<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
    <filter-name>springSecurityFilterChain</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>
    <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:spring.xml</param-value>
    </context-param>
    <listener>
    <listener-class>
    org.springframework.web.context.ContextLoaderListener
    </listener-class>
    </listener>
    

<?xml version="1.0" encoding="UTF-8"?>
    <beans:beansxmlns="http://www.springframework.org/schema/security"
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-3.0.xsd">
    </beans:beans>
    

<http auto-config="true">
    <intercept-url pattern="/**" access="ROLE_USER" />
    </http>
    <authentication-manager>
    <authentication-provider>
    <user-service>
    <user name="tom" password="123" authorities="ROLE_USER, ROLE_A" />
    <user name="jerry" password="123" authorities="ROLE_USER, ROLE_B" />
    </user-service>
    </authentication-provider>
    </authentication-manager>
    

<authentication-manager>
    <authentication-provider>
    <password-encoder hash=“md5”/>
    <jdbc-user-service data-source-ref="dataSource"/>
    </authentication-provider>
    </authentication-manager>
    数据表结构见SS说明手册附录A
    

<http auto-config="true">
    <intercept-url pattern="/js/**" filters="none"/>
    <intercept-url pattern="/css/**" filters="none"/>
    <intercept-url pattern="/images/**" filters="none"/>
    <intercept-url pattern="/a.jsp" access="ROLE_A" />
    <intercept-url pattern="/b.jsp" access="ROLE_B" />
    <intercept-url pattern="/c.jsp" access="ROLE_A, ROLE_B" />
    <intercept-url pattern="/**" access="ROLE_USER" />
    </http>
    

<http auto-config="true">
    <!-- 指定登陆页面、成功页面、失败页面-->
    <form-login login-page="/login.jsp" default-target-url="/index.jsp" authentication-failure-url="/login.jsp" />
    <!-- 尝试访问没有权限的页面时跳转的页面 -->
    <access-denied-handler error-page="/accessDenied.jsp"/>
    <!-- 使用记住用户名、密码功能，指定数据源和加密的key -->
    <remember-me data-source-ref="dataSource" />
    <!-- logout页面，logout后清除session -->
    <logout invalidate-session="true" logout-success-url="/login.jsp" />
    <!-- session 失效后跳转的页面，最大登陆次数 -->
    <session-management invalid-session-url="/sessionTimeout.htm">
    <concurrency-control max-sessions="1" expired-url="/sessionTimeout.htm" />
    </session-management>
    </http>
    可以使用SS自带的登陆页面作为login.jsp的模板
    

<!-- 加载错误信息资源文件 -->
    <beans:bean id="messageSource"
    class="org.springframework.context.support.ReloadableResourceBundleMessageSource">
    <beans:property name="basename" value="classpath:messages"/>
    </beans:bean>
    资源文件在SS核心包：spring-security-core-3.0.2.RELEASE.jar的orgspringframeworksecurity目录中
    

方式一：Java代码
    Authentication auth = SecurityContextHolder.getContext().getAuthentication();
    Collection<GrantedAuthority> col = auth.getAuthorities();
    方式二：标签库
    <%@ taglib prefix="sec" uri="http://www.springframework.org/security/tags" %>
    <sec:authentication property="name“/>
    <sec:authentication property="authorities“/>
    

方式一
    <sec:authorizeifAnyGranted="ROLE_A">
    <a href="a.jsp">你可以访问a.jsp</a>
    </sec:authorize>
    <sec:authorizeifNotGranted="ROLE_A">
    你不可以访问a.jsp
    </sec:authorize>
    方式二
    <sec:authorizeurl="/a.jsp">
    <a href="a.jsp">你可以访问a.jsp</a>
    </sec:authorize>
    

<global-method-security pre-post-annotations="enabled">
    <protect-pointcut expression="execution(* com.xasxt.*Service.add*(..))" access="ROLE_A"/>
    <protect-pointcut expression="execution(* com.xasxt.*Service.delete*(..))" access="ROLE_B"/>
    </global-method-security>
    此处使用了AspectJ中常用的切入点表达式（百度：AspectJ execution）
    

public class DemoService {
    @PreAuthorize("hasRole('ROLE_A')")
    public void methodA() {
    }
    @PreAuthorize("hasAnyRole('ROLE_A, ROLE_B')")
    public void methodB() {
    }
    }
    hasRole与hasAnyRole为SS通用内置表达式（google : spring security Common Built-In Expressions）