<?xml version="1.0" encoding="UTF-8"?>
<beansxmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:security="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.1.xsd
">
<security:http entry-point-ref="casEntryPoint" access-decision-manager-ref="myaccessDecisionManager">
<!-- 没用但是重要 否者不会执行我们自定义的myaccessDecisionManager <security:intercept-url pattern="/**" access="ROLE_XXX" /> -->
<security:logout delete-cookies="true"/>
<security:intercept-url pattern="/admin/index.jsp*" access="ROLE_ADMIN"/>
<security:remember-me/>
<!-- 不复制session -->
<security:session-management session-fixation-protection="none"/>
<!-- -->
<security:custom-filter position="CAS_FILTER" ref="casFilter" />
</security:http>
<bean id="casFilter"
class="org.springframework.security.cas.web.CasAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
</bean>
<bean id="casEntryPoint"
class="org.springframework.security.cas.web.CasAuthenticationEntryPoint">
<property name="loginUrl" value="http://www.lilin.com:4848/"/>
<property name="serviceProperties" ref="serviceProperties"/>
</bean>
<bean id="serviceProperties"
class="org.springframework.security.cas.ServiceProperties">
<property name="service"
value="http://localhost:8080/test_newspringanquan/j_spring_cas_security_check"/>
<property name="sendRenew" value="false"/>
</bean>
<security:authentication-manager alias="authenticationManager">
<security:authentication-provider ref="casAuthenticationProvider" />
</security:authentication-manager>
<bean id="casAuthenticationProvider"
class="org.springframework.security.cas.authentication.CasAuthenticationProvider">
<property name="authenticationUserDetailsService">
<bean class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper">
<property name="userDetailsService" ref="a"></property>
</bean>
</property>
<property name="serviceProperties" ref="serviceProperties" />
<property name="ticketValidator">
<bean class="org.jasig.cas.client.validation.Cas20ServiceTicketValidator">
<constructor-arg index="0" value="http://www.lilin.com:4848/" />
</bean>
</property>
<property name="key" value="an_id_for_this_auth_provider_only"/>
</bean>
<!--查询用户和用户权限 begin 这里要配置查询用户的sql语句-->
<bean id="myaccessDecisionManager" class="com.spring.MyAccessDecisionManager"> </bean>
<security:jdbc-user-service id="a" data-source-ref="dataSource"/>
<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource">
<property name="driverClass" value="com.microsoft.sqlserver.jdbc.SQLServerDriver" />
<property name="jdbcUrl" value="jdbc:sqlserver://localhost:1433;databaseName=hb_zb_database" />
<property name="user" value="sa" />
<property name="password" value="123456" />
</bean>
</beans>
说明
http://localhost:8080/test_newspringanquan/为自己的根项目。
服务器端的验证和查询出来的用户信息要匹配哦 否则会报 401 验证错误。