<!-- Security -->
	
	<context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>/WEB-INF/applicationContext.xml</param-value>
	</context-param>

	<filter>
		<filter-name>RequestContextFilter</filter-name>
		<filter-class>
			org.springframework.web.filter.RequestContextFilter
		</filter-class>
	</filter>

	<filter-mapping>
		<filter-name>RequestContextFilter</filter-name>
		<servlet-name>Persistent Faces Servlet</servlet-name>
	</filter-mapping>
	
	<listener>
	    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	  </listener>
	
	<filter>
        <filter-name>Acegi Filter Chain Proxy</filter-name>
        <filter-class>org.acegisecurity.util.FilterToBeanProxy</filter-class>
        <init-param>
            <param-name>targetClass</param-name>
            <param-value>org.acegisecurity.util.FilterChainProxy</param-value>
        </init-param>
    </filter>

    <filter-mapping>
      <filter-name>Acegi Filter Chain Proxy</filter-name>
      <servlet-name>Persistent Faces Servlet</servlet-name>
      <dispatcher>FORWARD</dispatcher>
      <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

<!-- Security Start -->	
	<application>
        <variable-resolver>
            org.springframework.web.jsf.DelegatingVariableResolver
        </variable-resolver>		
	</application>

	<lifecycle>
		<phase-listener>com.icesoft.icefaces.site.acegi.NoCachePhaseListener</phase-listener>
	</lifecycle>
<!-- Security Finish -->

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN 2.0//EN" "http://www.springframework.org/dtd/spring-beans-2.0.dtd">

<beans>

	<bean id="filterChainProxy" class="org.acegisecurity.util.FilterChainProxy">
		<property name="filterInvocationDefinitionSource">
			<value>
				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
				PATTERN_TYPE_APACHE_ANT
				/**=httpSessionContextIntegrationFilter,securityContextHolderAwareRequestFilter,exceptionTranslationFilter,filterInvocationInterceptor
			</value>
		</property>
	</bean>

	<bean id="httpSessionContextIntegrationFilter" class="org.acegisecurity.context.HttpSessionContextIntegrationFilter"/>
   
	<bean id="securityContextHolderAwareRequestFilter" class="org.acegisecurity.wrapper.SecurityContextHolderAwareRequestFilter"/>

	<bean id="exceptionTranslationFilter" class="org.acegisecurity.ui.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<bean class="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint">
				<property name="loginFormUrl" value="/index.jsp"/>
				<property name="forceHttps" value="false"/>
			</bean>
		</property>
		<property name="accessDeniedHandler">
			<bean class="org.acegisecurity.ui.AccessDeniedHandlerImpl">
			<property name="errorPage" value="/index.jsp"/>
			</bean>
		</property>
	</bean>

	<bean id="filterInvocationInterceptor" class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">
		<property name="authenticationManager" >
			<ref bean="authenticationManager"/>
		</property>
		<property name="accessDecisionManager">
			<bean class="org.acegisecurity.vote.AffirmativeBased">
				<property name="allowIfAllAbstainDecisions" value="false"/>
				<property name="decisionVoters">
					<list>
						<bean class="org.acegisecurity.vote.RoleVoter"/>
						<bean class="org.acegisecurity.vote.AuthenticatedVoter"/>
					</list>
				</property>
			</bean>
		</property>
		<property name="objectDefinitionSource">
			<value>
				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
				PATTERN_TYPE_APACHE_ANT
				/secure/**=ROLE_Administration
				/general/**=IS_AUTHENTICATED_REMEMBERED
			</value>
		</property>
	</bean>

	<bean id="authenticationManager" class="org.acegisecurity.providers.ProviderManager">
		<property name="providers">
			<list>
				<ref local="daoAuthenticationProvider"/>
			</list>
		</property>
	</bean>

	<bean id="daoAuthenticationProvider" class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
		<property name="userDetailsService" ref="userDetailsService"/>
		<property name="userCache">
			<bean class="org.acegisecurity.providers.dao.cache.EhCacheBasedUserCache">
				<property name="cache">
					<bean class="org.springframework.cache.ehcache.EhCacheFactoryBean">
						<property name="cacheManager">
							<bean class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
						</property>
						<property name="cacheName" value="userCache"/>
					</bean>
				</property>
			</bean>
		</property>
	</bean>

