不好部署，能否有文档说明下部署流程。

spring security扩展，从数据库读取信息。从新实现UserDetailsService和FilterInvocationSecurityMetadataSource

public class HibernateUserDetailsServiceImpl extends HibernateDaoSupport implements UserDetailsService {

	//~ Methods ========================================================================================================
	@SuppressWarnings("unchecked")
	public UserDetails loadUserByUsername(String userId)
			throws UsernameNotFoundException, DataAccessException {
		List results = getHibernateTemplate().find("from User as res left outer join fetch res.employee left outer join fetch res.authorities where userId = ?",
                new Object[] {userId});
		if (results.size() < 1) {
            throw new UsernameNotFoundException(userId + "not found");
        }

		return (UserDetails) results.get(0);
	}
}

public class HibernateFilterInvocationSecurityMetadataSource extends HibernateDaoSupport
		implements FilterInvocationSecurityMetadataSource{
	
	//~ Static fields ==================================================================================================
	public static final String CACHE_KEY = "FilterInvoSecMetaKey";

	//~ Instance fields ================================================================================================
	protected final Logger logger = LoggerFactory.getLogger(this.getClass());
	
	@javax.annotation.Resource(name="starFrameCache")
	private Cache cache;
	
	private Map<Object, Collection<ConfigAttribute>> httpMap = null;

	private UrlMatcher urlMatcher = new AntUrlPathMatcher(true);

    private boolean stripQueryStringFromUrls;
	
	//~ Constructors ===================================================================================================

	//~ Methods ========================================================================================================
    /**
     * 初始化，加载资源权限 
     */
    @SuppressWarnings("unchecked")
	@PostConstruct
	public void loadSecurityMetadataSource() throws Exception {
    	logger.info("Loading Security Metadata Source...");
    	
    	httpMap = new LinkedHashMap<Object, Collection<ConfigAttribute>>();
    	
    	Session session = getHibernateTemplate().getSessionFactory().openSession();
    	Query query = session.createQuery("from Resource as res left outer join fetch res.roles where res.enabled = :enabled and res.type <> :type order by res.priority");
    	query.setCharacter("enabled", 'Y');
    	//不等于method类型
    	query.setString("type", Resource.ResourceType.METHOD.getType());
		List<Resource> resources = query.list();
		
		for(Resource resource : resources) {
			String pattern = resource.getAction();
			//如果资源是菜单类型时，需要去掉前缀
			if(pattern.startsWith("./"))
				pattern = pattern.substring(1);
			else if(pattern.startsWith("../"))
				pattern = pattern.substring(2);
			
			while(pattern.startsWith("/..")) {
				pattern = pattern.substring(3);
			}
				
			List<ConfigAttribute> attrs = new ArrayList<ConfigAttribute>();
			Set<Role> roles = resource.getRoles();
	    	
			for(Role role : roles) {
				attrs.add(new SecurityConfig(role.getCode()));
			}
			httpMap.put(urlMatcher.compile(pattern), attrs);

			if (logger.isDebugEnabled()) {
	            logger.debug("Added URL pattern: " + pattern + "; attributes: " + attrs);
	        }
		}
		session.close();
		
		cache.putItem(CACHE_KEY, httpMap);
	}
	
	/**
	 * 
	 */
	public Collection<ConfigAttribute> getAllConfigAttributes() {
		return null;
	}

	/**
	 * 通过FilterInvocation对象查找适合的ConfigAttribute
	 * 
	 * @param object
	 * @return
	 */
	public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
		if ((object == null) || !this.supports(object.getClass())) {
            throw new IllegalArgumentException("Object must be a FilterInvocation");
        }

        String url = ((FilterInvocation) object).getRequestUrl();

        return lookupAttributes(url);
	}
	
	/**
	 * 
	 * @param url
	 * @return
	 */
	public final Collection<ConfigAttribute> lookupAttributes(String url) {
        if (stripQueryStringFromUrls) {
            // Strip anything after a question mark symbol, as per SEC-161. See also SEC-321
            int firstQuestionMarkIndex = url.indexOf("?");

            if (firstQuestionMarkIndex != -1) {
                url = url.substring(0, firstQuestionMarkIndex);
            }
        }

        if (urlMatcher.requiresLowerCaseUrl()) {
            url = url.toLowerCase();

            if (logger.isDebugEnabled()) {
                logger.debug("Converted URL to lowercase, from: '" + url + "'; to: '" + url + "'");
            }
        }

        // Obtain the map of request patterns to attributes for this method and lookup the url.
        Object obj = cache.getItem(CACHE_KEY);
        if(obj == null) {
    		try {
				loadSecurityMetadataSource();
			} catch (Exception e) {
				e.printStackTrace();
			}
        }
        Collection<ConfigAttribute> attributes = extractMatchingAttributes(url, httpMap);

        return attributes;
    }
	
	/**
	 * 
	 * @param url
	 * @param map
	 * @return
	 */
	private Collection<ConfigAttribute> extractMatchingAttributes(String url, Map<Object, Collection<ConfigAttribute>> map) {

        final boolean debug = logger.isDebugEnabled();

        for (Map.Entry<Object, Collection<ConfigAttribute>> entry : map.entrySet()) {
            Object p = entry.getKey();
            boolean matched = urlMatcher.pathMatchesUrl(entry.getKey(), url);

            if (debug) {
                logger.debug("Candidate is: '" + url + "'; pattern is " + p + "; matched=" + matched);
            }

            if (matched) {
                return entry.getValue();
            }
        }
        return null;
    }

	/**
	 * 
	 */
	public boolean supports(Class<?> clazz) {
		return FilterInvocation.class.isAssignableFrom(clazz);
	}

	public void setCache(Cache cache) {
		this.cache = cache;
	}
}

Ralasafe手册
第2章讲解了怎样安装。非常简单，就是复制文件，修改数据库配置文件和用户元数据文件。

粒度太粗了，这让我想起当年研究RBAC的日子。
那时候的导师要求需要将每个页面的每一个按钮都作为可控制部分，
而我那时也只是简单用url作为最小粒度，不过现在想一想还真对不起RBAC。

权限是最讨厌的

替楼主叫屈
看不明白那些投新手帖的
权限真的那么简单吗？