From fa3866854f67dda22081cd09dd48bc00fd534579 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Tue, 25 Feb 2014 16:13:23 -0500
Subject: [PATCH 1/7] Update booking-mvc to use Spring Java config

---
 booking-mvc/pom.xml                           |   2 +-
 .../booking/config/DataAccessConfig.java      |  46 ++++++++
 .../booking/config/SecurityConfig.java        |  39 +++++++
 .../samples/booking/config/WebFlowConfig.java |  59 ++++++++++
 .../samples/booking/config/WebMvcConfig.java  | 109 ++++++++++++++++++
 .../WEB-INF/config/data-access-config.xml     |  38 ------
 .../webapp/WEB-INF/config/security-config.xml |  37 ------
 .../WEB-INF/config/web-application-config.xml |  18 ---
 .../webapp/WEB-INF/config/webflow-config.xml  |  37 ------
 .../webapp/WEB-INF/config/webmvc-config.xml   |  70 -----------
 .../src/main/webapp/WEB-INF/login.html        |  12 +-
 booking-mvc/src/main/webapp/WEB-INF/web.xml   |  13 ++-
 12 files changed, 267 insertions(+), 213 deletions(-)
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
 delete mode 100644 booking-mvc/src/main/webapp/WEB-INF/config/data-access-config.xml
 delete mode 100644 booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
 delete mode 100644 booking-mvc/src/main/webapp/WEB-INF/config/web-application-config.xml
 delete mode 100644 booking-mvc/src/main/webapp/WEB-INF/config/webflow-config.xml
 delete mode 100644 booking-mvc/src/main/webapp/WEB-INF/config/webmvc-config.xml

diff --git a/booking-mvc/pom.xml b/booking-mvc/pom.xml
index fad2efe..c9f9448 100644
--- a/booking-mvc/pom.xml
+++ b/booking-mvc/pom.xml
@@ -10,7 +10,7 @@
 
