spring security

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:s="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.0.3.xsd">


<description>SpringSecurity安全配置</description>

<bean id="authenticationFilter"
class="org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager" />
<property name="filterProcessesUrl" value="/j_spring_security_check" />
<property name="rememberMeServices" ref="rememberMeServices" />
</bean> 

<bean id="accessDecisionManager"
class="org.springframework.security.access.vote.AffirmativeBased">
<property name="allowIfAllAbstainDecisions" value="false" />
<property name="decisionVoters">
<list>
<ref bean="roleHierarchyVoter" />
<ref bean="authenticatedVoter" />
</list>
</property>
</bean>

<!-- 设置权限字符串的前缀-->
<bean id="roleHierarchyVoter"
class="org.springframework.security.access.vote.RoleHierarchyVoter">
<constructor-arg ref="roleHierarchy" />
<property name="rolePrefix" value="P_" />
</bean>



<bean id="authenticatedVoter"
class="org.springframework.security.access.vote.AuthenticatedVoter" />

<!-- 可继承的权限 ，可设置权限的继承关系-->
<bean id="roleHierarchy"
class="org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl">
<property name="hierarchy">
<value>
P_A>P_B
P_B>P_C
</value>
</property>
</bean>



<!-- 成功登录后的处理 -->
<bean id="loginSuccessHandler"
class="com.jsw.security.web.login.LoginServlet" >
</bean>

<!-- http安全配置 -->
<s:http auto-config="true" access-decision-manager-ref='accessDecisionManager'>
<!--不需要安全控制的资源-->
<s:intercept-url pattern="*.gwt" filters="none" />
<s:intercept-url pattern="/stat/**" filters="none" />
<s:intercept-url pattern="*.css" filters="none" />
<s:intercept-url pattern="*.js" filters="none" />
<s:intercept-url pattern="**/images/**" filters="none" />


<!--需要安全控制的URL资源,pattern可使用正则表达式，access使用对应的权限-->
<s:intercept-url pattern="/securityTest/a.html"
access="P_A" />
<s:intercept-url pattern="/securityTest/b.html"
access="P_B" />
<s:intercept-url pattern="/securityTest/c.html"
access="P_C" />


<s:form-login 
login-processing-url="/j_spring_security_check" 
authentication-success-handler-ref="loginSuccessHandler"
authentication-failure-handler-ref="loginSuccessHandler" 

/>
<s:remember-me  services-ref="rememberMeServices"/>
<!--登出 -->
<s:logout logout-url="/j_spring_security_logout" />


<!--用户session管理，用于控制同一用户同时最多登录次数-->
<s:session-management invalid-session-url="/">
<s:concurrency-control  max-sessions="10" session-registry-ref="sessionRegistry"
error-if-maximum-exceeded="false" />
</s:session-management>



<!--用于开发时自动登录 -->
<s:custom-filter after="SECURITY_CONTEXT_FILTER" ref="autoLoginFilter" />


</s:http>




<!-- 方法安全配置 -->
<s:global-method-security secured-annotations="enabled" />


<!-- 认证配置 -->
<s:authentication-manager alias="authenticationManager">
<s:authentication-provider ref="rememberMeAuthenticationProvider" />

<s:authentication-provider  user-service-ref="userDetailsService">
<s:password-encoder hash="sha" />
</s:authentication-provider>
<s:authentication-provider ref="loginProvider" user-service-ref="userDetailsService"/>
</s:authentication-manager>

<bean id="loginProvider" class="com.jsw.zhongtou.server.web.LdapLoginProvider" autowire="byName">
<property name="enabled" value="${ldapEnabled}"/>
<property name="ldapUrl" value="${ldapUrl}"/>
<property name="principalSuffix" value="${principalSuffix}"/>
<property name="notLdapUsers" value="${notLdapUsers}"/>
</bean>


<!-- 项目实现的用户查询服务  -->
<bean id="userDetailsService" class="com.jsw.security.service.impl.UserDetailsServiceImpl" autowire="byName"/>
<bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl" autowire="byName"/>


<!-- 开发时自动登录的filter -->
<bean id="autoLoginFilter" class="com.jsw.security.web.filter.AutoLoginFilter" autowire="byName">
<property name="enabled" value="${security.autologin.enabled}" />
<property name="defaultUserName" value="${security.autologin.username}" />
</bean>


<bean id="rememberMeFilter"
class="org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
<property name="rememberMeServices" ref="rememberMeServices" />
<property name="authenticationManager" ref="authenticationManager" />
</bean>


<bean id="rememberMeServices"
class="com.jsw.security.web.login.RememberMeServiceImpl">
<property name="userDetailsService" ref="userDetailsService" />
<property name="key" value="springRocks" />
</bean>


<bean id="rememberMeAuthenticationProvider"
class="org.springframework.security.authentication.RememberMeAuthenticationProvider">
<property name="key" value="springRocks" />
</bean>

</beans>

<servlet>
<servlet-name>getInitData</servlet-name>
<servlet-class>com.jsw.security.web.login.LoginServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>getInitData</servlet-name>
<url-pattern>/getInitData</url-pattern>
</servlet-mapping>