Release version 3.2.4.RELEASE

- Upgrade to 0.0.3.RELEASE of the plugin
- Declare a dependency in the springIoVersions configuration on the
  Platform’s platform-versions artifact. An external property is used to
  provide the version of this artifact. This means that the build script
  does not need to refer to a snapshot artifact (the only version
  available at the time of writing) and also breaks a circular
  dependency between Spring Security (a project that’s part of the
  Platform) and the Platform itself.
- The plugin applied and the libs-snapshot repository is added only
  if the external property is specified. This removes the possibility
  of a release or milestone being shipped with a snapshot dependency
  (unless the release build is performed with -PplatformVersion=foo).

CONTRIBUTING.md

@@ -6,18 +6,6 @@ _Please refer back to this document as a checklist before issuing any pull reque
 
 Each Spring module is slightly different than another in terms of team size, number of issues, etc. Therefore each project is managed slightly different. You will notice that this document is very similar to the [Spring Framework Contributor guidelines](https://github.com/SpringSource/spring-framework/wiki/Contributor-guidelines). However, there are some subtle differences between the two documents, so please be sure to read this document thoroughly.
 
-# Importing into IDE
-
-The following provides information on setting up a development environment that can run the sample in [Spring Tool Suite 3.6.0+](http://www.springsource.org/sts). Other IDE's should work using Gradle's IDE support, but have not been tested.
-
-* IDE Setup
-  * Install Spring Tool Suite 3.6.0+
-  * You will need the following plugins installed (can be found on the Extensions Page)
-   	* Gradle Eclipse
-   	* Groovy Eclipse
-* Importing the project into Spring Tool Suite
-  * File->Import...->Gradle Project
-
 # Understand the basics 
 Not sure what a pull request is, or how to submit one? Take a look at GitHub's excellent [help documentation first](https://help.github.com/articles/using-pull-requests).
 

acl/acl.gradle

@@ -2,14 +2,13 @@
 
 dependencies {
     compile project(':spring-security-core'),
-            springCoreDependency,
             'aopalliance:aopalliance:1.0',
             "org.springframework:spring-aop:$springVersion",
             "org.springframework:spring-context:$springVersion",
             "org.springframework:spring-tx:$springVersion",
             "org.springframework:spring-jdbc:$springVersion"
 
-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
 
     testCompile "org.springframework:spring-beans:$springVersion",
                 "org.springframework:spring-context-support:$springVersion",

acl/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-acl</artifactId>
-  <version>4.0.0.RC1</version>
+  <version>3.2.4.RELEASE</version>
   <name>spring-security-acl</name>
   <description>spring-security-acl</description>
   <url>http://spring.io/spring-security</url>
@@ -30,12 +31,17 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
-  <repositories>
-    <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
-    </repository>
-  </repositories>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
   <dependencies>
     <dependency>
       <groupId>aopalliance</groupId>
@@ -46,25 +52,25 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -76,33 +82,33 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-jdbc</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-tx</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>commons-logging</groupId>
       <artifactId>commons-logging</artifactId>
-      <version>1.2</version>
+      <version>1.1.1</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>2.9.0</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.1.2</version>
+      <version>0.9.29</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -120,7 +126,7 @@
     <dependency>
       <groupId>org.hsqldb</groupId>
       <artifactId>hsqldb</artifactId>
-      <version>2.3.2</version>
+      <version>2.3.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -132,37 +138,26 @@
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.7</version>
+      <version>1.7.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context-support</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>

acl/src/main/java/org/springframework/security/acls/domain/AclAuthorizationStrategyImpl.java

@@ -87,7 +87,7 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
         Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
 
         // Check if authorized by virtue of ACL ownership
-        Sid currentUser = createCurrentUser(authentication);
+        Sid currentUser = new PrincipalSid(authentication);
 
         if (currentUser.equals(acl.getOwner())
                 && ((changeType == CHANGE_GENERAL) || (changeType == CHANGE_OWNERSHIP))) {
@@ -123,17 +123,6 @@ public class AclAuthorizationStrategyImpl implements AclAuthorizationStrategy {
                 "Principal does not have required ACL permissions to perform requested operation");
     }
 
-    /**
-     * Creates a principal-like sid from the authentication information.
-     *
-     * @param authentication the authentication information that can provide principal and thus the sid's id will be
-     *                       dependant on the value inside
-     * @return a sid with the ID taken from the authentication information
-     */
-    protected Sid createCurrentUser(Authentication authentication) {
-        return new PrincipalSid(authentication);
-    }
-
     public void setSidRetrievalStrategy(SidRetrievalStrategy sidRetrievalStrategy) {
         Assert.notNull(sidRetrievalStrategy, "SidRetrievalStrategy required");
         this.sidRetrievalStrategy = sidRetrievalStrategy;

acl/src/main/java/org/springframework/security/acls/domain/AclImpl.java

@@ -73,6 +73,16 @@ public class AclImpl implements Acl, MutableAcl, AuditableAcl, OwnershipAcl {
         this.permissionGrantingStrategy = new DefaultPermissionGrantingStrategy(auditLogger);
     }
 
+    /**
+     * @deprecated Use the version which takes a  {@code PermissionGrantingStrategy} argument instead.
+     */
+    @Deprecated
+    public AclImpl(ObjectIdentity objectIdentity, Serializable id, AclAuthorizationStrategy aclAuthorizationStrategy,
+                    AuditLogger auditLogger, Acl parentAcl, List<Sid> loadedSids, boolean entriesInheriting, Sid owner) {
+        this(objectIdentity, id, aclAuthorizationStrategy, new DefaultPermissionGrantingStrategy(auditLogger),
+                parentAcl, loadedSids, entriesInheriting, owner);
+    }
+
     /**
      * Full constructor, which should be used by persistence tools that do not
      * provide field-level access features.

acl/src/main/java/org/springframework/security/acls/domain/EhCacheBasedAclCache.java

@@ -46,6 +46,15 @@ public class EhCacheBasedAclCache implements AclCache {
 
     //~ Constructors ===================================================================================================
 
+    /**
+     * @deprecated use the second constructor which injects the strategy objects. See SEC-1498.
+     */
+    @Deprecated
+    public EhCacheBasedAclCache(Ehcache cache) {
+        Assert.notNull(cache, "Cache required");
+        this.cache = cache;
+    }
+
     public EhCacheBasedAclCache(Ehcache cache, PermissionGrantingStrategy permissionGrantingStrategy,
             AclAuthorizationStrategy aclAuthorizationStrategy) {
         Assert.notNull(cache, "Cache required");

acl/src/main/java/org/springframework/security/acls/jdbc/BasicLookupStrategy.java

@@ -74,7 +74,7 @@ import org.springframework.util.Assert;
  *
  * @author Ben Alex
  */
-public class BasicLookupStrategy implements LookupStrategy {
+public final class BasicLookupStrategy implements LookupStrategy {
 
     public final static String DEFAULT_SELECT_CLAUSE = "select acl_object_identity.object_id_identity, "
         + "acl_entry.ace_order,  "
@@ -131,20 +131,15 @@ public class BasicLookupStrategy implements LookupStrategy {
      * @param dataSource to access the database
      * @param aclCache the cache where fully-loaded elements can be stored
      * @param aclAuthorizationStrategy authorization strategy (required)
+     *
+     * @deprecated Use the version which takes a  {@code PermissionGrantingStrategy} argument instead.
      */
+    @Deprecated
     public BasicLookupStrategy(DataSource dataSource, AclCache aclCache,
             AclAuthorizationStrategy aclAuthorizationStrategy, AuditLogger auditLogger) {
         this(dataSource, aclCache, aclAuthorizationStrategy, new DefaultPermissionGrantingStrategy(auditLogger));
     }
 
-    /**
-     * Creates a new instance
-     *
-     * @param dataSource to access the database
-     * @param aclCache the cache where fully-loaded elements can be stored
-     * @param aclAuthorizationStrategy authorization strategy (required)
-     * @param grantingStrategy the PermissionGrantingStrategy
-     */
     public BasicLookupStrategy(DataSource dataSource, AclCache aclCache,
             AclAuthorizationStrategy aclAuthorizationStrategy, PermissionGrantingStrategy grantingStrategy) {
         Assert.notNull(dataSource, "DataSource required");
@@ -261,7 +256,7 @@ public class BasicLookupStrategy implements LookupStrategy {
      *         should not throw {@link NotFoundException}, as a chain of {@link LookupStrategy}s may be used
      *         to automatically create entries if required)
      */
-    public final Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) {
+    public Map<ObjectIdentity, Acl> readAclsById(List<ObjectIdentity> objects, List<Sid> sids) {
         Assert.isTrue(batchSize >= 1, "BatchSize must be >= 1");
         Assert.notEmpty(objects, "Objects to lookup required");
 
@@ -433,33 +428,17 @@ public class BasicLookupStrategy implements LookupStrategy {
         return result;
     }
 
-    /**
-     * Creates a particular implementation of {@link Sid} depending on the arguments.
-     *
-     * @param sid   the name of the sid representing its unique identifier. In typical ACL database schema it's
-     *                  located in table {@code acl_sid} table, {@code sid} column.
-     * @param isPrincipal whether it's a user or granted authority like role
-     * @return the instance of Sid with the {@code sidName} as an identifier
-     */
-    protected Sid createSid(boolean isPrincipal, String sid) {
-        if (isPrincipal) {
-            return new PrincipalSid(sid);
-        } else {
-            return new GrantedAuthoritySid(sid);
-        }
-    }
-
     /**
      * Sets the {@code PermissionFactory} instance which will be used to convert loaded permission
      * data values to {@code Permission}s. A {@code DefaultPermissionFactory} will be used by default.
      *
      * @param permissionFactory
      */
-    public final void setPermissionFactory(PermissionFactory permissionFactory) {
+    public void setPermissionFactory(PermissionFactory permissionFactory) {
         this.permissionFactory = permissionFactory;
     }
 
-    public final void setBatchSize(int batchSize) {
+    public void setBatchSize(int batchSize) {
         this.batchSize = batchSize;
     }
 
@@ -469,28 +448,28 @@ public class BasicLookupStrategy implements LookupStrategy {
      *
      * @param selectClause the select clause, which defaults to {@link #DEFAULT_SELECT_CLAUSE}.
      */
-    public final void setSelectClause(String selectClause) {
+    public void setSelectClause(String selectClause) {
         this.selectClause = selectClause;
     }
 
     /**
      * The SQL for the where clause used in the <tt>lookupPrimaryKey</tt> method.
      */
-    public final void setLookupPrimaryKeysWhereClause(String lookupPrimaryKeysWhereClause) {
+    public void setLookupPrimaryKeysWhereClause(String lookupPrimaryKeysWhereClause) {
         this.lookupPrimaryKeysWhereClause = lookupPrimaryKeysWhereClause;
     }
 
     /**
      * The SQL for the where clause used in the <tt>lookupObjectIdentities</tt> method.
      */
-    public final void setLookupObjectIdentitiesWhereClause(String lookupObjectIdentitiesWhereClause) {
+    public void setLookupObjectIdentitiesWhereClause(String lookupObjectIdentitiesWhereClause) {
         this.lookupObjectIdentitiesWhereClause = lookupObjectIdentitiesWhereClause;
     }
 
     /**
      * The SQL for the "order by" clause used in both queries.
      */
-    public final void setOrderByClause(String orderByClause) {
+    public void setOrderByClause(String orderByClause) {
         this.orderByClause = orderByClause;
     }
 
@@ -577,7 +556,13 @@ public class BasicLookupStrategy implements LookupStrategy {
                 }
 
                 boolean entriesInheriting = rs.getBoolean("entries_inheriting");
-                Sid owner = createSid(rs.getBoolean("acl_principal"), rs.getString("acl_sid"));
+                Sid owner;
+
+                if (rs.getBoolean("acl_principal")) {
+                    owner = new PrincipalSid(rs.getString("acl_sid"));
+                } else {
+                    owner = new GrantedAuthoritySid(rs.getString("acl_sid"));
+                }
 
                 acl = new AclImpl(objectIdentity, id, aclAuthorizationStrategy, grantingStrategy, parentAcl, null,
                         entriesInheriting, owner);
@@ -589,7 +574,13 @@ public class BasicLookupStrategy implements LookupStrategy {
             // It is permissible to have no ACEs in an ACL (which is detected by a null ACE_SID)
             if (rs.getString("ace_sid") != null) {
                 Long aceId = new Long(rs.getLong("ace_id"));
-                Sid recipient = createSid(rs.getBoolean("ace_principal"), rs.getString("ace_sid"));
+                Sid recipient;
+
+                if (rs.getBoolean("ace_principal")) {
+                    recipient = new PrincipalSid(rs.getString("ace_sid"));
+                } else {
+                    recipient = new GrantedAuthoritySid(rs.getString("ace_sid"));
+                }
 
                 int mask = rs.getInt("mask");
                 Permission permission = permissionFactory.buildFromMask(mask);

acl/src/main/java/org/springframework/security/acls/jdbc/JdbcMutableAclService.java

@@ -209,19 +209,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
             throw new IllegalArgumentException("Unsupported implementation of Sid");
         }
 
-        return createOrRetrieveSidPrimaryKey(sidName, sidIsPrincipal, allowCreate);
-    }
-
-    /**
-     * Retrieves the primary key from acl_sid, creating a new row if needed and the allowCreate property is
-     * true.
-     * @param sidName name of Sid to find or to create
-     * @param sidIsPrincipal whether it's a user or granted authority like role
-     * @param allowCreate true if creation is permitted if not found
-     * @return the primary key or null if not found
-     */
-    protected Long createOrRetrieveSidPrimaryKey(String sidName, boolean sidIsPrincipal, boolean allowCreate) {
-
         List<Long> sidIds = jdbcTemplate.queryForList(selectSidPrimaryKey,
                 new Object[] {Boolean.valueOf(sidIsPrincipal), sidName},  Long.class);
 

acl/src/test/java/org/springframework/security/acls/domain/AclImplTests.java

@@ -77,7 +77,7 @@ public class AclImplTests {
     @Test(expected=IllegalArgumentException.class)
     public void constructorsRejectNullAclAuthzStrategy() throws Exception {
         try {
-            new AclImpl(objectIdentity, 1, null, new DefaultPermissionGrantingStrategy(mockAuditLogger), null, null, true, new PrincipalSid("joe"));
+            new AclImpl(objectIdentity, 1, null, mockAuditLogger, null, null, true, new PrincipalSid("joe"));
             fail("It should have thrown IllegalArgumentException");
         }
         catch (IllegalArgumentException expected) {

acl/src/test/java/org/springframework/security/acls/domain/AclImplementationSecurityCheckTests.java

@@ -223,6 +223,7 @@ public class AclImplementationSecurityCheckTests {
         }
     }
 
+    @SuppressWarnings("deprecation")
     @Test
     public void testSecurityCheckPrincipalOwner() throws Exception {
         Authentication auth = new TestingAuthenticationToken("user", "password", "ROLE_ONE");
@@ -234,7 +235,7 @@ public class AclImplementationSecurityCheckTests {
                 new SimpleGrantedAuthority("ROLE_OWNERSHIP"), new SimpleGrantedAuthority("ROLE_AUDITING"),
                 new SimpleGrantedAuthority("ROLE_GENERAL"));
 
-        Acl acl = new AclImpl(identity, 1, aclAuthorizationStrategy, new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()), null, null,
+        Acl acl = new AclImpl(identity, 1, aclAuthorizationStrategy, new ConsoleAuditLogger(), null, null,
                 false, new PrincipalSid(auth));
         try {
             aclAuthorizationStrategy.securityCheck(acl, AclAuthorizationStrategy.CHANGE_GENERAL);

acl/src/test/java/org/springframework/security/acls/jdbc/BasicLookupStrategyTests.java

@@ -9,7 +9,15 @@ import org.springframework.core.io.ClassPathResource;
 import org.springframework.core.io.Resource;
 import org.springframework.jdbc.core.JdbcTemplate;
 import org.springframework.jdbc.datasource.SingleConnectionDataSource;
-import org.springframework.security.acls.domain.*;
+import org.springframework.security.acls.domain.AclAuthorizationStrategy;
+import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
+import org.springframework.security.acls.domain.BasePermission;
+import org.springframework.security.acls.domain.ConsoleAuditLogger;
+import org.springframework.security.acls.domain.DefaultPermissionFactory;
+import org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy;
+import org.springframework.security.acls.domain.EhCacheBasedAclCache;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
+import org.springframework.security.acls.domain.PrincipalSid;
 import org.springframework.security.acls.model.Acl;
 import org.springframework.security.acls.model.AuditableAccessControlEntry;
 import org.springframework.security.acls.model.MutableAcl;
@@ -84,7 +92,7 @@ public class BasicLookupStrategyTests {
 
     @Before
     public void initializeBeans() {
-        EhCacheBasedAclCache cache = new EhCacheBasedAclCache(getCache(), new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()), new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER")));
+        EhCacheBasedAclCache cache = new EhCacheBasedAclCache(getCache());
         AclAuthorizationStrategy authorizationStrategy = new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_ADMINISTRATOR"));
         strategy = new BasicLookupStrategy(dataSource, cache, authorizationStrategy,
                 new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()));
@@ -293,20 +301,4 @@ public class BasicLookupStrategyTests {
         strategy.readAclsById(Arrays.asList(oid), Arrays.asList(BEN_SID));
     }
 
-    @Test
-    public void testCreatePrincipalSid() {
-        Sid result = strategy.createSid(true, "sid");
-
-        Assert.assertEquals(PrincipalSid.class, result.getClass());
-        Assert.assertEquals("sid", ((PrincipalSid)result).getPrincipal());
-    }
-
-    @Test
-    public void testCreateGrantedAuthority() {
-        Sid result = strategy.createSid(false, "sid");
-
-        Assert.assertEquals(GrantedAuthoritySid.class, result.getClass());
-        Assert.assertEquals("sid", ((GrantedAuthoritySid)result).getGrantedAuthority());
-    }
-
 }

acl/src/test/java/org/springframework/security/acls/jdbc/EhCacheBasedAclCacheTests.java

@@ -1,6 +1,5 @@
 package org.springframework.security.acls.jdbc;
 
-import static org.mockito.Matchers.*;
 import static org.mockito.Mockito.*;
 import static org.junit.Assert.*;
 import static org.fest.assertions.Assertions.*;
@@ -12,34 +11,32 @@ import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.Serializable;
 import java.util.List;
-import java.util.Map;
 
-import net.sf.ehcache.Cache;
-import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Ehcache;
 import net.sf.ehcache.Element;
 
 import org.junit.After;
-import org.junit.AfterClass;
 import org.junit.Before;
-import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Captor;
 import org.mockito.Mock;
 import org.mockito.runners.MockitoJUnitRunner;
-import org.springframework.security.acls.domain.*;
+import org.springframework.security.acls.domain.AclAuthorizationStrategy;
+import org.springframework.security.acls.domain.AclAuthorizationStrategyImpl;
+import org.springframework.security.acls.domain.AclImpl;
+import org.springframework.security.acls.domain.ConsoleAuditLogger;
+import org.springframework.security.acls.domain.EhCacheBasedAclCache;
+import org.springframework.security.acls.domain.ObjectIdentityImpl;
 import org.springframework.security.acls.model.MutableAcl;
 import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
-import org.springframework.security.core.authority.AuthorityUtils;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.test.util.ReflectionTestUtils;
-import org.springframework.util.ReflectionUtils;
 
 /**
  * Tests {@link EhCacheBasedAclCache}
@@ -61,7 +58,7 @@ public class EhCacheBasedAclCacheTests {
 
     @Before
     public void setup() {
-        myCache = new EhCacheBasedAclCache(cache, new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()), new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER")));
+        myCache = new EhCacheBasedAclCache(cache);
 
         ObjectIdentity identity = new ObjectIdentityImpl(TARGET_CLASS, Long.valueOf(100));
         AclAuthorizationStrategy aclAuthorizationStrategy = new AclAuthorizationStrategyImpl(
@@ -78,7 +75,7 @@ public class EhCacheBasedAclCacheTests {
 
     @Test(expected=IllegalArgumentException.class)
     public void constructorRejectsNullParameters() throws Exception {
-        new EhCacheBasedAclCache(null, new DefaultPermissionGrantingStrategy(new ConsoleAuditLogger()), new AclAuthorizationStrategyImpl(new SimpleGrantedAuthority("ROLE_USER")));
+        new EhCacheBasedAclCache(null);
     }
 
     @Test

acl/src/test/java/org/springframework/security/acls/jdbc/JdbcMutableAclServiceTests.java

@@ -15,7 +15,6 @@
 package org.springframework.security.acls.jdbc;
 
 import static org.junit.Assert.*;
-import static org.mockito.Mockito.*;
 
 import java.util.Arrays;
 import java.util.List;
@@ -44,7 +43,6 @@ import org.springframework.security.acls.model.NotFoundException;
 import org.springframework.security.acls.model.ObjectIdentity;
 import org.springframework.security.acls.model.Permission;
 import org.springframework.security.acls.model.Sid;
-import org.springframework.security.acls.sid.CustomSid;
 import org.springframework.security.authentication.TestingAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
@@ -491,43 +489,6 @@ public class JdbcMutableAclServiceTests extends AbstractTransactionalJUnit4Sprin
        assertTrue(topParent.isGranted(Arrays.asList(cm), Arrays.asList(benSid), true));
 
        SecurityContextHolder.clearContext();
-    }
-    @Test
-    public void testProcessingCustomSid() {
-        CustomJdbcMutableAclService customJdbcMutableAclService = spy(new CustomJdbcMutableAclService(dataSource,
-                lookupStrategy, aclCache));
-        CustomSid customSid = new CustomSid("Custom sid");
-        when(customJdbcMutableAclService.createOrRetrieveSidPrimaryKey("Custom sid", false, false)).thenReturn(1L);
-
-        Long result = customJdbcMutableAclService.createOrRetrieveSidPrimaryKey(customSid, false);
-
-        assertEquals(result, new Long(1L));
-    }
-
-    /**
-     * This class needed to show how to extend {@link JdbcMutableAclService} for processing
-     * custom {@link Sid} implementations
-     */
-    private class CustomJdbcMutableAclService extends JdbcMutableAclService {
-
-        private CustomJdbcMutableAclService(DataSource dataSource, LookupStrategy lookupStrategy, AclCache aclCache) {
-            super(dataSource, lookupStrategy, aclCache);
-        }
-
-        @Override
-        protected Long createOrRetrieveSidPrimaryKey(Sid sid, boolean allowCreate) {
-            String sidName;
-            boolean isPrincipal = false;
-            if (sid instanceof CustomSid) {
-                sidName = ((CustomSid)sid).getSid();
-            } else if (sid instanceof GrantedAuthoritySid) {
-                sidName = ((GrantedAuthoritySid)sid).getGrantedAuthority();
-            } else {
-                sidName = ((PrincipalSid)sid).getPrincipal();
-                isPrincipal = true;
-            }
-            return createOrRetrieveSidPrimaryKey(sidName, isPrincipal, allowCreate);
-        }
-    }
+   }
 
 }

acl/src/test/java/org/springframework/security/acls/sid/CustomSid.java

@@ -1,24 +0,0 @@
-package org.springframework.security.acls.sid;
-
-import org.springframework.security.acls.model.Sid;
-
-/**
- * This class is example of custom {@link Sid} implementation
- * @author Mikhail Stryzhonok
- */
-public class CustomSid implements Sid {
-
-    private String sid;
-
-    public CustomSid(String sid) {
-        this.sid = sid;
-    }
-
-    public String getSid() {
-        return sid;
-    }
-
-    public void setSid(String sid) {
-        this.sid = sid;
-    }
-}

acl/src/test/resources/jdbcMutableAclServiceTests-context.xml

@@ -22,25 +22,6 @@
               <property name="cacheName" value="aclCache"/>
            </bean>
         </constructor-arg>
-        <constructor-arg>
-            <bean class="org.springframework.security.acls.domain.DefaultPermissionGrantingStrategy">
-                <constructor-arg>
-                    <bean class="org.springframework.security.acls.domain.ConsoleAuditLogger"/>
-                </constructor-arg>
-            </bean>
-        </constructor-arg>
-        <constructor-arg>
-            <bean class="org.springframework.security.acls.domain.AclAuthorizationStrategyImpl">
-                <constructor-arg>
-                    <list>
-                        <bean class="org.springframework.security.core.authority.SimpleGrantedAuthority">
-                            <constructor-arg value="ROLE_USER"/>
-                        </bean>
-                    </list>
-                </constructor-arg>
-            </bean>
-        </constructor-arg>
-
     </bean>
 
     <bean id="lookupStrategy" class="org.springframework.security.acls.jdbc.BasicLookupStrategy">

acl/template.mf

@@ -0,0 +1,24 @@
+Implementation-Title: org.springframework.security.acls
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.acls
+Bundle-Name: Spring Security Acls
+Bundle-Vendor: SpringSource
+Bundle-Version: ${version}
+Bundle-ManifestVersion: 2
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.aopalliance.*;version="${aopAllianceRange}",
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.springframework.cache.*;version="${springRange}";resolution:=optional,
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.access.*;version="${secRange}",
+ org.springframework.security.util.*;version="${secRange}",
+ org.springframework.context.*;version="${springRange}";resolution:=optional,
+ org.springframework.dao.*;version="${springRange}";resolution:=optional,
+ org.springframework.jdbc.core.*;version="${springRange}";resolution:=optional,
+ org.springframework.transaction.support.*;version="${springRange}";resolution:=optional,
+ org.springframework.util.*;version="${springRange}";resolution:=optional,
+ net.sf.ehcache.*;version="${ehcacheRange}";resolution:=optional,
+ javax.sql.*;version="0";resolution:=optional

aspects/aspects.gradle

@@ -1,7 +1,6 @@
 
 dependencies {
     compile project(':spring-security-core'),
-            springCoreDependency,
             "org.springframework:spring-beans:$springVersion",
             "org.springframework:spring-context:$springVersion"
 

aspects/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-aspects</artifactId>
-  <version>4.0.0.RC1</version>
+  <version>3.2.4.RELEASE</version>
   <name>spring-security-aspects</name>
   <description>spring-security-aspects</description>
   <url>http://spring.io/spring-security</url>
@@ -30,35 +31,40 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
-  <repositories>
-    <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
-    </repository>
-  </repositories>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
   <dependencies>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -70,14 +76,14 @@
     <dependency>
       <groupId>commons-logging</groupId>
       <artifactId>commons-logging</artifactId>
-      <version>1.2</version>
+      <version>1.1.1</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.aspectj</groupId>
       <artifactId>aspectjrt</artifactId>
-      <version>1.8.4</version>
+      <version>1.6.10</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
@@ -90,7 +96,7 @@
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.1.2</version>
+      <version>0.9.29</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -114,31 +120,20 @@
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.7</version>
+      <version>1.7.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>

aspects/src/test/java/org/springframework/security/access/intercept/aspectj/aspect/AnnotationSecurityAspectTests.java