 	<properties>
 		<springsecurity-version>3.2.0.RELEASE</springsecurity-version>
-		<webflow-version>2.3.3.RELEASE</webflow-version>
+		<webflow-version>2.4.0.BUILD-SNAPSHOT</webflow-version>
 		<slf4j-version>1.7.5</slf4j-version>
 		<thymeleaf-version>2.0.15</thymeleaf-version>
 		<thymeleaf-extras-tiles2-version>2.0.0</thymeleaf-extras-tiles2-version>
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
new file mode 100644
index 0000000..53166aa
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
@@ -0,0 +1,46 @@
+package org.springframework.webflow.samples.booking.config;
+
+import java.util.Collections;
+
+import javax.persistence.EntityManagerFactory;
+import javax.sql.DataSource;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.orm.jpa.JpaTransactionManager;
+import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
+import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.annotation.EnableTransactionManagement;
+
+@Configuration
+@EnableTransactionManagement
+@ComponentScan(basePackages="org.springframework.webflow.samples.booking")
+public class DataAccessConfig {
+
+	@Bean
+	public PlatformTransactionManager transactionManager(EntityManagerFactory emf) {
+		JpaTransactionManager txManager = new JpaTransactionManager();
+		txManager.setEntityManagerFactory(emf);
+		return txManager;
+	}
+
+	@Bean
+	public LocalContainerEntityManagerFactoryBean entityManagerFactory() {
+		LocalContainerEntityManagerFactoryBean emf = new LocalContainerEntityManagerFactoryBean();
+		emf.setDataSource(dataSource());
+		emf.setJpaVendorAdapter(new HibernateJpaVendorAdapter());
+		emf.setJpaPropertyMap(Collections.singletonMap("hibernate.session_factory_name", "mySessionFactory"));
+		return emf;
+	}
+
+	@Bean
+	public DataSource dataSource() {
+		DriverManagerDataSource dataSource = new DriverManagerDataSource("jdbc:hsqldb:mem:booking", "sa", "");
+		dataSource.setDriverClassName("org.hsqldb.jdbcDriver");
+		return dataSource;
+	}
+
+}
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
new file mode 100644
index 0000000..cf1a71f
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -0,0 +1,39 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http
+			.csrf().disable()
+			.formLogin()
+				.loginPage("/login")
+				.loginProcessingUrl("/loginProcess")
+				.defaultSuccessUrl("/hotels/search")
+				.failureUrl("/login?login_error=1")
+				.and()
+			.logout()
+				.logoutUrl("/logout")
+				.logoutSuccessUrl("/logoutSuccess");
+	}
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+			.passwordEncoder(new Md5PasswordEncoder())
+			.withUser("keith").password("417c7382b16c395bc25b5da1398cf076").roles("USER", "SUPERVISOR").and()
+			.withUser("erwin").password("12430911a8af075c6f41c6976af22b09").roles("USER", "SUPERVISOR").and()
+			.withUser("jeremy").password("57c6cbff0d421449be820763f03139eb").roles("USER").and()
+			.withUser("scott").password("942f2339bf50796de535a384f0d1af3e").roles("USER");
+	}
+
+}
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
new file mode 100644
index 0000000..d269d2b
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
@@ -0,0 +1,59 @@
+package org.springframework.webflow.samples.booking.config;
+
+import java.util.Arrays;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.validation.beanvalidation.LocalValidatorFactoryBean;
+import org.springframework.web.servlet.ViewResolver;
+import org.springframework.webflow.config.AbstractFlowConfiguration;
+import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;
+import org.springframework.webflow.engine.builder.support.FlowBuilderServices;
+import org.springframework.webflow.executor.FlowExecutor;
+import org.springframework.webflow.mvc.builder.MvcViewFactoryCreator;
+import org.springframework.webflow.security.SecurityFlowExecutionListener;
+
+@Configuration
+public class WebFlowConfig extends AbstractFlowConfiguration {
+
+	@Autowired
+	private WebMvcConfig webMvcConfig;
+
+	@Bean
+	public FlowExecutor flowExecutor() {
+		return getFlowExecutorBuilder(flowRegistry())
+				.addFlowExecutionListener(new SecurityFlowExecutionListener(), "*")
+				.build();
+	}
+
+	@Bean
+	public FlowDefinitionRegistry flowRegistry() {
+		return getFlowDefinitionRegistryBuilder(flowBuilderServices())
+				.setBasePath("/WEB-INF")
+				.addFlowLocationPattern("/**/*-flow.xml").build();
+	}
+
+	@Bean
+	public FlowBuilderServices flowBuilderServices() {
+		return getFlowBuilderServicesBuilder()
+				.setViewFactoryCreator(mvcViewFactoryCreator())
+				.setValidator(validator())
+				.setDevelopmentMode(true)
+				.build();
+	}
+
+	@Bean
+	public MvcViewFactoryCreator mvcViewFactoryCreator() {
+		MvcViewFactoryCreator factoryCreator = new MvcViewFactoryCreator();
+		factoryCreator.setViewResolvers(Arrays.<ViewResolver>asList(this.webMvcConfig.tilesViewResolver()));
+		factoryCreator.setUseSpringBeanBinding(true);
+		return factoryCreator;
+	}
+
+	@Bean
+	public LocalValidatorFactoryBean validator() {
+		return new LocalValidatorFactoryBean();
+	}
+
+}
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
new file mode 100644
index 0000000..82ffca7
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
@@ -0,0 +1,109 @@
+package org.springframework.webflow.samples.booking.config;
+
+import java.util.LinkedHashSet;
+import java.util.Set;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.web.servlet.config.annotation.DefaultServletHandlerConfigurer;
+import org.springframework.web.servlet.config.annotation.EnableWebMvc;
+import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
+import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.webflow.mvc.servlet.FlowHandlerAdapter;
+import org.springframework.webflow.mvc.servlet.FlowHandlerMapping;
+import org.springframework.webflow.samples.booking.BookingFlowHandler;
+import org.thymeleaf.dialect.IDialect;
+import org.thymeleaf.extras.conditionalcomments.dialect.ConditionalCommentsDialect;
+import org.thymeleaf.extras.springsecurity3.dialect.SpringSecurityDialect;
+import org.thymeleaf.extras.tiles2.dialect.TilesDialect;
+import org.thymeleaf.extras.tiles2.spring.web.configurer.ThymeleafTilesConfigurer;
+import org.thymeleaf.extras.tiles2.spring.web.view.FlowAjaxThymeleafTilesView;
+import org.thymeleaf.spring3.SpringTemplateEngine;
+import org.thymeleaf.spring3.view.AjaxThymeleafViewResolver;
+import org.thymeleaf.templateresolver.ServletContextTemplateResolver;
+
+@EnableWebMvc
+@Configuration
+public class WebMvcConfig extends WebMvcConfigurerAdapter {
+
+	@Autowired
+	private WebFlowConfig webFlowConfig;
+
+	@Override
+	public void addResourceHandlers(ResourceHandlerRegistry registry) {
+		registry.addResourceHandler("/resources/**").addResourceLocations("/", "classpath:/META-INF/web-resources/");
+	}
+
+	@Override
+	public void configureDefaultServletHandling(DefaultServletHandlerConfigurer configurer) {
+		configurer.enable();
+	}
+
+	@Override
+	public void addViewControllers(ViewControllerRegistry registry) {
+		registry.addViewController("/").setViewName("intro");
+		registry.addViewController("/login");
+		registry.addViewController("/logoutSuccess");
+	}
+
+	@Bean
+	public FlowHandlerMapping flowHandlerMapping() {
+		FlowHandlerMapping handlerMapping = new FlowHandlerMapping();
+		handlerMapping.setOrder(-1);
+		handlerMapping.setFlowRegistry(this.webFlowConfig.flowRegistry());
+		return handlerMapping;
+	}
+
+	@Bean
+	public FlowHandlerAdapter flowHandlerAdapter() {
+		FlowHandlerAdapter handlerAdapter = new FlowHandlerAdapter();
+		handlerAdapter.setFlowExecutor(this.webFlowConfig.flowExecutor());
+		handlerAdapter.setSaveOutputToFlashScopeOnRedirect(true);
+		return handlerAdapter;
+	}
+
+	@Bean(name="hotels/booking")
+	public BookingFlowHandler BookingFlowHandler() {
+		return new BookingFlowHandler();
+	}
+
+	@Bean
+	public AjaxThymeleafViewResolver tilesViewResolver() {
+		AjaxThymeleafViewResolver viewResolver = new AjaxThymeleafViewResolver();
+		viewResolver.setViewClass(FlowAjaxThymeleafTilesView.class);
+		viewResolver.setTemplateEngine(templateEngine());
+		return viewResolver;
+	}
+
+	@Bean
+	public SpringTemplateEngine templateEngine(){
+
+		Set<IDialect> dialects = new LinkedHashSet<IDialect>();
+		dialects.add(new TilesDialect());
+		dialects.add(new SpringSecurityDialect());
+		dialects.add(new ConditionalCommentsDialect());
+
+		SpringTemplateEngine templateEngine = new SpringTemplateEngine();
+		templateEngine.setTemplateResolver(templateResolver());
+		templateEngine.setAdditionalDialects(dialects);
+		return templateEngine;
+	}
+
+	@Bean
+	public ServletContextTemplateResolver templateResolver() {
+		ServletContextTemplateResolver templateResolver = new ServletContextTemplateResolver();
+		templateResolver.setPrefix("/WEB-INF/");
+		templateResolver.setTemplateMode("HTML5");
+		return templateResolver;
+	}
+
+	@Bean
+	public ThymeleafTilesConfigurer tilesConfigurer() {
+		ThymeleafTilesConfigurer configurer = new ThymeleafTilesConfigurer();
+		configurer.setDefinitions("/WEB-INF/**/views.xml");
+		return configurer;
+	}
+
+}
diff --git a/booking-mvc/src/main/webapp/WEB-INF/config/data-access-config.xml b/booking-mvc/src/main/webapp/WEB-INF/config/data-access-config.xml
deleted file mode 100644
index 924ede3..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/config/data-access-config.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:tx="http://www.springframework.org/schema/tx"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
-           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd">
-
-	<!-- Instructs Spring to perfrom declarative transaction management on annotated classes -->
-	<tx:annotation-driven />
-
-	<!-- Drives transactions using local JPA APIs -->
-	<bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">
-		<property name="entityManagerFactory" ref="entityManagerFactory" />
-	</bean>
-		
-	<!-- Creates a EntityManagerFactory for use with the Hibernate JPA provider and a simple in-memory data source populated with test data -->
-	<bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
-		<property name="dataSource" ref="dataSource" />
-		<property name="jpaVendorAdapter">
-			<bean class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter" />
-		</property>
-		<property name="jpaProperties">
-			<value>
-				hibernate.session_factory_name=mySessionFactory
-			</value>
-		</property>
-	</bean>
-	
-	<!-- Deploys a in-memory "booking" datasource populated -->
-	<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
-		<property name="driverClassName" value="org.hsqldb.jdbcDriver" />
-		<property name="url" value="jdbc:hsqldb:mem:booking" />
-		<property name="username" value="sa" />
-		<property name="password" value="" />
-	</bean>
-	
-</beans>
\ No newline at end of file
diff --git a/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml b/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
deleted file mode 100644
index 741607c..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/config/security-config.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:security="http://www.springframework.org/schema/security"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
-           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">
-
-	<!-- Configure Spring Security -->
-	<security:http auto-config="true" use-expressions="true">
-		<security:form-login login-page="/login" login-processing-url="/loginProcess" 
-			default-target-url="/hotels/search" authentication-failure-url="/login?login_error=1" />
-		<security:logout logout-url="/logout" logout-success-url="/logoutSuccess" />
-	</security:http>
-	
-	<!--
-		Define local authentication provider, a real app would use an external provider (JDBC, LDAP, CAS, etc)
-		
-		usernames/passwords are:
-			keith/melbourne
-			erwin/leuven
-			jeremy/atlanta
-			scott/rochester
-	-->
-	<security:authentication-manager>
-		<security:authentication-provider>
-			<security:password-encoder hash="md5" />
-			<security:user-service>
-				<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
-				<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
-				<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
-				<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
-			</security:user-service>
-		</security:authentication-provider>
-	</security:authentication-manager>
-	
-</beans>
\ No newline at end of file
diff --git a/booking-mvc/src/main/webapp/WEB-INF/config/web-application-config.xml b/booking-mvc/src/main/webapp/WEB-INF/config/web-application-config.xml
deleted file mode 100644
index 10ebcf5..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/config/web-application-config.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
-           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd">
-
-	<!-- Scans for application @Components to deploy -->
-	<context:component-scan base-package="org.springframework.webflow.samples.booking" />
-
-	<!-- Imports the configurations of the different infrastructure systems of the application -->
-	<import resource="webmvc-config.xml" />
-	<import resource="webflow-config.xml" />
-	<import resource="data-access-config.xml" />
-	<import resource="security-config.xml" />
-
-</beans>
\ No newline at end of file
diff --git a/booking-mvc/src/main/webapp/WEB-INF/config/webflow-config.xml b/booking-mvc/src/main/webapp/WEB-INF/config/webflow-config.xml
deleted file mode 100644
index 06cb11a..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/config/webflow-config.xml
+++ /dev/null
@@ -1,37 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:webflow="http://www.springframework.org/schema/webflow-config"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
-           http://www.springframework.org/schema/webflow-config http://www.springframework.org/schema/webflow-config/spring-webflow-config-2.3.xsd">
-
-	<!-- Executes flows: the entry point into the Spring Web Flow system -->
-	<webflow:flow-executor id="flowExecutor">
-		<webflow:flow-execution-listeners>
-			<webflow:listener ref="securityFlowExecutionListener" />
-		</webflow:flow-execution-listeners>
-	</webflow:flow-executor>
-	
-	<!-- The registry of executable flow definitions -->
-	<webflow:flow-registry id="flowRegistry" flow-builder-services="flowBuilderServices" base-path="/WEB-INF">
-		<webflow:flow-location-pattern value="/**/*-flow.xml" />
-	</webflow:flow-registry>
-
-	<!-- Plugs in a custom creator for Web Flow views -->
-	<webflow:flow-builder-services id="flowBuilderServices" view-factory-creator="mvcViewFactoryCreator" 
-		development="true" validator="validator" />
-
-	<!-- Configures Web Flow to use Tiles to create views for rendering; Tiles allows for applying consistent layouts to your views -->
-	<bean id="mvcViewFactoryCreator" class="org.springframework.webflow.mvc.builder.MvcViewFactoryCreator"> 
-		<property name="viewResolvers" ref="tilesViewResolver"/>
-		<property name="useSpringBeanBinding" value="true" />
-	</bean>
-	
-	<!-- Installs a listener to apply Spring Security authorities -->
-	<bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener" />
-
-	<!-- Bootstraps JSR-303 validation and exposes it through Spring's Validator interface -->
-	<bean id="validator" class="org.springframework.validation.beanvalidation.LocalValidatorFactoryBean"/>
-
-</beans>
\ No newline at end of file
diff --git a/booking-mvc/src/main/webapp/WEB-INF/config/webmvc-config.xml b/booking-mvc/src/main/webapp/WEB-INF/config/webmvc-config.xml
deleted file mode 100644
index 6a3c53b..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/config/webmvc-config.xml
+++ /dev/null
@@ -1,70 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns:mvc="http://www.springframework.org/schema/mvc"
-	xsi:schemaLocation="
-		http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
-		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
-
-	<!-- Enables controllers mapped with @RequestMapping annotations, formatting annotations @NumberFormat @DateTimeFormat, and JSR 303 style validation -->
-	<mvc:annotation-driven/>
-
-	<mvc:resources mapping="/resources/**" location="/, classpath:/META-INF/web-resources/" />
-	<mvc:default-servlet-handler />
-    
-	<!-- Maps request paths to flows in the flowRegistry; e.g. a path of /hotels/booking looks for a flow with id "hotels/booking". -->
-	<bean class="org.springframework.webflow.mvc.servlet.FlowHandlerMapping">
-		<property name="order" value="-1"/>
-		<property name="flowRegistry" ref="flowRegistry" />
-	</bean>
-
-	<!-- Map paths directly to view names without controller processing. Use the view-name attribute if necessary: by convention the view name equals the path without the leading slash -->
-	<mvc:view-controller path="/" view-name="intro" />
-	<mvc:view-controller path="/login" />
-	<mvc:view-controller path="/logoutSuccess" />
-
-	<!-- Dispatches requests mapped to flows to FlowHandler implementations -->
-	<bean class="org.springframework.webflow.mvc.servlet.FlowHandlerAdapter">
-		<property name="flowExecutor" ref="flowExecutor"/>
-		<!-- <property name="saveOutputToFlashScopeOnRedirect" value="true"/>  -->
-	</bean>
-
-	<!-- Custom FlowHandler for the hotel booking flow -->
-	<bean name="hotels/booking" class="org.springframework.webflow.samples.booking.BookingFlowHandler" />	
-		
-	<!-- Thymeleaf template resolver -->
-	<bean id="templateResolver"
-		  class="org.thymeleaf.templateresolver.ServletContextTemplateResolver">
-		<property name="prefix" value="/WEB-INF/" />
-		<property name="templateMode" value="HTML5" />
-	</bean>
-
-	<!-- Thymeleaf Template Engine -->
-    <bean id="templateEngine"
-          class="org.thymeleaf.spring3.SpringTemplateEngine">
-        <property name="templateResolver" ref="templateResolver" />
-        <property name="additionalDialects">
-            <set>
-                <bean class="org.thymeleaf.extras.tiles2.dialect.TilesDialect"/>
-                <bean class="org.thymeleaf.extras.springsecurity3.dialect.SpringSecurityDialect"/>
-                <bean class="org.thymeleaf.extras.conditionalcomments.dialect.ConditionalCommentsDialect"/>
-            </set>
-        </property>
-    </bean>
-
-	<!-- Resolves logical view names returned by Controllers to Tiles; a view name to resolve is treated as the name of a tiles definition -->
-	<bean id="tilesViewResolver" class="org.thymeleaf.spring3.view.AjaxThymeleafViewResolver">
-		<property name="viewClass" value="org.thymeleaf.extras.tiles2.spring.web.view.FlowAjaxThymeleafTilesView"/>
-		<property name="templateEngine" ref="templateEngine"/>
-	</bean>
-  
-	<!-- Configures the Tiles layout system using a specific thymeleaf-enabled Tiles Configurer -->
-	<bean id="tilesConfigurer" class="org.thymeleaf.extras.tiles2.spring.web.configurer.ThymeleafTilesConfigurer">
-		<property name="definitions">
-			<list>
-				<value>/WEB-INF/**/views.xml</value>
-			</list>
-		</property>
-	</bean>
-  	
-</beans>
diff --git a/booking-mvc/src/main/webapp/WEB-INF/login.html b/booking-mvc/src/main/webapp/WEB-INF/login.html
index b1bf112..4d85943 100644
--- a/booking-mvc/src/main/webapp/WEB-INF/login.html
+++ b/booking-mvc/src/main/webapp/WEB-INF/login.html
@@ -77,31 +77,31 @@
             <legend>Login Information</legend>
             
