Really simple spring security demo. Public data is accessible without login. Protected data is accessible only after login. Session timeout is set to 5 minutes. After login, each request must use same cookie JSESSIONID, because server is tracking http sessions by this cookie.

• Authentication is handled by internal service itx.examples.springboot.security.springsecurity.services.UserAccessService
• Authorization is handled by Spring's Method Security, RBAC model is used.

• POST http://localhost:8888/services/security/login

{
	"userName": "joe",
	"password": "secret"
}

• GET http://localhost:8888/services/security/logout

• joe / secret, ROLE_USER
• jane / secret, ROLE_USER, ROLE_ADMIN
• alice / secret, ROLE_PUBLIC

GET protected data for different user roles:

• GET http://localhost:8888/services/data/users/all (ROLE_USER, ROLE_ADMIN)
• GET http://localhost:8888/services/data/admins/all (ROLE_ADMIN)

• GET http://localhost:8888/services/public/data/all

gradle clean build 
java -jar build/libs/spring-security-0.0.1-SNAPSHOT.jar