@@ -53,9 +53,10 @@ public class AnnotationSecurityAspectTests {
     public final void setUp() throws Exception {
         MockitoAnnotations.initMocks(this);
         interceptor = new AspectJMethodSecurityInterceptor();
+        adm = new AffirmativeBased();
         AccessDecisionVoter[] voters = new AccessDecisionVoter[]
                 {new RoleVoter(), new PreInvocationAuthorizationAdviceVoter(new ExpressionBasedPreInvocationAdvice())};
-        adm = new AffirmativeBased(Arrays.<AccessDecisionVoter<? extends Object>>asList(voters));
+        adm.setDecisionVoters(Arrays.asList(voters));
         interceptor.setAccessDecisionManager(adm);
         interceptor.setAuthenticationManager(authman);
         interceptor.setSecurityMetadataSource(new SecuredAnnotationSecurityMetadataSource());

aspects/template.mf

@@ -0,0 +1,16 @@
+Implementation-Title: org.springframework.security.aspects
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.aspects
+Bundle-Name: Spring Security Aspects
+Bundle-Vendor: SpringSource
+Bundle-ManifestVersion: 2
+Bundle-Version: ${version}
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.aspectj.*;version="${aspectjRange}";resolution:=optional,
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.access.intercept.aspectj;version="${secRange}",
+ org.springframework.beans.factory;version="${springRange}"

build.gradle

@@ -5,12 +5,13 @@ buildscript {
         maven { url "https://repo.spring.io/plugins-release" }
     }
     dependencies {
-        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.7")
+        classpath("org.springframework.build.gradle:propdeps-plugin:0.0.6")
+        classpath("org.springframework.build.gradle:bundlor-plugin:0.1.2")
         classpath("org.springframework.build.gradle:spring-io-plugin:0.0.3.RELEASE")
-        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:1.2.5")
+        classpath("org.gradle.api.plugins:gradle-tomcat-plugin:0.9.8")
         classpath('me.champeau.gradle:gradle-javadoc-hotfix-plugin:0.1')
-        classpath('org.asciidoctor:asciidoctor-gradle-plugin:1.5.1')
-        classpath("io.spring.gradle:docbook-reference-plugin:0.3.0")
+        classpath('org.asciidoctor:asciidoctor-gradle-plugin:0.7.0')
+        classpath('org.asciidoctor:asciidoctor-java-integration:0.1.4.preview.1')
     }
 }
 
@@ -25,8 +26,10 @@ allprojects {
 
     ext.releaseBuild = version.endsWith('RELEASE')
     ext.snapshotBuild = version.endsWith('SNAPSHOT')
-    ext.springVersion = '4.1.3.RELEASE'
-    ext.springLdapVersion = '2.0.2.RELEASE'
+    ext.springVersion = '3.2.8.RELEASE'
+    ext.spring4Version = '4.0.2.RELEASE'
+    ext.springLdapVersion = '1.3.2.RELEASE'
+    ext.springLdap2Version = '2.0.1.RELEASE'
 
     group = 'org.springframework.security'
 
@@ -37,7 +40,7 @@ allprojects {
        maven { url "http://repo.terracotta.org/maven2/" }
     }
 
-    eclipse.project.name = "${project.name}-4.0.x"
+    eclipse.project.name = "${project.name}-3.2.x"
 }
 
 sonarRunner {
@@ -59,7 +62,7 @@ ext.javaProjects = subprojects.findAll { project -> project.name != 'docs' && pr
 ext.sampleProjects = subprojects.findAll { project -> project.name.startsWith('spring-security-samples') }
 ext.itestProjects = subprojects.findAll { project -> project.name.startsWith('itest') }
 ext.coreModuleProjects = javaProjects - sampleProjects - itestProjects
-ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml'), project(':spring-security-samples-aspectj-jc')]
+ext.aspectjProjects = [project(':spring-security-aspects'), project(':spring-security-samples-aspectj-xml')]
 
 configure(allprojects - javaProjects) {
     task afterEclipseImport {
@@ -96,18 +99,22 @@ configure(javaProjects) {
 }
 
 configure(coreModuleProjects) {
+    apply plugin: 'bundlor'
     apply plugin: 'emma'
     apply plugin: 'spring-io'
 
-    ext.springIoVersion = project.hasProperty('platformVersion') ? platformVersion : '1.1.0.BUILD-SNAPSHOT'
+    ext.springIoVersion = project.hasProperty('platformVersion') ? platformVersion : '1.0.0.BUILD-SNAPSHOT'
 
+    bundlor.doFirst {
+        def templateText = file("template.mf").text
+        bundlor.manifestTemplate = new SimpleTemplateEngine().createTemplate(templateText).make(bundlorProperties).toString()
+    }
     configurations {
         jacoco //Configuration Group used by Sonar to provide Code Coverage using JaCoCo
     }
-
     dependencies {
-        springIoVersions "io.spring.platform:platform-versions:${springIoVersion}@properties"
         jacoco "org.jacoco:org.jacoco.agent:0.6.2.201302030002:runtime"
+        springIoVersions "io.spring.platform:platform-versions:${springIoVersion}@properties"
     }
     test {
         jvmArgs "-javaagent:${configurations.jacoco.asPath}=destfile=${buildDir}/jacoco.exec,includes=${project.group}.*"
@@ -166,5 +173,5 @@ artifacts {
 }
 
 task wrapper(type: Wrapper) {
-    gradleVersion = '1.12'
+    gradleVersion = '1.10-rc-2'
 }

buildSrc/src/main/groovy/aspectj/AspectJPlugin.groovy

@@ -30,7 +30,7 @@ class AspectJPlugin implements Plugin<Project> {
         }
 
         if (project.configurations.findByName('ajtools') == null) {
-            project.configurations.create('ajtools')
+            project.configurations.add('ajtools')
             project.dependencies {
                 ajtools "org.aspectj:aspectjtools:${project.aspectjVersion}"
                 optional "org.aspectj:aspectjrt:${project.aspectjVersion}"
@@ -38,10 +38,10 @@ class AspectJPlugin implements Plugin<Project> {
         }
 
         if (project.configurations.findByName('aspectpath') == null) {
-            project.configurations.create('aspectpath')
+            project.configurations.add('aspectpath')
         }
 
-        project.tasks.create(name: 'compileAspect', overwrite: true, description: 'Compiles AspectJ Source', type: Ajc) {
+        project.tasks.add(name: 'compileAspect', overwrite: true, description: 'Compiles AspectJ Source', type: Ajc) {
             dependsOn project.configurations*.getTaskDependencyFromProjectDependency(true, "compileJava")
 
             dependsOn project.processResources
@@ -54,7 +54,7 @@ class AspectJPlugin implements Plugin<Project> {
         project.tasks.compileJava.dependsOn project.tasks.compileAspect
 
 
-        project.tasks.create(name: 'compileTestAspect', overwrite: true, description: 'Compiles AspectJ Test Source', type: Ajc) {
+        project.tasks.add(name: 'compileTestAspect', overwrite: true, description: 'Compiles AspectJ Test Source', type: Ajc) {
             dependsOn project.processTestResources, project.compileJava, project.jar
             sourceSet = project.sourceSets.test
             inputs.files(sourceSet.allSource)

buildSrc/src/main/groovy/emma/EmmaPlugin.groovy

@@ -21,7 +21,7 @@ class EmmaPlugin implements Plugin<Project> {
         def emmaCoverageFile = "${rootProject.buildDir}/emma/emma.ec"
 
         if (project.configurations.findByName('emma_rt') == null) {
-            project.configurations.create('emma_rt')
+            project.configurations.add('emma_rt')
             project.dependencies {
                 emma_rt 'emma:emma:2.0.5312'
             }
@@ -64,7 +64,7 @@ class EmmaPlugin implements Plugin<Project> {
         CoverageReport task;
 
         if (reportTasks.isEmpty()) {
-            task = rootProject.tasks.create('coverageReport', CoverageReport.class);
+            task = rootProject.tasks.add('coverageReport', CoverageReport.class);
             task.dataPath = [emmaMetaDataFile, emmaCoverageFile];
         } else {
             task = reportTasks[0];

buildSrc/src/main/groovy/trang/TrangPlugin.groovy

@@ -17,7 +17,7 @@ import org.gradle.api.file.FileCollection
  */
 class TrangPlugin implements Plugin<Project> {
     public void apply(Project project) {
-        Task rncToXsd = project.tasks.create('rncToXsd', RncToXsd.class)
+        Task rncToXsd = project.tasks.add('rncToXsd', RncToXsd.class)
         rncToXsd.description = 'Converts .rnc to .xsd'
         rncToXsd.group = 'Build'
     }

cas/cas.gradle

@@ -2,13 +2,12 @@
 dependencies {
     compile project(':spring-security-core'),
             project(':spring-security-web'),
-            springCoreDependency,
             "org.springframework:spring-context:$springVersion",
             "org.springframework:spring-beans:$springVersion",
             "org.springframework:spring-web:$springVersion",
-            "org.jasig.cas.client:cas-client-core:$casClientVersion"
+            "org.jasig.cas.client:cas-client-core:3.2.1"
 
-    optional "net.sf.ehcache:ehcache:$ehcacheVersion"
+    optional "net.sf.ehcache:ehcache-core:$ehcacheVersion"
 
     provided "javax.servlet:javax.servlet-api:$servletApiVersion"
 }

cas/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-cas</artifactId>
-  <version>4.0.0.RC1</version>
+  <version>3.2.4.RELEASE</version>
   <name>spring-security-cas</name>
   <description>spring-security-cas</description>
   <url>http://spring.io/spring-security</url>
@@ -30,47 +31,52 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
-  <repositories>
-    <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
-    </repository>
-  </repositories>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
   <dependencies>
     <dependency>
       <groupId>org.jasig.cas.client</groupId>
       <artifactId>cas-client-core</artifactId>
-      <version>3.3.3</version>
+      <version>3.2.1</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -82,20 +88,20 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-web</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>commons-logging</groupId>
       <artifactId>commons-logging</artifactId>
-      <version>1.2</version>
+      <version>1.1.1</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>net.sf.ehcache</groupId>
-      <artifactId>ehcache</artifactId>
-      <version>2.9.0</version>
+      <artifactId>ehcache-core</artifactId>
+      <version>1.7.2</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
@@ -108,7 +114,7 @@
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.1.2</version>
+      <version>0.9.29</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -132,25 +138,14 @@
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.7</version>
+      <version>1.7.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>

cas/src/main/java/org/springframework/security/cas/ServiceProperties.java

@@ -49,7 +49,9 @@ public class ServiceProperties implements InitializingBean {
     //~ Methods ========================================================================================================
 
     public void afterPropertiesSet() throws Exception {
-        Assert.hasLength(this.service, "service cannot be empty.");
+        if(!authenticateAllArtifacts) {
+            Assert.hasLength(this.service, "service must be specified unless authenticateAllArtifacts is true.");
+        }
         Assert.hasLength(this.artifactParameter, "artifactParameter cannot be empty.");
         Assert.hasLength(this.serviceParameter, "serviceParameter cannot be empty.");
     }
@@ -60,7 +62,7 @@ public class ServiceProperties implements InitializingBean {
      * This service is the callback URL belonging to the local Spring Security System for Spring secured application.
      * For example,
      * <pre>
-     * https://www.mycompany.com/application/login/cas
+     * https://www.mycompany.com/application/j_spring_cas_security_check
      * </pre>
      *
      * @return the URL of the service the user is authenticating to

cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationProvider.java

@@ -185,15 +185,15 @@ public class CasAuthenticationProvider implements AuthenticationProvider, Initia
         return this.authenticationUserDetailsService.loadUserDetails(token);
     }
 
+    @Deprecated
     @SuppressWarnings("unchecked")
     /**
-     * Sets the UserDetailsService to use. This is a convenience method to invoke
+     * @deprecated as of 3.0.  Use the {@link org.springframework.security.cas.authentication.CasAuthenticationProvider#setAuthenticationUserDetailsService(org.springframework.security.core.userdetails.AuthenticationUserDetailsService)} instead.
      */
     public void setUserDetailsService(final UserDetailsService userDetailsService) {
         this.authenticationUserDetailsService = new UserDetailsByNameServiceWrapper(userDetailsService);
     }
 
-
     public void setAuthenticationUserDetailsService(final AuthenticationUserDetailsService<CasAssertionAuthenticationToken> authenticationUserDetailsService) {
         this.authenticationUserDetailsService = authenticationUserDetailsService;
     }

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationEntryPoint.java

@@ -55,7 +55,9 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
      * disable the session encoding is provided for backwards compatibility.
      *
      * By default, encoding is enabled.
+     * @deprecated since 3.0.0 because CAS is currently on 3.3.5.
      */
+    @Deprecated
     private boolean encodeServiceUrlWithSessionId = true;
 
     //~ Methods ========================================================================================================
@@ -133,7 +135,9 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
      * Sets whether to encode the service url with the session id or not.
      *
      * @param encodeServiceUrlWithSessionId whether to encode the service url with the session id or not.
+     * @deprecated since 3.0.0 because CAS is currently on 3.3.5.
      */
+    @Deprecated
     public final void setEncodeServiceUrlWithSessionId(final boolean encodeServiceUrlWithSessionId) {
         this.encodeServiceUrlWithSessionId = encodeServiceUrlWithSessionId;
     }
@@ -142,7 +146,9 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
      * Sets whether to encode the service url with the session id or not.
      * @return whether to encode the service url with the session id or not.
      *
+     * @deprecated since 3.0.0 because CAS is currently on 3.3.5.
      */
+    @Deprecated
     protected boolean getEncodeServiceUrlWithSessionId() {
         return this.encodeServiceUrlWithSessionId;
     }

cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java

@@ -38,8 +38,6 @@ import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
 import org.springframework.security.web.authentication.AuthenticationFailureHandler;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
-import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
-import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;
 
 /**
@@ -51,7 +49,7 @@ import org.springframework.util.Assert;
  * presented in the <code>ticket</code> request parameter.
  * <p>
  * This filter monitors the <code>service</code> URL so it can
- * receive the service ticket and process it. By default this filter processes the URL <tt>/login/cas</tt>.
+ * receive the service ticket and process it. By default this filter processes the URL <tt>/j_spring_cas_security_check</tt>.
  * When processing this URL, the value of {@link ServiceProperties#getService()} is used as the <tt>service</tt> when validating
  * the <code>ticket</code>. This means that it is important that {@link ServiceProperties#getService()} specifies the same value
  * as the <tt>filterProcessesUrl</tt>.
@@ -92,7 +90,7 @@ import org.springframework.util.Assert;
  * <pre>
  * &lt;b:bean id=&quot;serviceProperties&quot;
  *     class=&quot;org.springframework.security.cas.ServiceProperties&quot;
- *     p:service=&quot;https://service.example.com/cas-sample/login/cas&quot;
+ *     p:service=&quot;https://service.example.com/cas-sample/j_spring_cas_security_check&quot;
  *     p:authenticateAllArtifacts=&quot;true&quot;/&gt;
  * &lt;b:bean id=&quot;casEntryPoint&quot;
  *     class=&quot;org.springframework.security.cas.web.CasAuthenticationEntryPoint&quot;
@@ -102,7 +100,7 @@ import org.springframework.util.Assert;
  *     p:authenticationManager-ref=&quot;authManager&quot;
  *     p:serviceProperties-ref=&quot;serviceProperties&quot;
  *     p:proxyGrantingTicketStorage-ref=&quot;pgtStorage&quot;
- *     p:proxyReceptorUrl=&quot;/login/cas/proxyreceptor&quot;&gt;
+ *     p:proxyReceptorUrl=&quot;/j_spring_cas_security_proxyreceptor&quot;&gt;
  *     &lt;b:property name=&quot;authenticationDetailsSource&quot;&gt;
  *         &lt;b:bean class=&quot;org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource&quot;/&gt;
  *     &lt;/b:property&gt;
@@ -129,7 +127,7 @@ import org.springframework.util.Assert;
  *         &lt;b:bean
  *             class=&quot;org.jasig.cas.client.validation.Cas20ProxyTicketValidator&quot;
  *             p:acceptAnyProxy=&quot;true&quot;
- *             p:proxyCallbackUrl=&quot;https://service.example.com/cas-sample/login/cas/proxyreceptor&quot;
+ *             p:proxyCallbackUrl=&quot;https://service.example.com/cas-sample/j_spring_cas_security_proxyreceptor&quot;
  *             p:proxyGrantingTicketStorage-ref=&quot;pgtStorage&quot;&gt;
  *             &lt;b:constructor-arg value=&quot;https://login.example.org/cas&quot; /&gt;
  *         &lt;/b:bean&gt;
@@ -172,7 +170,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     /**
      * The last portion of the receptor url, i.e. /proxy/receptor
      */
-    private RequestMatcher proxyReceptorMatcher;
+    private String proxyReceptorUrl;
 
     /**
      * The backing storage to store ProxyGrantingTicket requests.
@@ -188,7 +186,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     //~ Constructors ===================================================================================================
 
     public CasAuthenticationFilter() {
-        super("/login/cas");
+        super("/j_spring_cas_security_check");
         setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
     }
 
@@ -256,6 +254,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     /**
      * Overridden to provide proxying capabilities.
      */
+    @Override
     protected boolean requiresAuthentication(final HttpServletRequest request, final HttpServletResponse response) {
         final boolean serviceTicketRequest = serviceTicketRequest(request, response);
         final boolean result = serviceTicketRequest || proxyReceptorRequest(request) || (proxyTicketRequest(serviceTicketRequest, request));
@@ -287,7 +286,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
     }
 
     public final void setProxyReceptorUrl(final String proxyReceptorUrl) {
-        this.proxyReceptorMatcher = new AntPathRequestMatcher("/**" + proxyReceptorUrl);
+        this.proxyReceptorUrl = proxyReceptorUrl;
     }
 
     public final void setProxyGrantingTicketStorage(
@@ -344,7 +343,8 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
      * @return
      */
     private boolean proxyReceptorRequest(final HttpServletRequest request) {
-        final boolean result = proxyReceptorConfigured() && proxyReceptorMatcher.matches(request);
+        final String requestUri = request.getRequestURI();
+        final boolean result = proxyReceptorConfigured() && requestUri.endsWith(this.proxyReceptorUrl);
         if(logger.isDebugEnabled()) {
             logger.debug("proxyReceptorRequest = "+result);
         }
@@ -357,7 +357,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
      * @return
      */
     private boolean proxyReceptorConfigured() {
-        final boolean result = this.proxyGrantingTicketStorage != null && proxyReceptorMatcher != null;
+        final boolean result = this.proxyGrantingTicketStorage != null && !CommonUtils.isEmpty(this.proxyReceptorUrl);
         if(logger.isDebugEnabled()) {
             logger.debug("proxyReceptorConfigured = "+result);
         }

cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java

@@ -1,12 +1,12 @@
 /*
  * Copyright 2011 the original author or authors.
- *
+ * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- *
+ * 
  *      http://www.apache.org/licenses/LICENSE-2.0
- *
+ * 
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,8 +15,6 @@
  */
 package org.springframework.security.cas.web.authentication;
 
-import java.net.MalformedURLException;
-import java.net.URL;
 import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
@@ -52,13 +50,11 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
      *            string from containing the artifact name and value. This can
      *            be created using {@link #createArtifactPattern(String)}.
      */
-    DefaultServiceAuthenticationDetails(String casService, HttpServletRequest request, Pattern artifactPattern) throws MalformedURLException {
+    DefaultServiceAuthenticationDetails(HttpServletRequest request, Pattern artifactPattern) {
         super(request);
-        URL casServiceUrl = new URL(casService);
-        int port = getServicePort(casServiceUrl);
         final String query = getQueryString(request,artifactPattern);
-        this.serviceUrl = UrlUtils.buildFullRequestUrl(casServiceUrl.getProtocol(),
-                casServiceUrl.getHost(), port,
+        this.serviceUrl = UrlUtils.buildFullRequestUrl(request.getScheme(),
+                request.getServerName(), request.getServerPort(),
                 request.getRequestURI(), query);
     }
 
@@ -132,17 +128,4 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
         Assert.hasLength(artifactParameterName);
         return Pattern.compile("&?"+Pattern.quote(artifactParameterName)+"=[^&]*");
     }
-
-    /**
-     * Gets the port from the casServiceURL ensuring to return the proper value if the default port is being used.
-     * @param casServiceUrl the casServerUrl to be used (i.e. "https://example.com/context/login/cas")
-     * @return the port that is configured for the casServerUrl
-     */
-    private static int getServicePort(URL casServiceUrl) {
-        int port = casServiceUrl.getPort();
-        if(port == -1) {
-            port = casServiceUrl.getDefaultPort();
-        }
-        return port;
-    }
 }

cas/src/main/java/org/springframework/security/cas/web/authentication/ServiceAuthenticationDetailsSource.java

@@ -1,12 +1,12 @@
 /*
  * Copyright 2011 the original author or authors.
- *
+ * 
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
  * You may obtain a copy of the License at
- *
+ * 
  *      http://www.apache.org/licenses/LICENSE-2.0
- *
+ * 
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -15,14 +15,12 @@
  */
 package org.springframework.security.cas.web.authentication;
 
-import java.net.MalformedURLException;
 import java.util.regex.Pattern;
 
 import javax.servlet.http.HttpServletRequest;
 
 import org.springframework.security.authentication.AuthenticationDetailsSource;
 import org.springframework.security.cas.ServiceProperties;
-import org.springframework.util.Assert;
 
 /**
  * The {@code AuthenticationDetailsSource} that is set on the
@@ -40,31 +38,24 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
 
     private final Pattern artifactPattern;
 
-    private ServiceProperties serviceProperties;
-
     //~ Constructors ===================================================================================================
 
     /**
-     * Creates an implementation that uses the specified ServiceProperites and the default CAS artifactParameterName.
-     *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
+     * Creates an implementation that uses the default CAS artifactParameterName.
      */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties) {
-        this(serviceProperties,ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
+    public ServiceAuthenticationDetailsSource() {
+        this(ServiceProperties.DEFAULT_CAS_ARTIFACT_PARAMETER);
     }
 
     /**
      * Creates an implementation that uses the specified artifactParameterName
      *
-     * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
      * @param artifactParameterName
      *            the artifactParameterName that is removed from the current
      *            URL. The result becomes the service url. Cannot be null and
      *            cannot be an empty String.
      */
-    public ServiceAuthenticationDetailsSource(ServiceProperties serviceProperties, String artifactParameterName) {
-        Assert.notNull(serviceProperties, "serviceProperties cannot be null");
-        this.serviceProperties = serviceProperties;
+    public ServiceAuthenticationDetailsSource(final String artifactParameterName) {
         this.artifactPattern = DefaultServiceAuthenticationDetails.createArtifactPattern(artifactParameterName);
     }
 
@@ -75,10 +66,6 @@ public class ServiceAuthenticationDetailsSource implements AuthenticationDetails
      * @return the {@code ServiceAuthenticationDetails} containing information about the current request
      */
     public ServiceAuthenticationDetails buildDetails(HttpServletRequest context) {
-        try {
-            return new DefaultServiceAuthenticationDetails(serviceProperties.getService(),context,artifactPattern);
-        } catch (MalformedURLException e) {
-            throw new RuntimeException(e);
-        }
+        return new DefaultServiceAuthenticationDetails(context,artifactPattern);
     }
 }

cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java

@@ -19,7 +19,7 @@ public abstract class AbstractStatelessTicketCacheTests {
 
     protected CasAuthenticationToken getToken() {
         List<String> proxyList = new ArrayList<String>();
-        proxyList.add("https://localhost/newPortal/login/cas");
+        proxyList.add("https://localhost/newPortal/j_spring_cas_security_check");
 
         User user = new User("rod", "password", true, true, true, true, AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"));
         final Assertion assertion = new AssertionImpl("rod");

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java

@@ -69,7 +69,7 @@ public class CasAuthenticationEntryPointTests extends TestCase {
     public void testNormalOperationWithRenewFalse() throws Exception {
         ServiceProperties sp = new ServiceProperties();
         sp.setSendRenew(false);
-        sp.setService("https://mycompany.com/bigWebApp/login/cas");
+        sp.setService("https://mycompany.com/bigWebApp/j_spring_cas_security_check");
 
         CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
         ep.setLoginUrl("https://cas/login");
@@ -84,14 +84,14 @@ public class CasAuthenticationEntryPointTests extends TestCase {
         ep.commence(request, response, null);
 
         assertEquals("https://cas/login?service="
-            + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8"),
+            + URLEncoder.encode("https://mycompany.com/bigWebApp/j_spring_cas_security_check", "UTF-8"),
             response.getRedirectedUrl());
     }
 
     public void testNormalOperationWithRenewTrue() throws Exception {
         ServiceProperties sp = new ServiceProperties();
         sp.setSendRenew(true);
-        sp.setService("https://mycompany.com/bigWebApp/login/cas");
+        sp.setService("https://mycompany.com/bigWebApp/j_spring_cas_security_check");
 
         CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
         ep.setLoginUrl("https://cas/login");
@@ -105,7 +105,7 @@ public class CasAuthenticationEntryPointTests extends TestCase {
         ep.afterPropertiesSet();
         ep.commence(request, response, null);
         assertEquals("https://cas/login?service="
-            + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8") + "&renew=true",
+            + URLEncoder.encode("https://mycompany.com/bigWebApp/j_spring_cas_security_check", "UTF-8") + "&renew=true",
             response.getRedirectedUrl());
     }
 }

cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java

@@ -63,6 +63,7 @@ public class CasAuthenticationFilterTests {
     @Test
     public void testGettersSetters() {
         CasAuthenticationFilter filter = new CasAuthenticationFilter();
+        assertEquals("/j_spring_cas_security_check", filter.getFilterProcessesUrl());
         filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
         filter.setProxyReceptorUrl("/someurl");
         filter.setServiceProperties(new ServiceProperties());
@@ -70,8 +71,7 @@ public class CasAuthenticationFilterTests {
 
     @Test
     public void testNormalOperation() throws Exception {
-        MockHttpServletRequest request = new MockHttpServletRequest();
-        request.setServletPath("/login/cas");
+        MockHttpServletRequest request = new MockHttpServletRequest("GET", "/j_spring_cas_security_check");
         request.addParameter("ticket", "ST-0-ER94xMJmn6pha35CQRoZ");
 
         CasAuthenticationFilter filter = new CasAuthenticationFilter();
@@ -101,13 +101,11 @@ public class CasAuthenticationFilterTests {
 
     @Test
     public void testRequiresAuthenticationFilterProcessUrl() {
-        String url = "/login/cas";
         CasAuthenticationFilter filter = new CasAuthenticationFilter();
-        filter.setFilterProcessesUrl(url);
         MockHttpServletRequest request = new MockHttpServletRequest();
         MockHttpServletResponse response = new MockHttpServletResponse();
 
-        request.setServletPath(url);
+        request.setRequestURI(filter.getFilterProcessesUrl());
         assertTrue(filter.requiresAuthentication(request, response));
     }
 
