springframework.security.ui.AuthenticationDetailsSource;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
-import org.springframework.security.ui.WebAuthenticationDetailsSource;
+import org.springframework.security.userdetails.UserCache;
 import org.springframework.security.userdetails.UserDetails;
 import org.springframework.security.userdetails.UserDetailsService;
 import org.springframework.security.userdetails.UsernameNotFoundException;
+import org.springframework.security.userdetails.cache.NullUserCache;
 import org.springframework.security.util.StringSplitUtils;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.WebAuthenticationDetailsSource;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;

@@ -70,7 +70,7 @@ import org.springframework.util.StringUtils;
 * If authentication is successful, the resulting {@link org.springframework.security.Authentication Authentication}
 * object will be placed into the <code>SecurityContextHolder</code>.
 * <p>
- * If authentication fails, an {@link org.springframework.security.ui.AuthenticationEntryPoint AuthenticationEntryPoint}
+ * If authentication fails, an {@link org.springframework.security.web.AuthenticationEntryPoint AuthenticationEntryPoint}
 * implementation is called. This must always be {@link DigestProcessingFilterEntryPoint}, which will prompt the user
 * to authenticate again via Digest authentication.
 * <p>
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.digestauth;
+package org.springframework.security.web.authentication.www;

 import java.io.IOException;

@@ -22,7 +22,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.AuthenticationException;
-import org.springframework.security.ui.AuthenticationEntryPoint;
+import org.springframework.security.web.AuthenticationEntryPoint;
 import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.logging.Log;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.digestauth;
+package org.springframework.security.web.authentication.www;

 import org.springframework.security.AuthenticationException;

@@ -13,14 +13,16 @@
 * limitations under the License.
 */

-package org.springframework.security.concurrent;
+package org.springframework.security.web.concurrent;

 import org.springframework.security.Authentication;
+import org.springframework.security.concurrent.SessionInformation;
+import org.springframework.security.concurrent.SessionRegistry;
 import org.springframework.security.context.SecurityContextHolder;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
-import org.springframework.security.ui.logout.LogoutHandler;
-import org.springframework.security.ui.logout.SecurityContextLogoutHandler;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
+import org.springframework.security.web.logout.LogoutHandler;
+import org.springframework.security.web.logout.SecurityContextLogoutHandler;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;
@@ -42,10 +44,10 @@ import java.io.IOException;
 * {@link org.springframework.security.concurrent.SessionInformation} from the <code>SessionRegistry</code>
 * for each request and checks if the session has been marked as expired.
 * If it has been marked as expired, the configured logout handlers will be called (as happens with
- * {@link org.springframework.security.ui.logout.LogoutFilter}), typically to invalidate the session.
+ * {@link org.springframework.security.web.logout.LogoutFilter}), typically to invalidate the session.
 * A redirect to the expiredURL specified will be performed, and the session invalidation will cause an
- * {@link org.springframework.security.ui.session.HttpSessionDestroyedEvent} to be published via the
- * {@link org.springframework.security.ui.session.HttpSessionEventPublisher} registered in <code>web.xml</code>.</p>
+ * {@link org.springframework.security.web.session.HttpSessionDestroyedEvent} to be published via the
+ * {@link org.springframework.security.web.session.HttpSessionEventPublisher} registered in <code>web.xml</code>.</p>
 *
 * @author Ben Alex
 * @version $Id$
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.concurrent;
+package org.springframework.security.web.concurrent;

 import java.util.ArrayList;
 import java.util.Collections;
@@ -30,16 +30,18 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.context.ApplicationEvent;
 import org.springframework.context.ApplicationListener;
-import org.springframework.security.ui.session.HttpSessionDestroyedEvent;
+import org.springframework.security.concurrent.SessionInformation;
+import org.springframework.security.concurrent.SessionRegistry;
+import org.springframework.security.web.session.HttpSessionDestroyedEvent;
 import org.springframework.util.Assert;

