<beans:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-4.0.xsd">
		
	<!-- enable use-expressions -->
	<http auto-config="true" use-expressions="true">
		<intercept-url pattern="/myproducts*" access="hasAnyRole('admin','user')" />
		<intercept-url pattern="/products/create*" access="hasAnyRole('admin')" />
		<intercept-url pattern="/products/*" access="hasAnyRole('admin','user')" />
		<intercept-url pattern="/products/*/*" access="hasAnyRole('admin','user')" />
		
		<!-- access denied page -->
		<access-denied-handler error-page="/403" />
		<form-login 
		    login-page="/login" 
		    default-target-url="/products" 
			authentication-failure-url="/login" 
			username-parameter="login"
			password-parameter="password" />
		<logout logout-success-url="/products"  />
		
	</http>
	
	<!-- Select users and user_roles from database -->
	<authentication-manager>
		<authentication-provider>
			<jdbc-user-service data-source-ref="dataSource"
				users-by-username-query=
					"select u.login,u.password  from zzz.users u where u.login=? "
				authorities-by-username-query=
					"select u.login,u.password, u.role from zzz.users u where login =? and u.password=? " />
		</authentication-provider>
	</authentication-manager>

</beans:beans>

  <dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-web</artifactId>
			<version>4.0.0.RELEASE</version>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-config</artifactId>
			<version>4.0.0.RELEASE</version>
		</dependency>
		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-core</artifactId>
			<version>4.0.0.RELEASE</version>
		</dependency>

<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>