一、先说必要的配置文件:
1、web.xml文件添加上
<!-- Spring Security 权限框架 --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class> org.springframework.web.filter.DelegatingFilterProxy </filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
2、application-context.xml配置文件
在application-context配置文件中加入spring security配置文件的引用:
<?xml version="1.0" encoding="UTF-8"?> <beans ......> <bean> <!-- Connection Info --> ......此处省略 </bean><bean id="viewResolver" class="org.springframework.web.servlet.view.velocity.VelocityViewResolver"> ...... <!-- if you want to use the Spring Velocity macros, set this property to true --> <property name="exposeSpringMacroHelpers" value="true"/> <property name="contentType" value="text/html;charset=UTF-8"></property> <property name="toolboxConfigLocation"> <value>/WEB-INF/toolbox.xml</value> </property> </bean><import resource="/securityConfig.xml"/></beans>
3、securityConfig.xml文件:
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:security="http://www.springframework.org/schema/security" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd"> <!--use-expressions="true" 的意思是开启表达式 , access-denied-page的意思是,当验证权限失败后会跳转到的页面 --> <security:http auto-config="true" use-expressions="true" access-denied-page="/denied"> <!-- 对所有的资源,进行权限的设置访问--><!-- 所有人都可以访问资源文件 --><security:intercept-url pattern="/login" access="permitAll" /><security:intercept-url pattern="/logout" access="permitAll" /><security:intercept-url pattern="/slr/prd/**" access="hasAnyRole('SHOW_PRD','ADD_PRD','MOD_PRD','DEL_PRD')" /><security:intercept-url pattern="/slr/order/**" access="hasAnyRole('SHOW_ORD','CONFIRM_ORD','CANCEL_ORD')" /><security:intercept-url pattern="/slr/mgm/**" access="hasAnyRole('SHOW_ACCT','ADD_ACCT','MOD_ACCT','DEL_ACCT')" /><!-- 配置登录页面为