             <p>
-                <label for="j_username">User:</label>
+                <label for="username">User:</label>
                 <br />
-                <input type="text" name="j_username" id="j_username"
+                <input type="text" name="username" id="username"
                        th:value="(${param.login_error} and ${session}) ? ${session[__${lastUsernameKey}__]} : ''" />
             </p>
             
             <script type="text/javascript">
                 // <![CDATA[
                     Spring.addDecoration(new Spring.ElementDecoration({
-                        elementId : "j_username",
+                        elementId : "username",
                         widgetType : "dijit.form.ValidationTextBox",
                         widgetAttrs : { required : true }}));
                 // ]]>
             </script>
             
             <p>
-                <label for="j_password">Password:</label>
+                <label for="password">Password:</label>
                 <br />
-                <input type="password" name="j_password" id="j_password" />
+                <input type="password" name="password" id="password" />
             </p>
             
             <script type="text/javascript">
                 // <![CDATA[
                     Spring.addDecoration(new Spring.ElementDecoration({
-                        elementId : "j_password",
+                        elementId : "password",
                         widgetType : "dijit.form.ValidationTextBox",
                         widgetAttrs : { required : true}}));
                 // ]]>
diff --git a/booking-mvc/src/main/webapp/WEB-INF/web.xml b/booking-mvc/src/main/webapp/WEB-INF/web.xml
index 99c4593..0371362 100755
--- a/booking-mvc/src/main/webapp/WEB-INF/web.xml
+++ b/booking-mvc/src/main/webapp/WEB-INF/web.xml
@@ -4,15 +4,16 @@
 	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
 	version="2.4">
 
-	<!-- The master configuration file for this Spring web application -->
 	<context-param>
-		<param-name>contextConfigLocation</param-name>
-		<param-value>
-			/WEB-INF/config/web-application-config.xml
-		</param-value>
+		<param-name>contextClass</param-name>
+		<param-value>org.springframework.web.context.support.AnnotationConfigWebApplicationContext</param-value>
+	</context-param>
+
+	<context-param>
+		<param-name>contextConfigLocation</param-name>
+		<param-value>org.springframework.webflow.samples.booking.config</param-value>
 	</context-param>
 
-	<!-- Loads the Spring web application context -->
 	<listener>
 		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 	</listener>

From e0ed2a6dc6996ee601a7db4c0372ff93a3d5e2c0 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Tue, 25 Feb 2014 21:29:44 -0500
Subject: [PATCH 2/7] Replace web.xml with Java configuration in booking-mvc