@@ -117,13 +115,13 @@ public class CasAuthenticationFilterTests {
         MockHttpServletRequest request = new MockHttpServletRequest();
         MockHttpServletResponse response = new MockHttpServletResponse();
 
-        request.setServletPath("/pgtCallback");
+        request.setRequestURI("/pgtCallback");
         assertFalse(filter.requiresAuthentication(request, response));
-        filter.setProxyReceptorUrl(request.getServletPath());
+        filter.setProxyReceptorUrl(request.getRequestURI());
         assertFalse(filter.requiresAuthentication(request, response));
         filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
         assertTrue(filter.requiresAuthentication(request, response));
-        request.setServletPath("/other");
+        request.setRequestURI("/other");
         assertFalse(filter.requiresAuthentication(request, response));
     }
 
@@ -132,17 +130,15 @@ public class CasAuthenticationFilterTests {
         ServiceProperties properties = new ServiceProperties();
         properties.setAuthenticateAllArtifacts(true);
 
-        String url = "/login/cas";
         CasAuthenticationFilter filter = new CasAuthenticationFilter();
-        filter.setFilterProcessesUrl(url);
         filter.setServiceProperties(properties);
         MockHttpServletRequest request = new MockHttpServletRequest();
         MockHttpServletResponse response = new MockHttpServletResponse();
 
-        request.setServletPath(url);
+        request.setRequestURI(filter.getFilterProcessesUrl());
         assertTrue(filter.requiresAuthentication(request, response));
 
-        request.setServletPath("/other");
+        request.setRequestURI("/other");
         assertFalse(filter.requiresAuthentication(request, response));
         request.setParameter(properties.getArtifactParameter(), "value");
         assertTrue(filter.requiresAuthentication(request, response));
@@ -160,9 +156,9 @@ public class CasAuthenticationFilterTests {
         MockHttpServletRequest request = new MockHttpServletRequest();
         MockHttpServletResponse response = new MockHttpServletResponse();
 
-        request.setServletPath("/pgtCallback");
+        request.setRequestURI("/pgtCallback");
         filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
-        filter.setProxyReceptorUrl(request.getServletPath());
+        filter.setProxyReceptorUrl(request.getRequestURI());
         assertNull(filter.attemptAuthentication(request, response));
     }
 
@@ -176,7 +172,7 @@ public class CasAuthenticationFilterTests {
         serviceProperties.setAuthenticateAllArtifacts(true);
         MockHttpServletRequest request = new MockHttpServletRequest();
         request.setParameter("ticket", "ST-1-123");
-        request.setServletPath("/authenticate");
+        request.setRequestURI("/authenticate");
         MockHttpServletResponse response = new MockHttpServletResponse();
         FilterChain chain = mock(FilterChain.class);
 
@@ -193,7 +189,7 @@ public class CasAuthenticationFilterTests {
         verifyZeroInteractions(successHandler);
 
         // validate for when the filterProcessUrl matches
-        filter.setFilterProcessesUrl(request.getServletPath());
+        filter.setFilterProcessesUrl(request.getRequestURI());
         SecurityContextHolder.clearContext();
         filter.doFilter(request,response,chain);
         verifyNoMoreInteractions(chain);
@@ -208,9 +204,9 @@ public class CasAuthenticationFilterTests {
         MockHttpServletResponse response = new MockHttpServletResponse();
         FilterChain chain = mock(FilterChain.class);
 
-        request.setServletPath("/pgtCallback");
+        request.setRequestURI("/pgtCallback");
         filter.setProxyGrantingTicketStorage(mock(ProxyGrantingTicketStorage.class));
-        filter.setProxyReceptorUrl(request.getServletPath());
+        filter.setProxyReceptorUrl(request.getRequestURI());
 
         filter.doFilter(request,response,chain);
         verifyZeroInteractions(chain);

cas/src/test/java/org/springframework/security/cas/web/ServicePropertiesTests.java

@@ -36,13 +36,10 @@ public class ServicePropertiesTests {
     }
 
     @Test
-    public void nullServiceWhenAuthenticateAllTokens() throws Exception {
+    public void allowNullServiceWhenAuthenticateAllTokens() throws Exception {
         ServiceProperties sp = new ServiceProperties();
         sp.setAuthenticateAllArtifacts(true);
-        try {
-            sp.afterPropertiesSet();
-            fail("Expected Exception");
-        }catch(IllegalArgumentException success) {}
+        sp.afterPropertiesSet();
         sp.setAuthenticateAllArtifacts(false);
         try {
             sp.afterPropertiesSet();

cas/src/test/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetailsTests.java

@@ -18,21 +18,11 @@ import static org.junit.Assert.assertEquals;
 
 import java.util.regex.Pattern;
 
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.xml.XmlBeanDefinitionReader;
-import org.springframework.context.ConfigurableApplicationContext;
-import org.springframework.context.support.ClassPathXmlApplicationContext;
-import org.springframework.context.support.GenericApplicationContext;
-import org.springframework.context.support.GenericXmlApplicationContext;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.security.cas.ServiceProperties;
 import org.springframework.security.web.util.UrlUtils;
-import org.springframework.test.context.ContextConfiguration;
-import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 /**
  *
@@ -42,13 +32,9 @@ public class DefaultServiceAuthenticationDetailsTests {
     private DefaultServiceAuthenticationDetails details;
     private MockHttpServletRequest request;
     private Pattern artifactPattern;
-    private String casServiceUrl;
-
-    private ConfigurableApplicationContext context;
 
     @Before
     public void setUp() {
-        casServiceUrl = "https://localhost:8443/j_spring_security_cas";
         request = new MockHttpServletRequest();
         request.setScheme("https");
         request.setServerName("localhost");
@@ -58,74 +44,45 @@ public class DefaultServiceAuthenticationDetailsTests {
 
     }
 
-    @After
-    public void cleanup() {
-        if(context != null) {
-            context.close();
-        }
-    }
-
     @Test
     public void getServiceUrlNullQuery() throws Exception {
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals(UrlUtils.buildFullRequestUrl(request), details.getServiceUrl());
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
+        assertEquals(UrlUtils.buildFullRequestUrl(request),details.getServiceUrl());
     }
 
     @Test
-    public void getServiceUrlTicketOnlyParam() throws Exception {
+    public void getServiceUrlTicketOnlyParam() {
         request.setQueryString("ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString(null);
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketFirstMultiParam() throws Exception {
+    public void getServiceUrlTicketFirstMultiParam() {
         request.setQueryString("ticket=123&other=value");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketLastMultiParam() throws Exception {
+    public void getServiceUrlTicketLastMultiParam() {
         request.setQueryString("other=value&ticket=123");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
 
     @Test
-    public void getServiceUrlTicketMiddleMultiParam() throws Exception {
+    public void getServiceUrlTicketMiddleMultiParam() {
         request.setQueryString("other=value&ticket=123&last=this");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl,request,artifactPattern);
+        details = new DefaultServiceAuthenticationDetails(request,artifactPattern);
         String serviceUrl = details.getServiceUrl();
         request.setQueryString("other=value&last=this");
         assertEquals(UrlUtils.buildFullRequestUrl(request),serviceUrl);
     }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeader() throws Exception {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        details = new DefaultServiceAuthenticationDetails(casServiceUrl, request,artifactPattern);
-        assertEquals("https://example.com/cas-sample/secure/",details.getServiceUrl());
-    }
-
-    @Test
-    public void getServiceUrlDoesNotUseHostHeaderExplicit() {
-        casServiceUrl = "https://example.com/j_spring_security_cas";
-        request.setServerName("evil.com");
-        ServiceAuthenticationDetails details = loadServiceAuthenticationDetails("defaultserviceauthenticationdetails-explicit.xml");
-        assertEquals("https://example.com/cas-sample/secure/", details.getServiceUrl());
-    }
-
-    private ServiceAuthenticationDetails loadServiceAuthenticationDetails(String resourceName) {
-        context = new GenericXmlApplicationContext(getClass(), resourceName);
-        ServiceAuthenticationDetailsSource source = context.getBean(ServiceAuthenticationDetailsSource.class);
-        return source.buildDetails(request);
-    }
 }

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-explicit.xml

@@ -1,23 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-    <bean id="serviceProperties2"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example2.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource">
-        <constructor-arg ref="serviceProperties"/>
-    </bean>
-</beans>

cas/src/test/resources/org/springframework/security/cas/web/authentication/defaultserviceauthenticationdetails-passivity.xml

@@ -1,15 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">
-
-    <bean id="serviceProperties"
-          class="org.springframework.security.cas.ServiceProperties">
-        <property name="service"
-                  value="https://example.com/j_spring_security_cas"/>
-        <property name="sendRenew" value="false"/>
-    </bean>
-
-    <bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
-</beans>

cas/template.mf

@@ -0,0 +1,23 @@
+Implementation-Title: org.springframework.security.cas
+Implementation-Version: ${version}
+Bundle-SymbolicName: org.springframework.security.cas
+Bundle-Name: Spring Security CAS
+Bundle-Vendor: SpringSource
+Bundle-Version: ${version}
+Bundle-ManifestVersion: 2
+Ignored-Existing-Headers:
+ Import-Package,
+ Export-Package
+Import-Template:
+ org.apache.commons.logging.*;version="${cloggingRange}",
+ org.jasig.cas.client.*;version="${casRange}",
+ org.springframework.security.core.*;version="${secRange}",
+ org.springframework.security.authentication.*;version="${secRange}",
+ org.springframework.security.web.*;version="${secRange}",
+ org.springframework.beans.factory;version="${springRange}",
+ org.springframework.cache.*;version="${springRange}";resolution:=optional,
+ org.springframework.context.*;version="${springRange}",
+ org.springframework.dao;version="${springRange}",
+ org.springframework.util;version="${springRange}",
+ net.sf.ehcache.*;version="${ehcacheRange}";resolution:=optional,
+ javax.servlet.*;version="0"

config/config.gradle

@@ -10,7 +10,6 @@ compileTestJava.dependsOn(':spring-security-core:compileTestJava')
 dependencies {
     // NB: Don't add other compile time dependencies to the config module as this breaks tooling
     compile project(':spring-security-core'),
-            springCoreDependency,
             'aopalliance:aopalliance:1.0',
             "org.springframework:spring-aop:$springVersion",
             "org.springframework:spring-context:$springVersion",
@@ -19,9 +18,7 @@ dependencies {
     optional project(':spring-security-web'),
              project(':spring-security-ldap'),
              project(':spring-security-openid'),
-             project(':spring-security-messaging'),
-            "org.springframework:spring-web:$springVersion",
-            "org.springframework:spring-websocket:$springVersion",
+             "org.springframework:spring-web:$springVersion",
              "org.springframework:spring-webmvc:$springVersion",
              "org.aspectj:aspectjweaver:$aspectjVersion",
              "org.springframework:spring-jdbc:$springVersion",
@@ -31,7 +28,6 @@ dependencies {
 
     testCompile project(':spring-security-cas'),
                 project(':spring-security-core').sourceSets.test.output,
-                project(':spring-security-aspects'),
                 'javax.annotation:jsr250-api:1.0',
                 "org.springframework.ldap:spring-ldap-core:$springLdapVersion",
                 "org.springframework:spring-expression:$springVersion",
@@ -51,18 +47,18 @@ dependencies {
                 'ldapsdk:ldapsdk:4.1',
                 powerMockDependencies,
                  "org.hibernate:hibernate-entitymanager:3.6.10.Final",
-                "org.hsqldb:hsqldb:$hsqlVersion",
+                "org.hsqldb:hsqldb:2.2.8",
                 spockDependencies
 
     testCompile('org.openid4java:openid4java-nodeps:0.9.6') {
         exclude group: 'com.google.code.guice', module: 'guice'
     }
-    testCompile("org.springframework.data:spring-data-jpa:$springDataJpaVersion") {
+    testCompile('org.springframework.data:spring-data-jpa:1.4.1.RELEASE') {
         exclude group: 'org.aspectj', module: 'aspectjrt'
     }
 
     testRuntime "org.hsqldb:hsqldb:$hsqlVersion",
-                "cglib:cglib-nodep:$cglibVersion"
+                "cglib:cglib-nodep:2.2"
 }
 
 test {

config/pom.xml

@@ -1,9 +1,10 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<project xmlns="http://maven.apache.org/POM/4.0.0" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
+<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
   <modelVersion>4.0.0</modelVersion>
   <groupId>org.springframework.security</groupId>
   <artifactId>spring-security-config</artifactId>
-  <version>4.0.0.RC1</version>
+  <version>3.2.4.RELEASE</version>
   <name>spring-security-config</name>
   <description>spring-security-config</description>
   <url>http://spring.io/spring-security</url>
@@ -30,12 +31,17 @@
     <developerConnection>scm:git:git://github.com/spring-projects/spring-security</developerConnection>
     <url>https://github.com/spring-projects/spring-security</url>
   </scm>
-  <repositories>
-    <repository>
-      <id>spring-milestone</id>
-      <url>https://repo.spring.io/milestone</url>
-    </repository>
-  </repositories>
+  <build>
+    <plugins>
+      <plugin>
+        <artifactId>maven-compiler-plugin</artifactId>
+        <configuration>
+          <source>1.7</source>
+          <target>1.7</target>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
   <dependencies>
     <dependency>
       <groupId>aopalliance</groupId>
@@ -46,31 +52,31 @@
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-core</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-aop</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-beans</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-core</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <exclusions>
         <exclusion>
@@ -82,77 +88,63 @@
     <dependency>
       <groupId>commons-logging</groupId>
       <artifactId>commons-logging</artifactId>
-      <version>1.2</version>
+      <version>1.1.1</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.aspectj</groupId>
       <artifactId>aspectjweaver</artifactId>
-      <version>1.8.4</version>
+      <version>1.6.10</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-ldap</artifactId>
-      <version>4.0.0.RC1</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-messaging</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-openid</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-web</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-jdbc</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-tx</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-web</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-webmvc</artifactId>
-      <version>4.1.3.RELEASE</version>
-      <scope>compile</scope>
-      <optional>true</optional>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework</groupId>
-      <artifactId>spring-websocket</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>compile</scope>
       <optional>true</optional>
     </dependency>
@@ -165,13 +157,13 @@
     <dependency>
       <groupId>cglib</groupId>
       <artifactId>cglib-nodep</artifactId>
-      <version>3.1</version>
+      <version>2.2</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
-      <version>1.1.2</version>
+      <version>0.9.29</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -231,7 +223,7 @@
     <dependency>
       <groupId>org.codehaus.groovy</groupId>
       <artifactId>groovy-all</artifactId>
-      <version>2.3.8</version>
+      <version>2.0.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -261,7 +253,13 @@
     <dependency>
       <groupId>org.hsqldb</groupId>
       <artifactId>hsqldb</artifactId>
-      <version>2.3.2</version>
+      <version>2.2.8</version>
+      <scope>test</scope>
+    </dependency>
+    <dependency>
+      <groupId>org.hsqldb</groupId>
+      <artifactId>hsqldb</artifactId>
+      <version>2.3.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -285,7 +283,7 @@
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-api-mockito</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
       <exclusions>
         <exclusion>
@@ -297,37 +295,37 @@
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-api-support</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-core</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-module-junit4</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-module-junit4-common</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.powermock</groupId>
       <artifactId>powermock-reflect</artifactId>
-      <version>1.6.0</version>
+      <version>1.5.1</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
-      <version>1.7.7</version>
+      <version>1.7.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>
@@ -357,7 +355,7 @@
     <dependency>
       <groupId>org.springframework.data</groupId>
       <artifactId>spring-data-jpa</artifactId>
-      <version>1.7.1.RELEASE</version>
+      <version>1.4.1.RELEASE</version>
       <scope>test</scope>
       <exclusions>
         <exclusion>
@@ -369,49 +367,32 @@
     <dependency>
       <groupId>org.springframework.ldap</groupId>
       <artifactId>spring-ldap-core</artifactId>
-      <version>2.0.2.RELEASE</version>
-      <scope>test</scope>
-    </dependency>
-    <dependency>
-      <groupId>org.springframework.security</groupId>
-      <artifactId>spring-security-aspects</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>1.3.2.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework.security</groupId>
       <artifactId>spring-security-cas</artifactId>
-      <version>4.0.0.RC1</version>
+      <version>3.2.4.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-expression</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-orm</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-test</artifactId>
-      <version>4.1.3.RELEASE</version>
+      <version>3.2.8.RELEASE</version>
       <scope>test</scope>
     </dependency>
   </dependencies>
-  <build>
-    <plugins>
-      <plugin>
-        <artifactId>maven-compiler-plugin</artifactId>
-        <configuration>
-          <source>1.7</source>
-          <target>1.7</target>
-        </configuration>
-      </plugin>
-    </plugins>
-  </build>
 </project>

config/src/integration-test/groovy/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderConfigurerTests.groovy

@@ -1,60 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.authentication.ldap
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.UsernamePasswordAuthenticationToken
-import org.springframework.security.config.annotation.BaseSpringSpec
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.LdapAuthenticationProviderConfig
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
-import org.springframework.security.ldap.authentication.LdapAuthenticationProvider
-import org.springframework.security.ldap.authentication.PasswordComparisonAuthenticator
-import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator
-import org.springframework.security.ldap.userdetails.PersonContextMapper
-import org.springframework.test.util.ReflectionTestUtils
-
-import static org.springframework.security.config.annotation.authentication.ldap.NamespaceLdapAuthenticationProviderTestsConfigs.*
-
-/**
- *
- * @author Rob Winch
- *
- */
-class LdapAuthenticationProviderConfigurerTests extends BaseSpringSpec {
-
-    def "authentication-manager support multiple default ldap contexts (ports dynamically allocated)"() {
-        when:
-            loadConfig(MultiLdapAuthenticationProvidersConfig)
-        then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
-    }
-
-    @EnableWebSecurity
-    static class MultiLdapAuthenticationProvidersConfig extends WebSecurityConfigurerAdapter {
-        protected void configure(AuthenticationManagerBuilder auth) throws Exception {
-            auth
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-                    .and()
-                .ldapAuthentication()
-                    .groupSearchBase("ou=groups")
-                    .userDnPatterns("uid={0},ou=people")
-        }
-    }
-}

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/LdapAuthenticationProviderBuilderSecurityBuilderTests.groovy

@@ -15,12 +15,10 @@
  */
 package org.springframework.security.config.annotation.authentication.ldap
 
-import org.springframework.beans.factory.config.AutowireCapableBeanFactory
 import org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory;
 import org.springframework.context.annotation.AnnotationConfigApplicationContext;
 import org.springframework.context.annotation.Bean
 import org.springframework.context.annotation.Configuration
-import org.springframework.context.annotation.Import
 import org.springframework.ldap.core.ContextSource;
 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
 import org.springframework.security.authentication.AuthenticationManager
@@ -29,12 +27,7 @@ import org.springframework.security.authentication.UsernamePasswordAuthenticatio
 import org.springframework.security.config.annotation.BaseSpringSpec
 import org.springframework.security.config.annotation.SecurityBuilder;
 import org.springframework.security.config.annotation.authentication.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder
-import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessor
-import org.springframework.security.config.annotation.configuration.AutowireBeanFactoryObjectPostProcessorTests
-import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration
-import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.crypto.password.PasswordEncoder
 import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
 import org.springframework.security.ldap.authentication.LdapAuthenticationProvider;
@@ -65,7 +58,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
         }
     }
 
@@ -83,7 +75,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .groupRoleAttribute("group")
         }
     }
@@ -102,7 +93,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .groupSearchFilter("ou=groupName");
         }
     }
@@ -121,7 +111,6 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .userDnPatterns("uid={0},ou=people")
                     .rolePrefix("role_")
         }
     }
@@ -132,7 +121,7 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
         AuthenticationManager auth = context.getBean(AuthenticationManager)
         then:
         auth
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
+        auth.authenticate(new UsernamePasswordAuthenticationToken("admin","password")).authorities.collect { it.authority }.sort() == ["ROLE_ADMIN","ROLE_USER"]
     }
 
     @Configuration
@@ -142,29 +131,30 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
                 .ldapAuthentication()
                     .contextSource(contextSource())
                     .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
                     .userDnPatterns("uid={0},ou=people");
         }
     }
 
     def "SEC-2472: Can use crypto PasswordEncoder"() {
         setup:
+        PasswordEncoderConfig.PE = Mock(PasswordEncoder)
         loadConfig(PasswordEncoderConfig)
         when:
         AuthenticationManager auth = context.getBean(AuthenticationManager)
         then:
-        auth.authenticate(new UsernamePasswordAuthenticationToken("bcrypt","password")).authorities.collect { it.authority }.sort() == ["ROLE_DEVELOPERS"]
+        auth.authenticate(new UsernamePasswordAuthenticationToken("admin","password")).authorities.collect { it.authority }.sort() == ["ROLE_ADMIN","ROLE_USER"]
+        PasswordEncoderConfig.PE.matches(_, _) << true
     }
 
     @Configuration
     static class PasswordEncoderConfig extends BaseLdapServerConfig {
+        static PasswordEncoder PE
         protected void configure(AuthenticationManagerBuilder auth) throws Exception {
             auth
                 .ldapAuthentication()
                     .contextSource(contextSource())
-                    .passwordEncoder(new BCryptPasswordEncoder())
+                    .passwordEncoder(PE)
                     .groupSearchBase("ou=groups")
-                    .groupSearchFilter("(member={0})")
                     .userDnPatterns("uid={0},ou=people");
         }
     }
@@ -177,44 +167,23 @@ class LdapAuthenticationProviderBuilderSecurityBuilderTests extends BaseSpringSp
     static abstract class BaseLdapServerConfig extends BaseLdapProviderConfig {
         @Bean
         public ApacheDSContainer ldapServer() throws Exception {
-            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/test-server.ldif");
-            apacheDSContainer.setPort(getPort());
+            ApacheDSContainer apacheDSContainer = new ApacheDSContainer("dc=springframework,dc=org", "classpath:/users.ldif");
+            apacheDSContainer.setPort(33389);
             return apacheDSContainer;
         }
     }
 
     @Configuration
-    @EnableGlobalAuthentication
-    @Import(ObjectPostProcessorConfiguration)
     static abstract class BaseLdapProviderConfig {
 
         @Bean
         public BaseLdapPathContextSource contextSource() throws Exception {
             DefaultSpringSecurityContextSource contextSource = new DefaultSpringSecurityContextSource(
-                    "ldap://127.0.0.1:"+ getPort() + "/dc=springframework,dc=org")
+                    "ldap://127.0.0.1:33389/dc=springframework,dc=org")
             contextSource.userDn = "uid=admin,ou=system"
             contextSource.password = "secret"
-            contextSource.afterPropertiesSet()
+            contextSource.afterPropertiesSet();
             return contextSource;
         }
-
-        @Bean
-        public AuthenticationManager authenticationManager(AuthenticationManagerBuilder auth) {
-            configure(auth)
-            auth.build()
-        }
-
-        abstract protected void configure(AuthenticationManagerBuilder auth) throws Exception
-    }
-
-    static Integer port;
-
-    static int getPort() {
-        if(port == null) {
-            ServerSocket socket = new ServerSocket(0)
-            port = socket.localPort
-            socket.close()
-        }
-        port
     }
 }

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/NamespaceLdapAuthenticationProviderTests.groovy

@@ -40,7 +40,7 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
         when:
             loadConfig(LdapAuthenticationProviderConfig)
         then:
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
     }
 
     def "ldap-authentication-provider custom"() {
@@ -75,6 +75,6 @@ class NamespaceLdapAuthenticationProviderTests extends BaseSpringSpec {
             LdapAuthenticationProvider provider = findAuthenticationProvider(LdapAuthenticationProvider)
         then:
             provider.authenticator instanceof PasswordComparisonAuthenticator
-            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("bob","bobspassword"))
+            authenticationManager.authenticate(new UsernamePasswordAuthenticationToken("user","password")).authorities*.authority.sort() == ['ROLE_USER']
     }
 }

config/src/integration-test/java/org/springframework/security/config/annotation/authentication/ldap/NamespaceLdapAuthenticationProviderTestsConfigs.java

@@ -28,6 +28,8 @@ import org.springframework.security.ldap.userdetails.PersonContextMapper;
  *
  */
 public class NamespaceLdapAuthenticationProviderTestsConfigs {
+
+    @Configuration
     @EnableWebSecurity
     static class LdapAuthenticationProviderConfig extends WebSecurityConfigurerAdapter {
         protected void configure(AuthenticationManagerBuilder auth) throws Exception {
@@ -38,6 +40,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
         }
     }
 
+    @Configuration
     @EnableWebSecurity
     static class CustomLdapAuthenticationProviderConfig extends WebSecurityConfigurerAdapter {
         protected void configure(AuthenticationManagerBuilder auth) throws Exception {
@@ -53,7 +56,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
                     .userSearchFilter("(uid={0})") // ldap-authentication-provider@user-search-filter
                     // .contextSource(contextSource) // ldap-authentication-provider@server-ref
                     .contextSource()
-                        .ldif("classpath:users.xldif") // ldap-server@ldif
+                        .ldif("classpath:user.ldif") // ldap-server@ldif
                         .managerDn("uid=admin,ou=system") // ldap-server@manager-dn
                         .managerPassword("secret") // ldap-server@manager-password
                         .port(33399) // ldap-server@port
@@ -63,6 +66,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
         }
     }
 
+    @Configuration
     @EnableWebSecurity
     static class CustomAuthoritiesPopulatorConfig extends WebSecurityConfigurerAdapter {
         static LdapAuthoritiesPopulator LAP;
@@ -74,6 +78,7 @@ public class NamespaceLdapAuthenticationProviderTestsConfigs {
         }
     }
 
