<http auto-config="true" disable-url-rewriting="true">
    <intercept-url pattern="/test/*" access="ROLE_USER, ROLE_ADMIN"  />
    <intercept-url pattern="/admin" access="ROLE_ADMIN"  />
    <intercept-url pattern="/list*" access="ROLE_USER, ROLE_ADMIN" />
    <form-login login-page="/login"
            default-target-url="/home"
            authentication-failure-url="/loginfailed" />
    <logout invalidate-session="true" logout-success-url="/logout" />
    <session-management invalid-session-url="/login">
        <concurrency-control max-sessions="1" error-if-maximum-exceeded="true"/>
    </session-management>
</http>

<authentication-manager>
    <authentication-provider>
        <user-service>
            <user name="test" password="test" authorities="ROLE_USER" />
            <user name="admin" password="admin" authorities="ROLE_ADMIN" />
        </user-service>
    </authentication-provider>
</authentication-manager>

<authentication-manager>
    <authentication-provider ref="ldapActiveDirectoryAuthProvider"/>
</authentication-manager>