<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
 http://www.springframework.org/schema/beans/spring-beans-4.2.xsd
 http://www.springframework.org/schema/security
 http://www.springframework.org/schema/security/spring-security-4.1.xsd">

    <!-- enable use-expressions -->
    <http use-expressions="true">
        <csrf disabled="true"/>

        <intercept-url pattern="/" access="isAnonymous()" />
        <intercept-url pattern="/welcome" access="isAnonymous()" />
        <intercept-url pattern="/login" access="isAnonymous()" />
        <intercept-url pattern="/logout" access="isAnonymous()" />


        <intercept-url pattern="/userInfo"
                       access="hasAnyRole('ROLE_USER', 'ROLE_ADMIN')" />
        <intercept-url pattern="/admin" access="hasRole('ROLE_ADMIN')" />
        <intercept-url pattern="/other/**" access="isAuthenticated()" />

        <access-denied-handler error-page="/403" />

        <form-login login-page='/login' login-processing-url="/j_spring_security_check"
                    default-target-url="/userInfo" always-use-default-target="false"
                    authentication-failure-url="/login?error=true" username-parameter="email"
                    password-parameter="password" />

        <logout logout-url="/logout" logout-success-url="/logoutSuccessful"
                delete-cookies="JSESSIONID" invalidate-session="true" />

    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <user name="a@a" password="12345" authorities="ROLE_USER" />
                <user name="admin1" password="12345" authorities="ROLE_USER, ROLE_ADMIN" />
            </user-service>
        </authentication-provider>



        <!-- authentication from database -->
        <authentication-provider>
            <jdbc-user-service data-source-ref="myDataSource"
                               users-by-username-query="select email,password, enabled from users where username=?"
                               authorities-by-username-query="Select email, concat('ROLE_',user_role) user_role from user_roles where username=?" />
        </authentication-provider>

    </authentication-manager>

</beans:beans>