+    @Configuration
     @EnableWebSecurity
     static class PasswordCompareLdapConfig extends WebSecurityConfigurerAdapter {
         protected void configure(AuthenticationManagerBuilder auth) throws Exception {

config/src/integration-test/resources/test-server.ldif

@@ -68,22 +68,11 @@ sn: Mouse
 uid: jerry
 userPassword: jerryspassword
 
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
 dn: cn=developers,ou=groups,dc=springframework,dc=org
 objectclass: top
 objectclass: groupOfNames
 cn: developers
 ou: developer
-member: uid=bcrypt,ou=people,dc=springframework,dc=org
 member: uid=ben,ou=people,dc=springframework,dc=org
 member: uid=bob,ou=people,dc=springframework,dc=org
 

config/src/integration-test/resources/users.ldif

@@ -0,0 +1,42 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn: ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: people
+
+dn: uid=admin,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Rod Johnson
+sn: Johnson
+uid: admin
+userPassword: password
+
+dn: uid=user,ou=people,dc=springframework,dc=org
+objectclass: top
+objectclass: person
+objectclass: organizationalPerson
+objectclass: inetOrgPerson
+cn: Dianne Emu
+sn: Emu
+uid: user
+userPassword: password
+
+dn: cn=user,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: user
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org
+uniqueMember: uid=user,ou=people,dc=springframework,dc=org
+
+dn: cn=admin,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: groupOfNames
+cn: admin
+uniqueMember: uid=admin,ou=people,dc=springframework,dc=org

config/src/integration-test/resources/users.xldif

@@ -1,92 +0,0 @@
-dn: ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: groups
-
-dn: ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: subgroups
-
-dn: ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: people
-
-dn: ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: organizationalUnit
-ou: otherpeople
-
-dn: uid=ben,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Ben Alex
-sn: Alex
-uid: ben
-userPassword: {SHA}nFCebWjxfaLbHHG1Qk5UU4trbvQ=
-
-dn: uid=bcrypt,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: BCrypt user
-sn: BCrypt
-uid: bcrypt
-userPassword: $2a$10$lDa0YFNHAt63MjIzK/wUqeM0qjIhzPhp3RNI/MLUQEAUbzhB/SnnS
-
-dn: uid=bob,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Bob Hamilton
-sn: Hamilton
-uid: bob
-userPassword: bobspassword
-
-dn: uid=joe,ou=otherpeople,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Joe Smeth
-sn: Smeth
-uid: joe
-userPassword: joespassword
-
-dn: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-objectclass: top
-objectclass: person
-objectclass: organizationalPerson
-objectclass: inetOrgPerson
-cn: Mouse, Jerry
-sn: Mouse
-uid: jerry
-userPassword: jerryspassword
-
-dn: cn=developers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: developers
-ou: developer
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: uid=bob,ou=people,dc=springframework,dc=org
-
-dn: cn=managers,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: managers
-ou: manager
-member: uid=ben,ou=people,dc=springframework,dc=org
-member: cn=mouse\, jerry,ou=people,dc=springframework,dc=org
-
-dn: cn=submanagers,ou=subgroups,ou=groups,dc=springframework,dc=org
-objectclass: top
-objectclass: groupOfNames
-cn: submanagers
-ou: submanager
-member: uid=ben,ou=people,dc=springframework,dc=org

config/src/main/java/org/springframework/security/config/Elements.java

@@ -49,12 +49,11 @@ public abstract class Elements {
     public static final String JEE = "jee";
     public static final String FILTER_SECURITY_METADATA_SOURCE = "filter-security-metadata-source";
     public static final String METHOD_SECURITY_METADATA_SOURCE = "method-security-metadata-source";
+    @Deprecated
+    public static final String FILTER_INVOCATION_DEFINITION_SOURCE = "filter-invocation-definition-source";
     public static final String LDAP_PASSWORD_COMPARE = "password-compare";
     public static final String DEBUG = "debug";
     public static final String HTTP_FIREWALL = "http-firewall";
     public static final String HEADERS = "headers";
     public static final String CSRF = "csrf";
-
-    public static final String MESSAGES = "messages";
-    public static final String INTERCEPT_MESSAGE = "message-interceptor";
 }

config/src/main/java/org/springframework/security/config/SecurityNamespaceHandler.java

@@ -38,7 +38,6 @@ import org.springframework.security.config.http.HttpSecurityBeanDefinitionParser
 import org.springframework.security.config.ldap.LdapProviderBeanDefinitionParser;
 import org.springframework.security.config.ldap.LdapServerBeanDefinitionParser;
 import org.springframework.security.config.ldap.LdapUserServiceBeanDefinitionParser;
-import org.springframework.security.config.message.MessageSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser;
 import org.springframework.security.config.method.InterceptMethodsBeanDefinitionDecorator;
 import org.springframework.security.config.method.MethodSecurityMetadataSourceBeanDefinitionParser;
@@ -57,7 +56,6 @@ import org.w3c.dom.Node;
  */
 public final class SecurityNamespaceHandler implements NamespaceHandler {
     private static final String FILTER_CHAIN_PROXY_CLASSNAME = "org.springframework.security.web.FilterChainProxy";
-    private static final String MESSAGE_CLASSNAME = "org.springframework.messaging.Message";
     private final Log logger = LogFactory.getLog(getClass());
     private final Map<String, BeanDefinitionParser> parsers = new HashMap<String, BeanDefinitionParser>();
     private final BeanDefinitionDecorator interceptMethodsBDD = new InterceptMethodsBeanDefinitionDecorator();
@@ -173,14 +171,11 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
             parsers.put(Elements.DEBUG, new DebugBeanDefinitionParser());
             parsers.put(Elements.HTTP, new HttpSecurityBeanDefinitionParser());
             parsers.put(Elements.HTTP_FIREWALL, new HttpFirewallBeanDefinitionParser());
+            parsers.put(Elements.FILTER_INVOCATION_DEFINITION_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
             parsers.put(Elements.FILTER_SECURITY_METADATA_SOURCE, new FilterInvocationSecurityMetadataSourceParser());
             parsers.put(Elements.FILTER_CHAIN, new FilterChainBeanDefinitionParser());
             filterChainMapBDD = new FilterChainMapBeanDefinitionDecorator();
         }
-
-        if(ClassUtils.isPresent(MESSAGE_CLASSNAME, getClass().getClassLoader())) {
-            parsers.put(Elements.MESSAGES, new MessageSecurityBeanDefinitionParser());
-        }
     }
 
     /**
@@ -201,7 +196,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 
     private boolean matchesVersionInternal(Element element) {
         String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-        return schemaLocation.matches("(?m).*spring-security-4\\.0.*.xsd.*")
+        return schemaLocation.matches("(?m).*spring-security-3\\.2.*.xsd.*")
                  || schemaLocation.matches("(?m).*spring-security.xsd.*")
                  || !schemaLocation.matches("(?m).*spring-security.*");
     }

config/src/main/java/org/springframework/security/config/annotation/authentication/configuration/EnableGlobalAuthentication.java

@@ -19,7 +19,6 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
@@ -89,5 +88,4 @@ import org.springframework.security.config.annotation.web.servlet.configuration.
 @Target(value={java.lang.annotation.ElementType.TYPE})
 @Documented
 @Import(AuthenticationConfiguration.class)
-@Configuration
 public @interface EnableGlobalAuthentication {}

config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/ldap/LdapAuthenticationProviderConfigurer.java

@@ -42,9 +42,6 @@ import org.springframework.security.ldap.userdetails.PersonContextMapper;
 import org.springframework.security.ldap.userdetails.UserDetailsContextMapper;
 import org.springframework.util.Assert;
 
-import java.io.IOException;
-import java.net.ServerSocket;
-
 /**
  * Configures LDAP {@link AuthenticationProvider} in the {@link ProviderManagerBuilder}.
  *
@@ -64,7 +61,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
     private BaseLdapPathContextSource contextSource;
     private ContextSourceBuilder contextSourceBuilder = new ContextSourceBuilder();
     private UserDetailsContextMapper userDetailsContextMapper;
-    private Object passwordEncoder;
+    private PasswordEncoder passwordEncoder;
     private String passwordAttribute;
     private LdapAuthoritiesPopulator ldapAuthoritiesPopulator;
 
@@ -153,9 +150,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
      */
     private PasswordComparisonAuthenticator createPasswordCompareAuthenticator(BaseLdapPathContextSource contextSource) {
         PasswordComparisonAuthenticator ldapAuthenticator = new PasswordComparisonAuthenticator(contextSource);
-        if(passwordAttribute != null) {
-            ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
-        }
+        ldapAuthenticator.setPasswordAttributeName(passwordAttribute);
         ldapAuthenticator.setPasswordEncoder(passwordEncoder);
         return ldapAuthenticator;
     }
@@ -226,7 +221,21 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
      */
     public LdapAuthenticationProviderConfigurer<B> passwordEncoder(final org.springframework.security.crypto.password.PasswordEncoder passwordEncoder) {
         Assert.notNull(passwordEncoder, "passwordEncoder must not be null.");
-        this.passwordEncoder = passwordEncoder;
+        passwordEncoder(new PasswordEncoder() {
+            public String encodePassword(String rawPass, Object salt) {
+                checkSalt(salt);
+                return passwordEncoder.encode(rawPass);
+            }
+
+            public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
+                checkSalt(salt);
+                return passwordEncoder.matches(rawPass, encPass);
+            }
+
+            private void checkSalt(Object salt) {
+                Assert.isNull(salt, "Salt value must be null when used with crypto module PasswordEncoder");
+            }
+        });
         return this;
     }
 
@@ -393,8 +402,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         private String ldif = "classpath*:*.ldif";
         private String managerPassword;
         private String managerDn;
-        private Integer port;
-        private static final int DEFAULT_PORT = 33389;
+        private int port = 33389;
         private String root = "dc=springframework,dc=org";
         private String url;
 
@@ -439,7 +447,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
         }
 
         /**
-         * The port to connect to LDAP to (the default is 33389 or random available port if unavailable).
+         * The port to connect to LDAP to (the default is 33389).
          * @param port the port to connect to
          * @return the {@link ContextSourceBuilder} for further customization
          */
@@ -499,43 +507,14 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
                 return contextSource;
             }
             ApacheDSContainer apacheDsContainer = new ApacheDSContainer(root, ldif);
-            apacheDsContainer.setPort(getPort());
+            apacheDsContainer.setPort(port);
             postProcess(apacheDsContainer);
             return contextSource;
         }
 
-        private int getPort() {
-            if(port == null) {
-                port = getDefaultPort();
-            }
-            return port;
-        }
-
-        private int getDefaultPort() {
-            ServerSocket serverSocket = null;
-            try {
-                try {
-                    serverSocket = new ServerSocket(DEFAULT_PORT);
-                } catch (IOException e) {
-                    try {
-                        serverSocket = new ServerSocket(0);
-                    } catch(IOException e2) {
-                        return DEFAULT_PORT;
-                    }
-                }
-                return serverSocket.getLocalPort();
-            } finally {
-                if(serverSocket != null) {
-                    try {
-                        serverSocket.close();
-                    } catch (IOException e) {}
-                }
-            }
-        }
-
         private String getProviderUrl() {
             if(url == null) {
-                return "ldap://127.0.0.1:" + getPort() + "/" + root;
+                return "ldap://127.0.0.1:" + port + "/" + root;
             }
             return url;
         }

config/src/main/java/org/springframework/security/config/annotation/configuration/AutowireBeanFactoryObjectPostProcessor.java

@@ -62,7 +62,6 @@ final class AutowireBeanFactoryObjectPostProcessor implements ObjectPostProcesso
             Class<?> type = object.getClass();
             throw new RuntimeException("Could not postProcess " + object + " of type " + type, e);
         }
-        autowireBeanFactory.autowireBean(object);
         if(result instanceof DisposableBean) {
             disposableBeans.add((DisposableBean) result);
         }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/EnableGlobalMethodSecurity.java

@@ -20,7 +20,6 @@ import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
 import org.springframework.context.annotation.AdviceMode;
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.core.Ordered;
 import org.springframework.security.access.annotation.Secured;
@@ -47,7 +46,6 @@ import org.springframework.security.config.annotation.configuration.ObjectPostPr
 @Documented
 @Import({GlobalMethodSecuritySelector.class,ObjectPostProcessorConfiguration.class})
 @EnableGlobalAuthentication
-@Configuration
 public @interface EnableGlobalMethodSecurity {
 
     /**

config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityAspectJAutoProxyRegistrar.java

@@ -18,8 +18,6 @@ package org.springframework.security.config.annotation.method.configuration;
 import java.util.Map;
 
 import org.springframework.aop.config.AopConfigUtils;
-import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.BeanDefinitionRegistry;
 import org.springframework.context.annotation.ImportBeanDefinitionRegistrar;
 import org.springframework.core.annotation.AnnotationAttributes;
@@ -52,15 +50,18 @@ class GlobalMethodSecurityAspectJAutoProxyRegistrar implements
             AnnotationMetadata importingClassMetadata,
             BeanDefinitionRegistry registry) {
 
-        BeanDefinition interceptor = registry.getBeanDefinition("methodSecurityInterceptor");
+        AopConfigUtils
+                .registerAspectJAnnotationAutoProxyCreatorIfNecessary(registry);
 
-        BeanDefinitionBuilder aspect =
-                BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.access.intercept.aspectj.aspect.AnnotationSecurityAspect");
-        aspect.setFactoryMethod("aspectOf");
-        aspect.setRole(BeanDefinition.ROLE_INFRASTRUCTURE);
-        aspect.addPropertyValue("securityInterceptor", interceptor);
+        Map<String, Object> annotationAttributes = importingClassMetadata
+                .getAnnotationAttributes(EnableGlobalMethodSecurity.class
+                        .getName());
+        AnnotationAttributes enableAJAutoProxy = AnnotationAttributes
+                .fromMap(annotationAttributes);
 
-        registry.registerBeanDefinition("annotationSecurityAspect$0", aspect.getBeanDefinition());
+        if (enableAJAutoProxy.getBoolean("proxyTargetClass")) {
+            AopConfigUtils.forceAutoProxyCreatorToUseClassProxying(registry);
+        }
     }
 
 }

config/src/main/java/org/springframework/security/config/annotation/method/configuration/GlobalMethodSecurityConfiguration.java

@@ -24,7 +24,10 @@ import org.apache.commons.logging.Log;
 import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.config.BeanDefinition;
-import org.springframework.context.annotation.*;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.ImportAware;
+import org.springframework.context.annotation.Role;
 import org.springframework.core.annotation.AnnotationAttributes;
 import org.springframework.core.annotation.AnnotationUtils;
 import org.springframework.core.type.AnnotationMetadata;
@@ -45,7 +48,6 @@ import org.springframework.security.access.intercept.AfterInvocationProviderMana
 import org.springframework.security.access.intercept.RunAsManager;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor;
 import org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor;
-import org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor;
 import org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource;
 import org.springframework.security.access.method.MethodSecurityMetadataSource;
 import org.springframework.security.access.prepost.PostInvocationAdviceProvider;
@@ -109,7 +111,7 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
      */
     @Bean
     public MethodInterceptor methodSecurityInterceptor() throws Exception {
-        MethodSecurityInterceptor methodSecurityInterceptor = isAspectJ() ? new AspectJMethodSecurityInterceptor() : new MethodSecurityInterceptor();
+        MethodSecurityInterceptor methodSecurityInterceptor = new MethodSecurityInterceptor();
         methodSecurityInterceptor
                 .setAccessDecisionManager(accessDecisionManager());
         methodSecurityInterceptor
@@ -173,7 +175,7 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
      */
     @SuppressWarnings("rawtypes")
     protected AccessDecisionManager accessDecisionManager() {
-        List<AccessDecisionVoter<? extends Object>> decisionVoters = new ArrayList<AccessDecisionVoter<? extends Object>>();
+        List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>();
         ExpressionBasedPreInvocationAdvice expressionAdvice = new ExpressionBasedPreInvocationAdvice();
         expressionAdvice.setExpressionHandler(getExpressionHandler());
         if(prePostEnabled()) {
@@ -377,10 +379,6 @@ public class GlobalMethodSecurityConfiguration implements ImportAware {
         return (Integer) enableMethodSecurity().get("order");
     }
 
-    private boolean isAspectJ() {
-        return enableMethodSecurity().getEnum("mode") == AdviceMode.ASPECTJ;
-    }
-
     private AnnotationAttributes enableMethodSecurity() {
         if (enableMethodSecurity == null) {
             // if it is null look at this instance (i.e. a subclass was used)

config/src/main/java/org/springframework/security/config/annotation/web/AbstractRequestMatcherRegistry.java

@@ -41,6 +41,10 @@ public abstract class AbstractRequestMatcherRegistry<C> {
     /**
      * Maps any request.
      *
+     * @param method the {@link HttpMethod} to use or {@code null} for any {@link HttpMethod}.
+     * @param antPatterns the ant patterns to create {@link org.springframework.security.web.util.matcher.AntPathRequestMatcher}
+     *                    from
+     *
      * @return the object that is chained after creating the {@link RequestMatcher}
      */
     public C anyRequest() {
@@ -177,7 +181,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
         /**
          * Create a {@link List} of {@link RegexRequestMatcher} instances that do not specify an {@link HttpMethod}.
          *
-         * @param regexPatterns the regular expressions to create {@link RegexRequestMatcher} from
+         *  @param regexPatterns the regular expressions to create {@link RegexRequestMatcher} from
          *
          * @return a {@link List} of {@link RegexRequestMatcher} instances
          */

config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java

@@ -948,8 +948,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
      *                 .antMatchers(&quot;/**&quot;).hasRole(&quot;USER&quot;)
      *                 .and()
      *             .formLogin()
-     *                    .usernameParameter("username") // default is username
-     *                    .passwordParameter("password") // default is password
+     *                    .usernameParameter("j_username") // default is username
+     *                    .passwordParameter("j_password") // default is password
      *                    .loginPage("/authentication/login") // default is /login with an HTTP get
      *                    .failureUrl("/authentication/login?failed") // default is /login?error
      *                    .loginProcessingUrl("/authentication/login/process"); // default is /login with an HTTP post
@@ -1000,7 +1000,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
      *                 .and()
      *             .formLogin()
      *                 .and()
-     *             .requiresChannel()
+     *             .channelSecurity()
      *                 .anyRequest().requiresSecure();
      *     }
      *

config/src/main/java/org/springframework/security/config/annotation/web/configuration/ConditionalOnMissingBean.java

@@ -1,13 +0,0 @@
-package org.springframework.security.config.annotation.web.configuration;
-
-import org.springframework.context.annotation.Conditional;
-
-/**
- * @author Rob Winch
- * @since 4.0
- */
-@Conditional(OnMissingBeanCondition.class)
-@interface ConditionalOnMissingBean {
-
-    Class<?> value();
-}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/EnableWebSecurity.java

@@ -19,7 +19,6 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
 import org.springframework.security.config.annotation.configuration.ObjectPostProcessorConfiguration;
@@ -78,9 +77,8 @@ import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 @Retention(value=java.lang.annotation.RetentionPolicy.RUNTIME)
 @Target(value={java.lang.annotation.ElementType.TYPE})
 @Documented
-@Import({WebSecurityConfiguration.class,ObjectPostProcessorConfiguration.class, SpringWebMvcImportSelector.class})
+@Import({WebSecurityConfiguration.class,ObjectPostProcessorConfiguration.class})
 @EnableGlobalAuthentication
-@Configuration
 public @interface EnableWebSecurity {
 
     /**

config/src/main/java/org/springframework/security/config/annotation/web/configuration/OnBeanCondition.java

@@ -1,42 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.config.annotation.web.configuration;
-
-import org.springframework.context.annotation.ConditionContext;
-import org.springframework.context.annotation.ConfigurationCondition;
-import org.springframework.core.type.AnnotatedTypeMetadata;
-import org.springframework.util.ClassUtils;
-
-import java.util.Map;
-
-/**
- * @author Rob Winch
- */
-class OnMissingBeanCondition implements ConfigurationCondition {
-    @Override
-    public ConfigurationPhase getConfigurationPhase() {
-        return ConfigurationPhase.REGISTER_BEAN;
-    }
-
-    @Override
-    public boolean matches(ConditionContext context, AnnotatedTypeMetadata metadata) {
-        Map<String,Object> attrs = metadata.getAnnotationAttributes(ConditionalOnMissingBean.class.getName());
-
-        Class<?> type = (Class) attrs.get("value");
-        final Map<String, ?> beans = context.getBeanFactory().getBeansOfType(type);
-        return beans.isEmpty();
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/SpringWebMvcImportSelector.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configuration;
-
-import org.springframework.context.annotation.ImportSelector;
-import org.springframework.core.type.AnnotationMetadata;
-import org.springframework.util.ClassUtils;
-
-/**
- * Used by {@link EnableWebSecurity} to conditionaly import
- * {@link WebMvcSecurityConfiguration} when the DispatcherServlet is present on the
- * classpath.
- *
- * @author Rob Winch
- * @since 3.2
- */
-class SpringWebMvcImportSelector implements ImportSelector {
-
-    /* (non-Javadoc)
-     * @see org.springframework.context.annotation.ImportSelector#selectImports(org.springframework.core.type.AnnotationMetadata)
-     */
-    public String[] selectImports(AnnotationMetadata importingClassMetadata) {
-        boolean webmvcPresent = ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", getClass().getClassLoader());
-        return webmvcPresent ? new String[] {"org.springframework.security.config.annotation.web.configuration.WebMvcSecurityConfiguration"} : new String[] {};
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebMvcSecurityConfiguration.java

@@ -1,54 +0,0 @@
-/*
- * Copyright 2002-2013 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.annotation.web.configuration;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver;
-import org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor;
-import org.springframework.web.method.support.HandlerMethodArgumentResolver;
-import org.springframework.web.servlet.config.annotation.EnableWebMvc;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
-import org.springframework.web.servlet.support.RequestDataValueProcessor;
-
-import java.util.List;
-
-/**
- * Used to add a {@link RequestDataValueProcessor} for Spring MVC and Spring
- * Security CSRF integration. This configuration is added whenever
- * {@link EnableWebMvc} is added by {@link SpringWebMvcImportSelector} and the
- * DispatcherServlet is present on the classpath. It also adds the
- * {@link AuthenticationPrincipalArgumentResolver} as a
- * {@link HandlerMethodArgumentResolver}.
- *
- * @author Rob Winch
- * @since 3.2
- */
-class WebMvcSecurityConfiguration extends WebMvcConfigurerAdapter {
-
-    @Override
-    @SuppressWarnings("deprecation")
-    public void addArgumentResolvers(
-            List<HandlerMethodArgumentResolver> argumentResolvers) {
-        argumentResolvers.add(new AuthenticationPrincipalArgumentResolver());
-        argumentResolvers.add(new org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver());
-    }
-
-    @ConditionalOnMissingBean(RequestDataValueProcessor.class)
-    @Bean
-    public RequestDataValueProcessor requestDataValueProcessor() {
-        return new CsrfRequestDataValueProcessor();
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.java

@@ -38,10 +38,8 @@ import org.springframework.core.type.AnnotationMetadata;
 import org.springframework.security.access.expression.SecurityExpressionHandler;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.SecurityConfigurer;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.WebSecurityConfigurer;
 import org.springframework.security.config.annotation.web.builders.WebSecurity;
-import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.web.FilterChainProxy;
 import org.springframework.security.web.FilterInvocation;
 import org.springframework.security.web.access.WebInvocationPrivilegeEvaluator;
@@ -74,14 +72,6 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa
 
     private ClassLoader beanClassLoader;
 
-    @Autowired(required = false)
-    private ObjectPostProcessor<Object> objectObjectPostProcessor;
-
-    @Bean
-    public static DelegatingApplicationListener delegatingApplicationListener() {
-        return new DelegatingApplicationListener();
-    }
-
     @Bean
     @DependsOn(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
     public SecurityExpressionHandler<FilterInvocation> webSecurityExpressionHandler() {
@@ -97,8 +87,7 @@ public class WebSecurityConfiguration implements ImportAware, BeanClassLoaderAwa
     public Filter springSecurityFilterChain() throws Exception {
         boolean hasConfigurers = webSecurityConfigurers != null && !webSecurityConfigurers.isEmpty();
         if(!hasConfigurers) {
-            WebSecurityConfigurerAdapter adapter = objectObjectPostProcessor.postProcess(new WebSecurityConfigurerAdapter() {});
-            webSecurity.apply(adapter);
+            throw new IllegalStateException("At least one non-null instance of "+ WebSecurityConfigurer.class.getSimpleName()+" must be exposed as a @Bean when using @EnableWebSecurity. Hint try extending "+ WebSecurityConfigurerAdapter.class.getSimpleName());
         }
         return webSecurity.build();
     }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/AbstractInterceptUrlConfigurer.java

@@ -103,7 +103,7 @@ abstract class AbstractInterceptUrlConfigurer<C extends AbstractInterceptUrlConf
      *         default {@link AccessDecisionManager}
      */
     @SuppressWarnings("rawtypes")
-    abstract List<AccessDecisionVoter<? extends Object>> getDecisionVoters(H http);
+    abstract List<AccessDecisionVoter> getDecisionVoters(H http);
 
     abstract class AbstractInterceptUrlRegistry<R extends AbstractInterceptUrlRegistry<R,T>,T> extends AbstractConfigAttributeRequestMatcherRegistry<T> {
 

config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java

@@ -97,7 +97,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>> extends Abst
      * @return the {@link CsrfConfigurer} for further customizations
      */
     public CsrfConfigurer<H> requireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher) {
-        Assert.notNull(requireCsrfProtectionMatcher, "requireCsrfProtectionMatcher cannot be null");
+        Assert.notNull(csrfTokenRepository, "requireCsrfProtectionMatcher cannot be null");
         this.requireCsrfProtectionMatcher = requireCsrfProtectionMatcher;
         return this;
     }

config/src/main/java/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationConfigurer.java

@@ -141,8 +141,8 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
 
     @Override
     @SuppressWarnings("rawtypes")
-    final List<AccessDecisionVoter<? extends Object>> getDecisionVoters(H http) {
-        List<AccessDecisionVoter<? extends Object>> decisionVoters = new ArrayList<AccessDecisionVoter<? extends Object>>();
+    final List<AccessDecisionVoter> getDecisionVoters(H http) {
+        List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>();
         WebExpressionVoter expressionVoter = new WebExpressionVoter();
         expressionVoter.setExpressionHandler(getExpressionHandler(http));
         decisionVoters.add(expressionVoter);
@@ -213,6 +213,8 @@ public final class ExpressionUrlAuthorizationConfigurer<H extends HttpSecurityBu
         /**
          * Negates the following expression.
          *
+         * @param role the role to require (i.e. USER, ADMIN, etc). Note, it should not start with "ROLE_" as
+         *             this is automatically inserted.
          * @return the {@link ExpressionUrlAuthorizationConfigurer} for further customization
          */
         public AuthorizedUrl not() {

config/src/main/java/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.java

@@ -22,15 +22,10 @@ import java.util.List;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import org.springframework.context.ApplicationContext;
-import org.springframework.context.ApplicationListener;
-import org.springframework.context.event.GenericApplicationListenerAdapter;
-import org.springframework.context.event.SmartApplicationListener;
 import org.springframework.security.authentication.AuthenticationTrustResolver;
 import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.http.SessionCreationPolicy;
-import org.springframework.security.context.DelegatingApplicationListener;
 import org.springframework.security.core.session.SessionRegistry;
 import org.springframework.security.core.session.SessionRegistryImpl;
 import org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler;
@@ -92,7 +87,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
     private SessionAuthenticationStrategy sessionAuthenticationStrategy;
     private InvalidSessionStrategy invalidSessionStrategy;
     private List<SessionAuthenticationStrategy> sessionAuthenticationStrategies = new ArrayList<SessionAuthenticationStrategy>();
-    private SessionRegistry sessionRegistry;
+    private SessionRegistry sessionRegistry = new SessionRegistryImpl();
     private Integer maximumSessions;
     private String expiredUrl;
     private boolean maxSessionsPreventsLogin;
@@ -372,14 +367,14 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
                 http.setSharedObject(RequestCache.class, new NullRequestCache());
             }
         }
-        http.setSharedObject(SessionAuthenticationStrategy.class, getSessionAuthenticationStrategy(http));
+        http.setSharedObject(SessionAuthenticationStrategy.class, getSessionAuthenticationStrategy());
         http.setSharedObject(InvalidSessionStrategy.class, getInvalidSessionStrategy());
     }
 
