spring security 2的配置

sprint securiy2 适合portal的配置：

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:sec="http://www.springframework.org/schema/security"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd
						http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">

	<bean id="springSecurityFilterChain"
 		class="org.springframework.security.util.FilterChainProxy">
 		<property name="filterInvocationDefinitionSource">
 			<value>
 				CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
 				PATTERN_TYPE_APACHE_ANT
 				/my/security_login.do=httpSessionContextIntegrationFilter,authenticationProcessingFilter
 				/mydo/security_logout.do=logoutFilter
 				/**=httpSessionContextIntegrationFilter,myFilte,authenticationProcessingFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor
 			</value>
 		</property>
 	</bean>
	<bean id="anonymousProcessingFilter"
		class="org.springframework.security.providers.anonymous.AnonymousProcessingFilter">
		<property name="key">
			<value>SETTHISKEY</value>
		</property>
		<property name="userAttribute">
			<value>anonymousUser,ROLE_ANONYMOUS</value>
		</property>
	</bean>
	<bean id="httpSessionContextIntegrationFilter"
    	class="org.springframework.security.context.HttpSessionContextIntegrationFilter"/>
	<!-- 覆写主要是为了个性处理一下cookie -->
	<bean id="rememberMeServices"  
	    class="com.do.doportal.security.rememberme.MyTokenBasedRememberMeServices">  
	    <property name="userDetailsService" ref="portalUserDetailsService" />  
	    <property name="key" value="ChemboSetThisKey" />  
	</bean> 

	<bean id="rememberMeProcessingFilter"  
        class="org.springframework.security.ui.rememberme.RememberMeProcessingFilter">  
        <property name="rememberMeServices" ref="rememberMeServices" />  
        <property name="authenticationManager" ref="authenticationManager" />  
	</bean>  

	<bean id="rememberMeAuthenticationProvider"  
    	class="org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider">  
    	<property name="key" value="ChemboSetThisKey" />  
	</bean>
	<!-- 清理上面个性化处理的cookie -->
	<bean id="logoutFilter"
		class="org.springframework.security.ui.logout.LogoutFilter">
		<constructor-arg index="0" value="/portal/signin/signin/logout.do" />
		<constructor-arg index="1">
			<list>
				<ref bean="rememberMeServices"/>
				<bean class="com.do.doportal.security.logout.MySecurityContextLogoutHandler" />			
			</list>
		</constructor-arg>
		<property name="filterProcessesUrl" value="/mydoecurity_logout.do" />
	</bean>

	<bean id="authenticationProcessingFilter"  
    	class="com.do.doportal.security.authorities.support.MyAuthenticationProcessingFilter">  
    	<property name="defaultTargetUrl" value="/portal/signin/signin/forward.do"></property>
    	<property name="filterProcessesUrl" value="/mydo/security_login.do"></property>
    	<property name="authenticationManager" ref="authenticationManager"></property>
    	<property name="alwaysUseDefaultTargetUrl" value="true"></property>
    	<property name="authenticationFailureUrl" value="/portal/signin/signin/signin.do?error=true"></property>
    	<property name="rememberMeServices" ref="rememberMeServices" /> 
	</bean>

	<bean id="daoAuthenticationProvider"
		class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
		<property name="userDetailsService" ref="portalUserDetailsService" />
		<property name="passwordEncoder" ref="passwordEncoder" />
		<property name="hideUserNotFoundExceptions" value="false" />
	</bean>
	<bean id="exceptionTranslationFilter"
		class="org.springframework.security.ui.ExceptionTranslationFilter">
		<property name="authenticationEntryPoint">
			<bean
				class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
				<property name="loginFormUrl" value="/portal/signin/signin/signin.do" />
				<property name="forceHttps" value="false" />
			</bean>
		</property>
		<property name="accessDeniedHandler">
			<bean
				class="org.springframework.security.ui.AccessDeniedHandlerImpl">
				<property name="errorPage" value="/portal/signin/signin/deny.do" />
			</bean>
		</property>
	</bean>

	<bean id="passwordEncoder" class="org.springframework.security.providers.encoding.Md5PasswordEncoder" />
	<bean id="authenticationManager"  
	    class="org.springframework.security.providers.ProviderManager">  
	    <property name="providers">  
	        <list>  
				<ref local="daoAuthenticationProvider" />
	            <ref local="rememberMeAuthenticationProvider" />  
	        </list>  
	    </property>  
	</bean>
    <bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
        <property name="allowIfAllAbstainDecisions" value="false"/>
        <property name="decisionVoters">
            <list>
                <bean class="org.springframework.security.vote.RoleVoter">
                	<property name="rolePrefix" value="" />
                </bean>
                <bean class="org.springframework.security.vote.AuthenticatedVoter" /> 
            </list>
        </property>
    </bean>

	<bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
    	<property name="authenticationManager" ref="authenticationManager"/>
        <property name="accessDecisionManager" ref="accessDecisionManager"/>
    	<property name="objectDefinitionSource">
	    	<value>
	    	<![CDATA[ 
		        CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
		        PATTERN_TYPE_APACHE_ANT
		        /mydo/accounetting/bvoaetting/*=						ROLE_buyer
		        /mydo/sourcievent/se/loadtail.do=							ROLE_buyer
		        /mydo//se/entsrceventlist.do=					ROLE_buyer
		        /mydo/accousetting/mvoasetting/*=						ROLE_seller
		        /mydo/product/**=												ROLE_seller
		    ]]> 
	      	</value>
      	</property>
    	<property name="observeOncePerRequest" value="false" />
    	<sec:custom-filter after="LAST" />
	</bean>

	<bean id="myFilte" class="com.do.myportal.security.interceptor.InterceptUrl">
	   	<sec:custom-filter before="ANONYMOUS_FILTER" />
	</bean>
</beans>