Spring security 自定义登录与权限控制

一、先说必要的配置文件：

1、web.xml文件添加上

<!-- Spring Security 权限框架 -->
<filter>
   <filter-name>springSecurityFilterChain</filter-name>
   <filter-class>
      org.springframework.web.filter.DelegatingFilterProxy
   </filter-class>
</filter>
<filter-mapping>
   <filter-name>springSecurityFilterChain</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>

2、application-context.xml配置文件

在application-context配置文件中加入spring security配置文件的引用：

<?xml version="1.0" encoding="UTF-8"?>
<beans ......>
   <bean>
      <!-- Connection Info --> ......此处省略
   </bean>
   <bean id="viewResolver" class="org.springframework.web.servlet.view.velocity.VelocityViewResolver">
     ......  
     <!-- if you want to use the Spring Velocity macros, set this property to true -->
     <property name="exposeSpringMacroHelpers" value="true"/>
     <property name="contentType" value="text/html;charset=UTF-8"></property>
  
      <property name="toolboxConfigLocation">
      <value>/WEB-INF/toolbox.xml</value>
      </property>
    </bean>
   <import resource="/securityConfig.xml"/></beans>

3、securityConfig.xml文件：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
   xmlns:security="http://www.springframework.org/schema/security"
   xsi:schemaLocation="http://www.springframework.org/schema/beans 
             http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
         http://www.springframework.org/schema/security 
         http://www.springframework.org/schema/security/spring-security-3.2.xsd">

   <!--use-expressions="true" 的意思是开启表达式 ， access-denied-page的意思是，当验证权限失败后会跳转到的页面 -->
   <security:http auto-config="true" use-expressions="true" access-denied-page="/denied">
      
      <!-- 对所有的资源，进行权限的设置访问-->
      <!-- 所有人都可以访问资源文件 -->
      <security:intercept-url pattern="/login" access="permitAll" />
      <security:intercept-url pattern="/logout" access="permitAll" />
      <security:intercept-url pattern="/slr/prd/**" access="hasAnyRole('SHOW_PRD','ADD_PRD','MOD_PRD','DEL_PRD')" />
      <security:intercept-url pattern="/slr/order/**" access="hasAnyRole('SHOW_ORD','CONFIRM_ORD','CANCEL_ORD')" />
      <security:intercept-url pattern="/slr/mgm/**" access="hasAnyRole('SHOW_ACCT','ADD_ACCT','MOD_ACCT','DEL_ACCT')" />
      <!-- 配置登录页面为