Update itest/web to use Servelt 3.1

Previously itest/web used Servlet 2.5 which Spring 5 is not
compatabile with. This commit removes unnecessary tests (ones that
were already covered) and converts the remaining tests to MockMvc
using the provided servlet version.

Issue gh-4080

itest/web/src/integration-test/java/org/springframework/security/integration/AbstractWebServerIntegrationTests.java

@@ -15,26 +15,14 @@
  */
 package org.springframework.security.integration;
 
-import java.util.List;
+import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
 
-import javax.servlet.ServletContext;
-import javax.servlet.http.Cookie;
-
-import net.sourceforge.jwebunit.junit.WebTester;
-
-import org.mortbay.jetty.Server;
-import org.mortbay.jetty.servlet.ServletHolder;
-import org.mortbay.jetty.webapp.WebAppContext;
-import org.springframework.security.web.session.HttpSessionEventPublisher;
-import org.springframework.util.StringUtils;
-import org.springframework.web.context.ContextLoaderListener;
-import org.springframework.web.context.WebApplicationContext;
-import org.springframework.web.context.support.WebApplicationContextUtils;
-import org.springframework.web.servlet.DispatcherServlet;
-import org.testng.annotations.AfterClass;
-import org.testng.annotations.AfterMethod;
-import org.testng.annotations.BeforeClass;
-import org.testng.annotations.BeforeMethod;
+import org.junit.After;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.mock.web.MockServletContext;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.setup.MockMvcBuilders;
+import org.springframework.web.context.support.XmlWebApplicationContext;
 
 /**
  * Base class which allows the application to be started with a particular Spring
@@ -45,131 +33,29 @@ import org.testng.annotations.BeforeMethod;
  * @author Luke Taylor
  */
 public abstract class AbstractWebServerIntegrationTests {
-	private Server server;
-	private final Object SERVER_LOCK = new Object();
-	protected final WebTester tester = new WebTester();
+	protected ConfigurableApplicationContext context;
 
-	/**
-	 * Override to set the application context files that should be loaded or return null
-	 * to use web.xml.
-	 */
-	protected abstract String getContextConfigLocations();
-
-	protected String getContextPath() {
-		return "/testapp";
-	}
-
-	@BeforeClass
-	public void startServer() throws Exception {
-		synchronized (SERVER_LOCK) {
-			if (server == null) {
-				// System.setProperty("DEBUG", "true");
-				// System.setProperty("VERBOSE", "true");
-				// System.setProperty("IGNORED", "true");
-				server = new Server(0);
-				server.addHandler(createWebContext());
-				server.start();
-			}
+	@After
+	public void close() {
+		if(context != null) {
+			context.close();
 		}
 	}
 
-	@SuppressWarnings("unchecked")
-	private WebAppContext createWebContext() {
-		String webappDir = System.getProperty("webapp.dir");
-
-		WebAppContext webCtx = new WebAppContext(webappDir == null ? "src/main/webapp"
-				: webappDir, getContextPath());
-
-		if (StringUtils.hasText(getContextConfigLocations())) {
-			webCtx.addEventListener(new ContextLoaderListener());
-			webCtx.addEventListener(new HttpSessionEventPublisher());
-			webCtx.getInitParams().put("contextConfigLocation",
-					getContextConfigLocations());
+	protected final MockMvc createMockMvc(String... configLocations) throws Exception {
+		if(this.context != null) {
+			throw new IllegalStateException("context is already loaded");
 		}
 
-		ServletHolder servlet = new ServletHolder();
-		servlet.setName("testapp");
-		servlet.setClassName(DispatcherServlet.class.getName());
-		webCtx.addServlet(servlet, "*.htm");
+		XmlWebApplicationContext context = new XmlWebApplicationContext();
+		context.setConfigLocations(configLocations);
+		context.setServletContext(new MockServletContext());
+		context.refresh();
+		this.context = context;
 
