<?xml version="1.0" encoding="UTF-8"?>

<b:beans xmlns="http://www.springframework.org/schema/security"

    xmlns:b="http://www.springframework.org/schema/beans"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd

                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">

 <!-- 配置不需要安全管理的界面 -->

     <http pattern="/jsp/css/**" security="none"></http>

     <http pattern="/jsp/js/**" security="none"></http>

     <http pattern="/jsp/images/**" security="none"></http>

     <http pattern="/login.jsp" security="none" />

     <http pattern="/accessDenied.jsp" security="none" />

         <http pattern="/index.jsp" security="none" />

        <http use-expressions='true' entry-point-ref="myAuthenticationEntryPoint" access-denied-page="/accessDenied.jsp">

                <!-- 使用自己自定义的登陆认证过滤器 --><!-- 这里一定要注释掉，因为我们需要重写它的过滤器 -->

                <!-- <form-login login-page="/login.jsp"

                authentication-failure-url="/accessDenied.jsp"

        default-target-url="/index.jsp"

                 /> -->

                <!--访问/admin.jsp资源的用户必须具有ROLE_ADMIN的权限 -->

                <!-- <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN" /> -->

                <!--访问/**资源的用户必须具有ROLE_USER的权限 -->

                <!-- <intercept-url pattern="/**" access="ROLE_USER" /> -->

                <session-management>

                        <concurrency-control max-sessions="1"

                                error-if-maximum-exceeded="false" />

                </session-management>

                <!-- 认证和授权 --><!-- 重写登陆认证的过滤器，使我们可以拿到任何参数  -->

                <custom-filter ref="myAuthenticationFilter" position="FORM_LOGIN_FILTER"  />

                <custom-filter ref="myFilter" before="FILTER_SECURITY_INTERCEPTOR" />

                 <!-- 登出管理 -->

        <logout invalidate-session="true" logout-url="/j_spring_security_logout" />

        </http>

        <!-- 未登录的切入点 --><!-- 需要有个切入点 -->

    <b:bean id="myAuthenticationEntryPoint" class="org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint">

        <b:property name="loginFormUrl" value="/login.jsp"></b:property>

    </b:bean>

        <!-- 登录验证器：用户有没有登录的资格 --><!-- 这个就是重写的认证过滤器 -->

    <b:bean id="myAuthenticationFilter" class="com.lcy.springSecurity.MyAuthenticationFilter">

        <b:property name="authenticationManager" ref="authenticationManager" />

        <b:property name="filterProcessesUrl" value="/j_spring_security_check" />

        <b:property name="authenticationSuccessHandler">

            <b:bean class="org.springframework.security.web.authentication.SavedRequestAwareAuthenticationSuccessHandler">

                <b:property name="defaultTargetUrl" value="/index.jsp" />

            </b:bean>

        </b:property>

        <b:property name="authenticationFailureHandler">

            <b:bean class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">

                <b:property name="defaultFailureUrl" value="/accessDenied.jsp" />

            </b:bean>

        </b:property>

    </b:bean>

        <!--一个自定义的filter，必须包含 authenticationManager,accessDecisionManager,securityMetadataSource三个属性，我们的所有控制将在这三个类中实现，解释详见具体配置 -->

        <b:bean id="myFilter"

                class="com.lcy.springSecurity.MyFilterSecurityInterceptor">

                <b:property name="authenticationManager" ref="authenticationManager" />

                <b:property name="accessDecisionManager" ref="myAccessDecisionManagerBean" />

                <b:property name="securityMetadataSource" ref="securityMetadataSource" />

        </b:bean>

        <!--验证配置，认证管理器，实现用户认证的入口，主要实现UserDetailsService接口即可 -->

        <authentication-manager alias="authenticationManager">

                <authentication-provider user-service-ref="myUserDetailService">

                        <!--如果用户的密码采用加密的话 <password-encoder hash="md5" /> -->

                        <!-- <password-encoder hash="md5" /> -->

                </authentication-provider>

        </authentication-manager>

        <!--在这个类中，你就可以从数据库中读入用户的密码，角色信息，是否锁定，账号是否过期等 -->

        <b:bean id="myUserDetailService" class="com.lcy.springSecurity.MyUserDetailService" />

        <!--访问决策器，决定某个用户具有的角色，是否有足够的权限去访问某个资源 -->

        <b:bean id="myAccessDecisionManagerBean"

                class="com.lcy.springSecurity.MyAccessDecisionManager">

        </b:bean>

        <!--资源源数据定义，将所有的资源和权限对应关系建立起来，即定义某一资源可以被哪些角色访问 -->

        <b:bean id="securityMetadataSource"

                class="com.lcy.springSecurity.MyInvocationSecurityMetadataSource" /> 

 </b:beans>

package com.lcy.springSecurity;

import javax.annotation.Resource;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.springframework.security.authentication.AuthenticationServiceException;

import org.springframework.security.authentication.BadCredentialsException;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.security.core.AuthenticationException;

import org.springframework.security.core.context.SecurityContextHolder;

import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.lcy.dao.IAdminDao;

import com.lcy.dao.IStudentDao;

import com.lcy.dao.ITeacherDao;

import com.lcy.entity.Admin;

import com.lcy.entity.Student;

import com.lcy.entity.Teacher;

public class MyAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

        private static final String USERNAME = "username";

        private static final String PASSWORD = "password";