	<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->
	<bean id="userDetailsService" class="com.icesoft.icefaces.site.acegi.OurUserDetailsService">

	</bean>

    <bean id="authenticationController" class="com.icesoft.icefaces.site.acegi.AuthenticationController" scope="session">
        <property name="authenticationManager"><ref bean="authenticationManager"/></property>
    </bean>
	
	<!-- This bean is optional; it isn't used by any other bean as it only listens and logs -->
	<bean id="loggerListener" class="org.acegisecurity.event.authentication.LoggerListener"/>

</beans>

public class NoCachePhaseListener implements PhaseListener {

	   public PhaseId getPhaseId() {
	       return PhaseId.RENDER_RESPONSE;
	   }

	   public void afterPhase(PhaseEvent phaseEvent) {
	   }

	   public void beforePhase(PhaseEvent phaseEvent) {
	       FacesContext facesContext = phaseEvent.getFacesContext();
	       HttpServletResponse response = (HttpServletResponse) facesContext.getExternalContext().getResponse();
	       response.addHeader("Pragma", "no-cache");
	       response.addHeader("Cache-Control", "no-cache");
	       response.addHeader("Cache-Control", "no-store");
	       response.addHeader("Cache-Control", "must-revalidate");
	       response.addHeader("Expires", "Mon, 1 Jan 2006 05:00:00 GMT");//in the past
	   }
	} 

public final class AuthenticationController {

     private static final Log LOG = LogFactory.getLog( AuthenticationController.class );

     // injected properties
     private AuthenticationManager _authenticationManager;

     public String authenticate(String userName, String password) throws AuthenticationException{
         
         String outcome = "failure";
         
         final HttpServletRequest request = getRequest();

         try {
             final UsernamePasswordAuthenticationToken authReq = new UsernamePasswordAuthenticationToken(
                     userName, password );

             authReq.setDetails( new WebAuthenticationDetails( request ) );

             final HttpSession session = request.getSession();
             session.setAttribute(
                             AuthenticationProcessingFilter.ACEGI_SECURITY_LAST_USERNAME_KEY,
                             userName );

             /* perform authentication
              */
             final Authentication auth = getAuthenticationManager().authenticate( authReq );
          
             /* initialize the security context.
              */
             final SecurityContext secCtx = SecurityContextHolder.getContext();
             secCtx.setAuthentication( auth );
             session.setAttribute( HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY, secCtx );
             
             outcome = "success";

         } catch (Exception e ){
             outcome = "failure";
         }
         return outcome;
     }

     private HttpServletRequest getRequest() {
         return (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
     }

     public AuthenticationManager getAuthenticationManager() {
         return _authenticationManager;
     }

     public void setAuthenticationManager(
             AuthenticationManager authenticationManager ) {
         _authenticationManager = authenticationManager;
     }

}

            // begin acegi login
            persistentFacesState = PersistentFacesState.getInstance();
            authenticationController = ((AuthenticationController)persistentFacesState.getFacesContext().getApplication().getVariableResolver().resolveVariable(persistentFacesState.getFacesContext(), "authenticationController"));
            try{
               authenticationController.authenticate(username,password);
            } catch (AuthenticationException e) {
                loginMessage = e.getMessage() + ".";
                return "failed";
            }
            // end acegi login

        // acegi logout
        SecurityContextHolder.clearContext();
        final HttpServletRequest request = (HttpServletRequest) FacesContext.getCurrentInstance().getExternalContext().getRequest();
        final HttpSession session = request.getSession();
        session.removeAttribute( HttpSessionContextIntegrationFilter.ACEGI_SECURITY_CONTEXT_KEY );
        session.invalidate();

Authentication auth = SecurityContextHolder.getContext().getAuthentication();

Object obj = SecurityContextHolder.getContext().getAuthentication().getPrincipal();

if (obj instanceof UserDetails) {
  String username = ((UserDetails)obj).getUsername();
} else {
  String username = obj.toString();
}