-		return webCtx;
-	}
-
-	@AfterClass
-	public void stopServer() throws Exception {
-		synchronized (SERVER_LOCK) {
-			if (server != null) {
-				server.stop();
-			}
-			server = null;
-		}
-	}
-
-	@BeforeMethod
-	public void initializeTester() {
-		tester.getTestContext().setBaseUrl(getBaseUrl());
-	}
-
-	@AfterMethod
-	public void resetWebConversation() {
-		tester.closeBrowser();
-		tester.setTestContext(null);
-	}
-
-	protected final String getBaseUrl() {
-		int port = server.getConnectors()[0].getLocalPort();
-		return "http://localhost:" + port + getContextPath() + "/";
-	}
-
-	protected final Object getBean(String beanName) {
-		return getAppContext().getBean(beanName);
-	}
-
-	protected final WebApplicationContext getAppContext() {
-		ServletContext servletCtx = ((WebAppContext) server.getHandler())
-				.getServletContext();
-		WebApplicationContext appCtx = WebApplicationContextUtils
-				.getRequiredWebApplicationContext(servletCtx);
-		return appCtx;
-	}
-
-	@SuppressWarnings("unchecked")
-	protected Cookie getRememberMeCookie() {
-		List<Cookie> cookies = (List<Cookie>) tester.getTestingEngine().getCookies();
-		for (Cookie c : cookies) {
-			if (c.getName().equals("remember-me")) {
-				return c;
-			}
-		}
-		return null;
-	}
-
-	protected final void submit() {
-		tester.submit();
-	}
-
-	protected final void beginAt(String url) {
-		tester.beginAt(url);
-	}
-
-	protected final void setTextField(String name, String value) {
-		tester.setTextField(name, value);
-	}
-
-	protected final void assertFormPresent() {
-		tester.assertFormPresent();
-	}
-
-	protected final void assertTextPresent(String text) {
-		tester.assertTextPresent(text);
-	}
-
-	// Security-specific utility methods
-
-	protected void login(String username, String password) {
-		assertFormPresent();
-		setTextField("username", username);
-		setTextField("password", password);
-		submit();
+		return MockMvcBuilders
+			.webAppContextSetup(context)
+			.apply(springSecurity())
+			.build();
 	}
 }

itest/web/src/integration-test/java/org/springframework/security/integration/BasicAuthenticationTests.java

@@ -15,25 +15,29 @@
  */
 package org.springframework.security.integration;
 
-import org.testng.annotations.Test;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.httpBasic;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import org.junit.Test;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 
 public class BasicAuthenticationTests extends AbstractWebServerIntegrationTests {
 
-	@Override
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security-basic.xml /WEB-INF/in-memory-provider.xml";
+	@Test
+	public void httpBasicWhenAuthenticationRequiredAndNotAuthenticatedThen401() throws Exception {
+		MockMvc mockMvc = createMockMvc("classpath:/spring/http-security-basic.xml", "classpath:/spring/in-memory-provider.xml", "classpath:/spring/testapp-servlet.xml");
+		mockMvc.perform(get("secure/index"))
+			.andExpect(status().isUnauthorized());
 	}
 
 	@Test
-	public void basicAuthenticationIsSuccessful() throws Exception {
-		tester.setIgnoreFailingStatusCodes(true);
-		beginAt("secure/index.html");
-		// Ignore the 401
-		tester.setIgnoreFailingStatusCodes(false);
-		tester.assertHeaderEquals("WWW-Authenticate",
-				"Basic realm=\"Spring Security Application\"");
-		tester.getTestContext().setAuthorization("johnc", "johncspassword");
-		beginAt("secure/index.html");
+	public void httpBasicWhenProvidedThen200() throws Exception {
+		MockMvc mockMvc = createMockMvc("classpath:/spring/http-security-basic.xml", "classpath:/spring/in-memory-provider.xml", "classpath:/spring/testapp-servlet.xml");
+		MockHttpServletRequestBuilder request = get("/secure/index")
+				.with(httpBasic("johnc", "johncspassword"));
+		mockMvc.perform(request)
+			.andExpect(status().isOk());
 	}
-
 }

itest/web/src/integration-test/java/org/springframework/security/integration/ConcurrentSessionManagementTests.java

@@ -15,44 +15,93 @@
  */
 package org.springframework.security.integration;
 
-import net.sourceforge.jwebunit.junit.WebTester;
-import org.testng.annotations.Test;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.hamcrest.CoreMatchers.containsString;
+import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
+import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
+import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
+import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
+
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpSession;
+import org.springframework.security.core.context.SecurityContext;
+import org.springframework.security.core.session.SessionDestroyedEvent;
+import org.springframework.test.web.servlet.MockMvc;
+import org.springframework.test.web.servlet.MvcResult;
+import org.springframework.test.web.servlet.ResultHandler;
+import org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder;
 
 /**
  * @author Luke Taylor
  */
 public class ConcurrentSessionManagementTests extends AbstractWebServerIntegrationTests {
 
