spring security 配置

web.xml
DelegatingFilterProxy只是代理Spring容器中FilterChainProxy. 截到请求后转给后者处理。

<filter>
	<filter-name>springSecurityFilterChain</filter-name>
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
	<filter-name>springSecurityFilterChain</filter-name>
	<url-pattern>/*</url-pattern>
</filter-mapping>

SpringSecurityContext.xml：

<!--
<http>元素封装了安全性配置，它创建了一个名为"SpringSecurityFilterChain"的FilterChainProxy bean,这个bean维护了一系列的建立了web安全配置得安全过滤器。
-->
<http auto-config="false" 
	      access-denied-page="/accessDenied.jsp" 
<!--相当于下面的 <form-login/>
   entry-point-ref="authenticationProcessingFilterEntryPoint"-->
>
		
		<intercept-url pattern="/javascript/**" access="ROLE_READ" />
		<intercept-url pattern="/images/**" access="ROLE_READ" />
	
		
		<intercept-url pattern="/listUsers.do" access="ROLE_READ" />
		
		<intercept-url pattern="/userManagement.do" access="ROLE_ADMIN"/>
		
	    <logout logout-success-url="/"/>
	      <remember-me/>
	     <form-login login-page="/" authentication-failure-url="/?error=true" default-target-url="/home.do" /> 
	     <!--<concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="false" expired-url="/?error=true"/>  
	     -->
	</http>

<!-- 另一种设置登录页面的方法, 除了上面的<form-login/> -->
<!--
<beans:bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
	    <beans:property name="loginFormUrl" value="/login.jsp"/>
	</beans:bean>
-->

<!--其中UserDetailsSerivceImpl实现了UserDetailsService接口，重写了UserDetails loadUserByUsername(name) 方法。-->
<beans:bean id="userDetailsService" class="com.test.security.UserDetailsSerivceImpl" />

    <authentication-provider user-service-ref="userDetailsService">
    	<password-encoder hash="md5">
    		<salt-source user-property="username"/>
    	</password-encoder>
    </authentication-provider>

<!--<authentication-manager/>隐藏了providers属性的注入，实际注入了<authentication-provider/> -->
<authentication-manager alias="authenticationManager"/>

上面的配置，分为两个方向：
1）User--->Role(Authencation)
上面通过<authentication-manage/>来实现，再通过UserDetailsService来获得具体的验证。

也可以另一种简单配置的方法：
<authencation-provider>
   <user-service>
    <user name="" pswd="" authorities="xxxRole"/>
    ...
   </user-service>
</authencation-provide>


2）Resource---->Role(Authorization）
上面通过<http>中<intercept-url/>进行配置。

也可以使用另一种复杂配置：
通过FilterSecurityInterceptor作为过滤器链中一个元素而进行配置。
<Custom-filter>用来设定该过滤器的位置。

<beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">

<beans:property name="allowIfAllAbstainDecisions" value="false"/>
	    <beans:property name="decisionVoters">
	        <beans:list>
	            <beans:bean class="org.springframework.security.vote.RoleVoter"/>
	            <beans:bean class="org.springframework.security.vote.AuthenticatedVoter"/>
	        </beans:list>
             </beans:property>
</beans:bean>
	
<beans:bean id="resourceSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
		<beans:property name="validateConfigAttributes" value="false" />
		<beans:property name="authenticationManager" ref="authenticationManager"/>
	    <beans:property name="accessDecisionManager" ref="accessDecisionManager"/>
	    <beans:property name="objectDefinitionSource" ref="filterInvocationDefinitionSource" />
	    <beans:property name="observeOncePerRequest" value="false" />
	    <custom-filter after="LAST" />
</beans:bean>

<beans:bean id="filterInvocationDefinitionSource" class="com.test.security.service.FilterInvocationDefinitionSourceImpl" />

其中filterInvocationDefinitionSource<-----FilterInvocationDefinitionSource<----ObjectDefinitionSource
有下面的方法需要实现：

public interface ObjectDefinitionSource{

   public abstract ConfigAttributeDefinition getAttributes( Object obj )
      throws IllegalArgumentException;

   public abstract Collection getConfigAttributeDefinitions();

   public abstract boolean supports( Class class1 );
}

实现如下：

public ConfigAttributeDefinition getAttributes(Object filter)
			throws IllegalArgumentException {

		FilterInvocation filterInvocation = (FilterInvocation) filter;
		String requestURI = filterInvocation.getRequestUrl();

		Set<String> roles = securityService.loadUrlAuthorities(requestURI);

		String grantedAuthorities = StringUtils.join(roles.toArray(), ",");

		if (grantedAuthorities.length() > 0) {

			ConfigAttributeEditor configAttrEditor = new ConfigAttributeEditor();
			configAttrEditor.setAsText(grantedAuthorities);
			return (ConfigAttributeDefinition) configAttrEditor.getValue();
		}

		return null;
	}

	/**
	 * If available, returns all of the ConfigAttributeDefinitions defined by
	 * the implementing class. This is used by the AbstractSecurityInterceptor
	 * to perform startup time validation of each ConfigAttribute configured
	 * against it.
	 * 
	 * @return the ConfigAttributeDefinitions or null if unsupported
	 * @see org.springframework.security.intercept.ObjectDefinitionSource#getConfigAttributeDefinitions()
	 */
	@SuppressWarnings("unchecked")
	public Collection getConfigAttributeDefinitions() {
		return null;
	}

	/**
	 * Indicates whether the ObjectDefinitionSource implementation is able to
	 * provide ConfigAttributeDefinitions for the indicated secure object type.
	 * 
	 * @param clazz
	 *            -the class that is being queried.
	 * @return true -if the implementation can process the indicated class
	 * @see org.springframework.security.intercept.ObjectDefinitionSource#supports(java.lang.Class)
	 */
	@SuppressWarnings("unchecked")
	public boolean supports(Class clazz) {
		return true;
	}

pages.xml：

<form method="post" id="loginForm" action="${pageContext.request.contextPath}/j_spring_security_check">

<input class="width_200px" type="text" name="j_username" id="j_username" />
<input class="width_200px" type="password" name="j_password" id="j_password" />
<input class="button_3" type="submit" value="Log In" />
</form>