SpringSecurity配置

<beans:beans xmlns="http://www.springframework.org/schema/security"
  xmlns:beans="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
           http://www.springframework.org/schema/security
           http://www.springframework.org/schema/security/spring-security-3.2.xsd">
	<!-- 配置不过滤的资源（静态资源及登录相关） -->
	<http pattern="/**/*.css" security="none"></http>
	<http pattern="/**/*.jpg" security="none"></http>
	<http pattern="/**/*.jpeg" security="none"></http>
	<http pattern="/**/*.gif" security="none"></http>
	<http pattern="/**/*.png" security="none"></http>
	<http pattern="/scripts/**/*.js" security="none"></http>
	
	<http pattern="/login.jsp" security="none"></http>
	
	
	<http auto-config="true">
<!-- 		<intercept-url pattern="/toIndex.do" access="ROLE_GUEST,ROLE_ADMIN"/> -->
<!-- 		<intercept-url pattern="/**" access="ROLE_ADMIN"/> -->
		<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp"  
        default-target-url="/toIndex.do"/>
		<logout logout-success-url="/login.jsp" delete-cookies="JSESSIONID" /> 
		<custom-filter ref="customFilter" before="FILTER_SECURITY_INTERCEPTOR"/> 
		<access-denied-handler error-page="/login.jsp?authDenied=true"/>
	</http>

	<!-- 自定义Filter -->
	<beans:bean id="customFilter"
		class="com.pingan.insurance.roadassistant.service.MyFilterSecurityInterceptor">
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="accessDecisionManager" ref="customAccessDecisionManager" />
		<beans:property name="securityMetadataSource" ref="customSecurityMetadataSource" />
	</beans:bean> 
	
    <!-- 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 -->
	<authentication-manager alias="authenticationManager">  
        <authentication-provider ref="loginAuthenticationProvider">  
        </authentication-provider>  
    </authentication-manager>  
  
    <beans:bean id="loginAuthenticationProvider"  
        class="com.pingan.insurance.roadassistant.service.LoginAuthenticationProvider">  
        <beans:property name="userDetailsService" ref="customUserDetailsService"></beans:property>  
    </beans:bean>

		
    <beans:bean id="customUserDetailsService"
        class="com.pingan.insurance.roadassistant.service.MyUserDetailService" />

	<!--     访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源 -->
    <beans:bean id="customAccessDecisionManager"
        class="com.pingan.insurance.roadassistant.service.MyAccessDecisionManager"/>
    
	<!--     资源源数据定义，即定义某一资源可以被哪些角色访问 -->
    <beans:bean id="customSecurityMetadataSource"
        class="com.pingan.insurance.roadassistant.service.MyFilterInvocationSecurityMetadataSource"/>
        
</beans:beans>

 

转载于:https://my.oschina.net/u/3278373/blog/849266