springSecurity3的配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security-3.0.xsd">

    <global-method-security pre-post-annotations="enabled">

    </global-method-security>

    <!-- entry-point-ref 为用户第一次访问受保护的url时的处理程序.  -->
    <http use-expressions="true"    entry-point-ref="authenticationEntryPoint">

        <!-- 这里是拒绝用户访问的处理程序 -->
        <access-denied-handler ref="accessDeniedHandler" />
        <!-- 配置一些不需要认证过滤的地址 -->
        <intercept-url pattern="/roots/login.jsp" filters="none" />
        <intercept-url pattern="/css/**" filters="none" />
        <intercept-url pattern="/common/**" filters="none" />
        <intercept-url pattern="/images/**" filters="none" />
        <intercept-url pattern="/scripts/**" filters="none" />
        <intercept-url pattern="/DatePicker/**" filters="none" />
        <intercept-url pattern="/fckeditor/**" filters="none" />
        <!-- cooki认证的配置,具体 看rememberMeServices的配置. -->
        <remember-me services-ref="rememberMeServices" />

        <!--
            增加一个filter，这点与Acegi是不一样的，不能修改默认的filter了，这个filter位于FILTER_SECURITY_INTERCEPTOR之前
        -->
        <custom-filter position="LOGOUT_FILTER" ref="logoutFilter"></custom-filter>
        <custom-filter before="FILTER_SECURITY_INTERCEPTOR" ref="myFilter" />
        <custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" />
        <!-- 限制用户的最大登陆数,防止一个账号被多人使用 -->
        <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
        <session-management
            session-authentication-strategy-ref="sas" />
    </http>

    <!-- 认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 如下,可以配置多个Provider-->
    <authentication-manager alias="authenticationManager">

        <authentication-provider ref="daoAuthenticationProvider">
            <password-encoder hash="plaintext"></password-encoder>
        </authentication-provider>
        <authentication-provider ref="rememberMeAuthenticationProvider">
            <password-encoder hash="plaintext"></password-encoder>
        </authentication-provider>
    </authentication-manager>

    <beans:bean id="daoAuthenticationProvider"
        class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <beans:property name="userDetailsService" ref="myUserDetailService" />
    </beans:bean>

    <!--
        一个自定义的filter，必须包含authenticationManager,accessDecisionManager,securityMetadataSource三个属性，
        我们的所有控制将在这三个类中实现，解释详见具体配置
    -->
    <beans:bean id="myFilter" class="com.security.MyFilterSecurityInterceptor">
        <beans:property name="authenticationManager" ref="authenticationManager" />
        <beans:property name="accessDecisionManager" ref="myAccessDecisionManagerBean" />
        <beans:property name="securityMetadataSource" ref="securityMetadataSource" />
    </beans:bean>

    <!--
        下面的3个类,已做自动扫描 <beans:bean id="myUserDetailService"
        class="com.security.MyUserDetailService" />

        访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源 <beans:bean
        id="myAccessDecisionManagerBean"
        class="com.security.MyAccessDecisionManager"> </beans:bean>

        资源源数据定义，即定义某一资源可以被哪些角色访问 <beans:bean id="securityMetadataSource"
        class="com.security.MyInvocationSecurityMetadataSource" >

        </beans:bean>
    -->

    <beans:bean id="logoutFilter"
        class="org.springframework.security.web.authentication.logout.LogoutFilter">
        <beans:constructor-arg value="/roots/login.jsp" />
        <beans:constructor-arg>
            <beans:list>
                <beans:ref local="rememberMeServices" />
                <beans:bean
                    class="org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"></beans:bean>
            </beans:list>
        </beans:constructor-arg>
        <beans:property name="filterProcessesUrl" value="/ss_Loginout"></beans:property>
    </beans:bean>

    <beans:bean id="concurrencyFilter"
        class="org.springframework.security.web.session.ConcurrentSessionFilter">
        <beans:property name="sessionRegistry" ref="sessionRegistry" />
        <beans:property name="expiredUrl" value="/error/expired.jsp" />
    </beans:bean>
    <beans:bean id="sas"
        class="org.springframework.security.web.authentication.session.ConcurrentSessionControlStrategy">
        <beans:constructor-arg name="sessionRegistry"
            ref="sessionRegistry" />
        <beans:property name="maximumSessions" value="1" />
    </beans:bean>

    <beans:bean id="myAuthFilter"
        class="com.security.fliter.MyUsernamePasswordAuthenticationFilter">
        <beans:property name="sessionAuthenticationStrategy"
            ref="sas" />
        <beans:property name="authenticationManager" ref="authenticationManager" />
        <beans:property name="rememberMeServices" ref="rememberMeServices"></beans:property>
        <beans:property name="authenticationFailureHandler"
            ref="failureHandler" />
        <beans:property name="authenticationSuccessHandler"
            ref="successHandler" />
        <beans:property name="filterProcessesUrl" value="/ss_Login"></beans:property>

    </beans:bean>
    <beans:bean id="successHandler"
        class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">
        <beans:property name="defaultTargetUrl" value="/roots/index.jsp" />
    </beans:bean>
    <beans:bean id="failureHandler"
        class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
        <beans:property name="defaultFailureUrl" value="/roots/login.jsp?error=true" />
    </beans:bean>

    <beans:bean id="sessionRegistry"
        class="org.springframework.security.core.session.SessionRegistryImpl" />

文章出处：飞诺网(www.firnow.com):http://dev.firnow.com/course/3_program/java/javajs/20100719/461036.html