diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/AuthApplication.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/AuthApplication.java
new file mode 100644
index 0000000..1f01f90
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/AuthApplication.java
@@ -0,0 +1,13 @@
+package com.supwisdom.leaveschool.auth;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class AuthApplication {
+
+  public static void main(String[] args) {
+    SpringApplication.run(AuthApplication.class, args);
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/PasswordEncoderConfig.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/PasswordEncoderConfig.java
new file mode 100644
index 0000000..50b5b9b
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/PasswordEncoderConfig.java
@@ -0,0 +1,30 @@
+package com.supwisdom.leaveschool.auth.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.crypto.factory.PasswordEncoderFactories;
+import org.springframework.security.crypto.password.DelegatingPasswordEncoder;
+import org.springframework.security.crypto.password.NoOpPasswordEncoder;
+import org.springframework.security.crypto.password.PasswordEncoder;
+
+@Configuration
+public class PasswordEncoderConfig {
+  
+  private static final Logger logger = LoggerFactory.getLogger(PasswordEncoderConfig.class);
+  
+  @Bean
+  public PasswordEncoder passwordEncoder() {
+    
+    PasswordEncoder passwordEncoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
+
+    if (passwordEncoder instanceof DelegatingPasswordEncoder) {
+      ((DelegatingPasswordEncoder)passwordEncoder).setDefaultPasswordEncoderForMatches(NoOpPasswordEncoder.getInstance());
+    }
+
+    logger.debug("PasswordEncoderConfig passwordEncoder is {}", passwordEncoder);
+    return passwordEncoder;
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/UserDetailsServiceConfig.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/UserDetailsServiceConfig.java
new file mode 100644
index 0000000..0b47d53
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/config/UserDetailsServiceConfig.java
@@ -0,0 +1,23 @@
+package com.supwisdom.leaveschool.auth.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.core.userdetails.UserDetailsService;
+
+import com.supwisdom.leaveschool.auth.security.core.userdetails.MyUserDetailsService;
+
+@Configuration
+public class UserDetailsServiceConfig {
+
+  private static final Logger logger = LoggerFactory.getLogger(UserDetailsServiceConfig.class);
+  
+  @Bean
+  public UserDetailsService userDetailsService(MyUserDetailsService myUserDetailsService) throws Exception {
+    
+    logger.debug("UserDetailsServiceConfig userDetailsService is {}", myUserDetailsService);
+    return myUserDetailsService;
+  }
+  
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/api/ApiUserController.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/api/ApiUserController.java
new file mode 100644
index 0000000..0c34be9
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/api/ApiUserController.java
@@ -0,0 +1,30 @@
+package com.supwisdom.leaveschool.auth.controller.api;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.springframework.util.MimeTypeUtils;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+@RestController
+@RequestMapping("/api/user")
+public class ApiUserController {
+  
+
+  /**
+   * curl -i -s -X GET -H 'Accept:application/json' 'http://admin:password@localhost:8080/api/user/greeting/abc'
+   *
+   * @param name
+   * @return
+   */
+  @GetMapping(path = "/greeting/{name}", produces = MimeTypeUtils.APPLICATION_JSON_VALUE)
+  public Map<String, Object> greeting(@PathVariable String name) {
+    Map<String, Object> result = new HashMap<>();
+    result.put("message", "Good " + name);
+    return result;
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/MainController.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/MainController.java
new file mode 100755
index 0000000..7cd6d0e
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/MainController.java
@@ -0,0 +1,53 @@
+/*
+ * Copyright 2002-2016 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.supwisdom.leaveschool.auth.controller.web;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.ui.Model;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+
+@Controller
+public class MainController {
+
+	@RequestMapping("/")
+	public String root() {
+		return "redirect:/web/index";
+	}
+
+	@RequestMapping("/web/index")
+	public String index() {
+		return "web/index";
+	}
+
+	@RequestMapping(value = "/web/login")
+	public String login() {
+		return "web/login";
+	}
+
+	@RequestMapping(value = "/web/login", method = RequestMethod.POST)
+	public String postLogin() {
+		// TODO Enable form login with Spring Security (trigger error for now)
+		return "redirect:/web/login-error";
+	}
+
+	@RequestMapping("/web/login-error")
+	public String loginError(Model model) {
+		model.addAttribute("loginError", true);
+		return "web/login";
+	}
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminRoleController.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminRoleController.java
new file mode 100644
index 0000000..bfc9786
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminRoleController.java
@@ -0,0 +1,5 @@
+package com.supwisdom.leaveschool.auth.controller.web.admin;
+
