<authentication-manager>
        <authentication-provider ref="customAuthenticationProvider" />
     </authentication-manager>  

    <authentication-manager id="oauthClientAuthenticationManager">
        <authentication-provider user-service-ref="clientDetailsUserService">
            <password-encoder ref="passwordEncoder" />
        </authentication-provider>
    </authentication-manager>

    <oauth2:authorization-server token-services-ref="tokenServices"
                 client-details-service-ref="webServiceClientService"
                 user-approval-page="oauth/authorize" error-page="oauth/error">
        <oauth2:authorization-code />
    </oauth2:authorization-server>

    <beans:bean id="resourceServerFilter"
                class="it.dirimo.site.OAuthSigningTokenAuthenticationFilter">
        <beans:property name="authenticationEntryPoint"
                        ref="oauthAuthenticationEntryPoint" />
        <beans:property name="tokenServices" ref="tokenServices" />
        <beans:property name="resourceId" value="SUPPORT" />
    </beans:bean>

   <global-method-security pre-post-annotations="enabled" order="0"
                            proxy-target-class="true">
        <expression-handler ref="methodSecurityExpressionHandler" />
    </global-method-security>

    <http security="none" pattern="/resource/**" />
    <http security="none" pattern="/favicon.ico" />

    <http use-expressions="true" create-session="stateless"
          authentication-manager-ref="oauthClientAuthenticationManager"
          entry-point-ref="oauthAuthenticationEntryPoint" pattern="/oauth/token">
        <intercept-url pattern="/oauth/token"
                       access="hasAuthority('OAUTH_CLIENT')" />
        <http-basic />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
        <expression-handler ref="webSecurityExpressionHandler" />
    </http>

    <http use-expressions="true" create-session="stateless"
          entry-point-ref="oauthAuthenticationEntryPoint" pattern="/services/**">
        <intercept-url pattern="/services/**"
                       access="hasAuthority('OWNER')" />
        <custom-filter ref="resourceServerFilter" before="PRE_AUTH_FILTER" />
        <access-denied-handler ref="oauthAccessDeniedHandler" />
        <expression-handler ref="webSecurityExpressionHandler" />
    </http>

    <http use-expressions="true">
        <intercept-url pattern="/oauth/**" access="hasAuthority('OWNER')" />
        <intercept-url pattern="/login/**" access="permitAll() "/>
        <intercept-url pattern="/push/**"  access="permitAll()" />
        <intercept-url pattern="/logout"   access="permitall()" />
        <intercept-url pattern="/**"       access="isFullyAuthenticated()" />
        <form-login default-target-url="/" login-page="/login"
                    login-processing-url="/login/submit"
                    authentication-failure-url="/login?loginFailed"
                    username-parameter="username" password-parameter="password" />
         <logout logout-url="/logout" logout-success-url="/login?loggedOut"
                delete-cookies="JSESSIONID" invalidate-session="true" />
        <session-management invalid-session-url="/login"
                            session-fixation-protection="changeSessionId"> 
            <concurrency-control error-if-maximum-exceeded="true" max-sessions="1000"
                                 session-registry-ref="sessionRegistry" />
        </session-management>
        <expression-handler ref="webSecurityExpressionHandler"/>
</http>