spring security

1. <?xmlversion="1.0"encoding="UTF-8"?>
2. <beans:beansxmlns="http://www.springframework.org/schema/security"
3. xmlns:beans="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4. xsi:schemaLocation="http://www.springframework.org/schema/beans
5. http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
6. http://www.springframework.org/schema/security
7. http://www.springframework.org/schema/security/spring-security-3.0.xsd">
10. <global-method-securitypre-post-annotations="enabled">
12. </global-method-security>
14. <!--entry-point-ref为用户第一次访问受保护的url时的处理程序.-->
15. <httpuse-expressions="true"entry-point-ref="authenticationEntryPoint">
17. <!--这里是拒绝用户访问的处理程序-->
18. <access-denied-handlerref="accessDeniedHandler"/>
20. <!--配置一些不需要认证过滤的地址-->
21. <intercept-urlpattern="/roots/login.jsp"filters="none"/>
22. <intercept-urlpattern="/css/**"filters="none"/>
23. <intercept-urlpattern="/common/**"filters="none"/>
24. <intercept-urlpattern="/images/**"filters="none"/>
25. <intercept-urlpattern="/scripts/**"filters="none"/>
26. <intercept-urlpattern="/DatePicker/**"filters="none"/>
27. <intercept-urlpattern="/fckeditor/**"filters="none"/>
29. <!--cooki认证的配置,具体看rememberMeServices的配置.-->
30. <remember-meservices-ref="rememberMeServices"/>
32. <!--
33. 增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了，这个filter位于FILTER_SECURITY_INTERCEPTOR之前
34. -->
35. <custom-filterposition="LOGOUT_FILTER"ref="logoutFilter"></custom-filter>
36. <custom-filterbefore="FILTER_SECURITY_INTERCEPTOR"ref="myFilter"/>
37. <custom-filterposition="FORM_LOGIN_FILTER"ref="myAuthFilter"/>
38. <!--限制用户的最大登陆数,防止一个账号被多人使用-->
39. <custom-filterposition="CONCURRENT_SESSION_FILTER"ref="concurrencyFilter"/>
40. <session-management
41. session-authentication-strategy-ref="sas"/>
42. </http>
44. <!--认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可如下,可以配置多个Provider-->
45. <authentication-manageralias="authenticationManager">
47. <authentication-providerref="daoAuthenticationProvider">
48. <password-encoderhash="plaintext"></password-encoder>
49. </authentication-provider>
50. <authentication-providerref="rememberMeAuthenticationProvider">
51. <password-encoderhash="plaintext"></password-encoder>
52. </authentication-provider>
53. </authentication-manager>
55. <beans:beanid="daoAuthenticationProvider"
56. class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
57. <beans:propertyname="userDetailsService"ref="myUserDetailService"/>
58. </beans:bean>
60. <!--
61. 一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，
62. 我们的所有控制将在这三个类中实现，解释详见具体配置
63. -->
64. <beans:beanid="myFilter"class="com.security.MyFilterSecurityInterceptor">
65. <beans:propertyname="authenticationManager"ref="authenticationManager"/>
66. <beans:propertyname="accessDecisionManager"ref="myAccessDecisionManagerBean"/>
67. <beans:propertyname="securityMetadataSource"ref="securityMetadataSource"/>
68. </beans:bean>
70. <!--
71. 下面的3个类,已做自动扫描<beans:beanid="myUserDetailService"
72. class="com.security.MyUserDetailService"/>
74. 访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源<beans:bean
75. id="myAccessDecisionManagerBean"
76. class="com.security.MyAccessDecisionManager"></beans:bean>
78. 资源源数据定义，即定义某一资源可以被哪些角色访问<beans:beanid="securityMetadataSource"
79. class="com.security.MyInvocationSecurityMetadataSource">
81. </beans:bean>
82. -->
84. <beans:beanid="logoutFilter"
85. class="org.springframework.security.web.authentication.logout.LogoutFilter">
86. <beans:constructor-argvalue="/roots/login.jsp"/>
87. <beans:constructor-arg>
88. <beans:list>
89. <beans:reflocal="rememberMeServices"/>
90. <beans:bean
91. class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"></beans:bean>
92. </beans:list>
93. </beans:constructor-arg>
94. <beans:propertyname="filterProcessesUrl"value="/ss_Loginout"></beans:property>
95. </beans:bean>
98. <beans:beanid="concurrencyFilter"
99. class="org.springframework.security.web.session.ConcurrentSessionFilter">
100. <beans:propertyname="sessionRegistry"ref="sessionRegistry"/>
101. <beans:propertyname="expiredUrl"value="/error/expired.jsp"/>
102. </beans:bean>
103. <beans:beanid="sas"
104. class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
105. <beans:constructor-argname="sessionRegistry"
106. ref="sessionRegistry"/>
107. <beans:propertyname="maximumSessions"value="1"/>
108. </beans:bean>
110. <beans:beanid="myAuthFilter"
111. class="com.security.fliter.MyUsernamePasswordAuthenticationFilter">
112. <beans:propertyname="sessionAuthenticationStrategy"
113. ref="sas"/>
114. <beans:propertyname="authenticationManager"ref="authenticationManager"/>
