一个spring security 配置列子
<?xml version="1.0" encoding="UTF-8"?><beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"><!-- 配置数据库 --><beans:bean id="dataSource"value="oracle.jdbc.driver.OracleDriver" /><beans:property name="url" value="jdbc:oracle:thin:@localhost:1521:zzz" /><beans:property name="username" value="xxx" /><beans:property name="password" value="yyy" /></beans:bean> <http auto-config='true' access-denied-page="/accessDenied.jsp"> <!-- 自定义的登录页面 --> <form-login login-page="/login.jsp"/> <intercept-url pattern="/login.jsp" filters="none"/> <!-- 以下两个<intercept-url 的顺序是不可随便条换的，否则user用户也能登陆/admin.jsp页面 --> <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN"/> <intercept-url pattern="/hello.do*" access="ROLE_USER,ROLE_ADMIN"/> <intercept-url pattern="/index.jsp" access="ROLE_USER,ROLE_ADMIN"/> <intercept-url pattern="/**" access="ROLE_ADMIN" /> <session-management> <concurrency-control max-sessions="1" error-if-maximum-exceeded="true" /> </session-management> </http> <authentication-manager> <authentication-provider > <!-- 配置实现 <user-service> <user name="admin" password="admin" authorities="ROLE_USER,ROLE_ADMIN" /> <user name="user" password="user" authorities="ROLE_USER" /> </user-service> --> <!-- 数据库实现 --> <jdbc-user-service data-source-ref="dataSource" users-by-username-query="select username ,passWord, enabled from users where username=?" authorities-by-username-query="select username,authority from authorities where username=?"/> </authentication-provider></authentication-manager><!-- 国际化 --><beans:bean id="messageSource" value="classpath:messages_zh_CN"/></beans:bean><!-- 业务类 --><beans:bean id="helloWordService" expression="execution(* com.xx.service.*.sayHello(..))"/><!-- ROLE_USER不能执行sayBye方法 --><protect-pointcut access="ROLE_ADMIN" expression="execution(* com.xx.service.*.sayBye(..))"/></global-method-security></beans:beans>