     @Override
     public void configure(H http) throws Exception {
         SecurityContextRepository securityContextRepository = http.getSharedObject(SecurityContextRepository.class);
-        SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository, getSessionAuthenticationStrategy(http));
+        SessionManagementFilter sessionManagementFilter = new SessionManagementFilter(securityContextRepository, getSessionAuthenticationStrategy());
         if(sessionAuthenticationErrorUrl != null) {
             sessionManagementFilter.setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler(sessionAuthenticationErrorUrl));
         }
@@ -394,7 +389,7 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
 
         http.addFilter(sessionManagementFilter);
         if(isConcurrentSessionControlEnabled()) {
-            ConcurrentSessionFilter concurrentSessionFilter = new ConcurrentSessionFilter(getSessionRegistry(http), expiredUrl);
+            ConcurrentSessionFilter concurrentSessionFilter = new ConcurrentSessionFilter(sessionRegistry, expiredUrl);
             concurrentSessionFilter = postProcess(concurrentSessionFilter);
             http.addFilter(concurrentSessionFilter);
         }
@@ -449,13 +444,12 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
      *
      * @return the {@link SessionAuthenticationStrategy} to use
      */
-    private SessionAuthenticationStrategy getSessionAuthenticationStrategy(H http) {
+    private SessionAuthenticationStrategy getSessionAuthenticationStrategy() {
         if(sessionAuthenticationStrategy != null) {
             return sessionAuthenticationStrategy;
         }
         List<SessionAuthenticationStrategy> delegateStrategies = sessionAuthenticationStrategies;
         if(isConcurrentSessionControlEnabled()) {
-            SessionRegistry sessionRegistry = getSessionRegistry(http);
             ConcurrentSessionControlAuthenticationStrategy concurrentSessionControlStrategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
             concurrentSessionControlStrategy.setMaximumSessions(maximumSessions);
             concurrentSessionControlStrategy.setExceptionIfMaximumExceeded(maxSessionsPreventsLogin);
@@ -472,28 +466,6 @@ public final class SessionManagementConfigurer<H extends HttpSecurityBuilder<H>>
         return sessionAuthenticationStrategy;
     }
 
-    private SessionRegistry getSessionRegistry(H http) {
-        if(sessionRegistry == null) {
-            SessionRegistryImpl sessionRegistry = new SessionRegistryImpl();
-            registerDelegateApplicationListener(http, sessionRegistry);
-            this.sessionRegistry = sessionRegistry;
-        }
-        return sessionRegistry;
-    }
-
-    private void registerDelegateApplicationListener(H http, ApplicationListener<?> delegate) {
-        ApplicationContext context = http.getSharedObject(ApplicationContext.class);
-        if(context == null) {
-            return;
-        }
-        if(context.getBeansOfType(DelegatingApplicationListener.class).isEmpty()) {
-            return;
-        }
-        DelegatingApplicationListener delegating = context.getBean(DelegatingApplicationListener.class);
-        SmartApplicationListener smartListener = new GenericApplicationListenerAdapter(delegate);
-        delegating.addListener(smartListener);
-    }
-
     /**
      * Returns true if the number of concurrent sessions per user should be restricted.
      * @return

config/src/main/java/org/springframework/security/config/annotation/web/configurers/UrlAuthorizationConfigurer.java

@@ -81,12 +81,14 @@ import org.springframework.util.Assert;
  *
  * <ul>
  * <li>
- * AuthenticationManager
+ * {@link org.springframework.security.config.annotation.web.builders.HttpSecurity#getAuthenticationManager()}
  * </li>
  * </ul>
  *
  * @param <H>
  *            the type of {@link HttpSecurityBuilder} that is being configured
+ * @param <C>
+ *            the type of object that is being chained
  *
  * @author Rob Winch
  * @since 3.2
@@ -142,14 +144,15 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
 
     /**
      * Creates the default {@link AccessDecisionVoter} instances used if an
-     * {@link AccessDecisionManager} was not specified.
+     * {@link AccessDecisionManager} was not specified using
+     * {@link #accessDecisionManager(AccessDecisionManager)}.
      *
      * @param http the builder to use
      */
     @Override
     @SuppressWarnings("rawtypes")
-    final List<AccessDecisionVoter<? extends Object>> getDecisionVoters(H http) {
-        List<AccessDecisionVoter<? extends Object>> decisionVoters = new ArrayList<AccessDecisionVoter<? extends Object>>();
+    final List<AccessDecisionVoter> getDecisionVoters(H http) {
+        List<AccessDecisionVoter> decisionVoters = new ArrayList<AccessDecisionVoter>();
         decisionVoters.add(new RoleVoter());
         decisionVoters.add(new AuthenticatedVoter());
         return decisionVoters;
@@ -233,6 +236,7 @@ public final class UrlAuthorizationConfigurer<H extends HttpSecurityBuilder<H>>
         /**
          * Creates a new instance
          * @param requestMatchers the {@link RequestMatcher} instances to map to some {@link ConfigAttribute} instances.
+         * @see UrlAuthorizationConfigurer#chainRequestMatchers(List)
          */
         private AuthorizedUrl(List<RequestMatcher> requestMatchers) {
             Assert.notEmpty(requestMatchers, "requestMatchers must contain at least one value");

config/src/main/java/org/springframework/security/config/annotation/web/messaging/MessageSecurityMetadataSourceRegistry.java

@@ -1,354 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.config.annotation.web.messaging;
-
-import org.springframework.messaging.Message;
-import org.springframework.messaging.simp.SimpMessageType;
-import org.springframework.security.config.annotation.web.configurers.RememberMeConfigurer;
-import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
-import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
-import org.springframework.security.messaging.util.matcher.MessageMatcher;
-import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
-import org.springframework.security.messaging.util.matcher.SimpMessageTypeMatcher;
-import org.springframework.util.AntPathMatcher;
-import org.springframework.util.Assert;
-import org.springframework.util.PathMatcher;
-import org.springframework.util.StringUtils;
-
-import java.util.*;
-
-/**
- * Allows mapping security constraints using {@link MessageMatcher} to the security expressions.
- *
- * @since 4.0
- * @author Rob Winch
- */
-public class MessageSecurityMetadataSourceRegistry {
-    private static final String permitAll = "permitAll";
-    private static final String denyAll = "denyAll";
-    private static final String anonymous = "anonymous";
-    private static final String authenticated = "authenticated";
-    private static final String fullyAuthenticated = "fullyAuthenticated";
-    private static final String rememberMe = "rememberMe";
-
-    private final LinkedHashMap<MatcherBuilder,String> matcherToExpression = new LinkedHashMap<MatcherBuilder,String>();
-
-    private PathMatcher pathMatcher = new AntPathMatcher();
-
-    /**
-     * Maps any {@link Message} to a security expression.
-     *
-     * @return the Expression to associate
-     */
-    public Constraint anyMessage() {
-        return matchers(MessageMatcher.ANY_MESSAGE);
-    }
-
-    /**
-     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances.
-     *
-     * @param typesToMatch the {@link SimpMessageType} instance to match on
-     * @return the {@link Constraint} associated to the matchers.
-     */
-    public Constraint typeMatchers(SimpMessageType... typesToMatch) {
-        MessageMatcher<?>[] typeMatchers = new MessageMatcher<?>[typesToMatch.length];
-        for (int i = 0; i < typesToMatch.length; i++) {
-            SimpMessageType typeToMatch = typesToMatch[i];
-            typeMatchers[i] = new SimpMessageTypeMatcher(typeToMatch);
-        }
-        return matchers(typeMatchers);
-    }
-
-    /**
-     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances
-     * without regard to the {@link SimpMessageType}. If no destination is found
-     * on the Message, then the Matcher returns false.
-     *
-     * @param patterns
-     *            the patterns to create
-     *            {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
-     *            from. Uses
-     *            {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
-     *            .
-     *
-     * @return the {@link Constraint} that is associated to the
-     *         {@link MessageMatcher}
-     * @see {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
-     */
-    public Constraint antMatchers(String... patterns) {
-        return antMatchers(null, patterns);
-    }
-
-    /**
-     * Maps a {@link List} of {@link SimpDestinationMessageMatcher} instances.
-     * If no destination is found on the Message, then the Matcher returns
-     * false.
-     *
-     * @param type the {@link SimpMessageType} to match on. If null, the {@link SimpMessageType} is not considered for matching.
-     * @param patterns the patterns to create {@link org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher}
-     *                    from. Uses {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}.
-     *
-     * @return the {@link Constraint}  that is associated to the {@link MessageMatcher}
-     * @see {@link MessageSecurityMetadataSourceRegistry#pathMatcher(PathMatcher)}
-     */
-    public Constraint antMatchers(SimpMessageType type, String... patterns) {
-        List<MatcherBuilder> matchers = new ArrayList<MatcherBuilder>(patterns.length);
-        for(String pattern : patterns) {
-            matchers.add(new PathMatcherMessageMatcherBuilder(pattern, type));
-        }
-        return new Constraint(matchers);
-    }
-
-    /**
-     * The {@link PathMatcher} to be used with the {@link MessageSecurityMetadataSourceRegistry#antMatchers(String...)}.
-     * The default is to use the default constructor of {@link AntPathMatcher}.
-     *
-     * @param pathMatcher the {@link PathMatcher} to use. Cannot be null.
-     * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization.
-     */
-    public MessageSecurityMetadataSourceRegistry pathMatcher(PathMatcher pathMatcher) {
-        Assert.notNull(pathMatcher, "pathMatcher cannot be null");
-        this.pathMatcher = pathMatcher;
-        return this;
-    }
-
-    /**
-     * Maps a {@link List} of {@link MessageMatcher} instances to a security expression.
-     *
-     * @param matchers the {@link MessageMatcher} instances to map.
-     * @return The {@link Constraint} that is associated to the {@link MessageMatcher} instances
-     */
-    public Constraint matchers(MessageMatcher<?>... matchers) {
-        List<MatcherBuilder> builders = new ArrayList<MatcherBuilder>(matchers.length);
-        for(MessageMatcher<?> matcher : matchers) {
-            builders.add(new PreBuiltMatcherBuilder(matcher));
-        }
-        return new Constraint(builders);
-    }
-
-    /**
-     * Allows subclasses to create creating a {@link MessageSecurityMetadataSource}.
-     *
-     * <p>This is not exposed so as not to confuse users of the API, which should never invoke this method.</p>
-     *
-     * @return the {@link MessageSecurityMetadataSource} to use
-     */
-    protected MessageSecurityMetadataSource createMetadataSource() {
-        LinkedHashMap<MessageMatcher<?>,String> matcherToExpression = new LinkedHashMap<MessageMatcher<?>,String>();
-        for(Map.Entry<MatcherBuilder,String> entry : this.matcherToExpression.entrySet()) {
-            matcherToExpression.put(entry.getKey().build(), entry.getValue());
-        }
-        return ExpressionBasedMessageSecurityMetadataSourceFactory.createExpressionMessageMetadataSource(matcherToExpression);
-    }
-
-    /**
-     * Allows determining if a mapping was added.
-     *
-     * <p>This is not exposed so as not to confuse users of the API, which should never need to invoke this method.</p>
-     *
-     * @return true if a mapping was added, else false
-     */
-    protected boolean containsMapping() {
-        return !this.matcherToExpression.isEmpty();
-    }
-
-    /**
-     * Represents the security constraint to be applied to the {@link MessageMatcher} instances.
-     */
-    public class Constraint {
-        private final List<? extends MatcherBuilder> messageMatchers;
-
-        /**
-         * Creates a new instance
-         *
-         * @param messageMatchers the {@link MessageMatcher} instances to map to this constraint
-         */
-        private Constraint(List<? extends MatcherBuilder> messageMatchers) {
-            Assert.notEmpty(messageMatchers, "messageMatchers cannot be null or empty");
-            this.messageMatchers = messageMatchers;
-        }
-
-        /**
-         * Shortcut for specifying {@link Message} instances require a particular role. If you do not want to have "ROLE_" automatically
-         * inserted see {@link #hasAuthority(String)}.
-         *
-         * @param role the role to require (i.e. USER, ADMIN, etc). Note, it should not start with "ROLE_" as
-         *             this is automatically inserted.
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasRole(String role) {
-            return access(MessageSecurityMetadataSourceRegistry.hasRole(role));
-        }
-
-        /**
-         * Shortcut for specifying {@link Message} instances require any of a number of roles. If you
-         * do not want to have "ROLE_" automatically inserted see
-         * {@link #hasAnyAuthority(String...)}
-         *
-         * @param roles
-         *            the roles to require (i.e. USER, ADMIN, etc). Note, it
-         *            should not start with "ROLE_" as this is automatically
-         *            inserted.
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further
-         *         customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAnyRole(String... roles) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAnyRole(roles));
-        }
-
-        /**
-         * Specify that {@link Message} instances require a particular authority.
-         *
-         * @param authority the authority to require (i.e. ROLE_USER, ROLE_ADMIN, etc).
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAuthority(String authority) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAuthority(authority));
-        }
-
-        /**
-         * Specify that {@link Message} instances requires any of a number authorities.
-         *
-         * @param authorities the requests require at least one of the authorities (i.e. "ROLE_USER","ROLE_ADMIN" would
-         *                    mean either "ROLE_USER" or "ROLE_ADMIN" is required).
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry hasAnyAuthority(String... authorities) {
-            return access(MessageSecurityMetadataSourceRegistry.hasAnyAuthority(authorities));
-        }
-
-        /**
-         * Specify that Messages are allowed by anyone.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry permitAll() {
-            return access(permitAll);
-        }
-
-        /**
-         * Specify that Messages are allowed by anonymous users.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry anonymous() {
-            return access(anonymous);
-        }
-
-        /**
-         * Specify that Messages are allowed by users that have been remembered.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         * @see {@link RememberMeConfigurer}
-         */
-        public MessageSecurityMetadataSourceRegistry rememberMe() {
-            return access(rememberMe);
-        }
-
-        /**
-         * Specify that Messages are not allowed by anyone.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry denyAll() {
-            return access(denyAll);
-        }
-
-        /**
-         * Specify that Messages are allowed by any authenticated user.
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry authenticated() {
-            return access(authenticated);
-        }
-
-        /**
-         * Specify that Messages are allowed by users who have authenticated and were not "remembered".
-         *
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         * @see {@link RememberMeConfigurer}
-         */
-        public MessageSecurityMetadataSourceRegistry fullyAuthenticated() {
-            return access(fullyAuthenticated);
-        }
-
-        /**
-         * Allows specifying that Messages are secured by an arbitrary expression
-         *
-         * @param attribute the expression to secure the URLs (i.e. "hasRole('ROLE_USER') and hasRole('ROLE_SUPER')")
-         * @return the {@link MessageSecurityMetadataSourceRegistry} for further customization
-         */
-        public MessageSecurityMetadataSourceRegistry access(String attribute) {
-            for(MatcherBuilder messageMatcher : messageMatchers) {
-                matcherToExpression.put(messageMatcher, attribute);
-            }
-            return MessageSecurityMetadataSourceRegistry.this;
-        }
-    }
-
-    private static String hasAnyRole(String... authorities) {
-        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','ROLE_");
-        return "hasAnyRole('ROLE_" + anyAuthorities + "')";
-    }
-
-    private static String hasRole(String role) {
-        Assert.notNull(role, "role cannot be null");
-        if (role.startsWith("ROLE_")) {
-            throw new IllegalArgumentException("role should not start with 'ROLE_' since it is automatically inserted. Got '" + role + "'");
-        }
-        return "hasRole('ROLE_" + role + "')";
-    }
-
-    private static String hasAuthority(String authority) {
-        return "hasAuthority('" + authority + "')";
-    }
-
-    private static String hasAnyAuthority(String... authorities) {
-        String anyAuthorities = StringUtils.arrayToDelimitedString(authorities, "','");
-        return "hasAnyAuthority('" + anyAuthorities + "')";
-    }
-
-    private class PreBuiltMatcherBuilder implements MatcherBuilder {
-        private MessageMatcher<?> matcher;
-
-        private PreBuiltMatcherBuilder(MessageMatcher<?> matcher) {
-            this.matcher = matcher;
-        }
-
-        public MessageMatcher<?> build() {
-            return matcher;
-        }
-    }
-
-    private class PathMatcherMessageMatcherBuilder implements MatcherBuilder {
-        private final String pattern;
-        private final SimpMessageType type;
-
-        private PathMatcherMessageMatcherBuilder(String pattern, SimpMessageType type) {
-            this.pattern = pattern;
-            this.type = type;
-        }
-
-        public MessageMatcher<?> build() {
-            return new SimpDestinationMessageMatcher(pattern, type, pathMatcher);
-        }
-    }
-
-    private interface MatcherBuilder {
-        MessageMatcher<?> build();
-    }
-}

config/src/main/java/org/springframework/security/config/annotation/web/servlet/configuration/EnableWebMvcSecurity.java

@@ -19,7 +19,6 @@ import java.lang.annotation.Documented;
 import java.lang.annotation.Retention;
 import java.lang.annotation.Target;
 
-import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Import;
 import org.springframework.security.config.annotation.authentication.configuration.EnableGlobalAuthentication;
 
@@ -28,7 +27,6 @@ import org.springframework.security.config.annotation.authentication.configurati
  * Add this annotation to an {@code @Configuration} class to have the Spring Security
  * configuration integrate with Spring MVC.
  *
- * @deprecated Use EnableWebSecurity instead which will automatically add the Spring MVC related Security items.
  * @author Rob Winch
  * @since 3.2
  */
@@ -37,7 +35,5 @@ import org.springframework.security.config.annotation.authentication.configurati
 @Documented
 @Import(WebMvcSecurityConfiguration.class)
 @EnableGlobalAuthentication
-@Configuration
-@Deprecated
 public @interface EnableWebMvcSecurity {
 }

config/src/main/java/org/springframework/security/config/annotation/web/servlet/configuration/WebMvcSecurityConfiguration.java

@@ -20,7 +20,7 @@ import java.util.List;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.method.annotation.AuthenticationPrincipalArgumentResolver;
+import org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver;
 import org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor;
 import org.springframework.web.method.support.HandlerMethodArgumentResolver;
 import org.springframework.web.servlet.config.annotation.EnableWebMvc;
@@ -35,19 +35,17 @@ import org.springframework.web.servlet.support.RequestDataValueProcessor;
  * {@link AuthenticationPrincipalArgumentResolver} as a
  * {@link HandlerMethodArgumentResolver}.
  *
- * @deprecated This is applied internally using SpringWebMvcImportSelector
  * @author Rob Winch
  * @since 3.2
  */
+@Configuration
 @EnableWebSecurity
 public class WebMvcSecurityConfiguration extends WebMvcConfigurerAdapter {
 
     @Override
-    @SuppressWarnings("deprecation")
     public void addArgumentResolvers(
             List<HandlerMethodArgumentResolver> argumentResolvers) {
         argumentResolvers.add(new AuthenticationPrincipalArgumentResolver());
-        argumentResolvers.add(new org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver());
     }
 
     @Bean

config/src/main/java/org/springframework/security/config/annotation/web/socket/AbstractSecurityWebSocketMessageBrokerConfigurer.java

@@ -1,119 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License"); you may not
- * use this file except in compliance with the License. You may obtain a copy of
- * the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
- * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
- * License for the specific language governing permissions and limitations under
- * the License.
- */
-package org.springframework.security.config.annotation.web.socket;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.core.Ordered;
-import org.springframework.core.annotation.Order;
-import org.springframework.messaging.handler.invocation.HandlerMethodArgumentResolver;
-import org.springframework.messaging.simp.config.ChannelRegistration;
-import org.springframework.security.access.AccessDecisionVoter;
-import org.springframework.security.access.vote.AffirmativeBased;
-import org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry;
-import org.springframework.security.messaging.access.expression.MessageExpressionVoter;
-import org.springframework.security.messaging.access.intercept.ChannelSecurityInterceptor;
-import org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource;
-import org.springframework.security.messaging.context.AuthenticationPrincipalArgumentResolver;
-import org.springframework.security.messaging.context.SecurityContextChannelInterceptor;
-import org.springframework.web.socket.config.annotation.AbstractWebSocketMessageBrokerConfigurer;
-import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/**
- * Allows configuring WebSocket Authorization.
- *
- * <p>For example:</p>
- *
- * <pre>
- * @Configuration
- * public class WebSocketSecurityConfig extends AbstractSecurityWebSocketMessageBrokerConfigurer {
- *
- *   @Override
- *   protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
- *     messages
- *       .antMatchers("/user/queue/errors").permitAll()
- *       .antMatchers("/admin/**").hasRole("ADMIN")
- *       .anyMessage().authenticated();
- *   }
- * }
- * </pre>
- *
- *
- * @since 4.0
- * @author Rob Winch
- */
-@Order(Ordered.HIGHEST_PRECEDENCE + 100)
-public abstract class AbstractSecurityWebSocketMessageBrokerConfigurer extends AbstractWebSocketMessageBrokerConfigurer {
-    private final WebSocketMessageSecurityMetadataSourceRegistry inboundRegistry = new WebSocketMessageSecurityMetadataSourceRegistry();
-
-    public final void registerStompEndpoints(StompEndpointRegistry registry) {}
-
-    @Override
-    public void addArgumentResolvers(
-            List<HandlerMethodArgumentResolver> argumentResolvers) {
-        argumentResolvers.add(new AuthenticationPrincipalArgumentResolver());
-    }
-
-
-    @Override
-    public final void configureClientInboundChannel(ChannelRegistration registration) {
-        ChannelSecurityInterceptor inboundChannelSecurity = inboundChannelSecurity();
-        if(inboundRegistry.containsMapping()) {
-            registration.setInterceptors(securityContextChannelInterceptor(),inboundChannelSecurity);
-        }
-    }
-
-    @Bean
-    public ChannelSecurityInterceptor inboundChannelSecurity() {
-        ChannelSecurityInterceptor channelSecurityInterceptor = new ChannelSecurityInterceptor(inboundMessageSecurityMetadataSource());
-        List<AccessDecisionVoter<? extends Object>> voters = new ArrayList<AccessDecisionVoter<? extends Object>>();
-        voters.add(new MessageExpressionVoter());
-        AffirmativeBased manager = new AffirmativeBased(voters);
-        channelSecurityInterceptor.setAccessDecisionManager(manager);
-        return channelSecurityInterceptor;
-    }
-
-    @Bean
-    public SecurityContextChannelInterceptor securityContextChannelInterceptor() {
-        return new SecurityContextChannelInterceptor();
-    }
-
-    @Bean
-    public MessageSecurityMetadataSource inboundMessageSecurityMetadataSource() {
-        configureInbound(inboundRegistry);
-        return inboundRegistry.createMetadataSource();
-    }
-
-    /**
-     *
-     * @param messages
-     */
-    protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {}
-
-    private class WebSocketMessageSecurityMetadataSourceRegistry extends MessageSecurityMetadataSourceRegistry {
-        @Override
-        public MessageSecurityMetadataSource createMetadataSource() {
-            return super.createMetadataSource();
-        }
-
-        @Override
-        protected boolean containsMapping() {
-            return super.containsMapping();
-        }
-    }
-}

config/src/main/java/org/springframework/security/config/authentication/AuthenticationManagerBeanDefinitionParser.java

@@ -52,6 +52,7 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition
 
         String alias = element.getAttribute(ATT_ALIAS);
 
+        checkForDeprecatedSessionControllerRef(element, pc);
         List<BeanMetadataElement> providers = new ManagedList<BeanMetadataElement>();
         NamespaceHandlerResolver resolver = pc.getReaderContext().getNamespaceHandlerResolver();
 
@@ -112,6 +113,16 @@ public class AuthenticationManagerBeanDefinitionParser implements BeanDefinition
         return null;
     }
 
+    private void checkForDeprecatedSessionControllerRef(Element element, ParserContext pc) {
+        final String ATT_SESSION_CONTROLLER_REF = "session-controller-ref";
+
+        if (StringUtils.hasText(element.getAttribute(ATT_SESSION_CONTROLLER_REF))) {
+            pc.getReaderContext().warning(ATT_SESSION_CONTROLLER_REF + " is not supported in Spring Security " +
+                    " 3.0 and will be ignored. Use the attribute on the <concurrent-session-control> element instead.",
+                    pc.extractSource(element));
+        }
+    }
+
     /**
      * Provider which doesn't provide any service. Only used to prevent a configuration exception if the provider list
      * is empty (usually because a child ProviderManager from the &lt;http&gt; namespace, such as OpenID, is expected

config/src/main/java/org/springframework/security/config/authentication/AuthenticationManagerFactoryBean.java

@@ -6,13 +6,8 @@ import org.springframework.beans.factory.BeanFactoryAware;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.beans.factory.NoSuchBeanDefinitionException;
 import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.AuthenticationProvider;
 import org.springframework.security.authentication.ProviderManager;
-import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.config.BeanIds;
-import org.springframework.security.core.userdetails.UserDetailsService;
-
-import java.util.Arrays;
 
 /**
  * Factory bean for the namespace AuthenticationManager, which allows a more meaningful error message
@@ -33,13 +28,6 @@ public class AuthenticationManagerFactoryBean implements FactoryBean<Authenticat
              return (AuthenticationManager) bf.getBean(BeanIds.AUTHENTICATION_MANAGER);
         } catch (NoSuchBeanDefinitionException e) {
             if (BeanIds.AUTHENTICATION_MANAGER.equals(e.getBeanName())) {
-                try {
-                    UserDetailsService uds = bf.getBean(UserDetailsService.class);
-                    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
-                    provider.setUserDetailsService(uds);
-                    provider.afterPropertiesSet();
-                    return new ProviderManager(Arrays.<AuthenticationProvider>asList(provider));
-                } catch(NoSuchBeanDefinitionException noUds) {}
                 throw new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER, MISSING_BEAN_ERROR_MESSAGE);
             }
             throw e;

config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java

@@ -84,6 +84,7 @@ final class AuthenticationConfigBuilder {
 
     private static final String ATT_AUTO_CONFIG = "auto-config";
 
+    private static final String ATT_ACCESS_DENIED_PAGE = "access-denied-page";
     private static final String ATT_ACCESS_DENIED_ERROR_PAGE = "error-page";
     private static final String ATT_ENTRY_POINT_REF = "entry-point-ref";
 
@@ -130,12 +131,12 @@ final class AuthenticationConfigBuilder {
     private String loginProcessingUrl;
     private String openidLoginProcessingUrl;
 
