spring security 2.0 命名空间配置（转载）

spring security 2.0 命名空间配置(带例子)
spring security已经成为企业软件中应用最为广泛的Java安全框架之一，它可以在Spring应用上下文中配置的Bean，充分利用了Spring IoC（依赖注入，也称控制反转）和AOP（面向切面编程）功能，为应用系统提供声明式的安全访问控制功能，减少了为企业系统安全控制编写大量重复代码的工作。它提供了全面的认证、授权、基于实例的访问控制、channel安全及人类用户检验能力。
Spring Security 2.0构建在Acegi Security坚实的基础之上，并在此基础上增加了许多新特性，现在本文的重点是要讲spring security简化的基于命名空间的配置，旧式配置可能需要上百行的XML.
通过下面的例子，你会了解到基于命名空间的配置是如何的简单。

spring security 2.0 例子：

开发环境：MyEclipse 6.0
服务器 ：tomcat 6.x
开发架构：struts 1.2 spring 2.5
spring security 版本：2.0

1.首先要搭好应用的款架，struts和spring（省略）
2.在web.xml里把spring-security 的配置文件路径添加进来
3.在web.xml中添加过spring的过滤器代理
4.添加相关的监听器，以便spring的监听管理
具体web.xml文件如下：

<?xml version="1.0" encoding="UTF-8"?>

<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"

 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee   http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

 <!-- 装载spring配置文件 -->

 <context-param>

  <param-name>contextConfigLocation</param-name>

  <param-value>

  	/WEB-INF/spring-security-ns.xml 

    /WEB-INF/applicationContext.xml

   </param-value>

 </context-param>

 <context-param>

  <param-name>log4jConfigLocation</param-name>

  <param-value>/WEB-INF/classes/log4j.properties</param-value>

 </context-param>

 <filter>

  <filter-name>springSecurityFilterChain</filter-name>

  <!--bean的名字是springSecurityFilterChain，这是由命名空间创建的用于处理web安全的一个内部机制 -->

  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

 </filter>



 <filter-mapping>

  <filter-name>springSecurityFilterChain</filter-name>

  <url-pattern>/*</url-pattern>

 </filter-mapping>

 <!--

	  - Loads the root application context of this web app at startup.

	  - The application context is then available via

	  - WebApplicationContextUtils.getWebApplicationContext(servletContext).

    -->

 <listener>

  <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

 </listener>

 <!--

	  - Publishes events for session creation and destruction through the application

	  - context. Optional unless concurrent session control is being used.

      -->

 <listener>

  <listener-class>org.springframework.security.ui.session.HttpSessionEventPublisher</listener-class>

 </listener>

 <servlet>

  <servlet-name>action</servlet-name>

  <servlet-class>org.apache.struts.action.ActionServlet</servlet-class>

  <init-param>

   <param-name>config</param-name>

   <param-value>/WEB-INF/struts-config.xml</param-value>

  </init-param>

  <init-param>

   <param-name>debug</param-name>

   <param-value>3</param-value>

  </init-param>

  <init-param>

   <param-name>detail</param-name>

   <param-value>3</param-value>

  </init-param>

  <load-on-startup>0</load-on-startup>

 </servlet>

 <servlet-mapping>

  <servlet-name>action</servlet-name>

  <url-pattern>*.do</url-pattern>

 </servlet-mapping>

 <welcome-file-list>

  <welcome-file>login.jsp</welcome-file>

 </welcome-file-list>

 <error-page>

  <error-code>403</error-code>

  <location>/error.html</location>

 </error-page>

 <login-config>

  <auth-method>BASIC</auth-method>

 </login-config>

</web-app>

5.创建spring-security-ns.xml配置文件（具体看配置文件）：

<?xml version="1.0" encoding="UTF-8"?>

<!--

  - 基于名称空间配置

  -->

<beans:beans xmlns="http://www.springframework.org/schema/security"

    xmlns:beans="http://www.springframework.org/schema/beans"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd

                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.xsd">



	<global-method-security secured-annotations="enabled" >

		<!-- AspectJ pointcut expression that locates our "post" method and applies security that way