---
 booking-mvc/pom.xml                           |  4 +-
 .../config/DispatcherServletInitializer.java  | 35 +++++++++++
 .../SecurityWebApplicationInitializer.java    | 10 ++++
 booking-mvc/src/main/webapp/WEB-INF/web.xml   | 60 -------------------
 4 files changed, 47 insertions(+), 62 deletions(-)
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
 create mode 100644 booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
 delete mode 100755 booking-mvc/src/main/webapp/WEB-INF/web.xml

diff --git a/booking-mvc/pom.xml b/booking-mvc/pom.xml
index c9f9448..e899a48 100644
--- a/booking-mvc/pom.xml
+++ b/booking-mvc/pom.xml
@@ -178,8 +178,8 @@
 		<!-- Servlet -->
 		<dependency>
 			<groupId>javax.servlet</groupId>
-			<artifactId>servlet-api</artifactId>
-			<version>2.5</version>
+			<artifactId>javax.servlet-api</artifactId>
+			<version>3.0.1</version>
 			<scope>provided</scope>
 		</dependency>
 		<dependency>
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
new file mode 100644
index 0000000..c86c1e0
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
@@ -0,0 +1,35 @@
+package org.springframework.webflow.samples.booking.config;
+
+import javax.servlet.Filter;
+
+import org.springframework.web.filter.HiddenHttpMethodFilter;
+import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
+
+public class DispatcherServletInitializer  extends AbstractAnnotationConfigDispatcherServletInitializer {
+
+	@Override
+	protected Class<?>[] getRootConfigClasses() {
+		return new Class<?>[] {
+			SecurityConfig.class,
+			DataAccessConfig.class,
+			WebMvcConfig.class,
+			WebFlowConfig.class
+		};
+	}
+
+	@Override
+	protected Class<?>[] getServletConfigClasses() {
+		return null;
+	}
+
+	@Override
+	protected String[] getServletMappings() {
+		return new String[] { "/" };
+	}
+
+	@Override
+	protected Filter[] getServletFilters() {
+		return new Filter[] { new HiddenHttpMethodFilter() };
+	}
+
+}
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
new file mode 100644
index 0000000..df49deb
--- /dev/null
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
@@ -0,0 +1,10 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
+
+/**
+ * ServletContext initializer for Spring Security specific configuration such as
+ * the chain of Spring Security filters.
+ */
+public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
+}
diff --git a/booking-mvc/src/main/webapp/WEB-INF/web.xml b/booking-mvc/src/main/webapp/WEB-INF/web.xml
deleted file mode 100755
index 0371362..0000000
--- a/booking-mvc/src/main/webapp/WEB-INF/web.xml
+++ /dev/null
@@ -1,60 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
-	version="2.4">
-
-	<context-param>
-		<param-name>contextClass</param-name>
-		<param-value>org.springframework.web.context.support.AnnotationConfigWebApplicationContext</param-value>
-	</context-param>
-
-	<context-param>
-		<param-name>contextConfigLocation</param-name>
-		<param-value>org.springframework.webflow.samples.booking.config</param-value>
-	</context-param>
-
-	<listener>
-		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
-	</listener>
-
-	<!-- Enables use of HTTP methods PUT and DELETE -->
-	<filter>
-		<filter-name>httpMethodFilter</filter-name>
-		<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
-	</filter>
-
-	<filter-mapping>
-		<filter-name>httpMethodFilter</filter-name>
-		<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-	</filter-mapping>
-
-	<!-- Enables Spring Security -->
-	<filter>
-        <filter-name>springSecurityFilterChain</filter-name>
-        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
-    </filter>
-
-    <filter-mapping>
-      <filter-name>springSecurityFilterChain</filter-name>
-      <servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-    </filter-mapping>
-
-	<!-- The front controller of this Spring Web application, responsible for handling all application requests -->
-	<servlet>
-		<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
-		<init-param>
-			<param-name>contextConfigLocation</param-name>
-			<param-value></param-value>
-		</init-param>
-		<load-on-startup>1</load-on-startup>
-	</servlet>
-		
-	<!-- Map all *.spring requests to the DispatcherServlet for handling -->
-	<servlet-mapping>
-		<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-		<url-pattern>/</url-pattern>
-	</servlet-mapping>
-
-</web-app>
\ No newline at end of file

From 0b9fe7766c71a6841c8337b0614b2ade0f03c2af Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Wed, 26 Feb 2014 17:31:31 -0500
Subject: [PATCH 3/7] Update booking-faces to use Java config

---
 booking-faces/pom.xml                         |   6 +-
 .../samples/booking/config/AppConfig.java     |  16 +++
 .../booking/config/DataAccessConfig.java      |  44 +++++++
 .../config/DispatcherServletInitializer.java  |  55 ++++++++
 .../booking/config/SecurityConfig.java        |  44 +++++++
 .../SecurityWebApplicationInitializer.java    |  10 ++
 .../samples/booking/config/WebFlowConfig.java |  36 ++++++
 .../samples/booking/config/WebMvcConfig.java  |  52 ++++++++
 .../WEB-INF/config/data-access-config.xml     |  33 -----
 .../webapp/WEB-INF/config/security-config.xml |  38 ------
 .../WEB-INF/config/web-application-config.xml |  18 ---
 .../webapp/WEB-INF/config/webflow-config.xml  |  33 -----
 .../webapp/WEB-INF/config/webmvc-config.xml   |  36 ------
 .../src/main/webapp/WEB-INF/login.xhtml       |   4 +-
 booking-faces/src/main/webapp/WEB-INF/web.xml | 117 ------------------
 15 files changed, 262 insertions(+), 280 deletions(-)
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/AppConfig.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
 create mode 100644 booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
 delete mode 100644 booking-faces/src/main/webapp/WEB-INF/config/data-access-config.xml
 delete mode 100644 booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
 delete mode 100644 booking-faces/src/main/webapp/WEB-INF/config/web-application-config.xml
 delete mode 100644 booking-faces/src/main/webapp/WEB-INF/config/webflow-config.xml
 delete mode 100644 booking-faces/src/main/webapp/WEB-INF/config/webmvc-config.xml
 delete mode 100755 booking-faces/src/main/webapp/WEB-INF/web.xml

diff --git a/booking-faces/pom.xml b/booking-faces/pom.xml
index 76192e2..798b298 100644
--- a/booking-faces/pom.xml
+++ b/booking-faces/pom.xml
@@ -10,7 +10,7 @@
 
