acegi配置

<? xml version="1.0" encoding="UTF-8" ?>
<! DOCTYPE beans PUBLIC "-//SPRING//DTD BEAN//EN" "http://www.springframework.org/dtd/spring-beans.dtd" >

< beans >
     <!--  filter chain  -->
     < bean  id ="filterChainProxy"  class ="org.acegisecurity.util.FilterChainProxy" >
         < property  name ="filterInvocationDefinitionSource" >
             <!-- no filter: #TOKEN_NONE  -->
             < value > <![CDATA[
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /**=concurrentSessionFilter,httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor
             ]]> </ value >
         </ property >
     </ bean >

     <!--  filter  -->
    
     <!--  invalidate expired session and record last request time  -->
     < bean  id ="concurrentSessionFilter"  class ="sinosafecmb.web.security.ConcurrentSessionFilterModify" >
         < property  name ="sessionRegistry"  ref ="sessionRegistry" ></ property >
         < property  name ="expiredUrl"  value ="/login.jsp?error=1" ></ property >
     </ bean >
    
     <!--  create context in session and update that when response  -->
     < bean  id ="httpSessionContextIntegrationFilter"  class ="org.acegisecurity.context.HttpSessionContextIntegrationFilter" >
         < property  name ="forceEagerSessionCreation"  value ="true" ></ property >
     </ bean >

     <!--  logout:  /j_acegi_logout  -->
     < bean  id ="logoutFilter"  class ="org.acegisecurity.ui.logout.LogoutFilter" >
         < constructor-arg  value ="/login.jsp" />   <!--  URL redirected to after logout  -->
         < constructor-arg >
             < list >
                 < ref  bean ="rememberMeServices" />   <!--  deleteCookie  -->
                 < bean  class ="org.acegisecurity.ui.logout.SecurityContextLogoutHandler" />   <!--  invalidate session; clear context  -->
             </ list >
         </ constructor-arg >
     </ bean >
    
     <!--  login:  j_username, j_password, /j_acegi_security_check, ACEGI_SECURITY_LAST_USERNAME(session) -->
     <!--  fail: set exception in ACEGI_SECURITY_LAST_EXCEPTION_KEY(session) and redirect  -->
     <!--  success: set context and redirect   -->
     < bean  id ="authenticationProcessingFilter"  class ="org.acegisecurity.ui.webapp.AuthenticationProcessingFilter" >
         < property  name ="authenticationManager"  ref ="authenticationManager" />   <!--  invoke to authenticate  -->
         < property  name ="authenticationFailureUrl"  value ="/login.jsp?error=3" />
         < property  name ="defaultTargetUrl"  value ="/login.do" />
         < property  name ="filterProcessesUrl"  value ="/j_acegi_security_check" />
         < property  name ="rememberMeServices"  ref ="rememberMeServices" />   <!--  success or fail to handle cookie -->
     </ bean >

     <!--  auto login and authenticate  -->
     <!--  fail: delete cookie  -->
     <!--  success: set context  -->
     < bean  id ="rememberMeProcessingFilter"  class ="org.acegisecurity.ui.rememberme.RememberMeProcessingFilter" >
         < property  name ="rememberMeServices"  ref ="rememberMeServices" />   <!--  auto login  -->
         < property  name ="authenticationManager"  ref ="authenticationManager" />   <!--  invoke to authenticate  -->
     </ bean >

     <!--  anonymous login: clear authentication after request by default  -->
     < bean  id ="anonymousProcessingFilter"  class ="org.acegisecurity.providers.anonymous.AnonymousProcessingFilter" >
         < property  name ="key"  value ="changeThis" />   <!--  to identify if this object made by an authorised client  -->
         < property  name ="userAttribute"  value ="anonymous,ROLE_ANONYMOUS" />
     </ bean >

     <!--  handle exception  -->
     <!--  AuthenticationException: clear authentication and redirect to entry point  -->
     <!--  AccessDeniedException  -->
     < bean  id ="exceptionTranslationFilter"  class ="org.acegisecurity.ui.ExceptionTranslationFilter" >
         < property  name ="authenticationEntryPoint" >
             < bean  class ="org.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint" >
                 < property  name ="loginFormUrl"  value ="/login.jsp" />
                 < property  name ="forceHttps"  value ="false" />
             </ bean >
         </ property >
         < property  name ="accessDeniedHandler" >
             < bean  class ="org.acegisecurity.ui.AccessDeniedHandlerImpl" > <!--  ACEGI_SECURITY_ACCESS_DENIED_EXCEPTION_KEY(request)  -->
                 < property  name ="errorPage"  value ="/login.jsp?error=2" />
             </ bean >
         </ property >
     </ bean >