 /**
 * Base implementation of {@link org.springframework.security.concurrent.SessionRegistry}
- * which also listens for {@link org.springframework.security.ui.session.HttpSessionDestroyedEvent}s
+ * which also listens for {@link org.springframework.security.web.session.HttpSessionDestroyedEvent}s
 * published in the Spring application context.
 *
 * <p>
- * NB: It is important that you register the {@link org.springframework.security.ui.session.HttpSessionEventPublisher} in
+ * NB: It is important that you register the {@link org.springframework.security.web.session.HttpSessionEventPublisher} in
 * <code>web.xml</code> so that this class is notified of sessions that expire.
 * </p>
 *
@@ -1,4 +1,4 @@
-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import javax.servlet.ServletException;

@@ -21,7 +21,7 @@ import org.springframework.beans.factory.InitializingBean;
 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
 import org.springframework.security.context.SecurityContextImpl;
-import org.springframework.security.ui.FilterChainOrder;
+import org.springframework.security.web.FilterChainOrder;

 /**
 * Populates the {@link SecurityContextHolder} with information obtained from
@@ -1,4 +1,4 @@
-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import java.lang.reflect.Method;

@@ -1,4 +1,4 @@
-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import java.io.IOException;

@@ -1,4 +1,4 @@
-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import java.io.IOException;

@@ -10,8 +10,8 @@ import javax.servlet.http.HttpSession;

 import org.springframework.security.context.SecurityContext;
 import org.springframework.security.context.SecurityContextHolder;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.SpringSecurityFilter;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;

 /**
 * Populates the {@link SecurityContextHolder} with information obtained from
@@ -1,4 +1,4 @@
-package org.springframework.security.context.web;
+package org.springframework.security.web.context;

 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
@@ -1,4 +1,4 @@
-package org.springframework.security.expression.web.support;
+package org.springframework.security.web.expression;

 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.ExpressionParser;
@@ -8,8 +8,7 @@ import org.springframework.security.Authentication;
 import org.springframework.security.AuthenticationTrustResolver;
 import org.springframework.security.AuthenticationTrustResolverImpl;
 import org.springframework.security.expression.support.SecurityExpressionRoot;
-import org.springframework.security.expression.web.WebSecurityExpressionHandler;
-import org.springframework.security.intercept.web.FilterInvocation;
+import org.springframework.security.web.intercept.FilterInvocation;

 /**
 * Facade which isolates Spring Security's requirements for evaluating web-security expressions
@@ -1,4 +1,4 @@
-package org.springframework.security.expression.web;
+package org.springframework.security.web.expression;

 import java.util.ArrayList;
 import java.util.LinkedHashMap;
@@ -10,9 +10,9 @@ import org.apache.commons.logging.LogFactory;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.expression.ParseException;
 import org.springframework.security.ConfigAttribute;
-import org.springframework.security.intercept.web.DefaultFilterInvocationSecurityMetadataSource;
-import org.springframework.security.intercept.web.RequestKey;
 import org.springframework.security.util.UrlMatcher;
+import org.springframework.security.web.intercept.DefaultFilterInvocationSecurityMetadataSource;
+import org.springframework.security.web.intercept.RequestKey;
 import org.springframework.util.Assert;

 /**
@@ -1,4 +1,4 @@
-package org.springframework.security.expression.web;
+package org.springframework.security.web.expression;

 import org.springframework.expression.Expression;
 import org.springframework.security.ConfigAttribute;
@@ -1,4 +1,4 @@
-package org.springframework.security.expression.web;
+package org.springframework.security.web.expression;

 import java.util.List;

@@ -6,11 +6,8 @@ import org.springframework.expression.EvaluationContext;
 import org.springframework.security.Authentication;
 import org.springframework.security.ConfigAttribute;
 import org.springframework.security.expression.ExpressionUtils;
-import org.springframework.security.expression.MethodSecurityExpressionHandler;
-import org.springframework.security.expression.support.DefaultMethodSecurityExpressionHandler;
-import org.springframework.security.expression.web.support.DefaultWebSecurityExpressionHandler;
-import org.springframework.security.intercept.web.FilterInvocation;
 import org.springframework.security.vote.AccessDecisionVoter;
+import org.springframework.security.web.intercept.FilterInvocation;