		<protect-pointcut expression="execution(* bigbank.*Service.post*(..))" access="ROLE_TELLER"/>

		-->

	</global-method-security>

											

    <http access-denied-page="/error.jsp" access-decision-manager-ref="accessDecisionManager" 

    	session-fixation-protection="newSession" auto-config="true" path-type="ant" ><!--session-fixation-protection属性可以防止session固定攻击  -->

       <!-- 权限入口的顺序十分重要，注意必须把特殊的URL权限写在一般的URL权限之前。 -->        

		<intercept-url pattern="/acegiTest.do" access="ROLE_SUPERVISOR"/>        

        <intercept-url pattern="/index.jsp" access="IS_AUTHENTICATED_REMEMBERED" />

        <intercept-url pattern="/roleA/**.jsp" access="ROLE_A"/>

        <intercept-url pattern="/roleB/**.jsp" access="ROLE_B"/>

        <intercept-url pattern="/roleC/**.jsp" access="ROLE_C"/>

        <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>

		<!--

    	x509认证

        <x509 /> 

		-->

        <!-- All of this is unnecessary if auto-config="true"

        <form-login />

        <anonymous />

        <http-basic />

        <logout />

        <remember-me />

         -->

        <form-login login-page="/login.jsp" default-target-url="/index.jsp" authentication-failure-url="/login.jsp?login_error=1" />

        <anonymous key="cookie_key" username="ananoymous" granted-authority="IS_AUTHENTICATED_ANONYMOUSLY"/>        

        <logout invalidate-session="true" />

        <!-- session并发控制 -->				

		<concurrent-session-control max-sessions="1" exception-if-maximum-exceeded="true" /><!-- exception-if-maximum-exceeded="true" 第二次登入失效 -->

   		

    </http>   

    

    <!-- 访问决策管理 -->

	<beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">

		<beans:property name="allowIfAllAbstainDecisions" value="true"/>

		<beans:property name="decisionVoters"><!-- 投票者列表 -->

			<beans:list>

				<beans:bean class="org.springframework.security.vote.RoleVoter"/>

				<beans:bean class="org.springframework.security.vote.AuthenticatedVoter"/>

			</beans:list>

		</beans:property>

	</beans:bean>

  

    <authentication-provider><!-- user-service-ref="userDetailsService" -->    

     	 <!-- 基于内存存储用户 -->

    	<user-service>

    		<user name="admin" password="202cb962ac59075b964b07152d234b70" authorities="ROLE_A, ROLE_B, ROLE_C, ROLE_SUPERVISOR"/>

    		<user name="userab" password="202cb962ac59075b964b07152d234b70" authorities="ROLE_A, ROLE_B"/>

    		<user name="usera" password="202cb962ac59075b964b07152d234b70" authorities="ROLE_A"/>

    		<user name="userb" password="202cb962ac59075b964b07152d234b70" authorities="ROLE_B"/>

    	</user-service>    	 

    	 <!--密码md5加密--> 

        <password-encoder hash="md5"/>  

        <!--

	    <jdbc-user-service data-source-ref="f3CenterDS" 

	    		users-by-username-query="select name as 'username',password`,'true' as 'enabled' from users where name = ?" 

	    		authorities-by-username-query="select name as 'username',authorities as 'authority' from authentication where name = ?" 

	    		 />     

	 	--> 

	</authentication-provider>	

	<!--用户信息存在在数据库的验证-->

	<!--  

	<beans:bean id="userDetailsService"

		class="org.springframework.security.userdetails.jdbc.JdbcDaoImpl">

		<beans:property name="dataSource" ref="f3CenterDS" />

		<beans:property name="usersByUsernameQuery">

			<beans:value>

				select name as 'username',password,'true' as 'enabled' from users where name = ?

			</beans:value>

		</beans:property>

		<beans:property name="authoritiesByUsernameQuery">

			<beans:value>

				select name as 'username',authorities as 'authority' from authentication where name = ?

			</beans:value>

		</beans:property>

	</beans:bean>		

	-->

	

	

</beans:beans>