 	<properties>
 		<springsecurity-version>3.2.0.RELEASE</springsecurity-version>
-		<webflow-version>2.3.3.RELEASE</webflow-version>
+		<webflow-version>2.4.0.BUILD-SNAPSHOT</webflow-version>
 		<slf4j-version>1.6.1</slf4j-version>
 		<mojarra-version>2.2.5</mojarra-version>
 		<primefaces-version>4.0</primefaces-version>
@@ -156,8 +156,8 @@
 		<!-- Servlet -->
 		<dependency>
 			<groupId>javax.servlet</groupId>
-			<artifactId>servlet-api</artifactId>
-			<version>2.5</version>
+			<artifactId>javax.servlet-api</artifactId>
+			<version>3.0.1</version>
 			<scope>provided</scope>
 		</dependency>
 		<!-- JSR 303 with Hibernate Validator -->
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/AppConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/AppConfig.java
new file mode 100644
index 0000000..96ef724
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/AppConfig.java
@@ -0,0 +1,16 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.context.annotation.ComponentScan;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.context.annotation.Import;
+
+@Configuration
+@ComponentScan(basePackages="org.springframework.webflow.samples.booking")
+@Import(value={
+		DataAccessConfig.class,
+		WebMvcConfig.class,
+		WebFlowConfig.class
+	})
+public class AppConfig {
+
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
new file mode 100644
index 0000000..7167a1b
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DataAccessConfig.java
@@ -0,0 +1,44 @@
+package org.springframework.webflow.samples.booking.config;
+
+import java.util.Collections;
+
+import javax.persistence.EntityManagerFactory;
+import javax.sql.DataSource;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.jdbc.datasource.DriverManagerDataSource;
+import org.springframework.orm.jpa.JpaTransactionManager;
+import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;
+import org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter;
+import org.springframework.transaction.PlatformTransactionManager;
+import org.springframework.transaction.annotation.EnableTransactionManagement;
+
+@Configuration
+@EnableTransactionManagement(proxyTargetClass=true)
+public class DataAccessConfig {
+
+	@Bean
+	public PlatformTransactionManager transactionManager(EntityManagerFactory emf) {
+		JpaTransactionManager txManager = new JpaTransactionManager();
+		txManager.setEntityManagerFactory(emf);
+		return txManager;
+	}
+
+	@Bean
+	public LocalContainerEntityManagerFactoryBean entityManagerFactory() {
+		LocalContainerEntityManagerFactoryBean emf = new LocalContainerEntityManagerFactoryBean();
+		emf.setDataSource(dataSource());
+		emf.setJpaVendorAdapter(new HibernateJpaVendorAdapter());
+		emf.setJpaPropertyMap(Collections.singletonMap("hibernate.session_factory_name", "mySessionFactory"));
+		return emf;
+	}
+
+	@Bean
+	public DataSource dataSource() {
+		DriverManagerDataSource dataSource = new DriverManagerDataSource("jdbc:hsqldb:mem:booking", "sa", "");
+		dataSource.setDriverClassName("org.hsqldb.jdbcDriver");
+		return dataSource;
+	}
+
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
new file mode 100644
index 0000000..18a9065
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
@@ -0,0 +1,55 @@
+package org.springframework.webflow.samples.booking.config;
+
+import javax.faces.webapp.FacesServlet;
+import javax.servlet.Filter;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRegistration.Dynamic;
+
+import org.springframework.web.filter.CharacterEncodingFilter;
+import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
+
+public class DispatcherServletInitializer  extends AbstractAnnotationConfigDispatcherServletInitializer {
+
+	@Override
+	protected Class<?>[] getRootConfigClasses() {
+		return new Class<?>[] { SecurityConfig.class, AppConfig.class };
+	}
+
+	@Override
+	protected Class<?>[] getServletConfigClasses() {
+		return null;
+	}
+
+	@Override
+	protected String[] getServletMappings() {
+		return new String[] { "/spring/*" };
+	}
+
+	@Override
+	protected Filter[] getServletFilters() {
+		return new Filter[] { new CharacterEncodingFilter() };
+	}
+
+	@Override
+	public void onStartup(ServletContext servletContext) throws ServletException {
+
+		// Use JSF view templates saved as *.xhtml, for use with Facelets
+		servletContext.setInitParameter("javax.faces.DEFAULT_SUFFIX", ".xhtml");
+		// Enable special Facelets debug output during development
+		servletContext.setInitParameter("javax.faces.PROJECT_STAGE", "Development");
+		// Causes Facelets to refresh templates during development
+		servletContext.setInitParameter("javax.faces.FACELETS_REFRESH_PERIOD", "1");
+		// Declare Spring Security Facelets tag library
+		servletContext.setInitParameter("javax.faces.FACELETS_LIBRARIES", "/WEB-INF/springsecurity.taglib.xml");
+
+		// Add this so the JSF implementation can initialize, *not* used for request processing
+		Dynamic facesServlet = servletContext.addServlet("facesServlet", new FacesServlet());
+		facesServlet.addMapping("*.faces");
+		facesServlet.setLoadOnStartup(0);
+
+		// Let the DispatcherServlet be registered
+		super.onStartup(servletContext);
+	}
+
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
new file mode 100644
index 0000000..03d2007
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -0,0 +1,44 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
+import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
+
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig extends WebSecurityConfigurerAdapter {
+
+	@Override
+	protected void configure(HttpSecurity http) throws Exception {
+		http
+			.formLogin()
+				.loginPage("/spring/login")
+				.loginProcessingUrl("/spring/loginProcess")
+				.defaultSuccessUrl("/spring/main")
+				.failureUrl("/spring/login?login_error=1")
+				.and()
+			.logout()
+				.logoutUrl("/spring/logout")
+				.logoutSuccessUrl("/spring/logoutSuccess")
+				.and()
+			.requestCache()
+				.requestCache(new HttpSessionRequestCache())
+				.and()
+			.csrf().disable();
+	}
+
+	@Override
+	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
+		auth.inMemoryAuthentication()
+			.passwordEncoder(new Md5PasswordEncoder())
+			.withUser("keith").password("417c7382b16c395bc25b5da1398cf076").roles("USER", "SUPERVISOR").and()
+			.withUser("erwin").password("12430911a8af075c6f41c6976af22b09").roles("USER", "SUPERVISOR").and()
+			.withUser("jeremy").password("57c6cbff0d421449be820763f03139eb").roles("USER").and()
+			.withUser("scott").password("942f2339bf50796de535a384f0d1af3e").roles("USER");
+	}
+
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
new file mode 100644
index 0000000..df49deb
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityWebApplicationInitializer.java
@@ -0,0 +1,10 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
+
+/**
+ * ServletContext initializer for Spring Security specific configuration such as
+ * the chain of Spring Security filters.
+ */
+public class SecurityWebApplicationInitializer extends AbstractSecurityWebApplicationInitializer {
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
new file mode 100644
index 0000000..97d98cb
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebFlowConfig.java
@@ -0,0 +1,36 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.faces.config.AbstractFacesFlowConfiguration;
+import org.springframework.faces.webflow.FlowFacesContextLifecycleListener;
+import org.springframework.webflow.definition.registry.FlowDefinitionRegistry;
+import org.springframework.webflow.engine.builder.support.FlowBuilderServices;
+import org.springframework.webflow.executor.FlowExecutor;
+import org.springframework.webflow.security.SecurityFlowExecutionListener;
+
+@Configuration
+public class WebFlowConfig extends AbstractFacesFlowConfiguration {
+
+	@Bean
+	public FlowExecutor flowExecutor() {
+		return getFlowExecutorBuilder(flowRegistry())
+				.addFlowExecutionListener(new FlowFacesContextLifecycleListener())
+				.addFlowExecutionListener(new SecurityFlowExecutionListener())
+				.build();
+	}
+
+	@Bean
+	public FlowDefinitionRegistry flowRegistry() {
+		return getFlowDefinitionRegistryBuilder(flowBuilderServices())
+				.setBasePath("/WEB-INF/flows")
+				.addFlowLocationPattern("/**/*-flow.xml")
+				.build();
+	}
+
+	@Bean
+	public FlowBuilderServices flowBuilderServices() {
+		return getFlowBuilderServicesBuilder().setDevelopmentMode(true).build();
+	}
+
+}
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
new file mode 100644
index 0000000..b599e80
--- /dev/null
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
@@ -0,0 +1,52 @@
+package org.springframework.webflow.samples.booking.config;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.faces.mvc.JsfView;
+import org.springframework.faces.webflow.JsfFlowHandlerAdapter;
+import org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter;
+import org.springframework.web.servlet.mvc.UrlFilenameViewController;
+import org.springframework.web.servlet.view.UrlBasedViewResolver;
+import org.springframework.webflow.mvc.servlet.FlowHandlerAdapter;
+import org.springframework.webflow.mvc.servlet.FlowHandlerMapping;
+
+
+@Configuration
+public class WebMvcConfig {
+
+	@Autowired
+	private WebFlowConfig webFlowConfig;
+
+	@Bean
+	public FlowHandlerMapping flowHandlerMapping() {
+		FlowHandlerMapping mapping = new FlowHandlerMapping();
+		mapping.setOrder(1);
+		mapping.setFlowRegistry(this.webFlowConfig.flowRegistry());
+		/* If no flow matches, map the path to a view, e.g. "/intro" maps to a view named "intro" */
+		mapping.setDefaultHandler(new UrlFilenameViewController());
+		return mapping;
+	}
+
+	@Bean
+	public FlowHandlerAdapter flowHandlerAdapter() {
+		JsfFlowHandlerAdapter adapter = new JsfFlowHandlerAdapter();
+		adapter.setFlowExecutor(this.webFlowConfig.flowExecutor());
+		return adapter;
+	}
+
+	@Bean
+	public UrlBasedViewResolver faceletsViewResolver() {
+		UrlBasedViewResolver resolver = new UrlBasedViewResolver();
+		resolver.setViewClass(JsfView.class);
+		resolver.setPrefix("/WEB-INF/");
+		resolver.setSuffix(".xhtml");
+		return resolver;
+	}
+
+	@Bean
+	public SimpleControllerHandlerAdapter simpleControllerHandlerAdapter() {
+		return new SimpleControllerHandlerAdapter();
+	}
+
+}
diff --git a/booking-faces/src/main/webapp/WEB-INF/config/data-access-config.xml b/booking-faces/src/main/webapp/WEB-INF/config/data-access-config.xml
deleted file mode 100644
index 2d654bc..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/config/data-access-config.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:tx="http://www.springframework.org/schema/tx"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd">
-
-	<!-- Instructs Spring to perfrom declarative transaction management on annotated classes -->
-	<tx:annotation-driven />
-
-	<!-- Drives transactions using local JPA APIs -->
-	<bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">
-		<property name="entityManagerFactory" ref="entityManagerFactory" />
-	</bean>
-		
-	<!-- Creates a EntityManagerFactory for use with the Hibernate JPA provider and a simple in-memory data source populated with test data -->
-	<bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
-		<property name="dataSource" ref="dataSource" />
-		<property name="jpaVendorAdapter">
-			<bean class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter" />
-		</property>
-	</bean>
-
-	<!-- Deploys a in-memory "booking" datasource populated -->
-	<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
-		<property name="driverClassName" value="org.hsqldb.jdbcDriver" />
-		<property name="url" value="jdbc:hsqldb:mem:booking" />
-		<property name="username" value="sa" />