-    public AuthenticationConfigBuilder(Element element, boolean forceAutoConfig, ParserContext pc, SessionCreationPolicy sessionPolicy,
+    public AuthenticationConfigBuilder(Element element, ParserContext pc, SessionCreationPolicy sessionPolicy,
             BeanReference requestCache, BeanReference authenticationManager, BeanReference sessionStrategy, BeanReference portMapper, BeanReference portResolver, BeanMetadataElement csrfLogoutHandler) {
         this.httpElt = element;
         this.pc = pc;
         this.requestCache = requestCache;
-        autoConfig = forceAutoConfig | "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
+        autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
         this.allowSessionCreation = sessionPolicy != SessionCreationPolicy.NEVER
                 && sessionPolicy != SessionCreationPolicy.STATELESS;
         this.portMapper = portMapper;
@@ -193,7 +194,7 @@ final class AuthenticationConfigBuilder {
         RootBeanDefinition formFilter = null;
 
         if (formLoginElt != null || autoConfig) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login", "POST",
+            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
                     AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
 
             parser.parse(formLoginElt, pc);
@@ -218,7 +219,7 @@ final class AuthenticationConfigBuilder {
         RootBeanDefinition openIDFilter = null;
 
         if (openIDLoginElt != null) {
-            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login/openid", null,
+            FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
                     OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
 
             parser.parse(openIDLoginElt, pc);
@@ -492,11 +493,7 @@ final class AuthenticationConfigBuilder {
     void createLogoutFilter() {
         Element logoutElt = DomUtils.getChildElementByTagName(httpElt, Elements.LOGOUT);
         if (logoutElt != null || autoConfig) {
-            String formLoginPage = getLoginFormUrl(formEntryPoint);
-            if(formLoginPage == null) {
-                formLoginPage = DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL;
-            }
-            LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(formLoginPage,rememberMeServicesId, csrfLogoutHandler);
+            LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(rememberMeServicesId, csrfLogoutHandler);
             logoutFilter = logoutParser.parse(logoutElt, pc);
             logoutHandlers = logoutParser.getLogoutHandlers();
         }
@@ -590,9 +587,20 @@ final class AuthenticationConfigBuilder {
     }
 
     private BeanMetadataElement createAccessDeniedHandler(Element element, ParserContext pc) {
+        String accessDeniedPage = element.getAttribute(ATT_ACCESS_DENIED_PAGE);
+        WebConfigUtils.validateHttpRedirect(accessDeniedPage, pc, pc.extractSource(element));
         Element accessDeniedElt = DomUtils.getChildElementByTagName(element, Elements.ACCESS_DENIED_HANDLER);
         BeanDefinitionBuilder accessDeniedHandler = BeanDefinitionBuilder.rootBeanDefinition(AccessDeniedHandlerImpl.class);
 
+        if (StringUtils.hasText(accessDeniedPage)) {
+            if (accessDeniedElt != null) {
+                pc.getReaderContext().error("The attribute " + ATT_ACCESS_DENIED_PAGE +
+                        " cannot be used with <" + Elements.ACCESS_DENIED_HANDLER + ">", pc.extractSource(accessDeniedElt));
+            }
+
+            accessDeniedHandler.addPropertyValue("errorPage", accessDeniedPage);
+        }
+
         if (accessDeniedElt != null) {
             String errorPage = accessDeniedElt.getAttribute("error-page");
             String ref = accessDeniedElt.getAttribute("ref");

config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java

@@ -56,10 +56,6 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
     private BeanDefinition csrfFilter;
 
     public BeanDefinition parse(Element element, ParserContext pc) {
-        boolean disabled = element != null && "true".equals(element.getAttribute("disabled"));
-        if(disabled) {
-            return null;
-        }
         boolean webmvcPresent = ClassUtils.isPresent(DISPATCHER_SERVLET_CLASS_NAME, getClass().getClassLoader());
         if(webmvcPresent) {
             RootBeanDefinition beanDefinition = new RootBeanDefinition(CsrfRequestDataValueProcessor.class);
@@ -68,11 +64,8 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
             pc.registerBeanComponent(componentDefinition);
         }
 
-        String matcherRef = null;
-        if(element != null) {
-            csrfRepositoryRef = element.getAttribute(ATT_REPOSITORY);
-            matcherRef = element.getAttribute(ATT_MATCHER);
-        }
+        csrfRepositoryRef = element.getAttribute(ATT_REPOSITORY);
+        String matcherRef = element.getAttribute(ATT_MATCHER);
 
         if(!StringUtils.hasText(csrfRepositoryRef)) {
             RootBeanDefinition csrfTokenRepository = new RootBeanDefinition(HttpSessionCsrfTokenRepository.class);

config/src/main/java/org/springframework/security/config/http/FilterChainMapBeanDefinitionDecorator.java

@@ -5,17 +5,14 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
-import org.springframework.beans.BeanMetadataElement;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.config.BeanDefinitionHolder;
 import org.springframework.beans.factory.config.RuntimeBeanReference;
-import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.ManagedList;
 import org.springframework.beans.factory.support.ManagedMap;
 import org.springframework.beans.factory.xml.BeanDefinitionDecorator;
 import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.Elements;
-import org.springframework.security.web.DefaultSecurityFilterChain;
 import org.springframework.util.StringUtils;
 import org.springframework.util.xml.DomUtils;
 import org.w3c.dom.Element;
@@ -32,7 +29,7 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
     public BeanDefinitionHolder decorate(Node node, BeanDefinitionHolder holder, ParserContext parserContext) {
         BeanDefinition filterChainProxy = holder.getBeanDefinition();
 
-        ManagedList<BeanMetadataElement> securityFilterChains = new ManagedList<BeanMetadataElement>();
+        Map filterChainMap = new LinkedHashMap();
         Element elt = (Element)node;
 
         MatcherType matcherType = MatcherType.fromElement(elt);
@@ -56,7 +53,7 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
             BeanDefinition matcher = matcherType.createMatcher(path, null);
 
             if (filters.equals(HttpSecurityBeanDefinitionParser.OPT_FILTERS_NONE)) {
-                securityFilterChains.add(createSecurityFilterChain(matcher, new ManagedList(0)));
+                filterChainMap.put(matcher, Collections.EMPTY_LIST);
             } else {
                 String[] filterBeanNames = StringUtils.tokenizeToStringArray(filters, ",");
                 ManagedList filterChain = new ManagedList(filterBeanNames.length);
@@ -65,19 +62,15 @@ public class FilterChainMapBeanDefinitionDecorator implements BeanDefinitionDeco
                     filterChain.add(new RuntimeBeanReference(name));
                 }
 
-                securityFilterChains.add(createSecurityFilterChain(matcher, filterChain));
+                filterChainMap.put(matcher, filterChain);
             }
         }
 
-        filterChainProxy.getConstructorArgumentValues().addGenericArgumentValue(securityFilterChains);
+        ManagedMap map = new ManagedMap(filterChainMap.size());
+        map.putAll(filterChainMap);
+
+        filterChainProxy.getPropertyValues().addPropertyValue("filterChainMap", map);
 
         return holder;
     }
-
-    private BeanDefinition createSecurityFilterChain(BeanDefinition matcher, ManagedList<?> filters) {
-        BeanDefinitionBuilder sfc = BeanDefinitionBuilder.rootBeanDefinition(DefaultSecurityFilterChain.class);
-        sfc.addConstructorArgValue(matcher);
-        sfc.addConstructorArgValue(filters);
-        return sfc.getBeanDefinition();
-    }
 }

config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java

@@ -48,7 +48,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             }
         }
 
-        BeanDefinition mds = createSecurityMetadataSource(interceptUrls, false, element, parserContext);
+        BeanDefinition mds = createSecurityMetadataSource(interceptUrls, element, parserContext);
 
         String id = element.getAttribute(AbstractBeanDefinitionParser.ID_ATTRIBUTE);
 
@@ -60,16 +60,16 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
         return mds;
     }
 
-    static RootBeanDefinition createSecurityMetadataSource(List<Element> interceptUrls, boolean addAllAuth, Element httpElt, ParserContext pc) {
-        MatcherType matcherType = MatcherType.fromElement(httpElt);
-        boolean useExpressions = isUseExpressions(httpElt);
+    static RootBeanDefinition createSecurityMetadataSource(List<Element> interceptUrls, Element elt, ParserContext pc) {
+        MatcherType matcherType = MatcherType.fromElement(elt);
+        boolean useExpressions = isUseExpressions(elt);
 
         ManagedMap<BeanDefinition, BeanDefinition> requestToAttributesMap = parseInterceptUrlsForFilterInvocationRequestMap(
-                matcherType, interceptUrls, useExpressions, addAllAuth, pc);
+                matcherType, interceptUrls, useExpressions, pc);
         BeanDefinitionBuilder fidsBuilder;
 
         if (useExpressions) {
-            Element expressionHandlerElt = DomUtils.getChildElementByTagName(httpElt, Elements.EXPRESSION_HANDLER);
+            Element expressionHandlerElt = DomUtils.getChildElementByTagName(elt, Elements.EXPRESSION_HANDLER);
             String expressionHandlerRef = expressionHandlerElt == null ? null : expressionHandlerElt.getAttribute("ref");
 
             if (StringUtils.hasText(expressionHandlerRef)) {
@@ -86,7 +86,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             fidsBuilder.addConstructorArgValue(requestToAttributesMap);
         }
 
-        fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(httpElt));
+        fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(elt));
 
         return (RootBeanDefinition) fidsBuilder.getBeanDefinition();
     }
@@ -100,13 +100,12 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
     }
 
     static boolean isUseExpressions(Element elt) {
-        String useExpressions = elt.getAttribute(ATT_USE_EXPRESSIONS);
-        return !StringUtils.hasText(useExpressions) || "true".equals(useExpressions);
+        return "true".equals(elt.getAttribute(ATT_USE_EXPRESSIONS));
     }
 
     private static ManagedMap<BeanDefinition, BeanDefinition>
         parseInterceptUrlsForFilterInvocationRequestMap(MatcherType matcherType,
-                List<Element> urlElts, boolean useExpressions, boolean addAuthenticatedAll, ParserContext parserContext) {
+                List<Element> urlElts, boolean useExpressions, ParserContext parserContext) {
 
         ManagedMap<BeanDefinition, BeanDefinition> filterInvocationDefinitionMap = new ManagedMap<BeanDefinition, BeanDefinition>();
 
@@ -129,15 +128,14 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
 
             BeanDefinition matcher = matcherType.createMatcher(path, method);
             BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
+            attributeBuilder.addConstructorArgValue(access);
 
             if (useExpressions) {
                 logger.info("Creating access control expression attribute '" + access + "' for " + path);
                 // The single expression will be parsed later by the ExpressionFilterInvocationSecurityMetadataSource
-                attributeBuilder.addConstructorArgValue(new String[] { access });
-                attributeBuilder.setFactoryMethod("createList");
+                attributeBuilder.setFactoryMethod("createSingleAttributeList");
 
             } else {
-                attributeBuilder.addConstructorArgValue(access);
                 attributeBuilder.setFactoryMethod("createListFromCommaDelimitedString");
             }
 
@@ -148,15 +146,6 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
             filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
         }
 
-        if(addAuthenticatedAll && filterInvocationDefinitionMap.isEmpty()) {
-
-            BeanDefinition matcher = matcherType.createMatcher("/**", null);
-            BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
-            attributeBuilder.addConstructorArgValue(new String[] { "authenticated" });
-            attributeBuilder.setFactoryMethod("createList");
-            filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
-        }
-
         return filterInvocationDefinitionMap;
     }
 

config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java

@@ -66,13 +66,11 @@ public class FormLoginBeanDefinitionParser {
     private RootBeanDefinition filterBean;
     private RootBeanDefinition entryPointBean;
     private String loginPage;
-    private String loginMethod;
     private String loginProcessingUrl;
 
-    FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String loginMethod, String filterClassName,
+    FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String filterClassName,
             BeanReference requestCache, BeanReference sessionStrategy, boolean allowSessionCreation, BeanReference portMapper, BeanReference portResolver) {
         this.defaultLoginProcessingUrl = defaultLoginProcessingUrl;
-        this.loginMethod = loginMethod;
         this.filterClassName = filterClassName;
         this.requestCache = requestCache;
         this.sessionStrategy = sessionStrategy;
@@ -153,11 +151,8 @@ public class FormLoginBeanDefinitionParser {
 
         this.loginProcessingUrl = loginUrl;
 
-        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
+        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.logout.LogoutFilter$FilterProcessUrlRequestMatcher");
         matcherBuilder.addConstructorArgValue(loginUrl);
-        if(loginMethod != null) {
-            matcherBuilder.addConstructorArgValue("POST");
-        }
 
         filterBuilder.addPropertyValue("requiresAuthenticationRequestMatcher", matcherBuilder.getBeanDefinition());
 

config/src/main/java/org/springframework/security/config/http/HeadersBeanDefinitionParser.java

@@ -80,24 +80,14 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
         headerWriters = new ManagedList<BeanMetadataElement>();
         BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(HeaderWriterFilter.class);
 
-        if(element != null) {
+        parseCacheControlElement(element);
+        parseHstsElement(element);
+        parseXssElement(element, parserContext);
+        parseFrameOptionsElement(element, parserContext);
+        parseContentTypeOptionsElement(element);
 
-            parseCacheControlElement(element);
-            parseHstsElement(element);
-            parseXssElement(element, parserContext);
-            parseFrameOptionsElement(element, parserContext);
-            parseContentTypeOptionsElement(element);
+        parseHeaderElements(element);
 
-            parseHeaderElements(element);
-        }
-
-        boolean disabled = element != null && "true".equals(element.getAttribute("disabled"));
-        if(disabled) {
-            if(!headerWriters.isEmpty()) {
-                parserContext.getReaderContext().error("Cannot specify <headers disabled=\"true\"> with child elements.", element);
-            }
-            return null;
-        }
         if(headerWriters.isEmpty()) {
             addCacheControl();
             addHsts(null);
@@ -218,7 +208,7 @@ public class HeadersBeanDefinitionParser implements BeanDefinitionParser {
                         }
                         String fromParameter = getAttribute(frameElt, ATT_FROM_PARAMETER, "from");
                         allowFromStrategy.addPropertyValue("allowFromParameterName", fromParameter);
-                        builder.addConstructorArgValue(allowFromStrategy.getBeanDefinition());
+                        builder.addConstructorArgValue(allowFromStrategy);
                     }
                 } else {
                     parserContext.getReaderContext().error("One of 'strategy' and 'strategy-ref' must be set.",

config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

@@ -133,12 +133,10 @@ class HttpConfigurationBuilder {
     private CsrfBeanDefinitionParser csrfParser;
 
     private BeanDefinition invalidSession;
-    private boolean addAllAuth;
 
-    public HttpConfigurationBuilder(Element element, boolean addAllAuth, ParserContext pc,
+    public HttpConfigurationBuilder(Element element, ParserContext pc,
             BeanReference portMapper, BeanReference portResolver, BeanReference authenticationManager) {
         this.httpElt = element;
-        this.addAllAuth = addAllAuth;
         this.pc = pc;
         this.portMapper = portMapper;
         this.portResolver = portResolver;
@@ -585,7 +583,7 @@ class HttpConfigurationBuilder {
 
     private void createFilterSecurityInterceptor(BeanReference authManager) {
         boolean useExpressions = FilterInvocationSecurityMetadataSourceParser.isUseExpressions(httpElt);
-        RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, addAllAuth, httpElt, pc);
+        RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, httpElt, pc);
 
         RootBeanDefinition accessDecisionMgr;
         ManagedList<BeanDefinition> voters =  new ManagedList<BeanDefinition>(2);
@@ -640,22 +638,22 @@ class HttpConfigurationBuilder {
 
     private void createAddHeadersFilter() {
         Element elmt = DomUtils.getChildElementByTagName(httpElt, Elements.HEADERS);
-        this.addHeadersFilter = new HeadersBeanDefinitionParser().parse(elmt, pc);
+        if (elmt != null) {
+            this.addHeadersFilter = new HeadersBeanDefinitionParser().parse(elmt, pc);
+        }
 
     }
 
-    private void createCsrfFilter() {
+    private CsrfBeanDefinitionParser createCsrfFilter() {
         Element elmt = DomUtils.getChildElementByTagName(httpElt, Elements.CSRF);
-        csrfParser = new CsrfBeanDefinitionParser();
-        csrfFilter = csrfParser.parse(elmt, pc);
-
-        if(csrfFilter == null) {
-            csrfParser = null;
-            return;
+        if (elmt != null) {
+            csrfParser = new CsrfBeanDefinitionParser();
+            csrfFilter = csrfParser.parse(elmt, pc);
+            this.csrfAuthStrategy = csrfParser.getCsrfAuthenticationStrategy();
+            this.csrfLogoutHandler = csrfParser.getCsrfLogoutHandler();
+            return csrfParser;
         }
-
-        this.csrfAuthStrategy = csrfParser.getCsrfAuthenticationStrategy();
-        this.csrfLogoutHandler = csrfParser.getCsrfLogoutHandler();
+        return null;
     }
 
     BeanMetadataElement getCsrfLogoutHandler() {

config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java

@@ -132,11 +132,10 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
         ManagedList<BeanReference> authenticationProviders = new ManagedList<BeanReference>();
         BeanReference authenticationManager = createAuthenticationManager(element, pc, authenticationProviders);
 
-        boolean forceAutoConfig = isDefaultHttpConfig(element);
-        HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, forceAutoConfig, pc,
+        HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, pc,
                 portMapper, portResolver, authenticationManager);
 
-        AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, forceAutoConfig, pc,
+        AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, pc,
                 httpBldr.getSessionCreationPolicy(), httpBldr.getRequestCache(), authenticationManager,
                 httpBldr.getSessionStrategy(), portMapper, portResolver, httpBldr.getCsrfLogoutHandler());
 
@@ -165,10 +164,6 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
         return createSecurityFilterChainBean(element, pc, filterChain);
     }
 
-    private static boolean isDefaultHttpConfig(Element httpElt) {
-        return httpElt.getChildNodes().getLength() == 0 && httpElt.getAttributes().getLength() == 0;
-    }
-
     private BeanReference createSecurityFilterChainBean(Element element, ParserContext pc, List<?> filterChain) {
         BeanMetadataElement filterChainMatcher;
 

config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java

@@ -35,24 +35,23 @@ import org.w3c.dom.Element;
  */
 class LogoutBeanDefinitionParser implements BeanDefinitionParser {
     static final String ATT_LOGOUT_SUCCESS_URL = "logout-success-url";
+    static final String DEF_LOGOUT_SUCCESS_URL = "/";
 
     static final String ATT_INVALIDATE_SESSION = "invalidate-session";
 
     static final String ATT_LOGOUT_URL = "logout-url";
-    static final String DEF_LOGOUT_URL = "/logout";
+    static final String DEF_LOGOUT_URL = "/j_spring_security_logout";
     static final String ATT_LOGOUT_HANDLER = "success-handler-ref";
     static final String ATT_DELETE_COOKIES = "delete-cookies";
 
     final String rememberMeServices;
-    private final String defaultLogoutUrl;
     private ManagedList<BeanMetadataElement> logoutHandlers = new ManagedList<BeanMetadataElement>();
     private boolean csrfEnabled;
 
-    public LogoutBeanDefinitionParser(String loginPageUrl, String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
-        this.defaultLogoutUrl = loginPageUrl + "?logout";
+    public LogoutBeanDefinitionParser(String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
         this.rememberMeServices = rememberMeServices;
         this.csrfEnabled = csrfLogoutHandler != null;
-        if (this.csrfEnabled) {
+        if(this.csrfEnabled) {
             logoutHandlers.add(csrfLogoutHandler);
         }
     }
@@ -94,7 +93,7 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
         } else {
             // Use the logout URL if no handler set
             if (!StringUtils.hasText(logoutSuccessUrl)) {
-                logoutSuccessUrl = defaultLogoutUrl;
+                logoutSuccessUrl = DEF_LOGOUT_SUCCESS_URL;
             }
             builder.addConstructorArgValue(logoutSuccessUrl);
         }
@@ -120,13 +119,16 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
     }
 
     private BeanDefinition getLogoutRequestMatcher(String logoutUrl) {
-        BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
-        matcherBuilder.addConstructorArgValue(logoutUrl);
         if(this.csrfEnabled) {
+            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
+            matcherBuilder.addConstructorArgValue(logoutUrl);
             matcherBuilder.addConstructorArgValue("POST");
+            return matcherBuilder.getBeanDefinition();
+        } else {
+            BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter$FilterProcessUrlRequestMatcher");
+            matcherBuilder.addConstructorArgValue(logoutUrl);
+            return matcherBuilder.getBeanDefinition();
         }
-
-        return matcherBuilder.getBeanDefinition();
     }
 
     ManagedList<BeanMetadataElement> getLogoutHandlers() {

config/src/main/java/org/springframework/security/config/http/MatcherType.java

@@ -1,5 +1,7 @@
 package org.springframework.security.config.http;
 
+import org.apache.commons.logging.Log;
+import org.apache.commons.logging.LogFactory;
 import org.springframework.beans.factory.config.BeanDefinition;
 import org.springframework.beans.factory.support.BeanDefinitionBuilder;
 import org.springframework.beans.factory.support.RootBeanDefinition;
@@ -21,7 +23,10 @@ public enum MatcherType {
     regex (RegexRequestMatcher.class),
     ciRegex (RegexRequestMatcher.class);
 
+    private static final Log logger = LogFactory.getLog(MatcherType.class);
+
     private static final String ATT_MATCHER_TYPE = "request-matcher";
+    private static final String ATT_PATH_TYPE = "path-type";
 
     private final Class<? extends RequestMatcher> type;
 
@@ -51,6 +56,11 @@ public enum MatcherType {
             return valueOf(elt.getAttribute(ATT_MATCHER_TYPE));
         }
 
+        if (StringUtils.hasText(elt.getAttribute(ATT_PATH_TYPE))) {
+            logger.warn("'" + ATT_PATH_TYPE + "' is deprecated. Please use '" + ATT_MATCHER_TYPE +"' instead.");
+            return valueOf(elt.getAttribute(ATT_PATH_TYPE));
+        }
+
         return ant;
     }
 }

config/src/main/java/org/springframework/security/config/message/MessageSecurityBeanDefinitionParser.java

@@ -1,187 +0,0 @@
-/*
- * Copyright 2002-2014 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.config.message;
-
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
-import org.springframework.beans.BeansException;
-import org.springframework.beans.PropertyValue;
-import org.springframework.beans.factory.config.*;
-import org.springframework.beans.factory.support.*;
-import org.springframework.beans.factory.xml.BeanDefinitionParser;
-import org.springframework.beans.factory.xml.ParserContext;
-import org.springframework.beans.factory.xml.XmlReaderContext;
-import org.springframework.messaging.simp.annotation.support.SimpAnnotationMethodMessageHandler;
-import org.springframework.security.access.vote.ConsensusBased;
-import org.springframework.security.config.Elements;
-import org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory;
-import org.springframework.security.messaging.access.expression.MessageExpressionVoter;
-import org.springframework.security.messaging.access.intercept.ChannelSecurityInterceptor;
-import org.springframework.security.messaging.context.AuthenticationPrincipalArgumentResolver;
-import org.springframework.security.messaging.context.SecurityContextChannelInterceptor;
-import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
-import org.springframework.util.StringUtils;
-import org.springframework.util.xml.DomUtils;
-import org.w3c.dom.Element;
-
-import java.util.List;
-
-/**
- * Parses Spring Security's message namespace support. A simple example is:
- *
- * <code>
- * &lt;messages&gt;
- *     &lt;message-interceptor pattern='/permitAll' access='permitAll' /&gt;
- *     &lt;message-interceptor pattern='/denyAll' access='denyAll' /&gt;
- * &lt;/messages&gt;
- * </code>
- *
- * <p>
- * The above configuration will ensure that any SimpAnnotationMethodMessageHandler has the AuthenticationPrincipalArgumentResolver
- * registered as a custom argument resolver. It also ensures that the SecurityContextChannelInterceptor is automatically
- * registered for the clientInboundChannel. Last, it ensures that a ChannelSecurityInterceptor is registered with the
- * clientInboundChannel.
- * </p>
- *
- * <p>
- * If finer control is necessary, the id attribute can be used as shown below:
- * </p>
- *
- * <code>
- * &lt;messages id="channelSecurityInterceptor"&gt;
- *     &lt;message-interceptor pattern='/permitAll' access='permitAll' /&gt;
- *     &lt;message-interceptor pattern='/denyAll' access='denyAll' /&gt;
- * &lt;/messages&gt;
- * </code>
- *
- * <p>
- * Now the configuration will only create a bean named ChannelSecurityInterceptor and assign it to the id of
- * channelSecurityInterceptor. Users can explicitly wire Spring Security using the standard Spring Messaging XML
- * namespace support.
- * </p>
- *
- * @author Rob Winch
- * @since 4.0
- */
-public final class MessageSecurityBeanDefinitionParser implements BeanDefinitionParser {
-    private static final Log logger = LogFactory.getLog(MessageSecurityBeanDefinitionParser.class);
-
-    private static final String ID_ATTR = "id";
-
-    private static final String PATTERN_ATTR = "pattern";
-
-    private static final String ACCESS_ATTR = "access";
-
-
-    /**
-     * @param element
-     * @param parserContext
-     * @return
-     */
-    public BeanDefinition parse(Element element, ParserContext parserContext) {
-        BeanDefinitionRegistry registry = parserContext.getRegistry();
-        XmlReaderContext context = parserContext.getReaderContext();
-
-        ManagedMap<BeanDefinition,String> matcherToExpression = new ManagedMap<BeanDefinition, String>();
-
-        String id = element.getAttribute(ID_ATTR);
-
-        List<Element> interceptMessages = DomUtils.getChildElementsByTagName(element, Elements.INTERCEPT_MESSAGE);
-        for(Element interceptMessage : interceptMessages) {
-            String matcherPattern = interceptMessage.getAttribute(PATTERN_ATTR);
-            String accessExpression = interceptMessage.getAttribute(ACCESS_ATTR);
-            BeanDefinitionBuilder matcher = BeanDefinitionBuilder.rootBeanDefinition(SimpDestinationMessageMatcher.class);
-            matcher.addConstructorArgValue(matcherPattern);
-            matcherToExpression.put(matcher.getBeanDefinition(), accessExpression);
-        }
-
-        BeanDefinitionBuilder mds = BeanDefinitionBuilder.rootBeanDefinition(ExpressionBasedMessageSecurityMetadataSourceFactory.class);
-        mds.setFactoryMethod("createExpressionMessageMetadataSource");
-        mds.addConstructorArgValue(matcherToExpression);
-
-        String mdsId = context.registerWithGeneratedName(mds.getBeanDefinition());
-
-        ManagedList<BeanDefinition> voters = new ManagedList<BeanDefinition>();
-        voters.add(new RootBeanDefinition(MessageExpressionVoter.class));
-        BeanDefinitionBuilder adm = BeanDefinitionBuilder.rootBeanDefinition(ConsensusBased.class);
-        adm.addConstructorArgValue(voters);
-
-        BeanDefinitionBuilder inboundChannelSecurityInterceptor = BeanDefinitionBuilder.rootBeanDefinition(ChannelSecurityInterceptor.class);
-        inboundChannelSecurityInterceptor.addConstructorArgValue(registry.getBeanDefinition(mdsId));
-        inboundChannelSecurityInterceptor.addPropertyValue("accessDecisionManager", adm.getBeanDefinition());
-        String inSecurityInterceptorName = context.registerWithGeneratedName(inboundChannelSecurityInterceptor.getBeanDefinition());
-
-        if(StringUtils.hasText(id)) {
-            registry.registerAlias(inSecurityInterceptorName, id);
-        } else {
-            BeanDefinitionBuilder mspp = BeanDefinitionBuilder.rootBeanDefinition(MessageSecurityPostProcessor.class);
-            mspp.addConstructorArgValue(inSecurityInterceptorName);
-            context.registerWithGeneratedName(mspp.getBeanDefinition());
-        }
-
-        return null;
-    }
-
-    static class MessageSecurityPostProcessor implements BeanDefinitionRegistryPostProcessor {
-        private static final String CLIENT_INBOUND_CHANNEL_BEAN_ID = "clientInboundChannel";
-
-        private static final String INTERCEPTORS_PROP = "interceptors";
-
-        private static final String CUSTOM_ARG_RESOLVERS_PROP = "customArgumentResolvers";
-
-        private final String inboundSecurityInterceptorId;
-
-        public MessageSecurityPostProcessor(String inboundSecurityInterceptorId) {
-            this.inboundSecurityInterceptorId = inboundSecurityInterceptorId;
-        }
-
-        public void postProcessBeanDefinitionRegistry(BeanDefinitionRegistry registry) throws BeansException {
-            String[] beanNames = registry.getBeanDefinitionNames();
-            for(String beanName : beanNames) {
-                BeanDefinition bd = registry.getBeanDefinition(beanName);
-                if(bd.getBeanClassName().equals(SimpAnnotationMethodMessageHandler.class.getName())) {
-                    PropertyValue current = bd.getPropertyValues().getPropertyValue(CUSTOM_ARG_RESOLVERS_PROP);
-                    ManagedList<Object> argResolvers = new ManagedList<Object>();
-                    if(current != null) {
-                        argResolvers.addAll((ManagedList<?>)current.getValue());
-                    }
-                    argResolvers.add(new RootBeanDefinition(AuthenticationPrincipalArgumentResolver.class));
-                    bd.getPropertyValues().add(CUSTOM_ARG_RESOLVERS_PROP, argResolvers);
-                }
-            }
-
-            if(!registry.containsBeanDefinition(CLIENT_INBOUND_CHANNEL_BEAN_ID)) {
-                return;
-            }
-            ManagedList<Object> interceptors = new ManagedList();
-            interceptors.add(new RootBeanDefinition(SecurityContextChannelInterceptor.class));
-            interceptors.add(registry.getBeanDefinition(inboundSecurityInterceptorId));
-
-            BeanDefinition inboundChannel = registry.getBeanDefinition(CLIENT_INBOUND_CHANNEL_BEAN_ID);
-            PropertyValue currentInterceptorsPv =  inboundChannel.getPropertyValues().getPropertyValue(INTERCEPTORS_PROP);
-            if(currentInterceptorsPv != null) {
-                ManagedList<?> currentInterceptors = (ManagedList<?>) currentInterceptorsPv.getValue();
-                interceptors.addAll(currentInterceptors);
-            }
-
-            inboundChannel.getPropertyValues().add(INTERCEPTORS_PROP, interceptors);
-        }
-
-        public void postProcessBeanFactory(ConfigurableListableBeanFactory beanFactory) throws BeansException {
-
-        }
-    }
-}