        @Resource

        private IStudentDao studentdao;

        @Resource

        private ITeacherDao teacherdao;

        @Resource

        private IAdminDao admindao;

        @Override

        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

                if (!request.getMethod().equals("POST")) {

                        throw new AuthenticationServiceException("Authentication method not supported: " + request.getMethod());

                }

                String username = obtainUsername(request);

                String password = obtainPassword(request);

                String roletype = request.getParameter("roletype");

                username = username.trim();

                UsernamePasswordAuthenticationToken authRequest = null;

                if(!"".equals(roletype) || roletype != null){

                        if("student".equals(roletype)){

                                Student stu = studentdao.findById(username);

                                //通过session把用户对象设置到session中

                                request.getSession().setAttribute("session_user", stu);

                                //将角色标志在username上

                                username = "stu"+username;

                                try {

                                        if (stu == null || !stu.getPassword().equals(password)) {

                                                BadCredentialsException exception = new BadCredentialsException("用户名或密码不匹配");

                                                throw exception;

                                        }

                                } catch (Exception e) {

                                        BadCredentialsException exception = new BadCredentialsException("没有此用户");

                                        throw exception;

                                }

                        }else if("teacher".equals(roletype)){

                                Teacher tea = teacherdao.findById(username);

                                //通过session把用户对象设置到session中

                                request.getSession().setAttribute("session_user", tea);

                                //将角色标志在username上

                                username = "tea"+username;

                                try {

                                        if (tea == null || !tea.getPassword().equals(password)) {

                                                BadCredentialsException exception = new BadCredentialsException("用户名或密码不匹配");

                                                throw exception;

                                        }

                                } catch (Exception e) {

                                        BadCredentialsException exception = new BadCredentialsException("没有此用户");

                                        throw exception;

                                }

                        }else if("admin".equals(roletype)){

                                Admin adm = admindao.findById(username);

                                //通过session把用户对象设置到session中

                                request.getSession().setAttribute("session_user", adm);

                                //将角色标志在username上

                                username = "adm"+username;

                                try {

                                        if (adm == null || !password.equals(adm.getPassword())) {

                                                BadCredentialsException exception = new BadCredentialsException("用户名或密码不匹配");

                                                throw exception;

                                        }

                                } catch (Exception e) {

                                        BadCredentialsException exception = new BadCredentialsException("没有此用户");

                                        throw exception;

                                }

                        }else{

                                BadCredentialsException exception = new BadCredentialsException("系统错误：没有对应的角色！");

                                throw exception;

                        }

                }

                //实现验证

                authRequest = new UsernamePasswordAuthenticationToken(username, password);

                //允许设置用户详细属性

                setDetails(request, authRequest);

                //运行

                return this.getAuthenticationManager().authenticate(authRequest);

        }

        @Override

        protected String obtainUsername(HttpServletRequest request) {

                Object obj = request.getParameter(USERNAME);

                return null == obj ? "" : obj.toString();

        }

        @Override

        protected String obtainPassword(HttpServletRequest request) {

                Object obj = request.getParameter(PASSWORD);

                return null == obj ? "" : obj.toString();

        }

        @Override

        protected void setDetails(HttpServletRequest request, UsernamePasswordAuthenticationToken authRequest) {

                super.setDetails(request, authRequest);

        }

}

package com.lcy.springSecurity;

import java.util.ArrayList;

import java.util.Collection;

import javax.annotation.Resource;

import org.springframework.dao.DataAccessException;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import com.lcy.dao.IAdminDao;

import com.lcy.dao.IStudentDao;

import com.lcy.dao.ITeacherDao;

import com.lcy.entity.Admin;

import com.lcy.entity.Student;

import com.lcy.entity.Teacher;

public class MyUserDetailService implements UserDetailsService {

        @Resource

        private IStudentDao studentdao;

        @Resource

        private ITeacherDao teacherdao;

        @Resource

        private IAdminDao admindao;

        //登陆验证时，通过username获取用户的所有权限信息，

        //并返回User放到spring的全局缓存SecurityContextHolder中，以供授权器使用

        public UserDetails loadUserByUsername(String username)

                        throws UsernameNotFoundException, DataAccessException {

                Collection<GrantedAuthority> auths= new ArrayList<GrantedAuthority>();

                //获取角色标志

                String roletype = username.substring(0,3);

                username = username.substring(3);

                String password = "";

                if("stu".equals(roletype)){

                        Student stu = studentdao.findById(username);

                        password = stu.getPassword();

                        auths.add(new SimpleGrantedAuthority("ROLE_STU"));

                }else if("tea".equals(roletype)){

                        Teacher tea = teacherdao.findById(username);

                        password = tea.getPassword();

                        auths.add(new SimpleGrantedAuthority("ROLE_TEA"));

                }else if("adm".equals(roletype)){

                        Admin adm = admindao.findById(username);

                        password = adm.getPassword();

                        auths.add(new SimpleGrantedAuthority("ROLE_ADM"));

                }

                User user = new User(username, password, true, true, true, true, auths);

                return user;

                }

        }