SpringSecurity 3.2入门（9）自定义权限控制代码实现

1、 一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，我们的所有控制将在这三个类中实现 。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:security="http://www.springframework.org/schema/security"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.2.xsd"> 
<!-- 配置不过滤的资源（静态资源及登录相关） -->
<security:http pattern="/**/*.css" security="none" />
<security:http pattern="/**/*.js" security="none" />
<security:http pattern="/**/*.jpg" security="none" />
<security:http pattern="/**/*.jpeg" security="none" />
<security:http pattern="/**/*.gif" security="none" />
<security:http pattern="/**/*.png" security="none" />
<security:http pattern="/favicon.ico" security="none" />
<!-- 不过滤验证码 -->
<security:http pattern="/captcha-image.htm" security="none" />
<!-- 不过滤登录页面 -->
<security:http pattern="/login.htm" security="none" />
<security:http pattern="/login.jsp" security="none" />
<!-- 不过滤首页 -->
<security:http pattern="/index.htm" security="none" />
<security:http pattern="/index.jsp" security="none" />

<!-- 配置SpringSecurity的http安全服务 -->
<!-- 使用了 use-expressions="true 则 需使用hasRole('ROLE_USER')-->
<!-- 配置了auto-config="true"loginFilter报错，如果你没有自定义的登录页面，它就会跳转到security默认的登录页面中。 -->
<security:http access-denied-page="/accessDenied.jsp" entry-point-ref="authenticationProcessingFilterEntryPoint">
<security:session-management>
<security:concurrency-control
max-sessions="1" />
</security:session-management>

<!-- 检测失效的sessionId,session超时时，定位到另外一个URL -->
<security:session-management
invalid-session-url="/sessionTimeOut.jsp" />

<!-- 配置登出信息，指定退出系统后，跳转页面 -->
<security:logout logout-url="/logout"
logout-success-url="/login.htm" invalidate-session="true" />

<!-- 认证和授权 -->
<security:custom-filter ref="myLoginFilter" position="FORM_LOGIN_FILTER"  />
<security:custom-filter ref="securityFilter" before="FILTER_SECURITY_INTERCEPTOR"/>

</security:http>

<!-- 认证管理器，配置SpringSecutiry的权限信息 -->
<security:authentication-manager>
<security:authentication-provider>
<!-- 使用数据库中的用户名和密码 -->
<security:jdbc-user-service
data-source-ref="dataSource" />
</security:authentication-provider>
</security:authentication-manager>

<!-- 验证配置 ， 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 -->
<security:authentication-manager alias="myAuthenticationManager">
<!-- 使用自己数据库中的用户和角色表,获取用户拥有的权限 -->
<security:authentication-provider
user-service-ref="myUserDetailsServiceImpl" />
</security:authentication-manager>

<!-- 登录验证器 -->
<bean id="myLoginFilter"
class="cn.jxufe.core.security.MyUsernamePasswordAuthenticationFilter">
<!-- 处理登录 -->
<property name="filterProcessesUrl" value="/j_spring_security_check"></property>
<property name="usernameParameter" value="username"></property>
<property name="passwordParameter" value="password"></property>
<property name="authenticationSuccessHandler" ref="loginLogAuthenticationSuccessHandler"></property>
<property name="authenticationFailureHandler" ref="simpleUrlAuthenticationFailureHandler"></property>
<property name="authenticationManager" ref="myAuthenticationManager"></property>
<property name="baseDao" ref="baseDao"></property>
</bean>

<bean id="loginLogAuthenticationSuccessHandler"
class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/index.jsp"></property>
</bean>
<bean id="simpleUrlAuthenticationFailureHandler"
class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/login.jsp"></property>
</bean>

<!-- 认证过滤器 -->
<bean id="securityFilter" class="cn.jxufe.core.security.MySecurityFilter">
<!-- 用户拥有的权限 -->
<property name="authenticationManager" ref="myAuthenticationManager" />
<!-- 用户是否拥有所请求资源的权限 -->
<property name="accessDecisionManager" ref="myAccessDecisionManager" />
<!-- 资源与权限对应关系 -->
<property name="securityMetadataSource" ref="myFilterInvocationSecurityMetadataSource" />
</bean>

<bean id="myUserDetailsServiceImpl" class="cn.jxufe.core.security.MyUserDetailsService" />
<bean id="myAccessDecisionManager" class="cn.jxufe.core.security.MyAccessDecisionManager"/>
<bean id="myFilterInvocationSecurityMetadataSource" class="cn.jxufe.core.security.MyFilterInvocationSecurityMetadataSource">
<constructor-arg name="baseDao" ref="baseDao" />
</bean>

<bean id="baseDao" class="cn.jxufe.core.dao.BaseDaoImpl" />

<!-- 定义上下文返回的消息的国际化 -->
<bean id="messageSource"
class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
<property name="basename"
value="classpath:org/springframework/seurity/messages_zh_CN" />
</bean>

<!-- 未登录的切入点 -->
<bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">
<property name="loginFormUrl" value="/login.jsp"/>
</bean>

</beans>

View Code

（详细的拦截过程将会在下一章中学习）。