<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://java.sun.com/xml/ns/javaee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
	version="2.5">
	
	<!-- Spring in Practice informational metadata -->
	<context-param>
		<param-name>recipe</param-name>
		<param-value>7.5</param-value>
	</context-param>
	<context-param>
		<param-name>appName</param-name>
		<param-value>SiP University</param-value>
	</context-param>
	<context-param>
		<param-name>aboutThisRecipe</param-name>
		<param-value><![CDATA[
<p>Recipe 7.5 shows how to display JSP fragments selectively based on ACLs.</p>
<p>You can use any of the following usernames to log in. The password in each case is <code>p@ssword</code>.</p>
<ul>
<li><code>juan</code> (user, admin)</li>
<li><code>elvira</code> (user, faculty member, student)</li>
<li><code>julia</code> (user, faculty member)</li>
<li><code>daniel</code> (user, student)</li>
<li><code>paula</code> (user)</li>
</ul>
		]]></param-value>
	</context-param>
	
	<!-- Configuration -->
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>
			classpath:/spring/beans-service.xml
			classpath:/spring/beans-security.xml
			classpath:/spring/beans-security-special.xml
			classpath:/spring/beans-security-acl.xml
		</param-value>
	</context-param>
    
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>
	
	<filter>
		<filter-name>sitemesh</filter-name>
		<filter-class>com.opensymphony.sitemesh.webapp.SiteMeshFilter</filter-class>
	</filter>
	<filter>
		<filter-name>httpMethodFilter</filter-name>
		<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
	</filter>
	<filter>
		<filter-name>springSecurityFilterChain</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	
	<!-- Allows us to show the username in the page template. This establishes the SecurityContext and places the
	     authentication object on it, but doesn't apply any access controls, force a redirect or anything like that. -->
	<filter>
		<filter-name>specialFilterChainProxy</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	</filter>
	
	<!-- This comes before Spring Security so we can see PUTs and DELETEs from Spring Security. -->
	<filter-mapping>
		<filter-name>httpMethodFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<!-- Allows us to show the username in the page template. -->
	<filter-mapping>
		<filter-name>specialFilterChainProxy</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<!-- Put this before Spring Security to style the login and access denied pages. -->
	<!-- But we have to take special steps to ensure that we can access authentication info from pageTemplate.jsp. -->
	<filter-mapping>
		<filter-name>sitemesh</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<filter-mapping>
		<filter-name>springSecurityFilterChain</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<servlet>
		<servlet-name>spring</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>
				classpath:/spring/beans-web.xml
			</param-value>
		</init-param>
	</servlet>
	
	<servlet-mapping>
		<servlet-name>spring</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
</web-app>
