<?xml version="1.0" encoding="UTF-8" ?>
- <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">
- <http access-denied-page="/403.jsp" auto-config="true">
<intercept-url pattern="/resources/images/**" filters="none" />
<intercept-url pattern="/resources/js/**" filters="none" />
<intercept-url pattern="/resources/css/**" filters="none" />
<intercept-url pattern="/resources/style/**" filters="none" />
<intercept-url pattern="/resources/flash/**" filters="none" />
<intercept-url pattern="/messagebroker/**" filters="none" />
<intercept-url pattern="/commons/**" filters="none" />
<intercept-url pattern="/login.jsp" filters="none" />
<intercept-url pattern="/index.jsp" filters="none" />
<intercept-url pattern="/servlet/jugServlet" filters="none" />
<intercept-url pattern="/security/user!userLogin.do" filters="none" />
<intercept-url pattern="/config/sysconfig!**" filters="none" />
<intercept-url pattern="/install_flash_player_10_active_x.exe" filters="none" />
<intercept-url pattern="/resources/PubwinKey.cab" filters="none" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?error=true" default-target-url="/view/module/mainframe.jsp" always-use-default-target="true" />
<logout logout-url="/j_spring_security_logout" logout-success-url="/login.jsp" invalidate-session="true" />
<http-basic />
</http>
- <!-- 获取用户权限信息
-->
- <authentication-provider user-service-ref="userDetailsPoliceService">
<password-encoder ref="userPasswordEncoder" />
</authentication-provider>
- <!-- 资源的控制
-->
- <beans:bean id="resourceSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor">
<beans:property name="authenticationManager" ref="authenticationManager" />
<beans:property name="accessDecisionManager" ref="accessDecisionManager" />
- <!-- 指定你的过滤器应该出现的位置
-->
<custom-filter before="FILTER_SECURITY_INTERCEPTOR" />
<beans:property name="objectDefinitionSource" ref="secureResourceFilter" />
- <!-- 在第一次进行过安全检查之后就不会再做了
-->
<beans:property name="observeOncePerRequest" value="false" />
</beans:bean>
<beans:bean id="loggerListener" class="org.springframework.security.event.authentication.LoggerListener" />
<authentication-manager alias="authenticationManager" />
- <beans:bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased">
<beans:property name="allowIfAllAbstainDecisions" value="false" />
- <beans:property name="decisionVoters">
- <beans:list>
<beans:bean class="org.springframework.security.vote.RoleVoter" />
<beans:bean class="org.springframework.security.vote.AuthenticatedVoter" />
</beans:list>
</beans:property>
</beans:bean>
</beans:beans>
import java.util.Collection;
import javax.annotation.Resource;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.security.ConfigAttributeDefinition;
import org.springframework.security.intercept.web.FilterInvocation;
import org.springframework.security.intercept.web.FilterInvocationDefinitionSource;
import org.springframework.stereotype.Service;
/**
*
* @author tangj
*/
@Service
public class SecureResourceFilter implements FilterInvocationDefinitionSource {
@Override
public ConfigAttributeDefinition getAttributes(Object filter) throws IllegalArgumentException {
FilterInvocation filterInvocation = (FilterInvocation) filter;
// System.out.println(filterInvocation.getHttpRequest().getRemoteAddr());
UserInfo user=this.userService.getSessionUserInfo();
if(user!=null){
user.getEntity().setIpAddress(filterInvocation.getHttpRequest().getRemoteAddr());
}
// Map<String, String> urlAuthorities = userDetails.getUrlMenuNameResources();
// FilterInvocation filterInvocation = (FilterInvocation) filter;
// String requestURL = filterInvocation.getRequestUrl();
// String requestURlIndex = requestURL.split("\\?")[0];
// if (logger.isDebugEnabled()) {
// logger.debug("requestURL::::" + requestURL);
// logger.debug("requestURlIndex::::" + requestURlIndex);
// }
// if (requestURlIndex.indexOf("!") > 0) {
// if (urlAuthorities.get(requestURlIndex) != null) {
// } else {
// // throw new
// // AccessDeniedException("User has no AccessDeniedException:" +
// // requestURL);
// }
// } else {
// }
return null;
}
@Override
public Collection getConfigAttributeDefinitions() {
return null;
}
@Override
public boolean supports(Class clazz) {
return true;
}
}
分享到:
相关推荐
Spring Security 2 配置精讲
这里包括Spring Security2的中文文档和一个基于Dao的开发实例,相信不管是对原来基于Acegi安全框架的开发人员还是现在基于Spring安全框架(Spring Security2实际上是Acegi2)的开发人员都有参考价值.
详细的spring security2.x配置
spring security 2 配置说明
Spring Security 2 中文参考文档 示例程序
Spring Security2 配置 精讲。
NULL 博文链接:https://huttoncs.iteye.com/blog/1900180
2、Spring Security 2.x Quick Start 3、Spring Security 2.x Overview 4、Dive Into Spring Security Authentication Authorization 5、Development Experiences & Demo 6、Q & A 张明星 5年以上保险、电信大中...
自己在网络上看到并整理成CHM版本的。 原地址:http://www.family168.com/tutorial/springsecurity/html/springsecurity.html
Spring Security为基于J2EE企业应用软件提供了全面安全服务。 特别是使用领先的J2EE解决方案-spring框架开发的企业软件项目。
springsecurity2
-------Spring Security2 配置精讲-------
一个GWT+Spring2+Spring Security2+Hibernate3的实例,数据库为mssql.在/GwtWeb/WebRoot/WEB-INF/lib 目录下RequiredJar.txt有需要用到的库说明 修改一下applicationContext.xml的数据库设定就可以使用
目前项目由spring security2升级到spring security3。实现的demo下载导入myeclipse即可运行。。。。登录,退出,自动登录均测试通过。。。。是基于最基本的过滤认证,若要比较全部的security3认证,则不适合本demo.....
spring security2 安全手册,不是官方的参考手册,写的非常好,推荐给大家
Spring Security三份资料,实战Spring Security 3.x.pdf;Spring Security 3.pdf;Spring Security使用手册.pdf
spring security spring security 中文文档
NULL 博文链接:https://kaqike.iteye.com/blog/1068652