-		<property name="password" value="" />
-	</bean>
-	
-</beans>
\ No newline at end of file
diff --git a/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml b/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
deleted file mode 100644
index 09a6009..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/config/security-config.xml
+++ /dev/null
@@ -1,38 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:security="http://www.springframework.org/schema/security"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
-           http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd">
-
-	<!-- Configure Spring Security -->
-	<security:http auto-config="true" use-expressions="true">
-		<security:form-login login-page="/spring/login" login-processing-url="/spring/loginProcess" 
-			default-target-url="/spring/main" authentication-failure-url="/spring/login?login_error=1" />
-		<security:logout logout-url="/spring/logout" logout-success-url="/spring/logoutSuccess" />
-		<security:intercept-url pattern="/secure" method="POST" access="hasRole('ROLE_SUPERVISOR')"/>
-	</security:http>
-    
-	<!--
-		Define local authentication provider, a real app would use an external provider (JDBC, LDAP, CAS, etc)
-		
-		usernames/passwords are:
-			keith/melbourne
-			erwin/leuven
-			jeremy/atlanta
-			scott/rochester
-	-->
-	<security:authentication-manager>
-		<security:authentication-provider>
-			<security:password-encoder hash="md5" />
-			<security:user-service>
-				<security:user name="keith" password="417c7382b16c395bc25b5da1398cf076" authorities="ROLE_USER, ROLE_SUPERVISOR" />
-				<security:user name="erwin" password="12430911a8af075c6f41c6976af22b09" authorities="ROLE_USER, ROLE_SUPERVISOR" />
-				<security:user name="jeremy" password="57c6cbff0d421449be820763f03139eb" authorities="ROLE_USER" />
-				<security:user name="scott" password="942f2339bf50796de535a384f0d1af3e" authorities="ROLE_USER" />
-			</security:user-service>
-		</security:authentication-provider>
-	</security:authentication-manager>	
-
-</beans>
diff --git a/booking-faces/src/main/webapp/WEB-INF/config/web-application-config.xml b/booking-faces/src/main/webapp/WEB-INF/config/web-application-config.xml
deleted file mode 100644
index 5791b17..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/config/web-application-config.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd">
-
-	<!-- Scans for application @Components to deploy -->
-	<context:component-scan base-package="org.springframework.webflow.samples.booking" />
-
-	<!-- Imports the configurations of the different infrastructure systems of the application -->
-	<import resource="webmvc-config.xml" />
-	<import resource="webflow-config.xml" />
-	<import resource="data-access-config.xml" />
-	<import resource="security-config.xml" />
-
-</beans>
\ No newline at end of file
diff --git a/booking-faces/src/main/webapp/WEB-INF/config/webflow-config.xml b/booking-faces/src/main/webapp/WEB-INF/config/webflow-config.xml
deleted file mode 100644
index 51efb44..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/config/webflow-config.xml
+++ /dev/null
@@ -1,33 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:webflow="http://www.springframework.org/schema/webflow-config"
-       xmlns:faces="http://www.springframework.org/schema/faces"
-       xsi:schemaLocation="
-           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-           http://www.springframework.org/schema/webflow-config http://www.springframework.org/schema/webflow-config/spring-webflow-config-2.3.xsd
-           http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces-2.2.xsd">
-
-	<!-- Executes flows: the central entry point into the Spring Web Flow system -->
-	<webflow:flow-executor id="flowExecutor">
-		<webflow:flow-execution-listeners>
-			<webflow:listener ref="facesContextListener"/>
-			<webflow:listener ref="securityFlowExecutionListener" />
-		</webflow:flow-execution-listeners>
-	</webflow:flow-executor>
-	
-	<!-- The registry of executable flow definitions -->
-	<webflow:flow-registry id="flowRegistry" flow-builder-services="facesFlowBuilderServices" base-path="/WEB-INF/flows">
-		<webflow:flow-location-pattern value="/**/*-flow.xml" />
-	</webflow:flow-registry>
-	
-	<!-- Configures the Spring Web Flow JSF integration -->
-	<faces:flow-builder-services id="facesFlowBuilderServices" development="true" />
-
-	<!-- Installs a listener that creates and releases the FacesContext for each request. -->
-	<bean id="facesContextListener" class="org.springframework.faces.webflow.FlowFacesContextLifecycleListener"/>
-	
-	<!-- Installs a listener to apply Spring Security authorities -->
-	<bean id="securityFlowExecutionListener" class="org.springframework.webflow.security.SecurityFlowExecutionListener" />
-
-</beans>
\ No newline at end of file
diff --git a/booking-faces/src/main/webapp/WEB-INF/config/webmvc-config.xml b/booking-faces/src/main/webapp/WEB-INF/config/webmvc-config.xml
deleted file mode 100644
index b5581ad..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/config/webmvc-config.xml
+++ /dev/null
@@ -1,36 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://www.springframework.org/schema/beans"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xmlns:faces="http://www.springframework.org/schema/faces"
-	xsi:schemaLocation="
-		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
-		http://www.springframework.org/schema/faces http://www.springframework.org/schema/faces/spring-faces-2.4.xsd">
-
-	<faces:resources />
-
-	<!-- Maps request paths to flows in the flowRegistry; e.g. a path of /hotels/booking looks for a flow with id "hotels/booking" -->
-	<bean class="org.springframework.webflow.mvc.servlet.FlowHandlerMapping">
-		<property name="order" value="1"/>
-		<property name="flowRegistry" ref="flowRegistry" />
-		<property name="defaultHandler">
-			<!-- If no flow match, map path to a view to render; e.g. the "/intro" path would map to the view named "intro" -->	
-			<bean class="org.springframework.web.servlet.mvc.UrlFilenameViewController" />
-		</property>
-	</bean>
-
-	<!-- Maps logical view names to Facelet templates in /WEB-INF (e.g. 'search' to '/WEB-INF/search.xhtml' -->
-	<bean id="faceletsViewResolver" class="org.springframework.web.servlet.view.UrlBasedViewResolver">
-		<property name="viewClass" value="org.springframework.faces.mvc.JsfView"/>
-		<property name="prefix" value="/WEB-INF/" />
-		<property name="suffix" value=".xhtml" />
-	</bean>
-
-	<!-- Dispatches requests mapped to org.springframework.web.servlet.mvc.Controller implementations -->
-	<bean class="org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter" />
-
-	<!-- Dispatches requests mapped to flows to FlowHandler implementations -->
-	<bean class="org.springframework.faces.webflow.JsfFlowHandlerAdapter">
-		<property name="flowExecutor" ref="flowExecutor" />
-	</bean>
-
-</beans>
diff --git a/booking-faces/src/main/webapp/WEB-INF/login.xhtml b/booking-faces/src/main/webapp/WEB-INF/login.xhtml
index b37fb94..e48cc16 100755
--- a/booking-faces/src/main/webapp/WEB-INF/login.xhtml
+++ b/booking-faces/src/main/webapp/WEB-INF/login.xhtml
@@ -37,12 +37,12 @@
 					<c:if test="${not empty param.login_error}">
 						<c:set var="username" value="${sessionScope.SPRING_SECURITY_LAST_USERNAME}"/>
 					</c:if>
-					<input type="text" name="j_username" value="#{username}"/>
+					<input type="text" name="username" value="#{username}"/>
 				</p>
 				<p>
 					Password:
 					<br />
-					<input type="password" name="j_password" />				
+					<input type="password" name="password" />
 				</p>
 				<p>
 					<input type="checkbox" name="_spring_security_remember_me"/> 
diff --git a/booking-faces/src/main/webapp/WEB-INF/web.xml b/booking-faces/src/main/webapp/WEB-INF/web.xml
deleted file mode 100755
index 9a4ac64..0000000
--- a/booking-faces/src/main/webapp/WEB-INF/web.xml
+++ /dev/null
@@ -1,117 +0,0 @@
-<?xml version="1.0" encoding="ISO-8859-1"?>
-<web-app xmlns="http://java.sun.com/xml/ns/j2ee"
-	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_5.xsd"
-	version="2.5">
-
-	<!-- The master configuration file for this Spring web application -->
-	<context-param>
-		<param-name>contextConfigLocation</param-name>
-		<param-value>
-			/WEB-INF/config/web-application-config.xml
-		</param-value>
-	</context-param>
-	
-	<!-- Use JSF view templates saved as *.xhtml, for use with Facelets -->
-	<context-param>
-		<param-name>javax.faces.DEFAULT_SUFFIX</param-name>
-		<param-value>.xhtml</param-value>
-	</context-param>
-	
-	<!-- Enables special Facelets debug output during development -->
-  	<context-param>
-        <param-name>javax.faces.PROJECT_STAGE</param-name>
-   		<param-value>Development</param-value>
-  	</context-param>
-  	
-  	<!-- Causes Facelets to refresh templates during development -->
-  	<context-param>
-  		<param-name>javax.faces.FACELETS_REFRESH_PERIOD</param-name>
-  		<param-value>1</param-value>
-  	</context-param>
-
-	<!--
-		Uncomment this to disable partial state saving when using Apache MyFaces 2 !!
-	<context-param>
-		<param-name>javax.faces.PARTIAL_STATE_SAVING</param-name>
-		<param-value>false</param-value>
-	</context-param>
-	-->
-
-  	
-  	<!-- Declare Spring Security Facelets tag library -->
-  	<context-param>
-  		<param-name>javax.faces.FACELETS_LIBRARIES</param-name>
-  		<param-value>/WEB-INF/springsecurity.taglib.xml</param-value>
-  	</context-param>
-  	
-    <!-- Enforce UTF-8 Character Encoding -->
-    <filter>
-        <filter-name>charEncodingFilter</filter-name>
-        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
-        <init-param>
-            <param-name>encoding</param-name>
-            <param-value>UTF-8</param-value>
-        </init-param>
-        <init-param>
-            <param-name>forceEncoding</param-name>
-            <param-value>true</param-value>
-        </init-param>
-    </filter>
-    
-    <filter-mapping>
-        <filter-name>charEncodingFilter</filter-name>
-        <url-pattern>/*</url-pattern>
-    </filter-mapping>
-    
-	<!-- Enables Spring Security -->
-	<filter>
-        <filter-name>springSecurityFilterChain</filter-name>
-        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
-    </filter>
-	 
-    <filter-mapping>
-      <filter-name>springSecurityFilterChain</filter-name>
-      <url-pattern>/*</url-pattern>
-    </filter-mapping>
-
-	<!-- Loads the Spring web application context -->
-	<listener>
-		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
-	</listener>
-  	
-	<!-- The front controller of this Spring Web application, responsible for handling all application requests -->
-	<servlet>
-		<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
-		<init-param>
-			<param-name>contextConfigLocation</param-name>
-			<param-value></param-value>
-		</init-param>
-		<load-on-startup>2</load-on-startup>
-	</servlet>
-		
-	<!-- Map all /spring requests to the Dispatcher Servlet for handling -->
-	<servlet-mapping>
-		<servlet-name>Spring MVC Dispatcher Servlet</servlet-name>
-		<url-pattern>/spring/*</url-pattern>
-	</servlet-mapping>
-
-	<!-- Just here so the JSF implementation can initialize, *not* used at runtime -->
-	<servlet>
-		<servlet-name>Faces Servlet</servlet-name>
-		<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
-		<load-on-startup>1</load-on-startup>
-	</servlet>
-	
-	<!-- Just here so the JSF implementation can initialize -->
-	<servlet-mapping>
-		<servlet-name>Faces Servlet</servlet-name>
-		<url-pattern>*.faces</url-pattern>
-	</servlet-mapping>
-	
-	<welcome-file-list>
-		<welcome-file>index.html</welcome-file>
-	</welcome-file-list>
-
-</web-app>

