<?xml version="1.0" encoding="UTF-8"?>
<web-app version="3.1" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd">
    <context-param>
        <param-name>javax.faces.PROJECT_STAGE</param-name>
        <param-value>Development</param-value>
    </context-param>
    <servlet>
        <servlet-name>Faces Servlet</servlet-name>
        <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>Faces Servlet</servlet-name>
        <url-pattern>/faces/*</url-pattern>
    </servlet-mapping>
    <session-config>
        <session-timeout>
            30
        </session-timeout>
    </session-config>
    <welcome-file-list>
        <welcome-file>faces/index.xhtml</welcome-file>
    </welcome-file-list>


    <!--MANUAL INPUT BY TW-->

    <context-param>
        <param-name>javax.faces.WEBAPP_RESOURCES_DIRECTORY</param-name>
        <param-value>/WEB-INF/resources</param-value>
    </context-param>


    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            /WEB-INF/applicationContext.xml
            /WEB-INF/spring-security.xml
        </param-value>
    </context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <filter>
        <filter-name>springSecurityFilterChain</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <!--<filter-mapping>-->
        <!--<filter-name>springSecurityFilterChain</filter-name>-->
        <!--<url-pattern>/*</url-pattern>-->
    <!--</filter-mapping>-->

    <listener>
        <listener-class> org.springframework.security.web.session.HttpSessionEventPublisher </listener-class>
    </listener>

    <listener>
        <listener-class> com.auth.SessionListener </listener-class>
    </listener>


</web-app>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
       http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
       http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd">

    <bean id="KSAuthenticationProvider" class="com.auth.KSAuthenticationProvider"/>

</beans>

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security.xsd">



    <authentication-manager>
        <authentication-provider ref='KSAuthenticationProvider' />
    </authentication-manager>


    <http auto-config="true" use-expressions="false">
        <access-denied-handler error-page="/faces/index.xhtml" />
        <intercept-url pattern="/index.xhtml*" access="ROLE_ANONYMOUS"/>
        <intercept-url pattern="/faces/index.xhtml*" access="ROLE_ANONYMOUS"/>
        <intercept-url pattern="/protected/**" access="ROLE_USER" />
        <intercept-url pattern="/faces/protected/**" access="ROLE_USER" />
        <intercept-url pattern="/vod/**" access="ROLE_USER" />
        <intercept-url pattern="/faces/vod/**" access="ROLE_USER" />
        <session-management>
            <concurrency-control max-sessions="1" />
        </session-management>
        <session-management invalid-session-url="/faces/index.xhtml" />

        <logout logout-success-url="/afterlogout.html" />

    </http>


</beans:beans>

package com.auth;

import com.utils.Logger;
import java.util.List;
import javax.faces.bean.ManagedProperty;
import org.springframework.security.authentication.AuthenticationProvider;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;


public class KSAuthenticationProvider implements AuthenticationProvider {

    private Logger logger = new Logger();

    @ManagedProperty(value = "#{sessionService}")
    private SessionService sessionService;

    public SessionService getSessionService() {
        return sessionService;
    }

    public void setSessionService(SessionService sessionService) {
        this.sessionService = sessionService;
    }

    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        UsernamePasswordAuthenticationToken auth = (UsernamePasswordAuthenticationToken) authentication;
        String userName = String.valueOf(auth.getPrincipal());
        String password = String.valueOf(auth.getCredentials());

        // blended out some internal login stuff
        String rolesString = "ROLE_USER";

        List<GrantedAuthority> roles = AuthorityUtils.commaSeparatedStringToAuthorityList(rolesString);
        return new UsernamePasswordAuthenticationToken(userName, null, roles);
    }

    @Override
    public boolean supports(Class<?> authentication) {
        return true;  //To indicate that this authenticationprovider can handle the auth request. since there's currently only one way of logging in, always return true
    }

}

<!--PRIMEFACES-->
    <dependency>
        <groupId>org.primefaces</groupId>
        <artifactId>primefaces</artifactId>
        <version>6.0</version>
    </dependency>
    <dependency>
        <groupId>org.primefaces.extensions</groupId>
        <artifactId>all-themes</artifactId>
        <version>1.0.8</version>
        <scope>compile</scope>
    </dependency>


    <!--Spring Security-->
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-web</artifactId>
        <version>4.1.1.RELEASE</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-config</artifactId>
        <version>4.1.1.RELEASE</version>
    </dependency>
    <dependency>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
        <version>1.2</version>
    </dependency>