SEC-2783: XML Configuration Defaults Should Match JavaConfig

* j_username -> username
* j_password -> password
* j_spring_security_check -> login
* j_spring_cas_security_check -> login/cas
* j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
* j_spring_openid_security_login -> login/openid
* j_spring_security_switch_user -> login/impersonate
* j_spring_security_exit_user -> logout/impersonate
* login_error -> error
* use-expressions=true by default

samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/LdapXmlTests.groovy

@@ -51,7 +51,7 @@ class LdapXmlTests extends GebReportingSpec {
         when: 'user logs out'
         logout.click()
         then: 'the default logout success page is displayed'
-        at HomePage
+        at LogoutPage
         when: 'Unauthenticated user accesses the Manage Page'
         via SecurePage
         then: 'The login page is displayed'

samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LoginPage.groovy

@@ -27,8 +27,8 @@ class LoginPage extends Page {
     static at = { assert driver.title == 'Login Page'; true}
     static content = {
         login(required:false) { user='rod', password='koala' ->
-            loginForm.j_username = user
-            loginForm.j_password = password
+            loginForm.username = user
+            loginForm.password = password
             submit.click()
         }
         loginForm { $('form') }

samples/ldap-xml/src/integration-test/groovy/org/springframework/security/samples/pages/LogoutPage.groovy

@@ -0,0 +1,25 @@
+/*
+ * Copyright 2011 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.samples.pages
+/**
+ * The login page.
+ *
+ * @author Rob Winch
+ */
+class LogoutPage extends LoginPage {
+    static url = 'login'
+    static at = { assert driver.title == 'Login Page' && $('p').text() == 'You have been logged out'; true}
+}

samples/ldap-xml/src/main/webapp/WEB-INF/applicationContext-security.xml

@@ -5,9 +5,9 @@
     http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
 
     <s:http>
-        <s:intercept-url pattern="/secure/extreme/**" access="ROLE_SUPERVISOR"/>
-        <s:intercept-url pattern="/secure/**" access="IS_AUTHENTICATED_REMEMBERED" />
-        <s:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" />
+        <s:intercept-url pattern="/secure/extreme/**" access="hasRole('ROLE_SUPERVISOR')"/>
+        <s:intercept-url pattern="/secure/**" access="authenticated" />
+        <s:intercept-url pattern="/**" access="permitAll" />
 
         <s:form-login />
         <s:anonymous />

samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp

@@ -7,7 +7,7 @@
 This is a protected page. You can only see me if you are a supervisor.
 
 <p><a href="../../">Home</a>
-<form action="<c:url value="/j_spring_security_logout"/>" method="post">
+<form action="<c:url value="/logout"/>" method="post">
 <input type="submit" value="Logoff"/>
 <security:csrfInput/>
 </form>

samples/ldap-xml/src/main/webapp/secure/index.jsp

@@ -13,7 +13,7 @@ or if you've authenticated this session.<br><br>
 
 
 <p><a href="../">Home</a>
-<form action="<c:url value="/j_spring_security_logout"/>" method="post">
+<form action="<c:url value="/logout"/>" method="post">
 <input type="submit" value="Logoff"/> (also clears any remember-me cookie)
 <security:csrfInput/>
 </form>