Spring-security-xml

<?xml version="1.0" encoding="UTF-8"?> 
<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
http://www.springframework.org/schema/security 
http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled">

    </global-method-security>

    <!-- entry-point-ref 为用户第一次访问受保护的url时的处理程序.  --> 
    <http use-expressions="true"    entry-point-ref="authenticationEntryPoint">

        <!-- 这里是拒绝用户访问的处理程序 --> 
        <access-denied-handler ref="accessDeniedHandler" /> 
        <!-- 配置一些不需要认证过滤的地址 --> 
        <intercept-url pattern="/roots/login.jsp" filters="none" /> 
        <intercept-url pattern="/css/**" filters="none" /> 
        <intercept-url pattern="/common/**" filters="none" /> 
        <intercept-url pattern="/images/**" filters="none" /> 
        <intercept-url pattern="/scripts/**" filters="none" /> 
        <intercept-url pattern="/DatePicker/**" filters="none" /> 
        <intercept-url pattern="/fckeditor/**" filters="none" /> 
        <!-- cooki认证的配置,具体 看rememberMeServices的配置. --> 
        <remember-me services-ref="rememberMeServices" />

        <!-- 
            增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了，这个filter位于FILTER_SECURITY_INTERCEPTOR之前 
        --> 
        <custom-filter position="LOGOUT_FILTER" ref="logoutFilter"></custom-filter> 
        <custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="myFilter" /> 
        <custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" /> 
        <!-- 限制用户的最大登陆数,防止一个账号被多人使用 --> 
        <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /> 
        <session-management 
            session-authentication-strategy-ref="sas" /> 
    </http>

    <!-- 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 如下,可以配置多个Provider--> 
    <authentication-manager alias="authenticationManager">

        <authentication-provider ref="daoAuthenticationProvider"> 
            <password-encoder hash="plaintext"></password-encoder> 
        </authentication-provider> 
        <authentication-provider ref="rememberMeAuthenticationProvider"> 
            <password-encoder hash="plaintext"></password-encoder> 
        </authentication-provider> 
    </authentication-manager>

    <beans:bean id="daoAuthenticationProvider" 
        class="org.springframework.security.authentication.dao.DaoAuthenticationProvider"> 
        <beans:property name="userDetailsService" ref="myUserDetailService" /> 
    </beans:bean>

    <!-- 
        一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性， 
        我们的所有控制将在这三个类中实现，解释详见具体配置 
    --> 
    <beans:bean id="myFilter" class="com.security.MyFilterSecurityInterceptor"> 
        <beans:property name="authenticationManager" ref="authenticationManager" /> 
        <beans:property name="accessDecisionManager" ref="myAccessDecisionManagerBean" /> 
        <beans:property name="securityMetadataSource" ref="securityMetadataSource" /> 
    </beans:bean>

    <!-- 
        下面的3个类,已做自动扫描 <beans:bean id="myUserDetailService" 
        class="com.security.MyUserDetailService" />

        访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源 <beans:bean 
        id="myAccessDecisionManagerBean" 
        class="com.security.MyAccessDecisionManager"> </beans:bean>

        资源源数据定义，即定义某一资源可以被哪些角色访问 <beans:bean id="securityMetadataSource" 
        class="com.security.MyInvocationSecurityMetadataSource" >

        </beans:bean> 
    -->

    <beans:bean id="logoutFilter" 
        class="org.springframework.security.web.authentication.logout.LogoutFilter"> 
        <beans:constructor-arg value="/roots/login.jsp" /> 
        <beans:constructor-arg> 
            <beans:list> 
                <beans:ref local="rememberMeServices" /> 
                <beans:bean 
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"></beans:bean> 
            </beans:list> 
        </beans:constructor-arg> 
        <beans:property name="filterProcessesUrl" value="/ss_Loginout"></beans:property> 
    </beans:bean>

    <beans:bean id="concurrencyFilter" 
        class="org.springframework.security.web.session.ConcurrentSessionFilter"> 
        <beans:property name="sessionRegistry" ref="sessionRegistry" /> 
        <beans:property name="expiredUrl" value="/error/expired.jsp" /> 
    </beans:bean> 
    <beans:bean id="sas" 
        class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy"> 
        <beans:constructor-arg name="sessionRegistry" 
            ref="sessionRegistry" /> 
        <beans:property name="maximumSessions" value="1" /> 
    </beans:bean>

    <beans:bean id="myAuthFilter" 
        class="com.security.fliter.MyUsernamePasswordAuthenticationFilter"> 
        <beans:property name="sessionAuthenticationStrategy" 
            ref="sas" /> 
        <beans:property name="authenticationManager" ref="authenticationManager" /> 
        <beans:property name="rememberMeServices" ref="rememberMeServices"></beans:property> 
        <beans:property name="authenticationFailureHandler" 
            ref="failureHandler" /> 
        <beans:property name="authenticationSuccessHandler" 
            ref="successHandler" /> 
        <beans:property name="filterProcessesUrl" value="/ss_Login"></beans:property>

    </beans:bean> 
    <beans:bean id="successHandler" 
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler"> 
        <beans:property name="defaultTargetUrl" value="/roots/index.jsp" /> 
    </beans:bean> 
    <beans:bean id="failureHandler" 
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler"> 
        <beans:property name="defaultFailureUrl" value="/roots/login.jsp?error=true" /> 
    </beans:bean>

    <beans:bean id="sessionRegistry" 
        class="org.springframework.security.core.session.SessionRegistryImpl" />