config/src/main/resources/META-INF/spring.schemas

@@ -1,5 +1,4 @@
-http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-4.0.xsd
-http\://www.springframework.org/schema/security/spring-security-4.0.xsd=org/springframework/security/config/spring-security-4.0.xsd
+http\://www.springframework.org/schema/security/spring-security.xsd=org/springframework/security/config/spring-security-3.2.xsd
 http\://www.springframework.org/schema/security/spring-security-3.2.xsd=org/springframework/security/config/spring-security-3.2.xsd
 http\://www.springframework.org/schema/security/spring-security-3.1.xsd=org/springframework/security/config/spring-security-3.1.xsd
 http\://www.springframework.org/schema/security/spring-security-3.0.3.xsd=org/springframework/security/config/spring-security-3.0.3.xsd

config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd

@@ -844,7 +844,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /logout if unspecified.</xs:documentation>
+          /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -864,7 +864,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /login.</xs:documentation>
+          /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd

@@ -863,7 +863,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /logout if unspecified.</xs:documentation>
+          /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -883,7 +883,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /login.</xs:documentation>
+          /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd

@@ -893,7 +893,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /logout if unspecified.</xs:documentation>
+          /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -913,7 +913,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /login.</xs:documentation>
+          /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd

@@ -772,7 +772,7 @@
       <xs:annotation>
         <xs:documentation>Specifies the URL that will cause a logout. Spring Security will
           initialize a filter that responds to this particular URL. Defaults to
-          /logout if unspecified.</xs:documentation>
+          /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:string">
@@ -792,7 +792,7 @@
     <xs:attribute name="login-processing-url" type="xs:string">
       <xs:annotation>
         <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
-          /login.</xs:documentation>
+          /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:string">

config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd

@@ -799,7 +799,7 @@
   <xs:attributeGroup name="logout.attlist">
     <xs:attribute name="logout-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.</xs:documentation>
+        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:token">
@@ -827,7 +827,7 @@
   <xs:attributeGroup name="form-login.attlist">
     <xs:attribute name="login-processing-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.</xs:documentation>
+        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:token">

config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd

@@ -787,7 +787,7 @@
   <xs:attributeGroup name="logout.attlist">
     <xs:attribute name="logout-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.</xs:documentation>
+        <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="logout-success-url" type="xs:token">
@@ -815,7 +815,7 @@
   <xs:attributeGroup name="form-login.attlist">
     <xs:attribute name="login-processing-url" type="xs:token">
       <xs:annotation>
-        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.</xs:documentation>
+        <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.</xs:documentation>
       </xs:annotation>
     </xs:attribute>
     <xs:attribute name="default-target-url" type="xs:token">

config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc

@@ -370,7 +370,7 @@ logout =
     ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
     element logout {logout.attlist, empty}
 logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
     attribute logout-url {xsd:token}?
 logout.attlist &=
     ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
     ## Sets up a form login configuration for authentication with a username and password
     element form-login {form-login.attlist, empty}
 form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
+    ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
     attribute login-processing-url {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'username'.
+    ## The name of the request parameter which contains the username. Defaults to 'j_username'.
     attribute username-parameter {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'password'.
+    ## The name of the request parameter which contains the password. Defaults to 'j_password'.
     attribute password-parameter {xsd:token}?
 form-login.attlist &=
     ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.

config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd

@@ -1278,7 +1278,7 @@
       <xs:attribute name="logout-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that
-                responds to this particular URL. Defaults to /logout if unspecified.
+                responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1324,19 +1324,20 @@
   <xs:attributeGroup name="form-login.attlist">
       <xs:attribute name="login-processing-url" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.
+            <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
+                /j_spring_security_check.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="username-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'username'.
+            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'j_username'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="password-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'password'.
+            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'j_password'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>

config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc

@@ -370,7 +370,7 @@ logout =
     ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
     element logout {logout.attlist, empty}
 logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
+    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
     attribute logout-url {xsd:token}?
 logout.attlist &=
     ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
     ## Sets up a form login configuration for authentication with a username and password
     element form-login {form-login.attlist, empty}
 form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
+    ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
     attribute login-processing-url {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'username'.
+    ## The name of the request parameter which contains the username. Defaults to 'j_username'.
     attribute username-parameter {xsd:token}?
 form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'password'.
+    ## The name of the request parameter which contains the password. Defaults to 'j_password'.
     attribute password-parameter {xsd:token}?
 form-login.attlist &=
     ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.

config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd

@@ -1280,7 +1280,7 @@
       <xs:attribute name="logout-url" type="xs:token">
          <xs:annotation>
             <xs:documentation>Specifies the URL that will cause a logout. Spring Security will initialize a filter that
-                responds to this particular URL. Defaults to /logout if unspecified.
+                responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
@@ -1326,19 +1326,20 @@
   <xs:attributeGroup name="form-login.attlist">
       <xs:attribute name="login-processing-url" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to /login.
+            <xs:documentation>The URL that the login form is posted to. If unspecified, it defaults to
+                /j_spring_security_check.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="username-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'username'.
+            <xs:documentation>The name of the request parameter which contains the username. Defaults to 'j_username'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>
       <xs:attribute name="password-parameter" type="xs:token">
          <xs:annotation>
-            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'password'.
+            <xs:documentation>The name of the request parameter which contains the password. Defaults to 'j_password'.
                 </xs:documentation>
          </xs:annotation>
       </xs:attribute>

