<filter>
        <filter-name>encoding-filter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>encoding-filter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans" 
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
	http://www.springframework.org/schema/beans/spring-beans-4.1.xsd
	http://www.springframework.org/schema/security
	http://www.springframework.org/schema/security/spring-security-4.2.xsd">

    <global-method-security pre-post-annotations="enabled"/>
    
    <beans:bean name="customAccessDeniedHandler"
                class="ru.npt.cim.browser.controller.CustomAccessDeniedHandler" />
    
    <beans:bean id="ajaxRequestMatcher"
                class="org.springframework.security.web.util.matcher.AntPathRequestMatcher">
        <beans:constructor-arg value="/rest/**"/>
    </beans:bean>
    
    <beans:bean id="ajaxAuthenticationEntryPoint"
                class="ru.npt.cim.browser.controller.Http403ForbiddenEntryPoint"
                autowire="constructor"/>
    
    <beans:bean id="loginUrlAuthenticationEntryPoint"
                class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
        <beans:constructor-arg value="/login" />
    </beans:bean>
    
    <beans:bean id="authenticationEntryPoint"
                class="org.springframework.security.web.authentication.DelegatingAuthenticationEntryPoint">
        <beans:constructor-arg>
            <beans:map>
                <beans:entry key-ref="ajaxRequestMatcher" value-ref="ajaxAuthenticationEntryPoint" />
            </beans:map>
        </beans:constructor-arg>
        <beans:property name="defaultEntryPoint" ref="loginUrlAuthenticationEntryPoint" />
    </beans:bean>
    
    <http auto-config="true" entry-point-ref="authenticationEntryPoint">
        <access-denied-handler ref="customAccessDeniedHandler"/>
        <intercept-url pattern="/login" access="permitAll" />
        <intercept-url pattern="/favicon.ico" access="permitAll" />
        <intercept-url pattern="/resources/**" access="permitAll" />
        <intercept-url pattern="/rest/login" access="permitAll" />
        <intercept-url pattern="/**" access="isAuthenticated()" />
        <form-login 
            login-page="/login" 
            default-target-url="/" 
            authentication-failure-url="/login?error" 
            username-parameter="username"
            password-parameter="password" />
        <logout success-handler-ref="customLogoutSuccessHandler" />
        <csrf disabled="true"/>
        <headers>
            <frame-options disabled="true"></frame-options>
        </headers>
    </http>

    <authentication-manager alias="authenticationManager">
        <authentication-provider ref="kerberosAuthenticationProvider">
        </authentication-provider>
    </authentication-manager> 
    
    <beans:bean id="kerberosAuthenticationProvider" class="ru.npt.cim.browser.services.KerberosAuthenticationProvider" />
    <beans:bean id="customLogoutSuccessHandler" class="ru.npt.cim.browser.services.CustomLogoutSuccessHandler" />

</beans:beans>