spring security

http://blog.csdn.net/k10509806/article/details/6436987
http://www.iteye.com/topic/1129965
http://dreamzhong.iteye.com/blog/1722285


http://www.open-open.com/doc/list/153?pn=2

https://github.com/spring-projects/spring-security/tree/3.1.x/web/src/main/java/org/springframework/security/web 源码下载

http://repo1.maven.org/maven2/org/springframework/security/spring-security-taglibs/3.2.0.RELEASE/
release 下载

http://www.open-open.com/doc/list/153?pn=0

http://dead-knight.iteye.com/category/220917 spring security 源码分析

这里有一个比较关键的问题，就是封装他们的过滤器（或者仅仅是知道他们到底是哪些过滤器在起作用）：
表1
Alias Filter Class Namespace Element or Attribute
CHANNEL_FILTER ChannelProcessingFilter http/intercept-url@requires-channel
CONCURRENT_SESSION_FILTER ConcurrentSessionFilter session-management/concurrency-control
SECURITY_CONTEXT_FILTER SecurityContextPersistenceFilter http
LOGOUT_FILTER LogoutFilter http/logout
X509_FILTER X509AuthenticationFilter http/x509
PRE_AUTH_FILTER AstractPreAuthenticatedProcessingFilter Subclasses N/A
CAS_FILTER CasAuthenticationFilter N/A
FORM_LOGIN_FILTER UsernamePasswordAuthenticationFilter http/form-login
BASIC_AUTH_FILTER BasicAuthenticationFilter http/http-basic
SERVLET_API_SUPPORT_FILTER SecurityContextHolderAwareFilter http/@servlet-api-provision
REMEMBER_ME_FILTER RememberMeAuthenticationFilter http/remember-me
ANONYMOUS_FILTER AnonymousAuthenticationFilter http/anonymous
SESSION_MANAGEMENT_FILTER SessionManagementFilter session-management
EXCEPTION_TRANSLATION_FILTER ExceptionTranslationFilter http
FILTER_SECURITY_INTERCEPTOR FilterSecurityInterceptor http
SWITCH_USER_FILTER SwitchUserFilter N/A

（最开始看的时候，把这个表格忽略了，现在看来这些就是我们想要的！）
我们的验证过程，就是按照这样的顺序进行的。自上而下进行。

如果我们要自己定制相应的验证处理方法（在过滤器里面），我们就可以对照上面的过滤器，覆盖相应的接口方法。
根据我的处理过程，主要是用户名密码的验证过程，我大体描述一下自己的配置和处理过程：
1.配置namespace的标签:
  <http  use-expressions="true" ><!-- This is not the default value -->
       <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter"/> <!--This is my own filter which just extends AbstractAuthenticationProcessingFilter as what UsernamePasswordAuthenticationFilter does.-->
       <intercept-url pattern="/test/**"  access="hasRole('ROLE_MY')"/><!-- I tested that what is role,and how I can use it.So ROLE_MY is just a role name I defined.-->
       <intercept-url pattern="/login.jsp*" access="permitAll" />
       <logout />
       <anonymous />
       <http-basic />
  </http>
这里的问题是，要定制自己的过滤器，就要通过<custom-filter/>，然后对照 表1 中指定的position,覆盖默认的filter。
2.我的form-login  filter配置（这些配置都是在application-security.xml文件中）为：
<beans:bean id="myFilter"
      class="com.saveworld.authentication.filters.MyUsernamePasswordAuthenticationFilter">
    <beans:property name="defaultTargetUrl"  value="/default.jsp" />
    <beans:property name="defaultFailureUrl"  value="/error.jsp" />
    <beans:property name="authenticationManager" ref="authenticationManager" />
    <beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
    <beans:property name="continueChainBeforeSuccessfulAuthentication" value="false" />
  </beans:bean>

NOTE：
在这里有个问题就是： filter position conflicts!
如果使用这样的配置
<http auto-config='true'>
   <custom-filter position="FORM_LOGIN_FILTER" ref="myFilter"/>
</http>
自定义的filter对应的position是FORM_LOGIN_FILTER
但是因为使用了auto-config='true'，所以默认有<form-login />，which is on the position FORM_LOGIN_FILTER!
这时就会出现position conflicts问题了。当然，如果你没有设置auto-config='true'，但是却自己设置了<form-login />，呵呵，这个情况就是自己大意了，还是有了position conflicts的异常，所以，好好看看上面的表格是相当必要的，看清楚每个position默认都对应那些namespace，都是对应的哪些filter！




控制一个帐号多次登录方法
：

		<!-- 检测失效的sessionId, 超时时定位到另外一个URL -->
		<session-management invalid-session-url="/framework/security/none/login.jsp" session-authentication-strategy-ref="sas">
<!-- 			<concurrency-control max-sessions="1" error-if-maximum-exceeded="false" /> -->
		</session-management>

	<beans:bean id="sas" class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">  
   		 <beans:property name="maximumSessions" value="1"></beans:property>  
    	<beans:property name="exceptionIfMaximumExceeded" value="false"></beans:property>  
    	<beans:constructor-arg name="sessionRegistry" ref="sessionRegistry"></beans:constructor-arg>  
	</beans:bean>  
	<beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"></beans:bean>  


<!-- 登录验证器 -->
	<beans:bean id="usernamePasswordValidateCodeAuthenticationFilter" class="com.cpp.framework.security.web.authentication.UsernamePasswordValidateCodeAuthenticationFilter">
		<!-- 处理登录的action -->
		<beans:property name="filterProcessesUrl" value="/j_spring_security_check" />
		<!-- 验证成功后的处理 -->
		<beans:property name="authenticationSuccessHandler" ref="authenticationSuccessHandler" />
		<!-- 验证失败后的处理 -->
		<beans:property name="authenticationFailureHandler" ref="authenticationFailureHandler" />
		<beans:property name="authenticationManager" ref="authenticationManager" />
		<beans:property name="sessionAuthenticationStrategy" ref="sas"></beans:property>  
	</beans:bean>