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security-concurrency.xml /WEB-INF/in-memory-provider.xml";
-	}
-
 	@Test
 	public void maxConcurrentLoginsValueIsRespected() throws Exception {
-		System.out.println("Client: ******* First login ******* ");
-		beginAt("secure/index.html");
-		login("jimi", "jimispassword");
-		// Login again
-		System.out.println("Client: ******* Second login ******* ");
-		WebTester tester2 = new WebTester();
-		tester2.getTestContext().setBaseUrl(getBaseUrl());
-		tester2.beginAt("secure/index.html");
-		// seems to be a bug in checking for form here (it fails)
-		// tester2.assertFormPresent();
-		tester2.setTextField("username", "jimi");
-		tester2.setTextField("password", "jimispassword");
-		// tester2.submit() also fails to detect the form
-		tester2.getTestingEngine().submit();
-		tester2.assertTextPresent("Maximum sessions of 1 for this principal exceeded");
+		final MockHttpSession session1 = new MockHttpSession();
+		final MockHttpSession session2 = new MockHttpSession();
+
+		MockMvc mockMvc = createMockMvc("classpath:/spring/http-security-concurrency.xml","classpath:/spring/in-memory-provider.xml", "classpath:/spring/testapp-servlet.xml");
+
+		mockMvc.perform(get("secure/index").session(session1))
+			.andExpect(status().is3xxRedirection());
+
+		MockHttpServletRequestBuilder login1 = login()
+				.session(session1);
+		mockMvc.
+			perform(login1)
+			.andExpect(authenticated().withUsername("jimi"));
+
+
+		MockHttpServletRequestBuilder login2 = login()
+				.session(session2);
+		mockMvc.perform(login2)
+			.andExpect(redirectedUrl("/login.jsp?login_error=true"));
+		Exception exception = (Exception) session2.getAttribute("SPRING_SECURITY_LAST_EXCEPTION");
+		assertThat(exception).isNotNull();
+		assertThat(exception.getMessage()).contains("Maximum sessions of 1 for this principal exceeded");
 
 		// Now logout to kill first session
-		tester.gotoPage("/logout");
+		mockMvc.perform(post("/logout").with(csrf()))
+			.andExpect(status().is3xxRedirection())
+			.andDo(new ResultHandler() {
+				@SuppressWarnings("serial")
+				@Override
+				public void handle(MvcResult result) throws Exception {
+					context.publishEvent(new SessionDestroyedEvent(session1) {
+						@Override
+						public List<SecurityContext> getSecurityContexts() {
+							return Collections.emptyList();
+						}
+
+						@Override
+						public String getId() {
+							return session1.getId();
+						}
+					});
+				}
+			});
 
 		// Try second session again
-		tester2.setTextField("username", "jimi");
-		tester2.setTextField("password", "jimispassword");
-		// tester2.submit() also fails to detect the form
-		tester2.getTestingEngine().submit();
-		tester2.assertTextPresent("A Secure Page");
+		login2 = login()
+				.session(session2);
+		mockMvc.perform(login2)
+			.andExpect(authenticated().withUsername("jimi"));
+
+		mockMvc.perform(get("/secure/index").session(session2))
+			.andExpect(content().string(containsString("A Secure Page")));
+	}
+
+	private MockHttpServletRequestBuilder login() {
+		return post("/login")
+		.param("username", "jimi")
+		.param("password", "jimispassword")
+		.with(csrf());
 	}
 }

itest/web/src/integration-test/java/org/springframework/security/integration/CustomConcurrentSessionManagementTests.java

@@ -1,71 +0,0 @@
-/*
- * Copyright 2002-2016 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.integration;
-
-import net.sourceforge.jwebunit.junit.WebTester;
-
-import static org.assertj.core.api.Assertions.*;
-
-import org.springframework.security.core.session.SessionRegistry;
-import org.testng.annotations.Test;
-
-/**
- * @author Luke Taylor
- */
-public class CustomConcurrentSessionManagementTests extends
-		AbstractWebServerIntegrationTests {
-
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security-custom-concurrency.xml /WEB-INF/in-memory-provider.xml";
-	}
-
-	@Test
-	public void maxConcurrentLoginsValueIsRespected() throws Exception {
-		beginAt("secure/index.html");
-		login("jimi", "jimispassword");
-		// Login again
-		System.out.println("Client: ******* Second login ******* ");
-		WebTester tester2 = new WebTester();
-		tester2.getTestContext().setBaseUrl(getBaseUrl());
-		tester2.beginAt("secure/index.html");
-		tester2.setTextField("username", "jimi");
-		tester2.setTextField("password", "jimispassword");
-		tester2.setIgnoreFailingStatusCodes(true);
-		tester2.submit();
-		assertThat(tester2.getServerResponse()).contains(
-				"Maximum sessions of 1 for this principal exceeded");
-	}
-
-	@Test
-	public void logoutClearsSessionRegistryAndAllowsSecondLogin() throws Exception {
-		beginAt("secure/index.html");
-		login("bessie", "bessiespassword");
-		SessionRegistry reg = getAppContext().getBean(SessionRegistry.class);
-
-		tester.gotoPage("/logout");
-
-		// Login again
-		System.out.println("Client: ******* Second login ******* ");
-		WebTester tester2 = new WebTester();
-		tester2.getTestContext().setBaseUrl(getBaseUrl());
-		tester2.beginAt("secure/index.html");
-		tester2.setTextField("username", "bessie");
-		tester2.setTextField("password", "bessiespassword");
-		tester2.setIgnoreFailingStatusCodes(true);
-		tester2.submit();
-		assertThat(tester2.getServerResponse()).contains("A secure page");
-	}
-}

