spring security

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:security="http://www.springframework.org/schema/security"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                          http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    
      <!-- 用户验证通过才能授权，若不通过会跳到authentication-failure-url(验证失败页面:就是登陆页面)
            若用户验证通过，但没有default-target-url的访问权限，则会跳转至access-denied-page(授权失败页面)
            如果访问的URL没有在Resource表中定义那么将被Security视为非法URL禁止访问 -->
      <security:http access-denied-page="/accessDenied.jsp"  entry-point-ref="authenticationEntryPoint">
          <security:intercept-url pattern="/back/menuItem/menuItem-queryMenuItemAllWithURL.do" filters="none" />
          <security:intercept-url pattern="/remoting/destroycache" filters="none" />
          <security:intercept-url pattern="/login.jsp" filters="none" />
          <security:intercept-url pattern="/index.jsp" filters="none" /> 
          <security:intercept-url pattern="/jsp/**" filters="none" />
        <security:intercept-url pattern="/*.css" filters="none" />
        <security:intercept-url pattern="/jslib/**" filters="none"/>
        <security:intercept-url pattern="/css/**" filters="none"/>
        <security:intercept-url pattern="/images/**" filters="none"/>
        <security:intercept-url pattern="/js/**" filters="none"/>
        <security:intercept-url pattern="/**/*.css" filters="none"/>
        <security:intercept-url pattern="/**/*.gif" filters="none"/>
        <security:intercept-url pattern="/**/*.js" filters="none"/>
       
         <security:logout logout-success-url="/login.jsp" />
         <security:form-login login-page="/login.jsp" default-target-url="/main.jsp"
             authentication-failure-url="/login.jsp" />
         <security:http-basic />
         <security:custom-filter ref="customSecurityFilter" before="FILTER_SECURITY_INTERCEPTOR" />
     </security:http>
    
     <bean id="authenticationEntryPoint" class="com.cpic.a2.backend.security.AuthenticationEntryPoint">
         <constructor-arg name="loginUrl" value="/login.jsp" />
     </bean>
    
    
     <bean id="customSecurityFilter"
         class="com.cpic.a2.backend.security.CustomSecurityFilter">
 
         <!-- 注入决策管理器 -->
         <property name="accessDecisionManager" ref="_accessDecisionManager"></property>
 
         <!-- 注入资源角色授权管理器 -->
         <property name="securityMetadataSource" ref="_securityMetadataSource"></property>
 
         <!-- 注入身份认证管理器 -->
         <property name="authenticationManager" ref="_authenticationManager"></property>
 
     </bean>
 
     <bean id="_securityMetadataSource"
         class="com.cpic.a2.backend.security.CustomFilterInvocationSecurityMetadataSource"></bean>
 
     <bean id="_accessDecisionManager"
         class="com.cpic.a2.backend.security.CustomAccessDecisionManager"></bean>
 
      <bean id="passwordEncoder"
          class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" ></bean>
      
     <security:authentication-manager alias="_authenticationManager">
         <security:authentication-provider user-service-ref="userDetailService">
               <security:password-encoder ref="passwordEncoder" /> 
         </security:authentication-provider>
     </security:authentication-manager>
 
     <bean id="userDetailService"
         class="com.cpic.a2.backend.security.CustomUserDetailService"></bean>
 </beans>