diff --git a/conf/icecast.xml.in b/conf/icecast.xml.in
index 367417ff..a7fc4976 100644
--- a/conf/icecast.xml.in
+++ b/conf/icecast.xml.in
@@ -165,8 +165,11 @@
         <public>false</public>
         <intro>/server-wide-intro.ogg</intro>
         <max-listener-duration>3600</max-listener-duration>
-        <authentication type="url">
-                <option name="mount_add" value="http://auth.example.org/stream_start.php"/>
+        <authentication>
+            <role type="url" method="source,put" allow-web="*" allow-admin="*">
+                <option name="client_add" value="http://auth.example.org/stream_start.php"/>
+            </role>
+            <role type="anonymous" method="source,put" deny-all="*" />
         </authentication>
         <http-headers>
                 <header name="foo" value="bar" />
@@ -179,9 +182,6 @@
     <mount type="normal">
         <mount-name>/example-complex.ogg</mount-name>
 
-        <username>othersource</username>
-        <password>hackmemore</password>
-
         <max-listeners>1</max-listeners>
         <dump-file>/tmp/dump-example1.ogg</dump-file>
         <burst-size>65536</burst-size>
@@ -191,9 +191,15 @@
         <intro>/example_intro.ogg</intro>
         <hidden>true</hidden>
         <public>true</public>
-        <authentication type="htpasswd">
-                <option name="filename" value="myauth"/>
-                <option name="allow_duplicate_users" value="false"/>
+        <authentication>
+            <role type="htpasswd" connections-per-user="1">
+                <option name="filename" value="myauth" />
+            </role>
+            <role type="static" allow-method="source,put,get,post,options" deny-web="*" allow-admin="*">
+                <option name="username" value="othersource" />
+                <option name="passwod" value="hackmemore" />
+            </role>
+            <role type="anonymous" deny-all="*" />
         </authentication>
         <http-headers>
                 <header name="Access-Control-Allow-Origin" value="http://webplayer.example.org" />
@@ -214,14 +220,27 @@
     <!--
     <mount type="normal">
         <mount-name>/auth_example.ogg</mount-name>
-        <authentication type="url">
-            <option name="mount_add"       value="http://myauthserver.net/notify_mount.php"/>
-            <option name="mount_remove"    value="http://myauthserver.net/notify_mount.php"/>
-            <option name="listener_add"    value="http://myauthserver.net/notify_listener.php"/>
-            <option name="listener_remove" value="http://myauthserver.net/notify_listener.php"/>
-            <option name="headers"         value="x-pragma,x-token"/>
-            <option name="header_prefix"   value="ClientHeader."/>
+        <authentication>
+            <role type="url" method="get,post,head,options" allow-web="*" deny-admin="*" may-alter="send_error,redirect">
+                <option name="client_add"       value="http://myauthserver.net/notify_listener.php"/>
+                <option name="client_remove"    value="http://myauthserver.net/notify_listener.php"/>
+                <option name="action_add"       value="listener_add"/>
+                <option name="action_remove"    value="listener_remove"/>
+                <option name="headers"          value="x-pragma,x-token"/>
+                <option name="header_prefix"    value="ClientHeader."/>
+            </role>
+            <role type="anonymous" method="get,post,head,options" deny-all="*" />
         </authentication>
+        <event-bindings>
+            <event type="url" trigger="source-connect">
+                <option name="url" value="http://myauthserver.net/notify_mount.php" />
+                <option name="action" value="mount_add" />
+            </event>
+            <event type="url" trigger="source-disconnect">
+                <option name="url" value="http://myauthserver.net/notify_mount.php" />
+                <option name="action" value="mount_remove" />
+            </event>
+        </event-bindings>
     </mount>
     -->