config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc

@@ -1,826 +0,0 @@
-namespace a = "http://relaxng.org/ns/compatibility/annotations/1.0"
-datatypes xsd = "http://www.w3.org/2001/XMLSchema-datatypes"
-
-default namespace = "http://www.springframework.org/schema/security"
-
-start = http | ldap-server | authentication-provider | ldap-authentication-provider | any-user-service | ldap-server | ldap-authentication-provider
-
-hash =
-    ## Defines the hashing algorithm used on user passwords. Bcrypt is recommended.
-    attribute hash {"bcrypt" | "plaintext" | "sha" | "sha-256" | "md5" | "md4" | "{sha}" | "{ssha}"}
-base64 =
-    ## Whether a string should be base64 encoded
-    attribute base64 {xsd:boolean}
-request-matcher =
-    ## Defines the strategy use for matching incoming requests. Currently the options are 'ant' (for ant path patterns), 'regex' for regular expressions and 'ciRegex' for case-insensitive regular expressions.
-    attribute request-matcher {"ant" | "regex" | "ciRegex"}
-port =
-    ## Specifies an IP port number. Used to configure an embedded LDAP server, for example.
-    attribute port { xsd:positiveInteger }
-url =
-    ## Specifies a URL.
-    attribute url { xsd:token }
-id =
-    ## A bean identifier, used for referring to the bean elsewhere in the context.
-    attribute id {xsd:token}
-name =
-    ## A bean identifier, used for referring to the bean elsewhere in the context.
-    attribute name {xsd:token}
-ref =
-    ## Defines a reference to a Spring bean Id.
-    attribute ref {xsd:token}
-
-cache-ref =
-    ## Defines a reference to a cache for use with a UserDetailsService.
-    attribute cache-ref {xsd:token}
-
-user-service-ref =
-    ## A reference to a user-service (or UserDetailsService bean) Id
-    attribute user-service-ref {xsd:token}
-
-authentication-manager-ref =
-    ## A reference to an AuthenticationManager bean
-    attribute authentication-manager-ref {xsd:token}
-
-data-source-ref =
-    ## A reference to a DataSource bean
-    attribute data-source-ref {xsd:token}
-
-
-
-debug =
-    ## Enables Spring Security debugging infrastructure. This will provide human-readable (multi-line) debugging information to monitor requests coming into the security filters. This may include sensitive information, such as request parameters or headers, and should only be used in a development environment.
-    element debug {empty}
-
-password-encoder =
-    ## element which defines a password encoding strategy. Used by an authentication provider to convert submitted passwords to hashed versions, for example.
-    element password-encoder {password-encoder.attlist, salt-source?}
-password-encoder.attlist &=
-    ref | (hash? & base64?)
-
-salt-source =
-    ## Password salting strategy. A system-wide constant or a property from the UserDetails object can be used.
-    element salt-source {user-property | system-wide | ref}
-user-property =
-    ## A property of the UserDetails object which will be used as salt by a password encoder. Typically something like "username" might be used.
-    attribute user-property {xsd:token}
-system-wide =
-    ## A single value that will be used as the salt for a password encoder.
-    attribute system-wide {xsd:token}
-
-role-prefix =
-    ## A non-empty string prefix that will be added to role strings loaded from persistent storage (e.g. "ROLE_"). Use the value "none" for no prefix in cases where the default is non-empty.
-    attribute role-prefix {xsd:token}
-
-use-expressions =
-    ## Enables the use of expressions in the 'access' attributes in <intercept-url> elements rather than the traditional list of configuration attributes. Defaults to 'true'. If enabled, each attribute should contain a single boolean expression. If the expression evaluates to 'true', access will be granted.
-    attribute use-expressions {xsd:boolean}
-
-ldap-server =
-    ## Defines an LDAP server location or starts an embedded server. The url indicates the location of a remote server. If no url is given, an embedded server will be started, listening on the supplied port number. The port is optional and defaults to 33389. A Spring LDAP ContextSource bean will be registered for the server with the id supplied.
-    element ldap-server {ldap-server.attlist}
-ldap-server.attlist &= id?
-ldap-server.attlist &= (url | port)?
-ldap-server.attlist &=
-    ## Username (DN) of the "manager" user identity which will be used to authenticate to a (non-embedded) LDAP server. If omitted, anonymous access will be used.
-    attribute manager-dn {xsd:string}?
-ldap-server.attlist &=
-    ## The password for the manager DN. This is required if the manager-dn is specified.
-    attribute manager-password {xsd:string}?
-ldap-server.attlist &=
-    ## Explicitly specifies an ldif file resource to load into an embedded LDAP server. The default is classpath*:*.ldiff
-    attribute ldif { xsd:string }?
-ldap-server.attlist &=
-    ## Optional root suffix for the embedded LDAP server. Default is "dc=springframework,dc=org"
-    attribute root { xsd:string }?
-
-ldap-server-ref-attribute =
-    ## The optional server to use. If omitted, and a default LDAP server is registered (using <ldap-server> with no Id), that server will be used.
-    attribute server-ref {xsd:token}
-
-
-group-search-filter-attribute =
-    ## Group search filter. Defaults to (uniqueMember={0}). The substituted parameter is the DN of the user.
-    attribute group-search-filter {xsd:token}
-group-search-base-attribute =
-    ## Search base for group membership searches. Defaults to "" (searching from the root).
-    attribute group-search-base {xsd:token}
-user-search-filter-attribute =
-    ## The LDAP filter used to search for users (optional). For example "(uid={0})". The substituted parameter is the user's login name.
-    attribute user-search-filter {xsd:token}
-user-search-base-attribute =
-    ## Search base for user searches. Defaults to "". Only used with a 'user-search-filter'.
-    attribute user-search-base {xsd:token}
-group-role-attribute-attribute =
-    ## The LDAP attribute name which contains the role name which will be used within Spring Security. Defaults to "cn".
-    attribute group-role-attribute {xsd:token}
-user-details-class-attribute =
-    ## Allows the objectClass of the user entry to be specified. If set, the framework will attempt to load standard attributes for the defined class into the returned UserDetails object
-    attribute user-details-class {"person" | "inetOrgPerson"}
-user-context-mapper-attribute =
-    ## Allows explicit customization of the loaded user object by specifying a UserDetailsContextMapper bean which will be called with the context information from the user's directory entry
-    attribute user-context-mapper-ref {xsd:token}
-
-
-ldap-user-service =
-    ## This element configures a LdapUserDetailsService which is a combination of a FilterBasedLdapUserSearch and a DefaultLdapAuthoritiesPopulator.
-    element ldap-user-service {ldap-us.attlist}
-ldap-us.attlist &= id?
-ldap-us.attlist &=
-    ldap-server-ref-attribute?
-ldap-us.attlist &=
-    user-search-filter-attribute?
-ldap-us.attlist &=
-    user-search-base-attribute?
-ldap-us.attlist &=
-    group-search-filter-attribute?
-ldap-us.attlist &=
-    group-search-base-attribute?
-ldap-us.attlist &=
-    group-role-attribute-attribute?
-ldap-us.attlist &=
-    cache-ref?
-ldap-us.attlist &=
-    role-prefix?
-ldap-us.attlist &=
-    (user-details-class-attribute | user-context-mapper-attribute)?
-
-ldap-authentication-provider =
-    ## Sets up an ldap authentication provider
-    element ldap-authentication-provider {ldap-ap.attlist, password-compare-element?}
-ldap-ap.attlist &=
-    ldap-server-ref-attribute?
-ldap-ap.attlist &=
-    user-search-base-attribute?
-ldap-ap.attlist &=
-    user-search-filter-attribute?
-ldap-ap.attlist &=
-    group-search-base-attribute?
-ldap-ap.attlist &=
-    group-search-filter-attribute?
-ldap-ap.attlist &=
-    group-role-attribute-attribute?
-ldap-ap.attlist &=
-    ## A specific pattern used to build the user's DN, for example "uid={0},ou=people". The key "{0}" must be present and will be substituted with the username.
-    attribute user-dn-pattern {xsd:token}?
-ldap-ap.attlist &=
-    role-prefix?
-ldap-ap.attlist &=
-    (user-details-class-attribute | user-context-mapper-attribute)?
-
-password-compare-element =
-    ## Specifies that an LDAP provider should use an LDAP compare operation of the user's password to authenticate the user
-    element password-compare {password-compare.attlist, password-encoder?}
-
-password-compare.attlist &=
-    ## The attribute in the directory which contains the user password. Defaults to "userPassword".
-    attribute password-attribute {xsd:token}?
-password-compare.attlist &=
-    hash?
-
-intercept-methods =
-    ## Can be used inside a bean definition to add a security interceptor to the bean and set up access configuration attributes for the bean's methods
-    element intercept-methods {intercept-methods.attlist, protect+}
-intercept-methods.attlist &=
-    ## Optional AccessDecisionManager bean ID to be used by the created method security interceptor.
-    attribute access-decision-manager-ref {xsd:token}?
-
-
-protect =
-    ## Defines a protected method and the access control configuration attributes that apply to it. We strongly advise you NOT to mix "protect" declarations with any services provided "global-method-security".
-    element protect {protect.attlist, empty}
-protect.attlist &=
-    ## A method name
-    attribute method {xsd:token}
-protect.attlist &=
-    ## Access configuration attributes list that applies to the method, e.g. "ROLE_A,ROLE_B".
-    attribute access {xsd:token}
-
-method-security-metadata-source =
-    ## Creates a MethodSecurityMetadataSource instance
-    element method-security-metadata-source {msmds.attlist, protect+}
-msmds.attlist &= id?
-
-msmds.attlist &= use-expressions?
-
-global-method-security =
-    ## Provides method security for all beans registered in the Spring application context. Specifically, beans will be scanned for matches with the ordered list of "protect-pointcut" sub-elements, Spring Security annotations and/or. Where there is a match, the beans will automatically be proxied and security authorization applied to the methods accordingly. If you use and enable all four sources of method security metadata (ie "protect-pointcut" declarations, expression annotations, @Secured and also JSR250 security annotations), the metadata sources will be queried in that order. In practical terms, this enables you to use XML to override method security metadata expressed in annotations. If using annotations, the order of precedence is EL-based (@PreAuthorize etc.), @Secured and finally JSR-250.
-    element global-method-security {global-method-security.attlist, (pre-post-annotation-handling | expression-handler)?, protect-pointcut*, after-invocation-provider*}
-global-method-security.attlist &=
-    ## Specifies whether the use of Spring Security's pre and post invocation annotations (@PreFilter, @PreAuthorize, @PostFilter, @PostAuthorize) should be enabled for this application context. Defaults to "disabled".
-    attribute pre-post-annotations {"disabled" | "enabled" }?
-global-method-security.attlist &=
-    ## Specifies whether the use of Spring Security's @Secured annotations should be enabled for this application context. Defaults to "disabled".
-    attribute secured-annotations {"disabled" | "enabled" }?
-global-method-security.attlist &=
-    ## Specifies whether JSR-250 style attributes are to be used (for example "RolesAllowed"). This will require the javax.annotation.security classes on the classpath. Defaults to "disabled".
-    attribute jsr250-annotations {"disabled" | "enabled" }?
-global-method-security.attlist &=
-    ## Optional AccessDecisionManager bean ID to override the default used for method security.
-    attribute access-decision-manager-ref {xsd:token}?
-global-method-security.attlist &=
-    ## Optional RunAsmanager implementation which will be used by the configured MethodSecurityInterceptor
-    attribute run-as-manager-ref {xsd:token}?
-global-method-security.attlist &=
-    ## Allows the advice "order" to be set for the method security interceptor.
-    attribute order {xsd:token}?
-global-method-security.attlist &=
-    ## If true, class based proxying will be used instead of interface based proxying.
-    attribute proxy-target-class {xsd:boolean}?
-global-method-security.attlist &=
-    ## Can be used to specify that AspectJ should be used instead of the default Spring AOP. If set, secured classes must be woven with the AnnotationSecurityAspect from the spring-security-aspects module.
-    attribute mode {"aspectj"}?
-global-method-security.attlist &=
-    ## An external MethodSecurityMetadataSource instance can be supplied which will take priority over other sources (such as the default annotations).
-    attribute metadata-source-ref {xsd:token}?
-global-method-security.attlist &=
-    authentication-manager-ref?
-
-
-after-invocation-provider =
-    ## Allows addition of extra AfterInvocationProvider beans which should be called by the MethodSecurityInterceptor created by global-method-security.
-    element after-invocation-provider {ref}
-
-pre-post-annotation-handling =
-    ## Allows the default expression-based mechanism for handling Spring Security's pre and post invocation annotations (@PreFilter, @PreAuthorize, @PostFilter, @PostAuthorize) to be replace entirely. Only applies if these annotations are enabled.
-    element pre-post-annotation-handling {invocation-attribute-factory, pre-invocation-advice, post-invocation-advice}
-
-invocation-attribute-factory =
-    ## Defines the PrePostInvocationAttributeFactory instance which is used to generate pre and post invocation metadata from the annotated methods.
-    element invocation-attribute-factory {ref}
-
-pre-invocation-advice =
-    ## Customizes the PreInvocationAuthorizationAdviceVoter with the ref as the PreInvocationAuthorizationAdviceVoter for the <pre-post-annotation-handling> element.
-    element pre-invocation-advice {ref}
-
-post-invocation-advice =
-    ## Customizes the PostInvocationAdviceProvider with the ref as the PostInvocationAuthorizationAdvice for the <pre-post-annotation-handling> element.
-    element post-invocation-advice {ref}
-
-
-expression-handler =
-    ## Defines the SecurityExpressionHandler instance which will be used if expression-based access-control is enabled. A default implementation (with no ACL support) will be used if not supplied.
-    element expression-handler {ref}
-
-protect-pointcut =
-    ## Defines a protected pointcut and the access control configuration attributes that apply to it. Every bean registered in the Spring application context that provides a method that matches the pointcut will receive security authorization.
-    element protect-pointcut {protect-pointcut.attlist, empty}
-protect-pointcut.attlist &=
-    ## An AspectJ expression, including the 'execution' keyword. For example, 'execution(int com.foo.TargetObject.countLength(String))' (without the quotes).
-    attribute expression {xsd:string}
-protect-pointcut.attlist &=
-    ## Access configuration attributes list that applies to all methods matching the pointcut, e.g. "ROLE_A,ROLE_B"
-    attribute access {xsd:token}
-
-messages =
-    ## Allows securing a Message Broker. There are two modes. If no id is specified: ensures that any SimpAnnotationMethodMessageHandler has the AuthenticationPrincipalArgumentResolver registered as a custom argument resolver; ensures that the SecurityContextChannelInterceptor is automatically registered for the clientInboundChannel; and that a ChannelSecurityInterceptor is registered with the clientInboundChannel. If the id is specified, creates a ChannelSecurityInterceptor that can be manually registered with the clientInboundChannel.
-    element messages { messages.attrlist, (message-interceptor*) }
-
-messages.attrlist &=
-    ## A bean identifier, used for referring to the bean elsewhere in the context. If specified, explicit configuration within clientInboundChannel is required. If not specified, ensures that any SimpAnnotationMethodMessageHandler has the AuthenticationPrincipalArgumentResolver registered as a custom argument resolver; ensures that the SecurityContextChannelInterceptor is automatically registered for the clientInboundChannel; and that a ChannelSecurityInterceptor is registered with the clientInboundChannel.
-    attribute id {xsd:token}?
-
-message-interceptor =
-    ## Creates an authorization rule for a message.
-    element message-interceptor {message-interceptor.attrlist}
-
-message-interceptor.attrlist &=
-    ## The destination ant pattern which will be mapped to the access attribute. For example, /** matches any message with a destination, /admin/** matches any message that has a destination that starts with admin.
-    attribute pattern {xsd:token}?
-message-interceptor.attrlist &=
-     ## The access configuration attributes that apply for the configured message. For example, permitAll grants access to anyone, hasRole('ROLE_ADMIN') requires the user have the role 'ROLE_ADMIN'.
-    attribute access {xsd:token}?
-
-http-firewall =
-    ## Allows a custom instance of HttpFirewall to be injected into the FilterChainProxy created by the namespace.
-    element http-firewall {ref}
-
-http =
-    ## Container element for HTTP security configuration. Multiple elements can now be defined, each with a specific pattern to which the enclosed security configuration applies. A pattern can also be configured to bypass Spring Security's filters completely by setting the "security" attribute to "none".
-    element http {http.attlist, (intercept-url* & access-denied-handler? & form-login? & openid-login? & x509? & jee? & http-basic? & logout? & session-management & remember-me? & anonymous? & port-mappings & custom-filter* & request-cache? & expression-handler? & headers? & csrf?) }
-http.attlist &=
-    ## The request URL pattern which will be mapped to the filter chain created by this <http> element. If omitted, the filter chain will match all requests.
-    attribute pattern {xsd:token}?
-http.attlist &=
-    ## When set to 'none', requests matching the pattern attribute will be ignored by Spring Security. No security filters will be applied and no SecurityContext will be available. If set, the <http> element must be empty, with no children.
-    attribute security {"none"}?
-http.attlist &=
-    ## Allows a RequestMatcher instance to be used, as an alternative to pattern-matching.
-    attribute request-matcher-ref { xsd:token }?
-http.attlist &=
-    ## A legacy attribute which automatically registers a login form, BASIC authentication and a logout URL and logout services. If unspecified, defaults to "false". We'd recommend you avoid using this and instead explicitly configure the services you require.
-    attribute auto-config {xsd:boolean}?
-http.attlist &=
-    use-expressions?
-http.attlist &=
-    ## Controls the eagerness with which an HTTP session is created by Spring Security classes. If not set, defaults to "ifRequired". If "stateless" is used, this implies that the application guarantees that it will not create a session. This differs from the use of "never" which mans that Spring Security will not create a session, but will make use of one if the application does.
-    attribute create-session {"ifRequired" | "always" | "never" | "stateless"}?
-http.attlist &=
-    ## A reference to a SecurityContextRepository bean. This can be used to customize how the SecurityContext is stored between requests.
-    attribute security-context-repository-ref {xsd:token}?
-http.attlist &=
-    request-matcher?
-http.attlist &=
-    ## Provides versions of HttpServletRequest security methods such as isUserInRole() and getPrincipal() which are implemented by accessing the Spring SecurityContext. Defaults to "true".
-    attribute servlet-api-provision {xsd:boolean}?
-http.attlist &=
-    ## If available, runs the request as the Subject acquired from the JaasAuthenticationToken. Defaults to "false".
-    attribute jaas-api-provision {xsd:boolean}?
-http.attlist &=
-    ## Optional attribute specifying the ID of the AccessDecisionManager implementation which should be used for authorizing HTTP requests.
-    attribute access-decision-manager-ref {xsd:token}?
-http.attlist &=
-    ## Optional attribute specifying the realm name that will be used for all authentication features that require a realm name (eg BASIC and Digest authentication). If unspecified, defaults to "Spring Security Application".
-    attribute realm {xsd:token}?
-http.attlist &=
-    ## Allows a customized AuthenticationEntryPoint to be set on the ExceptionTranslationFilter.
-    attribute entry-point-ref {xsd:token}?
-http.attlist &=
-    ## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "true"
-    attribute once-per-request {xsd:boolean}?
-http.attlist &=
-    ## Prevents the jsessionid parameter from being added to rendered URLs.
-    attribute disable-url-rewriting {xsd:boolean}?
-http.attlist &=
-    ## Exposes the list of filters defined by this configuration under this bean name in the application context.
-    name?
-http.attlist &=
-    authentication-manager-ref?
-
-access-denied-handler =
-    ## Defines the access-denied strategy that should be used. An access denied page can be defined or a reference to an AccessDeniedHandler instance.
-    element access-denied-handler {access-denied-handler.attlist, empty}
-access-denied-handler.attlist &= (ref | access-denied-handler-page)
-
-access-denied-handler-page =
-    ## The access denied page that an authenticated user will be redirected to if they request a page which they don't have the authority to access.
-    attribute error-page {xsd:token}
-
-intercept-url =
-    ## Specifies the access attributes and/or filter list for a particular set of URLs.
-    element intercept-url {intercept-url.attlist, empty}
-intercept-url.attlist &=
-    ## The pattern which defines the URL path. The content will depend on the type set in the containing http element, so will default to ant path syntax.
-    attribute pattern {xsd:token}
-intercept-url.attlist &=
-    ## The access configuration attributes that apply for the configured path.
-    attribute access {xsd:token}?
-intercept-url.attlist &=
-    ## The HTTP Method for which the access configuration attributes should apply. If not specified, the attributes will apply to any method.
-    attribute method {"GET" | "DELETE" | "HEAD" | "OPTIONS" | "POST" | "PUT" | "PATCH" | "TRACE"}?
-
-intercept-url.attlist &=
-    ## The filter list for the path. Currently can be set to "none" to remove a path from having any filters applied. The full filter stack (consisting of all filters created by the namespace configuration, and any added using 'custom-filter'), will be applied to any other paths.
-    attribute filters {"none"}?
-intercept-url.attlist &=
-    ## Used to specify that a URL must be accessed over http or https, or that there is no preference. The value should be "http", "https" or "any", respectively.
-    attribute requires-channel {xsd:token}?
-
-logout =
-    ## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
-    element logout {logout.attlist, empty}
-logout.attlist &=
-    ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
-    attribute logout-url {xsd:token}?
-logout.attlist &=
-    ## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
-    attribute logout-success-url {xsd:token}?
-logout.attlist &=
-    ## Specifies whether a logout also causes HttpSession invalidation, which is generally desirable. If unspecified, defaults to true.
-    attribute invalidate-session {xsd:boolean}?
-logout.attlist &=
-    ## A reference to a LogoutSuccessHandler implementation which will be used to determine the destination to which the user is taken after logging out.
-    attribute success-handler-ref {xsd:token}?
-logout.attlist &=
-    ## A comma-separated list of the names of cookies which should be deleted when the user logs out
-    attribute delete-cookies {xsd:token}?
-
-request-cache =
-    ## Allow the RequestCache used for saving requests during the login process to be set
-    element request-cache {ref}
-
-form-login =
-    ## Sets up a form login configuration for authentication with a username and password
-    element form-login {form-login.attlist, empty}
-form-login.attlist &=
-    ## The URL that the login form is posted to. If unspecified, it defaults to /login.
-    attribute login-processing-url {xsd:token}?
-form-login.attlist &=
-    ## The name of the request parameter which contains the username. Defaults to 'username'.
-    attribute username-parameter {xsd:token}?
-form-login.attlist &=
-    ## The name of the request parameter which contains the password. Defaults to 'password'.
-    attribute password-parameter {xsd:token}?
-form-login.attlist &=
-    ## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.
-    attribute default-target-url {xsd:token}?
-form-login.attlist &=
-    ## Whether the user should always be redirected to the default-target-url after login.
-    attribute always-use-default-target {xsd:boolean}?
-form-login.attlist &=
-    ## The URL for the login page. If no login URL is specified, Spring Security will automatically create a login URL at GET /login and a corresponding filter to render that login URL when requested.
-    attribute login-page {xsd:token}?
-form-login.attlist &=
-    ## The URL for the login failure page. If no login failure URL is specified, Spring Security will automatically create a failure login URL at /login?error and a corresponding filter to render that login failure URL when requested.
-    attribute authentication-failure-url {xsd:token}?
-form-login.attlist &=
-    ## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful authentication request. Should not be used in combination with default-target-url (or always-use-default-target-url) as the implementation should always deal with navigation to the subsequent destination
-    attribute authentication-success-handler-ref {xsd:token}?
-form-login.attlist &=
-    ## Reference to an AuthenticationFailureHandler bean which should be used to handle a failed authentication request. Should not be used in combination with authentication-failure-url as the implementation should always deal with navigation to the subsequent destination
-    attribute authentication-failure-handler-ref {xsd:token}?
-form-login.attlist &=
-    ## Reference to an AuthenticationDetailsSource which will be used by the authentication filter
-    attribute authentication-details-source-ref {xsd:token}?
-
-
-openid-login =
-    ## Sets up form login for authentication with an Open ID identity
-    element openid-login {form-login.attlist, user-service-ref?, attribute-exchange*}
-
-attribute-exchange =
-    ## Sets up an attribute exchange configuration to request specified attributes from the OpenID identity provider. When multiple elements are used, each must have an identifier-attribute attribute. Each configuration will be matched in turn against the supplied login identifier until a match is found.
-    element attribute-exchange {attribute-exchange.attlist, openid-attribute+}
-
-attribute-exchange.attlist &=
-    ## A regular expression which will be compared against the claimed identity, when deciding which attribute-exchange configuration to use during authentication.
-    attribute identifier-match {xsd:token}?
-
-openid-attribute =
-    ## Attributes used when making an OpenID AX Fetch Request
-    element openid-attribute {openid-attribute.attlist}
-
-openid-attribute.attlist &=
-    ## Specifies the name of the attribute that you wish to get back. For example, email.
-    attribute name {xsd:token}
-openid-attribute.attlist &=
-    ## Specifies the attribute type. For example, http://axschema.org/contact/email. See your OP's documentation for valid attribute types.
-    attribute type {xsd:token}
-openid-attribute.attlist &=
-    ## Specifies if this attribute is required to the OP, but does not error out if the OP does not return the attribute. Default is false.
-    attribute required {xsd:boolean}?
-openid-attribute.attlist &=
-    ## Specifies the number of attributes that you wish to get back. For example, return 3 emails. The default value is 1.
-    attribute count {xsd:int}?
-
-
-filter-chain-map =
-    ## Used to explicitly configure a FilterChainProxy instance with a FilterChainMap
-    element filter-chain-map {filter-chain-map.attlist, filter-chain+}
-filter-chain-map.attlist &=
-    request-matcher?
-
-filter-chain =
-    ## Used within to define a specific URL pattern and the list of filters which apply to the URLs matching that pattern. When multiple filter-chain elements are assembled in a list in order to configure a FilterChainProxy, the most specific patterns must be placed at the top of the list, with  most general ones at the bottom.
-    element filter-chain {filter-chain.attlist, empty}
-filter-chain.attlist &=
-    (pattern | request-matcher-ref)
-filter-chain.attlist &=
-    ## A comma separated list of bean names that implement Filter that should be processed for this FilterChain. If the value is none, then no Filters will be used for this FilterChain.
-    attribute filters {xsd:token}
-
-pattern =
-    ## The request URL pattern which will be mapped to the FilterChain.
-    attribute pattern {xsd:token}
-request-matcher-ref =
-    ## Allows a RequestMatcher instance to be used, as an alternative to pattern-matching.
-    attribute request-matcher-ref {xsd:token}
-
-filter-security-metadata-source =
-    ## Used to explicitly configure a FilterSecurityMetadataSource bean for use with a FilterSecurityInterceptor. Usually only needed if you are configuring a FilterChainProxy explicitly, rather than using the <http> element. The intercept-url elements used should only contain pattern, method and access attributes. Any others will result in a configuration error.
-    element filter-security-metadata-source {fsmds.attlist, intercept-url+}
-fsmds.attlist &=
-    use-expressions?
-fsmds.attlist &=
-    id?
-fsmds.attlist &=
-    ## Compare after forcing to lowercase
-    attribute lowercase-comparisons {xsd:boolean}?
-fsmds.attlist &=
-    request-matcher?
-
-http-basic =
-    ## Adds support for basic authentication
-    element http-basic {http-basic.attlist, empty}
-
-http-basic.attlist &=
-    ## Sets the AuthenticationEntryPoint which is used by the BasicAuthenticationFilter.
-    attribute entry-point-ref {xsd:token}?
-http-basic.attlist &=
-    ## Reference to an AuthenticationDetailsSource which will be used by the authentication filter
-    attribute authentication-details-source-ref {xsd:token}?
-
-session-management =
-    ## Session-management related functionality is implemented by the addition of a SessionManagementFilter to the filter stack.
-    element session-management {session-management.attlist, concurrency-control?}
-
-session-management.attlist &=
-    ## Indicates how session fixation protection will be applied when a user authenticates. If set to "none", no protection will be applied. "newSession" will create a new empty session, with only Spring Security-related attributes migrated. "migrateSession" will create a new session and copy all session attributes to the new session. In Servlet 3.1 (Java EE 7) and newer containers, specifying "changeSessionId" will keep the existing session and use the container-supplied session fixation protection (HttpServletRequest#changeSessionId()). Defaults to "changeSessionId" in Servlet 3.1 and newer containers, "migrateSession" in older containers. Throws an exception if "changeSessionId" is used in older containers.
-    attribute session-fixation-protection {"none" | "newSession" | "migrateSession" | "changeSessionId" }?
-session-management.attlist &=
-    ## The URL to which a user will be redirected if they submit an invalid session indentifier. Typically used to detect session timeouts.
-    attribute invalid-session-url {xsd:token}?
-session-management.attlist &=
-    ## Allows injection of the SessionAuthenticationStrategy instance used by the SessionManagementFilter
-    attribute session-authentication-strategy-ref {xsd:token}?
-session-management.attlist &=
-    ## Defines the URL of the error page which should be shown when the SessionAuthenticationStrategy raises an exception. If not set, an unauthorized (401) error code will be returned to the client. Note that this attribute doesn't apply if the error occurs during a form-based login, where the URL for authentication failure will take precedence.
-    attribute session-authentication-error-url {xsd:token}?
-
-
-concurrency-control =
-    ## Enables concurrent session control, limiting the number of authenticated sessions a user may have at the same time.
-    element concurrency-control {concurrency-control.attlist, empty}
-
-concurrency-control.attlist &=
-    ## The maximum number of sessions a single authenticated user can have open at the same time. Defaults to "1".
-    attribute max-sessions {xsd:positiveInteger}?
-concurrency-control.attlist &=
-    ## The URL a user will be redirected to if they attempt to use a session which has been "expired" because they have logged in again.
-    attribute expired-url {xsd:token}?
-concurrency-control.attlist &=
-    ## Specifies that an unauthorized error should be reported when a user attempts to login when they already have the maximum configured sessions open. The default behaviour is to expire the original session. If the session-authentication-error-url attribute is set on the session-management URL, the user will be redirected to this URL.
-    attribute error-if-maximum-exceeded {xsd:boolean}?
-concurrency-control.attlist &=
-    ## Allows you to define an alias for the SessionRegistry bean in order to access it in your own configuration.
-    attribute session-registry-alias {xsd:token}?
-concurrency-control.attlist &=
-    ## Allows you to define an external SessionRegistry bean to be used by the concurrency control setup.
-    attribute session-registry-ref {xsd:token}?
-
-
-remember-me =
-    ## Sets up remember-me authentication. If used with the "key" attribute (or no attributes) the cookie-only implementation will be used. Specifying "token-repository-ref" or "remember-me-data-source-ref" will use the more secure, persisten token approach.
-    element remember-me {remember-me.attlist}
-remember-me.attlist &=
-    ## The "key" used to identify cookies from a specific token-based remember-me application. You should set this to a unique value for your application. If unset, it will default to a random value generated by SecureRandom.
-    attribute key {xsd:token}?
-
-remember-me.attlist &=
-    (token-repository-ref | remember-me-data-source-ref | remember-me-services-ref)
-
-remember-me.attlist &=
-    user-service-ref?
-
-remember-me.attlist &=
-    ## Exports the internally defined RememberMeServices as a bean alias, allowing it to be used by other beans in the application context.
-    attribute services-alias {xsd:token}?
-
-remember-me.attlist &=
-    ## Determines whether the "secure" flag will be set on the remember-me cookie. If set to true, the cookie will only be submitted over HTTPS (recommended). By default, secure cookies will be used if the request is made on a secure connection.
-    attribute use-secure-cookie {xsd:boolean}?
-
-remember-me.attlist &=
-    ## The period (in seconds) for which the remember-me cookie should be valid.
-    attribute token-validity-seconds {xsd:string}?
-
-remember-me.attlist &=
-    ## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful remember-me authentication.
-    attribute authentication-success-handler-ref {xsd:token}?
-remember-me.attlist &=
-    ## The name of the request parameter which toggles remember-me authentication. Defaults to '_spring_security_remember_me'.
-    attribute remember-me-parameter {xsd:token}?
-
-token-repository-ref =
-    ## Reference to a PersistentTokenRepository bean for use with the persistent token remember-me implementation.
-    attribute token-repository-ref {xsd:token}
-remember-me-services-ref =
-    ## Allows a custom implementation of RememberMeServices to be used. Note that this implementation should return RememberMeAuthenticationToken instances with the same "key" value as specified in the remember-me element. Alternatively it should register its own AuthenticationProvider. It should also implement the LogoutHandler interface, which will be invoked when a user logs out. Typically the remember-me cookie would be removed on logout.
-    attribute services-ref {xsd:token}?
-remember-me-data-source-ref =
-    ## DataSource bean for the database that contains the token repository schema.
-    data-source-ref
-
-anonymous =
-    ## Adds support for automatically granting all anonymous web requests a particular principal identity and a corresponding granted authority.
-    element anonymous {anonymous.attlist}
-anonymous.attlist &=
-    ## The key shared between the provider and filter. This generally does not need to be set. If unset, it will default to a random value generated by SecureRandom.
-    attribute key {xsd:token}?
-anonymous.attlist &=
-    ## The username that should be assigned to the anonymous request. This allows the principal to be identified, which may be important for logging and auditing. if unset, defaults to "anonymousUser".
-    attribute username {xsd:token}?
-anonymous.attlist &=
-    ## The granted authority that should be assigned to the anonymous request. Commonly this is used to assign the anonymous request particular roles, which can subsequently be used in authorization decisions. If unset, defaults to "ROLE_ANONYMOUS".
-    attribute granted-authority {xsd:token}?
-anonymous.attlist &=
-    ## With the default namespace setup, the anonymous "authentication" facility is automatically enabled. You can disable it using this property.
-    attribute enabled {xsd:boolean}?
-
-
-port-mappings =
-    ## Defines the list of mappings between http and https ports for use in redirects
-    element port-mappings {port-mappings.attlist, port-mapping+}
-
-port-mappings.attlist &= empty
-
-port-mapping =
-    ## Provides a method to map http ports to https ports when forcing a redirect.
-    element port-mapping {http-port, https-port}
-
-http-port =
-    ## The http port to use.
-    attribute http {xsd:token}
-
-https-port =
-    ## The https port to use.
-    attribute https {xsd:token}
-
-
-x509 =
-    ## Adds support for X.509 client authentication.
-    element x509 {x509.attlist}
-x509.attlist &=
-    ## The regular expression used to obtain the username from the certificate's subject. Defaults to matching on the common name using the pattern "CN=(.*?),".
-    attribute subject-principal-regex {xsd:token}?
-x509.attlist &=
-    ## Explicitly specifies which user-service should be used to load user data for X.509 authenticated clients. If ommitted, the default user-service will be used.
-    user-service-ref?
-x509.attlist &=
-    ## Reference to an AuthenticationDetailsSource which will be used by the authentication filter
-    attribute authentication-details-source-ref {xsd:token}?
-
-jee =
-    ## Adds a J2eePreAuthenticatedProcessingFilter to the filter chain to provide integration with container authentication.
-    element jee {jee.attlist}
-jee.attlist &=
-    ## A comma-separate list of roles to look for in the incoming HttpServletRequest.
-    attribute mappable-roles {xsd:token}
-jee.attlist &=
-    ## Explicitly specifies which user-service should be used to load user data for container authenticated clients. If ommitted, the set of mappable-roles will be used to construct the authorities for the user.
-    user-service-ref?
-
-authentication-manager =
-    ## Registers the AuthenticationManager instance and allows its list of AuthenticationProviders to be defined. Also allows you to define an alias to allow you to reference the AuthenticationManager in your own beans.
-    element authentication-manager {authman.attlist & authentication-provider* & ldap-authentication-provider*}
-authman.attlist &=
-    id?
-authman.attlist &=
-    ## An alias you wish to use for the AuthenticationManager bean (not required it you are using a specific id)
-    attribute alias {xsd:token}?
-authman.attlist &=
-    ## If set to true, the AuthenticationManger will attempt to clear any credentials data in the returned Authentication object, once the user has been authenticated.
-    attribute erase-credentials {xsd:boolean}?
-
-authentication-provider =
-    ## Indicates that the contained user-service should be used as an authentication source.
-    element authentication-provider {ap.attlist & any-user-service & password-encoder?}
-ap.attlist &=
-    ## Specifies a reference to a separately configured AuthenticationProvider instance which should be registered within the AuthenticationManager.
-    ref?
-ap.attlist &=
-    ## Specifies a reference to a separately configured UserDetailsService from which to obtain authentication data.
-    user-service-ref?
-
-user-service =
-    ## Creates an in-memory UserDetailsService from a properties file or a list of "user" child elements. Usernames are converted to lower-case internally to allow for case-insensitive lookups, so this should not be used if case-sensitivity is required.
-    element user-service {id? & (properties-file | (user*))}
-properties-file =
-    ## The location of a Properties file where each line is in the format of username=password,grantedAuthority[,grantedAuthority][,enabled|disabled]
-    attribute properties {xsd:token}?
-
-user =
-    ## Represents a user in the application.
-    element user {user.attlist, empty}
-user.attlist &=
-    ## The username assigned to the user.
-    attribute name {xsd:token}
-user.attlist &=
-    ## The password assigned to the user. This may be hashed if the corresponding authentication provider supports hashing (remember to set the "hash" attribute of the "user-service" element). This attribute be omitted in the case where the data will not be used for authentication, but only for accessing authorities. If omitted, the namespace will generate a random value, preventing its accidental use for authentication. Cannot be empty.
-    attribute password {xsd:string}?
-user.attlist &=
-    ## One of more authorities granted to the user. Separate authorities with a comma (but no space). For example, "ROLE_USER,ROLE_ADMINISTRATOR"
-    attribute authorities {xsd:token}
-user.attlist &=
-    ## Can be set to "true" to mark an account as locked and unusable.
-    attribute locked {xsd:boolean}?
-user.attlist &=
-     ## Can be set to "true" to mark an account as disabled and unusable.
-    attribute disabled {xsd:boolean}?
-
-jdbc-user-service =
-    ## Causes creation of a JDBC-based UserDetailsService.
-    element jdbc-user-service {id? & jdbc-user-service.attlist}
-jdbc-user-service.attlist &=
-    ## The bean ID of the DataSource which provides the required tables.
-    attribute data-source-ref {xsd:token}
-jdbc-user-service.attlist &=
-    cache-ref?
-jdbc-user-service.attlist &=
-    ## An SQL statement to query a username, password, and enabled status given a username. Default is "select username,password,enabled from users where username = ?"
-    attribute users-by-username-query {xsd:token}?
-jdbc-user-service.attlist &=
-    ## An SQL statement to query for a user's granted authorities given a username. The default is "select username, authority from authorities where username = ?"
-    attribute authorities-by-username-query {xsd:token}?
-jdbc-user-service.attlist &=
-    ## An SQL statement to query user's group authorities given a username. The default is "select g.id, g.group_name, ga.authority from groups g, group_members gm, group_authorities ga where gm.username = ? and g.id = ga.group_id and g.id = gm.group_id"
-    attribute group-authorities-by-username-query {xsd:token}?
-jdbc-user-service.attlist &=
-    role-prefix?
-
-csrf =
- ## Element for configuration of the CsrfFilter for protection against CSRF. It also updates the default RequestCache to only replay "GET" requests.
-    element csrf {csrf-options.attlist}
-csrf-options.attlist &=
-    ## Specifies if csrf protection should be disabled. Default false (i.e. CSRF protection is enabled).
-    attribute disabled {xsd:boolean}?
-csrf-options.attlist &=
-    ## The RequestMatcher instance to be used to determine if CSRF should be applied. Default is any HTTP method except "GET", "TRACE", "HEAD", "OPTIONS"
-    attribute request-matcher-ref { xsd:token }?
-csrf-options.attlist &=
-    ## The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository
-    attribute token-repository-ref { xsd:token }?
-
-headers =
- ## Element for configuration of the HeaderWritersFilter. Enables easy setting for the X-Frame-Options, X-XSS-Protection and X-Content-Type-Options headers.
- element headers { headers-options.attlist, (cache-control? & xss-protection? & hsts? & frame-options? & content-type-options? & header*)}
-headers-options.attlist &=
-    ## Specifies if headers should be disabled. Default false.
-    attribute disabled {xsd:boolean}?
-hsts =
-    ## Adds support for HTTP Strict Transport Security (HSTS)
-    element hsts {hsts-options.attlist}
-hsts-options.attlist &=
-    ## Specifies if subdomains should be included. Default true.
-    attribute include-subdomains {xsd:boolean}?
-hsts-options.attlist &=
-    ## Specifies the maximum ammount of time the host should be considered a Known HSTS Host. Default one year.
-    attribute max-age-seconds {xsd:integer}?
-hsts-options.attlist &=
-    ## The RequestMatcher instance to be used to determine if the header should be set. Default is if HttpServletRequest.isSecure() is true.
-    attribute request-matcher-ref { xsd:token }?
-
-cache-control =
-    ## Adds Cache-Control no-cache, no-store, must-revalidate, Pragma no-cache, and Expires 0 for every request
-    element cache-control {empty}
-
-frame-options =
-    ## Enable basic clickjacking support for newer browsers (IE8+), will set the X-Frame-Options header.
-    element frame-options {frame-options.attlist,empty}
-frame-options.attlist &=
-    ## Specify the policy to use for the X-Frame-Options-Header.
-    attribute policy {"DENY","SAMEORIGIN","ALLOW-FROM"}?
-frame-options.attlist &=
-    ## Specify the strategy to use when ALLOW-FROM is chosen.
-    attribute strategy {"static","whitelist","regexp"}?
-frame-options.attlist &=
-    ## Specify the a reference to the custom AllowFromStrategy to use when ALLOW-FROM is chosen.
-    ref?
-frame-options.attlist &=
-    ## Specify the a value to use for the chosen strategy.
-    attribute value {xsd:string}?
-frame-options.attlist &=
-    ## Specify the request parameter to use for the origin when using a 'whitelist' or 'regexp' based strategy. Default is 'from'.
-    attribute from-parameter {xsd:string}?
-
-
-xss-protection =
-    ## Enable basic XSS browser protection, supported by newer browsers (IE8+), will set the X-XSS-Protection header.
-    element xss-protection {xss-protection.attlist,empty}
-xss-protection.attlist &=
-    ## enable or disable the X-XSS-Protection header. Default is 'true' meaning it is enabled.
-    attribute enabled {xsd:boolean}?
-xss-protection.attlist &=
-    ## Add mode=block to the header or not, default is on.
-    attribute block {xsd:boolean}?
-
-content-type-options =
-    ## Add a X-Content-Type-Options header to the resopnse. Value is always 'nosniff'.
-    element content-type-options {empty}
-
-header=
-    ## Add additional headers to the response.
-    element header {header.attlist}
-header.attlist &=
-    ## The name of the header to add.
-    attribute name {xsd:token}?
-header.attlist &=
-    ## The value for the header.
-    attribute value {xsd:token}?
-header.attlist &=
-    ## Reference to a custom HeaderWriter implementation.
-    ref?
-
-any-user-service = user-service | jdbc-user-service | ldap-user-service
-
-custom-filter =
-    ## Used to indicate that a filter bean declaration should be incorporated into the security filter chain.
-    element custom-filter {custom-filter.attlist}
-
-custom-filter.attlist &=
-    ref
-
-custom-filter.attlist &=
-    (after | before | position)
-
-after =
-    ## The filter immediately after which the custom-filter should be placed in the chain. This feature will only be needed by advanced users who wish to mix their own filters into the security filter chain and have some knowledge of the standard Spring Security filters. The filter names map to specific Spring Security implementation filters.
-    attribute after {named-security-filter}
-before =
-    ## The filter immediately before which the custom-filter should be placed in the chain
-    attribute before {named-security-filter}
-position =
-    ## The explicit position at which the custom-filter should be placed in the chain. Use if you are replacing a standard filter.
-    attribute position {named-security-filter}
-
-named-security-filter = "FIRST" | "CHANNEL_FILTER" | "SECURITY_CONTEXT_FILTER" | "CONCURRENT_SESSION_FILTER" | "WEB_ASYNC_MANAGER_FILTER" | "HEADERS_FILTER" | "CSRF_FILTER" | "LOGOUT_FILTER" | "X509_FILTER" | "PRE_AUTH_FILTER" | "CAS_FILTER" | "FORM_LOGIN_FILTER" | "OPENID_FILTER" | "LOGIN_PAGE_FILTER" | "DIGEST_AUTH_FILTER" | "BASIC_AUTH_FILTER" | "REQUEST_CACHE_FILTER" | "SERVLET_API_SUPPORT_FILTER" | "JAAS_API_SUPPORT_FILTER" | "REMEMBER_ME_FILTER" | "ANONYMOUS_FILTER" | "SESSION_MANAGEMENT_FILTER" | "EXCEPTION_TRANSLATION_FILTER" | "FILTER_SECURITY_INTERCEPTOR" | "SWITCH_USER_FILTER" | "LAST"