Add method security web sample

Useful sample for common use case where user adds custom Authentication,
a form login, *and* global method security all the the same application.

spring-boot-samples/spring-boot-sample-web-method-security/src/main/java/sample/ui/method/SampleMethodSecurityApplication.java

@@ -0,0 +1,104 @@
+/*
+ * Copyright 2012-2014 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample.ui.method;
+
+import java.util.Date;
+import java.util.Map;
+
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.builder.SpringApplicationBuilder;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.access.annotation.Secured;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+
+@EnableAutoConfiguration
+@ComponentScan
+@EnableGlobalMethodSecurity(securedEnabled = true)
+public class SampleMethodSecurityApplication extends WebMvcConfigurerAdapter {
+
+	@Controller
+	protected static class HomeController {
+
+		@RequestMapping("/")
+		@Secured("ROLE_ADMIN")
+		public String home(Map<String, Object> model) {
+			model.put("message", "Hello World");
+			model.put("title", "Hello Home");
+			model.put("date", new Date());
+			return "home";
+		}
+
+	}
+
+	public static void main(String[] args) throws Exception {
+		new SpringApplicationBuilder(SampleMethodSecurityApplication.class).run(args);
+	}
+
+	@Override
+	public void addViewControllers(ViewControllerRegistry registry) {
+		registry.addViewController("/login").setViewName("login");
+		registry.addViewController("/access").setViewName("access");
+	}
+
+	@Bean
+	public ApplicationSecurity applicationSecurity() {
+		return new ApplicationSecurity();
+	}
+
+	@Order(Ordered.LOWEST_PRECEDENCE - 8)
+	protected static class ApplicationSecurity extends WebSecurityConfigurerAdapter {
+
+		@Override
+		protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+			// @formatter:off
+			auth.inMemoryAuthentication()
+				.withUser("admin").password("admin").roles("ADMIN", "USER")
+			.and()
+				.withUser("user").password("user").roles("USER");
+			// @formatter:on
+		}
+
+		@Override
+		protected void configure(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.authorizeRequests()
+					.antMatchers("/login").permitAll()
+					.anyRequest().fullyAuthenticated()
+			.and()
+				.formLogin().loginPage("/login").failureUrl("/login?error")
+			.and()
+				.logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
+			.and()
+				.exceptionHandling().accessDeniedPage("/access?error");
+			// @formatter:on
+		}
+
+	}
+
+}