     <!--  authority  -->
     < bean  id ="filterSecurityInterceptor"  class ="org.acegisecurity.intercept.web.FilterSecurityInterceptor" >
         < property  name ="authenticationManager"  ref ="authenticationManager" />
         < property  name ="accessDecisionManager" >
             < bean  class ="org.acegisecurity.vote.AffirmativeBased" >
                 < property  name ="allowIfAllAbstainDecisions"  value ="false" />
                 < property  name ="decisionVoters" >
                     < list >
                         < bean  class ="org.acegisecurity.vote.RoleVoter" />
                         < bean  class ="org.acegisecurity.vote.AuthenticatedVoter" />
                     </ list >
                 </ property >
             </ bean >
         </ property >
         < property  name ="objectDefinitionSource" >
             < value > <![CDATA[
                PATTERN_TYPE_APACHE_ANT
                /login.jsp=ROLE_ANONYMOUS,ROLE_ADMIN,ROLE_OPERATOR_DATA,        
             ]]> </ value >
         </ property >
     </ bean >

     < bean  id ="rememberMeServices"  class ="org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices" >
         < property  name ="tokenValiditySeconds"  value ="1209600" />
         < property  name ="userDetailsService"  ref ="userDetailsService" />
         < property  name ="key"  value ="changeThis" />
     </ bean >

     < bean  id ="authenticationManager"  class ="org.acegisecurity.providers.ProviderManager" >
         < property  name ="providers" >
             < list >
                 < ref  local ="daoAuthenticationProvider" />
                 < bean  class ="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider" >
                     < property  name ="key"  value ="changeThis" />
                 </ bean >
                 < bean  class ="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider" >
                     < property  name ="key"  value ="changeThis" />
                 </ bean >
             </ list >
         </ property >
         < property  name ="sessionController" >< ref  bean ="concurrentSessionController" /></ property >
     </ bean >
    
     <!--  concurrent session  -->
     < bean  id ="concurrentSessionController"  class ="org.acegisecurity.concurrent.ConcurrentSessionControllerImpl" >
       < property  name ="maximumSessions" >< value > 1 </ value ></ property >
       < property  name ="sessionRegistry" >< ref  local ="sessionRegistry" /></ property >
     </ bean >     
     < bean  id ="sessionRegistry"  class ="org.acegisecurity.concurrent.SessionRegistryImpl" />
    
     < bean  id ="anonymousAuthenticationProvider"  class ="org.acegisecurity.providers.anonymous.AnonymousAuthenticationProvider" >
           < property  name ="key" >< value > changeThis </ value ></ property >
     </ bean >
    
     < bean  id ="rememberMeAuthenticationProvider"  class ="org.acegisecurity.providers.rememberme.RememberMeAuthenticationProvider" >
           < property  name ="key" >< value > changeThis </ value ></ property >
     </ bean >
    
     < bean  id ="daoAuthenticationProvider"  class ="org.acegisecurity.providers.dao.DaoAuthenticationProvider" >
         < property  name ="userDetailsService"  ref ="userDetailsService" />
     </ bean >
    
     <!--  data source  -->
     < bean  id ="huafademoDS"
        class ="org.springframework.jndi.JndiObjectFactoryBean" >
          < property  name ="jndiName" >
           < value > java:huafademoDS </ value >
         </ property >
         < property  name ="jndiTemplate" >
             < ref  bean ="jndiTemplate" />
         </ property >
     </ bean >     
    
      <!--  UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users  -->
     <!-- bean id="userDetailsService" class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">
        <property name="userProperties">
            <bean class="org.springframework.beans.factory.config.PropertiesFactoryBean">
                <property name="location" value="/WEB-INF/users.properties"/>
            </bean>
        </property>
    </bean -->
    
     < bean  id ="userDetailsService"  class ="sinosafecmb.web.security.UserDetailsServiceProxy" >
         < property  name ="applicationController"  ref ="huafademoAC" />
     </ bean >
    
     <!--  bean id="userDetailsService" class="org.acegisecurity.userdetails.jdbc.JdbcDaoImpl">
          <property name="dataSource"><ref bean="huafademoDS"/></property>
        <property name="usersByUsernameQuery">
              <value>SELECT c_user, c_password, 1 FROM zs_users WHERE c_user=?</value>
        </property>
        <property name="authoritiesByUsernameQuery">
              <value>SELECT c_user, c_privilege FROM zs_authority WHERE c_user=?</value>
        </property>        
    </bean -->      

     <!--  This bean is optional; it isn't used by any other bean as it only listens and logs  -->
     < bean  id ="loggerListener"  class ="org.acegisecurity.event.authentication.LoggerListener" />
    
     <!--  messages  -->
     < bean  id ="messageSource"  class ="org.springframework.context.support.ResourceBundleMessageSource" >
       < property  name ="basename" >< value > org/acegisecurity/messages </ value ></ property >
     </ bean >      

     </ bean >
</ beans >

代码中加入了自己的注释，针对项目需要，对acegi做了几个修改。

1. 因为项目是分布式部署的，所以在页面的控制层中做了一个代理userDetailsService，用来从ejb中获得需要的数据。

2. 原来的acegi在控制同一用户登陆的时候有点小问题：被踢出去的用户session未超时，所以必须打开一个新窗口登陆。于是修改了concurrentSessionFilter中的代码，在踢用户的时候，让session失效