From addc2134221d5df132177eb8f55efcc4278dc707 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Wed, 26 Feb 2014 17:32:19 -0500
Subject: [PATCH 4/7] Update Thymeleaf version and enable CSRF protection

---
 booking-mvc/pom.xml                                  | 12 ++++++------
 .../samples/booking/config/SecurityConfig.java       |  5 ++---
 .../webflow/samples/booking/config/WebMvcConfig.java |  8 ++++----
 3 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/booking-mvc/pom.xml b/booking-mvc/pom.xml
index e899a48..8897eda 100644
--- a/booking-mvc/pom.xml
+++ b/booking-mvc/pom.xml
@@ -12,10 +12,10 @@
 		<springsecurity-version>3.2.0.RELEASE</springsecurity-version>
 		<webflow-version>2.4.0.BUILD-SNAPSHOT</webflow-version>
 		<slf4j-version>1.7.5</slf4j-version>
-		<thymeleaf-version>2.0.15</thymeleaf-version>
-		<thymeleaf-extras-tiles2-version>2.0.0</thymeleaf-extras-tiles2-version>
-		<thymeleaf-extras-springsecurity3-version>2.0.0</thymeleaf-extras-springsecurity3-version>
-		<thymeleaf-extras-conditionalcomments-version>2.0.0</thymeleaf-extras-conditionalcomments-version>
+		<thymeleaf-version>2.1.2.RELEASE</thymeleaf-version>
+		<thymeleaf-extras-tiles2-version>2.1.1.RELEASE</thymeleaf-extras-tiles2-version>
+		<thymeleaf-extras-springsecurity3-version>2.1.1.RELEASE</thymeleaf-extras-springsecurity3-version>
+		<thymeleaf-extras-conditionalcomments-version>2.1.0.RELEASE</thymeleaf-extras-conditionalcomments-version>
 		<tiles-version>2.2.2</tiles-version>
 	</properties>
 
@@ -54,12 +54,12 @@
 		</dependency>
 		<dependency>
 			<groupId>org.thymeleaf</groupId>
-			<artifactId>thymeleaf-spring3</artifactId>
+			<artifactId>thymeleaf-spring4</artifactId>
 			<version>${thymeleaf-version}</version>
 		</dependency>
 		<dependency>
 			<groupId>org.thymeleaf.extras</groupId>
-			<artifactId>thymeleaf-extras-tiles2</artifactId>
+			<artifactId>thymeleaf-extras-tiles2-spring4</artifactId>
 			<version>${thymeleaf-extras-tiles2-version}</version>
 		</dependency>
 		<dependency>
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
index cf1a71f..c05e755 100644
--- a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -4,17 +4,16 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
 
 @Configuration
-@EnableWebSecurity
+@EnableWebMvcSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
 		http
-			.csrf().disable()
 			.formLogin()
 				.loginPage("/login")
 				.loginProcessingUrl("/loginProcess")
diff --git a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
index 82ffca7..9977aed 100644
--- a/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
+++ b/booking-mvc/src/main/java/org/springframework/webflow/samples/booking/config/WebMvcConfig.java
@@ -18,10 +18,10 @@ import org.thymeleaf.dialect.IDialect;
 import org.thymeleaf.extras.conditionalcomments.dialect.ConditionalCommentsDialect;
 import org.thymeleaf.extras.springsecurity3.dialect.SpringSecurityDialect;
 import org.thymeleaf.extras.tiles2.dialect.TilesDialect;
-import org.thymeleaf.extras.tiles2.spring.web.configurer.ThymeleafTilesConfigurer;
-import org.thymeleaf.extras.tiles2.spring.web.view.FlowAjaxThymeleafTilesView;
-import org.thymeleaf.spring3.SpringTemplateEngine;
-import org.thymeleaf.spring3.view.AjaxThymeleafViewResolver;
+import org.thymeleaf.extras.tiles2.spring4.web.configurer.ThymeleafTilesConfigurer;
+import org.thymeleaf.extras.tiles2.spring4.web.view.FlowAjaxThymeleafTilesView;
+import org.thymeleaf.spring4.SpringTemplateEngine;
+import org.thymeleaf.spring4.view.AjaxThymeleafViewResolver;
 import org.thymeleaf.templateresolver.ServletContextTemplateResolver;
 
 @EnableWebMvc

From 7d8a3ce8ddfcf7128815311c7b3ca87efe48e79b Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Wed, 26 Feb 2014 22:01:25 -0500
Subject: [PATCH 5/7] Autowire BookingService into the HotelLazyDataModel

