/*
 * Copyright 2012-2013 the original author or authors.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *      http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package org.springframework.bootstrap.actuate.autoconfigure;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.bootstrap.actuate.properties.SecurityProperties;
import org.springframework.bootstrap.context.annotation.ConditionalOnClass;
import org.springframework.bootstrap.context.annotation.ConditionalOnMissingBean;
import org.springframework.bootstrap.context.annotation.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationEventPublisher;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
import org.springframework.security.authentication.ProviderManager;
import org.springframework.security.config.annotation.authentication.AuthenticationBuilder;
import org.springframework.security.config.annotation.web.EnableWebSecurity;
import org.springframework.security.config.annotation.web.HttpConfigurator;
import org.springframework.security.config.annotation.web.WebSecurityConfiguration;
import org.springframework.security.config.annotation.web.WebSecurityConfigurerAdapter;

/**
 * @author Dave Syer
 */
@Configuration
@ConditionalOnClass({ EnableWebSecurity.class })
@EnableWebSecurity
@EnableConfigurationProperties(SecurityProperties.class)
public class SecurityConfiguration {

	@Bean
	@ConditionalOnMissingBean({ AuthenticationEventPublisher.class })
	public AuthenticationEventPublisher authenticationEventPublisher() {
		return new DefaultAuthenticationEventPublisher();
	}

	@Bean
	public WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() {
		return new BoostrapWebSecurityConfigurerAdapter();
	}

	private static class BoostrapWebSecurityConfigurerAdapter extends
			WebSecurityConfigurerAdapter {

		@Value("${endpoints.healthz.path:/healthz}")
		private String healthzPath = "/healthz";

		@Value("${endpoints.info.path:/info}")
		private String infoPath = "/info";

		@Autowired
		private SecurityProperties security;

		@Autowired
		private AuthenticationEventPublisher authenticationEventPublisher;

		@Override
		protected void configure(HttpConfigurator http) throws Exception {
			http.antMatcher("/**").httpBasic().and().anonymous().disable();
			if (this.security.isRequireSsl()) {
				http.requiresChannel().antMatchers("/**").requiresSecure();
			}
			http.authorizeUrls().antMatchers("/**").hasRole("USER");
		}

		@Override
		public void configure(WebSecurityConfiguration builder) throws Exception {
			builder.ignoring().antMatchers(this.healthzPath, this.infoPath);
		}

		@Override
		protected AuthenticationManager authenticationManager() throws Exception {
			AuthenticationManager manager = super.authenticationManager();
			if (manager instanceof ProviderManager) {
				((ProviderManager) manager)
						.setAuthenticationEventPublisher(this.authenticationEventPublisher);
			}
			return manager;
		}

	}

	@ConditionalOnMissingBean(AuthenticationManager.class)
	@Configuration
	public static class AuthenticationManagerConfiguration {

		@Bean
		public AuthenticationManager authenticationManager() throws Exception {
			return new AuthenticationBuilder().inMemoryAuthentication().withUser("user")
					.password("password").roles("USER").and().and().build();
		}

	}

}

@@ -1623,24 +1623,31 @@
 thentication
+Manager
 Builder;%0Aimp
@@ -1639,24 +1639,24 @@
 gerBuilder;%0A
-
 import org.s
@@ -1792,18 +1792,19 @@
 nfigurat
-or
+ion
 ;%0Aimport
@@ -2972,18 +2972,19 @@
 nfigurat
-or
+ion
  http) t
@@ -3984,16 +3984,23 @@
 tication
+Manager
 Builder(
@@ -4025,16 +4025,22 @@
 cation()
+%0A%09%09%09%09%09
 .withUse
@@ -4048,22 +4048,16 @@
 (%22user%22)
-%0A%09%09%09%09%09
 .passwor
@@ -4095,16 +4095,22 @@
 ().and()
+%0A%09%09%09%09%09
 .build()

Update for Spring Security snapshot