itest/web/src/integration-test/java/org/springframework/security/integration/InMemoryProviderWebAppTests.java

@@ -1,89 +0,0 @@
-/*
- * Copyright 2002-2016 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.integration;
-
-
-import static org.assertj.core.api.Assertions.*;
-
-import javax.servlet.http.Cookie;
-
-import org.testng.annotations.Test;
-
-/**
- * @author Luke Taylor
- */
-public class InMemoryProviderWebAppTests extends AbstractWebServerIntegrationTests {
-
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security.xml /WEB-INF/in-memory-provider.xml";
-	}
-
-	@Test
-	public void loginFailsWithinvalidPassword() {
-		beginAt("secure/index.html");
-		login("jimi", "wrongPassword");
-		assertTextPresent("Your login attempt was not successful");
-	}
-
-	@Test
-	public void loginSucceedsWithCorrectPassword() {
-		beginAt("secure/index.html");
-		login("jimi", "jimispassword");
-		assertTextPresent("A Secure Page");
-		tester.gotoPage("/logout");
-	}
-
-	@Test
-	public void basicAuthenticationIsSuccessful() throws Exception {
-		tester.getTestContext().setAuthorization("johnc", "johncspassword");
-		beginAt("secure/index.html");
-		beginAt("secure/index.html");
-	}
-
-	/*
-	 * Checks use of <jsp:include> with parameters in the secured page.
-	 */
-	@Test
-	public void savedRequestWithJspIncludeSeesCorrectParams() {
-		beginAt("secure/secure1.jsp?x=0");
-		login("jimi", "jimispassword");
-		// Included JSP has params ?x=1&y=2
-		assertTextPresent("Params: x=1, y=2");
-		assertTextPresent("xcount=2");
-	}
-
-	// SEC-1255
-	@Test
-	public void redirectToUrlWithSpecialCharsInFilenameWorksOk() throws Exception {
-		beginAt("secure/file%3Fwith%3Fspecial%3Fchars.htm?someArg=1");
-		login("jimi", "jimispassword");
-		assertTextPresent("I'm file?with?special?chars.htm");
-	}
-
-	@Test
-	public void persistentLoginIsSuccesful() throws Exception {
-		beginAt("secure/index.html");
-		tester.checkCheckbox("remember-me");
-		login("jimi", "jimispassword");
-		Cookie rememberMe = getRememberMeCookie();
-		assertThat(rememberMe).isNotNull();
-		tester.closeBrowser();
-
-		tester.getTestContext().addCookie(rememberMe);
-		beginAt("secure/index.html");
-		assertTextPresent("A Secure Page");
-	}
-}

itest/web/src/integration-test/java/org/springframework/security/integration/JspTaglibTests.java