---
 .../samples/booking/HotelLazyDataModel.java        | 13 +++++++++----
 .../webflow/samples/booking/SearchCriteria.java    |  9 ---------
 .../main/webapp/WEB-INF/flows/main/main-flow.xml   | 14 ++++++++------
 3 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/HotelLazyDataModel.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/HotelLazyDataModel.java
index 5d48baa..6093396 100644
--- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/HotelLazyDataModel.java
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/HotelLazyDataModel.java
@@ -8,25 +8,30 @@ import java.util.Map;
 
 import org.primefaces.model.LazyDataModel;
 import org.primefaces.model.SortOrder;
+import org.springframework.beans.factory.annotation.Autowired;
 
 public class HotelLazyDataModel extends LazyDataModel<Hotel> {
 
 	private static final long serialVersionUID = -8832831134966938627L;
 
-	SearchCriteria searchCriteria;
+	private SearchCriteria searchCriteria;
 
-	BookingService bookingService;
+	private BookingService bookingService;
 
 	private List<Hotel> hotels;
 
 	private Hotel selected;
 
 
-	public HotelLazyDataModel(SearchCriteria searchCriteria, BookingService bookingService) {
-		this.searchCriteria = searchCriteria;
+	@Autowired
+	public void setBookingService(BookingService bookingService) {
 		this.bookingService = bookingService;
 	}
 
+	public void setSearchCriteria(SearchCriteria searchCriteria) {
+		this.searchCriteria = searchCriteria;
+	}
+
 	@Override
 	public List<Hotel> load(int first, int pageSize, String sortField, SortOrder order, Map<String, String> filters) {
 		this.searchCriteria.setCurrentPage(first / pageSize + 1);
diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/SearchCriteria.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/SearchCriteria.java
index 9888777..8bf2cd7 100755
--- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/SearchCriteria.java
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/SearchCriteria.java
@@ -2,8 +2,6 @@ package org.springframework.webflow.samples.booking;
 
 import java.io.Serializable;
 
-import javax.faces.model.DataModel;
-
 /**
  * A backing bean for the main hotel search form. Encapsulates the criteria needed to perform a hotel search.
  */
@@ -26,13 +24,6 @@ public class SearchCriteria implements Serializable {
 	 */
 	private int currentPage = 1;
 
-	/**
-	 * Returns a {@link DataModel} based on the search criteria.
-	 * @param bookingService the service to use to retrieve hotels.
-	 */
-	public DataModel<Hotel> getDataModel(BookingService bookingService) {
-		return new HotelLazyDataModel(this, bookingService);
-	}
 
 	public String getSearchString() {
 		return searchString;
diff --git a/booking-faces/src/main/webapp/WEB-INF/flows/main/main-flow.xml b/booking-faces/src/main/webapp/WEB-INF/flows/main/main-flow.xml
index 0ad4cc8..c08aa87 100755
--- a/booking-faces/src/main/webapp/WEB-INF/flows/main/main-flow.xml
+++ b/booking-faces/src/main/webapp/WEB-INF/flows/main/main-flow.xml
@@ -4,12 +4,13 @@
 	xsi:schemaLocation="
 		http://www.springframework.org/schema/webflow
 		http://www.springframework.org/schema/webflow/spring-webflow-2.0.xsd">
-	
-	<var name="searchCriteria" class="org.springframework.webflow.samples.booking.SearchCriteria" />
+
+	<var name="searchCriteria" class="org.springframework.webflow.samples.booking.SearchCriteria"/>
 	
 	<view-state id="enterSearchCriteria">
 		<on-render>
-			<evaluate expression="bookingService.findBookings(currentUser?.name)" result="viewScope.bookings" result-type="dataModel" />
+			<evaluate expression="bookingService.findBookings(currentUser?.name)"
+				result="viewScope.bookings" result-type="dataModel" />
 		</on-render>
 		<transition on="search" to="reviewHotels"/>
 		<transition on="cancelBooking">
@@ -18,9 +19,10 @@
 	</view-state>
 	
 	<view-state id="reviewHotels">
-		<on-entry>
-			<set name="viewScope.hotels" value="searchCriteria.getDataModel(bookingService)" />
-		</on-entry>
+		<var name="hotels" class="org.springframework.webflow.samples.booking.HotelLazyDataModel"/>
+		<on-render>
+			<evaluate expression="hotels.setSearchCriteria(searchCriteria)" />
+		</on-render>
 		<transition on="select" to="reviewHotel">
 			<set name="flowScope.hotel" value="hotels.selected" />
 		</transition>

From 242b5908da182086768e35fbe941c5052e5736d9 Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Wed, 26 Feb 2014 22:41:32 -0500
Subject: [PATCH 6/7] Replace FacesServlet declaration w/ ConfigureListener

---
 .../booking/config/DispatcherServletInitializer.java  | 11 +++++------
 .../samples/booking/MainFlowExecutionTests.java       |  2 +-
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
index 18a9065..a73d6db 100644
--- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/DispatcherServletInitializer.java
@@ -4,12 +4,14 @@ import javax.faces.webapp.FacesServlet;
 import javax.servlet.Filter;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
-import javax.servlet.ServletRegistration.Dynamic;
+import javax.servlet.ServletRegistration;
 
 import org.springframework.web.filter.CharacterEncodingFilter;
 import org.springframework.web.servlet.support.AbstractAnnotationConfigDispatcherServletInitializer;
 
-public class DispatcherServletInitializer  extends AbstractAnnotationConfigDispatcherServletInitializer {
+import com.sun.faces.config.ConfigureListener;
+
+public class DispatcherServletInitializer extends AbstractAnnotationConfigDispatcherServletInitializer {
 
 	@Override
 	protected Class<?>[] getRootConfigClasses() {
@@ -43,10 +45,7 @@ public class DispatcherServletInitializer  extends AbstractAnnotationConfigDispa
 		// Declare Spring Security Facelets tag library
 		servletContext.setInitParameter("javax.faces.FACELETS_LIBRARIES", "/WEB-INF/springsecurity.taglib.xml");
 
-		// Add this so the JSF implementation can initialize, *not* used for request processing
-		Dynamic facesServlet = servletContext.addServlet("facesServlet", new FacesServlet());
-		facesServlet.addMapping("*.faces");
-		facesServlet.setLoadOnStartup(0);
+		servletContext.addListener(ConfigureListener.class);
 
 		// Let the DispatcherServlet be registered
 		super.onStartup(servletContext);
diff --git a/booking-faces/src/test/java/org/springframework/webflow/samples/booking/MainFlowExecutionTests.java b/booking-faces/src/test/java/org/springframework/webflow/samples/booking/MainFlowExecutionTests.java
index 9feca43..29811dd 100644
--- a/booking-faces/src/test/java/org/springframework/webflow/samples/booking/MainFlowExecutionTests.java
+++ b/booking-faces/src/test/java/org/springframework/webflow/samples/booking/MainFlowExecutionTests.java
@@ -78,7 +78,7 @@ public class MainFlowExecutionTests extends AbstractXmlFlowExecutionTests {
 	hotel.setId(1L);
 	hotel.setName("Jameson Inn");
 	hotels.add(hotel);
-	HotelLazyDataModel dataModel = new HotelLazyDataModel(null, null);
+	HotelLazyDataModel dataModel = new HotelLazyDataModel();
 	dataModel.setSelected(hotel);
 	getViewScope().put("hotels", dataModel);
 

From f311f2d83306f8d2878274732f5e58510650541b Mon Sep 17 00:00:00 2001
From: Rossen Stoyanchev <rstoyanchev@gopivotal.com>
Date: Thu, 27 Feb 2014 11:29:11 -0500
Subject: [PATCH 7/7] Add reference to Spring Security issue w/ Java config

---
 .../samples/booking/config/SecurityConfig.java        | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
index 03d2007..8898767 100644
--- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
+++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java
@@ -14,6 +14,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
 	@Override
 	protected void configure(HttpSecurity http) throws Exception {
+
 		http
 			.formLogin()
 				.loginPage("/spring/login")
@@ -25,10 +26,14 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 				.logoutUrl("/spring/logout")
 				.logoutSuccessUrl("/spring/logoutSuccess")
 				.and()
+
+			// Disable CSRF (won't work with JSF) but ensure last HTTP POST request is saved
+			// See https://jira.springsource.org/browse/SEC-2498
+
+			.csrf().disable()
 			.requestCache()
-				.requestCache(new HttpSessionRequestCache())
-				.and()
-			.csrf().disable();
+				.requestCache(new HttpSessionRequestCache());
+
 	}
 
 	@Override