115. <beans:propertyname="rememberMeServices"ref="rememberMeServices"></beans:property>
116. <beans:propertyname="authenticationFailureHandler"
117. ref="failureHandler"/>
118. <beans:propertyname="authenticationSuccessHandler"
119. ref="successHandler"/>
120. <beans:propertyname="filterProcessesUrl"value="/ss_Login"></beans:property>
122. </beans:bean>
123. <beans:beanid="successHandler"
124. class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
125. <beans:propertyname="defaultTargetUrl"value="/roots/index.jsp"/>
126. </beans:bean>
127. <beans:beanid="failureHandler"
128. class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
129. <beans:propertyname="defaultFailureUrl"value="/roots/login.jsp?error=true"/>
130. </beans:bean>
132. <beans:beanid="sessionRegistry"
133. class="org.springframework.security.core.session.SessionRegistryImpl"/>
137. <!--
138. remembermefliter此fliter的配置没有使用留做参考<beans:bean
139. id="rememberMeFilter"
140. class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
141. <beans:propertyname="rememberMeServices"ref="rememberMeServices"/>
142. <beans:propertyname="authenticationManager"
143. ref="authenticationManager"/></beans:bean>
144. -->
146. <beans:beanid="rememberMeServices"
147. class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
148. <beans:propertyname="userDetailsService"ref="myUserDetailService"/>
149. <beans:propertyname="key"value="springsecurityCookies1"/>
150. <beans:propertyname="alwaysRemember"value="true"></beans:property>
151. <beans:propertyname="tokenValiditySeconds"value="86400"></beans:property>
152. <beans:propertyname="parameter"value="_spring_security_remember_me"></beans:property>
153. </beans:bean>
155. <beans:beanid="rememberMeAuthenticationProvider"
156. class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
157. <beans:propertyname="key"value="springsecurityCookies1"/>
158. </beans:bean>
160. <!--
161. 此fliter的配置没有使用留做参考<beans:beanid="exceptionTranslationFilter"
162. class="org.springframework.security.web.access.ExceptionTranslationFilter">
163. <beans:propertyname="authenticationEntryPoint"
164. ref="authenticationEntryPoint"/><beans:property
165. name="accessDeniedHandler"ref="accessDeniedHandler"/></beans:bean>
166. -->
168. <beans:beanid="authenticationEntryPoint"
169. class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
170. <beans:propertyname="loginFormUrl"value="/roots/login.jsp"/>
171. </beans:bean>
173. <beans:beanid="accessDeniedHandler"
174. class="org.springframework.security.web.access.AccessDeniedHandlerImpl">
175. <beans:propertyname="errorPage"value="/roots/login.jsp?error=ad"/>
176. </beans:bean>
180. <!--下面配置,security对于方法的保护-->
181. <beans:beanid="methodSecurityInterceptor"
182. class="org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor">
183. <beans:propertyname="validateConfigAttributes">
184. <beans:value>false</beans:value>
185. </beans:property>
186. <beans:propertyname="authenticationManager">
187. <beans:refbean="authenticationManager"/>
188. </beans:property>
189. <beans:propertyname="accessDecisionManager">
190. <beans:refbean="myAccessDecisionManagerBean"/>
191. </beans:property>
192. <!--这里配置通过数据库配置来查找权限myMethodSecurityMetadataSource这个类继承AbstractMethodSecurityMetadataSource-->
193. <beans:propertyname="securityMetadataSource"ref="myMethodSecurityMetadataSource"/>
194. <!--
195. 说明:下面的模式是配置了ISome类的doSupervisor的方法只需要ROLE_SUPERVISOR来访问<value>
196. com.acegi.MethodInterceptionTest.method*=ROLE_ADMIN</value>
197. </property>
198. -->
199. </beans:bean>
200. <!--
201. 在数据库里配置roleanddatebase...下面的autoProxyCreator还是要配置切入点的.
202. myMethodSecurityMetadataSource已经配置在自动扫描中.
203. -->
204. <beans:beanid="sprintsecurityAutoIntercept"
205. class="org.springframework.aop.framework.autoproxy.BeanNameAutoProxyCreator"
206. scope="singleton">
207. <beans:propertyname="beanNames">
208. <!--在这里配置要切的类的名称,可以为一个配置好的bean的id,多个id用逗号分隔-->
209. <beans:value>*test</beans:value>
210. </beans:property>
213. <!--这里就写上切入点-->
214. <beans:propertyname="interceptorNames">
215. <beans:list>
216. <beans:value>methodSecurityInterceptor</beans:value>
217. </beans:list>
218. </beans:property>
219. <!--这个,如果你的类被代理了,比如在spring中使用,一定要设置这个属性为true-->
220. <beans:propertyname="proxyTargetClass"value="true"/>
221. </beans:bean>
224. <!--这里接收security日志的配置
225. <beanid="authenticationLoggerListener"
226. class="org.springframework.security.authentication.event.LoggerListener"/>
227. <beanid="authorizationLoggerListener"
228. class="org.springframework.security.access.event.LoggerListener"/>
229. -->
232. </beans:beans>