@@ -1,60 +0,0 @@
-/*
- * Copyright 2002-2016 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.integration;
-
-
-import static org.assertj.core.api.Assertions.*;
-
-import org.testng.annotations.Test;
-
-/**
- *
- * @author Luke Taylor
- */
-public final class JspTaglibTests extends AbstractWebServerIntegrationTests {
-
-	@Override
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security.xml /WEB-INF/in-memory-provider.xml";
-	}
-
-	@Test
-	public void authenticationTagEscapingWorksCorrectly() {
-		beginAt("secure/authenticationTagTestPage.jsp");
-		login("theescapist<>&.", "theescapistspassword");
-		String response = tester.getServerResponse();
-		assertThat(response)
-				.contains("This is the unescaped authentication name: theescapist<>&.");
-		assertThat(response)
-				.contains("This is the unescaped principal.username: theescapist<>&.");
-		assertThat(response)
-				.contains("This is the authentication name: theescapist&lt;&gt;&amp;&#46;");
-		assertThat(response)
-				.contains("This is the principal.username: theescapist&lt;&gt;&amp;&#46;");
-	}
-
-	@Test
-	public void authorizationTagEvaluatesExpressionCorrectlyAndWritesValueToVariable() {
-		beginAt("secure/authorizationTagTestPage.jsp");
-		login("bessie", "bessiespassword");
-		String response = tester.getServerResponse();
-		assertThat(response)
-				.contains("Users can see this and 'allowed' variable is true.");
-		assertThat(response).doesNotContain("Role X users (nobody) can see this.");
-		assertThat(response).contains("Role X expression evaluates to false");
-	}
-
-}

itest/web/src/integration-test/java/org/springframework/security/integration/LdapWebAppTests.java

@@ -1,34 +0,0 @@
-/*
- * Copyright 2002-2016 the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-package org.springframework.security.integration;
-
-import org.testng.annotations.*;
-
-/**
- * @author Luke Taylor
- */
-public class LdapWebAppTests extends AbstractWebServerIntegrationTests {
-
-	protected String getContextConfigLocations() {
-		return "/WEB-INF/http-security.xml /WEB-INF/ldap-provider.xml";
-	}
-
-	@Test
-	public void doSomething() {
-
-	}
-
-}

itest/web/src/integration-test/resources/spring/http-security-basic.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<beans:beans xmlns="http://www.springframework.org/schema/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+
+	<http use-expressions="false">
+		<intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />
+		<http-basic />
+	</http>
+
+</beans:beans>

itest/web/src/integration-test/resources/spring/http-security-concurrency.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<beans:beans xmlns="http://www.springframework.org/schema/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+
+	<debug />
+
+	<!--
+	   Http App Context to test form login, remember-me and concurrent session control.
+	   Needs to be supplemented with authentication provider(s)
+	-->
+	<http pattern="/login.jsp" security="none" />
+
+	<http>
+		<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
+		<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
+
+		<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
+		<http-basic/>
+
+		<!-- Default logout configuration -->
+		<logout logout-url="/logout"/>
+
+		<session-management>
+			<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
+		</session-management>
+
+		<csrf disabled="true"/>
+	</http>
+
+</beans:beans>

itest/web/src/integration-test/resources/spring/http-security.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<beans:beans xmlns="http://www.springframework.org/schema/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+
+	<!--
+	   Http App Context to test form login, remember-me and concurrent session control.
+	   Needs to be supplemented with authentication provider(s)
+	-->
+	<http pattern="/login.jsp" security="none" />
+
+	<http>
+		<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
+		<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
+
+		<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
+		<http-basic/>
+
+		<!-- Default logout configuration -->
+		<logout logout-url="/logout"/>
+
+		<session-management>
+			<concurrency-control max-sessions="1" />
+		</session-management>
+
+		<remember-me key="doesntmatter" token-repository-ref="tokenRepo"/>
+	</http>
+
+	<beans:bean name="tokenRepo" class="org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl"/>
+
+</beans:beans>

itest/web/src/integration-test/resources/spring/in-memory-provider.xml

@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<beans:beans xmlns="http://www.springframework.org/schema/security"
+	xmlns:beans="http://www.springframework.org/schema/beans"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+
+	<authentication-manager alias="authenticationManager">
+		<authentication-provider>
+			<user-service>
+			  <user name="miles" password="milespassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_TRUMPETER"/>
+			  <user name="johnc" password="johncspassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_SAXOPHONIST"/>
+			  <user name="jimi" password="jimispassword" authorities="ROLE_USER,ROLE_ROCK,ROLE_GUITARIST"/>
+			  <user name="bessie" password="bessiespassword" authorities="ROLE_USER,ROLE_JAZZ,ROLE_SINGER"/>
+			  <user name="theescapist&lt;&gt;&amp;." password="theescapistspassword" authorities="ROLE_USER"/>
+			</user-service>
+		</authentication-provider>
+	</authentication-manager>
+
+</beans:beans>

itest/web/src/integration-test/resources/spring/testapp-servlet.xml

@@ -0,0 +1,8 @@
+<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context"
+		xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+				http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">
+
+	<context:component-scan base-package="org.springframework.security.itest.web"/>
+	<context:annotation-config />
+</beans>