 /**
 * Voter which handles web authorisation decisions.
@@ -1,9 +1,9 @@
-package org.springframework.security.expression.web;
+package org.springframework.security.web.expression;

 import org.springframework.expression.EvaluationContext;
 import org.springframework.expression.ExpressionParser;
 import org.springframework.security.Authentication;
-import org.springframework.security.intercept.web.FilterInvocation;
+import org.springframework.security.web.intercept.FilterInvocation;

 public interface WebSecurityExpressionHandler {
    /**
@@ -1,4 +1,4 @@
-package org.springframework.security.expression.web.support;
+package org.springframework.security.web.expression;

 import java.net.InetAddress;
 import java.net.UnknownHostException;
@@ -6,7 +6,7 @@ import java.util.Arrays;

 import org.springframework.security.Authentication;
 import org.springframework.security.expression.support.SecurityExpressionRoot;
-import org.springframework.security.intercept.web.FilterInvocation;
+import org.springframework.security.web.intercept.FilterInvocation;
 import org.springframework.util.StringUtils;

 /**
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 import java.util.Arrays;
 import java.util.Collection;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 import org.springframework.security.web.util.UrlUtils;

@@ -65,7 +65,7 @@ public class FilterInvocation {
     * Indicates the URL that the user agent used for this request.
     * <p>
     * The returned URL does <b>not</b> reflect the port number determined from a
-     * {@link org.springframework.security.web.util.PortResolver}.
+     * {@link org.springframework.security.web.PortResolver}.
     *
     * @return the full URL of this request
     */
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 import org.springframework.security.intercept.SecurityMetadataSource;

@@ -13,12 +13,12 @@
 * limitations under the License.
 */

-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 import org.springframework.security.intercept.AbstractSecurityInterceptor;
 import org.springframework.security.intercept.InterceptorStatusToken;
 import org.springframework.security.intercept.SecurityMetadataSource;
-import org.springframework.security.ui.FilterChainOrder;
+import org.springframework.security.web.FilterChainOrder;
 import org.springframework.core.Ordered;

 import java.io.IOException;
@@ -1,4 +1,4 @@
-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 /**
 * @author Luke Taylor
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.intercept.web;
+package org.springframework.security.web.intercept;

 import java.util.List;

@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.logout;
+package org.springframework.security.web.logout;

 import java.io.IOException;
 import java.util.Arrays;
@@ -26,9 +26,8 @@ import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.Authentication;
 import org.springframework.security.context.SecurityContextHolder;
-import org.springframework.security.ui.FilterChainOrder;
-import org.springframework.security.ui.LogoutSuccessHandler;
-import org.springframework.security.ui.SpringSecurityFilter;
+import org.springframework.security.web.FilterChainOrder;
+import org.springframework.security.web.SpringSecurityFilter;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.logout;
+package org.springframework.security.web.logout;

 import org.springframework.security.Authentication;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui;
+package org.springframework.security.web.logout;

 import java.io.IOException;

@@ -7,7 +7,6 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.Authentication;
-import org.springframework.security.ui.logout.LogoutFilter;

 /**
 * Strategy that is called after a successful logout by the {@link LogoutFilter}, to handle redirection or
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.logout;
+package org.springframework.security.web.logout;

 import org.springframework.security.Authentication;

@@ -1,4 +1,4 @@
-package org.springframework.security.ui.logout;
+package org.springframework.security.web.logout;

 import java.io.IOException;

@@ -7,8 +7,7 @@ import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;

 import org.springframework.security.Authentication;
-import org.springframework.security.ui.AbstractAuthenticationTargetUrlRequestHandler;
-import org.springframework.security.ui.LogoutSuccessHandler;
+import org.springframework.security.web.AbstractAuthenticationTargetUrlRequestHandler;

 /**
 * Handles the navigation on logout by delegating to the {@link AbstractAuthenticationTargetUrlRequestHandler}
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.savedrequest;
+package org.springframework.security.web.savedrequest;

 import java.util.ArrayList;
 import java.util.Collection;
@@ -13,7 +13,7 @@
 * limitations under the License.
 */

-package org.springframework.security.ui.savedrequest;
+package org.springframework.security.web.savedrequest;

 import java.text.DateFormat;
 import java.text.ParseException;
--- a/Show More
+++ b/Show More