package ca.corefacility.bioinformatics.irida.web.config;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.annotation.web.configurers.SessionCreationPolicy;

import ca.corefacility.bioinformatics.irida.config.IridaApiSecurityConfig;

@Configuration
@EnableWebSecurity
@Import(IridaApiSecurityConfig.class)
public class IridaRestApiSecurityConfig extends WebSecurityConfigurerAdapter {
	@Autowired
	private AuthenticationManager authenticationManager;

	@Override
	public void configure(HttpSecurity http) throws Exception {
		http.authorizeUrls().anyRequest().fullyAuthenticated().and().httpBasic().and().sessionManagement()
				.sessionCreationPolicy(SessionCreationPolicy.stateless);
	}

	@Override
	protected void registerAuthentication(AuthenticationManagerBuilder auth) {
		auth.parentAuthenticationManager(authenticationManager);
	}
}

@@ -361,60 +361,55 @@
 ion.
-authentication.builders.AuthenticationManagerBuilder
+method.configuration.EnableGlobalMethodSecurity
 ;%0Aim
@@ -884,16 +884,396 @@
 ecurity%0A
+// DO NOT WANT. For some reason, even though we import the%0A// IridaApiSecurityConfig below (that already has @EnableGlobalMethodSecurity),%0A// we must add the annotation again to this configuration class. That doesn't%0A// allow us to turn method security on in the API project, then use the API%0A// project configuration elsewhere.%0A@EnableGlobalMethodSecurity(prePostEnabled = true)%0A
 @Import(
@@ -1621,16 +1621,16 @@
 ement()%0A
+
 %09%09%09%09.ses
@@ -1688,157 +1688,7 @@
 ;%0A%09%7D
-%0A%0A%09@Override%0A%09protected void registerAuthentication(AuthenticationManagerBuilder auth) %7B%0A%09%09auth.parentAuthenticationManager(authenticationManager);%0A%09%7D
 %0A%7D%0A

Enable method-level security by annotating the configuration class in *this* project. Works (for now), but not an ideal solution.