+public class WebAdminRoleController {
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminUserController.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminUserController.java
new file mode 100644
index 0000000..e98c17f
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/controller/web/admin/WebAdminUserController.java
@@ -0,0 +1,20 @@
+package com.supwisdom.leaveschool.auth.controller.web.admin;
+
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.RequestMapping;
+
+import com.supwisdom.leaveschool.auth.util.AuthenticationUtil;
+
+@Controller
+@RequestMapping("/web/admin/user")
+public class WebAdminUserController {
+
+  @RequestMapping("/index")
+  public String userIndex() {
+    
+    AuthenticationUtil.currentUsername();
+    
+    return "web/admin/user/index";
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUser.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUser.java
new file mode 100644
index 0000000..40fee48
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUser.java
@@ -0,0 +1,30 @@
+package com.supwisdom.leaveschool.auth.security.core.userdetails;
+
+import java.util.Collection;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.userdetails.User;
+
+public class MyUser extends User {
+  
+  //private static final Log logger = LogFactory.getLog(MyUser.class);
+  private static final Logger logger = LoggerFactory.getLogger(MyUser.class);
+
+  /**
+   * 
+   */
+  private static final long serialVersionUID = 5438858716934315373L;
+  
+  public MyUser(String username, String password,
+      Collection<? extends GrantedAuthority> authorities) {
+    this(username, password, true, true, true, true, authorities);
+  }
+
+  public MyUser(String username, String password, boolean enabled, boolean accountNonExpired,
+      boolean credentialsNonExpired, boolean accountNonLocked, Collection<? extends GrantedAuthority> authorities) {
+    super(username, password, enabled, accountNonExpired, credentialsNonExpired, accountNonLocked, authorities);
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUserDetailsService.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUserDetailsService.java
new file mode 100644
index 0000000..5310d9e
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/security/core/userdetails/MyUserDetailsService.java
@@ -0,0 +1,41 @@
+package com.supwisdom.leaveschool.auth.security.core.userdetails;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.core.GrantedAuthority;
+import org.springframework.security.core.authority.SimpleGrantedAuthority;
+import org.springframework.security.core.userdetails.UserDetails;
+import org.springframework.security.core.userdetails.UserDetailsService;
+import org.springframework.security.core.userdetails.UsernameNotFoundException;
+import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.stereotype.Service;
+
+@Service
+public class MyUserDetailsService implements UserDetailsService {
+  
+  //private static final Log logger = LogFactory.getLog(MyUserDetailsService.class);
+  private static final Logger logger = LoggerFactory.getLogger(MyUserDetailsService.class);
+  
+  @Autowired
+  PasswordEncoder passwordEncoder;
+  
+  @Override
+  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
+    
+    logger.debug("MyUserDetailsService.loadUserByUsername({})", username);
+    
+    // TODO: 从数据库获取
+    List<GrantedAuthority> authorities = new ArrayList<GrantedAuthority>();
+    authorities.add(new SimpleGrantedAuthority("ROLE_USER"));
+    
+    MyUser myUser = new MyUser("user", passwordEncoder.encode("password"), authorities);
+    logger.debug("myUser is {}", myUser);
+    
+    return myUser;
+  }
+
+}
diff --git a/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/util/AuthenticationUtil.java b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/util/AuthenticationUtil.java
new file mode 100644
index 0000000..8035dec
--- /dev/null
+++ b/samples/auth/src/main/java/com/supwisdom/leaveschool/auth/util/AuthenticationUtil.java
@@ -0,0 +1,44 @@
+package com.supwisdom.leaveschool.auth.util;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.context.SecurityContextHolder;
+
+import com.supwisdom.leaveschool.auth.security.core.userdetails.MyUser;
+
+public class AuthenticationUtil {
+
+  private static final Logger logger = LoggerFactory.getLogger(AuthenticationUtil.class);
+
+  public static String currentUsername() {
+
+    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
+
+    if (authentication == null) {
+      logger.error("authentication is null");
+      return null;
+    }
+
+    logger.debug("authentication is {}", authentication.getPrincipal());
+
+    if (!authentication.isAuthenticated()) {
+      logger.error("authentication is not authenticated");
+      return null;
+    }
+
+    if (authentication.getPrincipal() == null) {
+      logger.error("authentication's principal is null");
+      return null;
+    }
+
+    logger.debug("authentication's principal is {}", authentication.getPrincipal());
+
+    if (authentication.getPrincipal() instanceof MyUser) {
+      return ((MyUser) authentication.getPrincipal()).getUsername();
+    }
+
+    return null;
+  }
+
+}
diff --git a/samples/auth/src/main/resources/application.properties b/samples/auth/src/main/resources/application.properties
new file mode 100755
index 0000000..d8ecab2
