<Connector port="8443" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8441" />

<http auto-config="true" use-expressions="true">
    <intercept-url pattern="/index.xhtml" access="permitAll" />

    <intercept-url pattern="/401.jsp" access="permitAll" />
    <intercept-url pattern="/dataentry/**" access="isAuthenticated()" />
    <intercept-url pattern="/reports/**" access="isAuthenticated()" />
    <intercept-url pattern="/admin/**" access="isAuthenticated()" />

    <form-login login-page="/index.xhtml" default-target-url="/admin/admin_dashboard.xhtml"
        authentication-failure-url="/index.xhtml?failed=1" />

    <logout logout-success-url="/index.xhtml?logout"
        invalidate-session="true" delete-cookies="JSESSIONID" />

</http>