--- /dev/null
+++ b/samples/auth/src/main/resources/application.properties
@@ -0,0 +1,31 @@
+server.port=8888
+
+spring.application.name=sample-auth
+
+## logging
+logging.level.root=INFO
+logging.level.org.springframework.web=INFO
+logging.level.com.supwisdom.infras.security=DEBUG
+logging.level.com.supwisdom.leaveschool=DEBUG
+
+## thymeleaf
+spring.thymeleaf.cache=false
+
+
+## 认证方式，是否开启 CAS 认证
+infras.security.cas.enabled=false
+
+## CAS
+#应用访问地址
+app.server.host.url=http://localhost:8080
+#应用登录地址
+app.login.url=/web/caslogin
+#应用登出地址
+app.logout.url=/web/logout
+
+#CAS服务地址
+cas.server.host.url=http://101.231.81.202:9080/cas
+#CAS服务登录地址
+cas.server.host.login_url=${cas.server.host.url}/login
+#CAS服务登出地址
+cas.server.host.logout_url=${cas.server.host.url}/logout?service=${app.server.host.url}
diff --git a/samples/auth/src/main/resources/static/assets/css/CSS b/samples/auth/src/main/resources/static/assets/css/CSS
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/samples/auth/src/main/resources/static/assets/css/CSS
diff --git a/samples/auth/src/main/resources/static/assets/css/main.css b/samples/auth/src/main/resources/static/assets/css/main.css
new file mode 100755
index 0000000..5e6687a
--- /dev/null
+++ b/samples/auth/src/main/resources/static/assets/css/main.css
@@ -0,0 +1,13 @@
+body {
+    font-family: sans;
+    font-size: 1em;
+}
+
+p.error {
+    font-weight: bold;
+    color: red;
+}
+
+div.logout {
+    float: right;
+}
\ No newline at end of file
diff --git a/samples/auth/src/main/resources/static/assets/images/IMAGES b/samples/auth/src/main/resources/static/assets/images/IMAGES
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/samples/auth/src/main/resources/static/assets/images/IMAGES
diff --git a/samples/auth/src/main/resources/static/assets/js/JS b/samples/auth/src/main/resources/static/assets/js/JS
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/samples/auth/src/main/resources/static/assets/js/JS
diff --git a/samples/auth/src/main/resources/templates/web/admin/user/index.html b/samples/auth/src/main/resources/templates/web/admin/user/index.html
new file mode 100644
index 0000000..2326203
--- /dev/null
+++ b/samples/auth/src/main/resources/templates/web/admin/user/index.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
+<head>
+<title>Hello Spring Security</title>
+<meta charset="utf-8" />
+<link rel="stylesheet" href="/assets/css/main.css" th:href="@{/assets/css/main.css}" />
+</head>
+<body>
+  <div th:substituteby="web/index::logout"></div>
+  <h1>This is a secured page!</h1>
+  <p>
+    <a href="/web/index" th:href="@{/web/index}">Back to home page</a>
+  </p>
+</body>
+</html>
\ No newline at end of file
diff --git a/samples/auth/src/main/resources/templates/web/index.html b/samples/auth/src/main/resources/templates/web/index.html
new file mode 100644
index 0000000..b9dcbf4
--- /dev/null
+++ b/samples/auth/src/main/resources/templates/web/index.html
@@ -0,0 +1,26 @@
+<!DOCTYPE HTML>
+<!-- <html xmlns:th="http://www.thymeleaf.org"> -->
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
+<head>
+<title>Hello Spring Security</title>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+<meta charset="utf-8" />
+<link rel="stylesheet" href="/assets/css/main.css" th:href="@{/assets/css/main.css}" />
+</head>
+<body>
+  <div th:fragment="logout" class="logout" sec:authorize="isAuthenticated()">
+    Logged in user: <span sec:authentication="name"></span> | 
+    Roles: <span sec:authentication="principal.authorities"></span>
+    <div>
+      <form action="#" th:action="@{/web/logout}" method="post">
+        <input type="submit" value="Logout" />
+      </form>
+    </div>
+  </div>
+  <h1>Hello Spring Security</h1>
+  <p>This is an unsecured page, but you can access the secured pages after authenticating.</p>
+  <ul>
+    <li>Go to the <a href="/web/admin/user/index" th:href="@{/web/admin/user/index}">secured pages</a></li>
+  </ul>
+</body>
+</html>
diff --git a/samples/auth/src/main/resources/templates/web/login.html b/samples/auth/src/main/resources/templates/web/login.html
new file mode 100755
index 0000000..1bc5e4d
--- /dev/null
+++ b/samples/auth/src/main/resources/templates/web/login.html
@@ -0,0 +1,24 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
+    <head>
+        <title>Login page</title>
+        <meta charset="utf-8" />
+        <link rel="stylesheet" href="/assets/css/main.css" th:href="@{/assets/css/main.css}" />
+	</head>
+    <body>
+        <h1>Login page</h1>
+        <p>Example user: user / password</p>
+        <p th:if="${loginError}" class="error">Wrong user or password</p>
+        <div th:if="${param.error}" class="alert alert-error">Invalid username and password.</div>
+        <div th:if="${param.logout}" class="alert alert-success">You have been logged out.</div>
+        
+        <form th:action="@{/web/login}" method="post">
+            <label for="username">Username</label>:
+            <input type="text" id="username" name="username" autofocus="autofocus" /> <br />
+            <label for="password">Password</label>:
+            <input type="password" id="password" name="password" /> <br />
+            <input type="submit" value="Log in" />
+        </form>
+        <p><a href="/index" th:href="@{/index}">Back to home page</a></p>
+    </body>
+</html>