spring security 配置

<?xml version=
"1.0"
 encoding=
"UTF-8"
?>
<beans xmlns="http://www.springframework.org/schema/beans"
 xmlns:xsi=
"http://www.w3.org/2001/XMLSchema-instance"
    xmlns:aop="http://www.springframework.org/schema/aop"
 xmlns:context=
"http://www.springframework.org/schema/context"
    xmlns:jee="http://www.springframework.org/schema/jee"
 xmlns:jms=
"http://www.springframework.org/schema/jms"
    xmlns:p="http://www.springframework.org/schema/p"
 xmlns:tx=
"http://www.springframework.org/schema/tx"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd
        http://www.springframework.org/schema/jms http://www.springframework.org/schema/jms/spring-jms.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd">


    <!-- login start -->
    <bean id="filterChainProxy"
 
class
=
"org.springframework.security.util.FilterChainProxy"
>
        <property name="filterInvocationDefinitionSource"
>
            <value><![CDATA[
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /**=channelProcessingFilter,httpSessionContextIntegrationFilter,logoutFilter,authenticationProcessingFilter,concurrentSessionFilter,rememberMeProcessingFilter,anonymousProcessingFilter,exceptionTranslationFilter,filterSecurityInterceptor
            ]]></value>
                <!-- securityContextHolderAwareRequestFilter,rememberMeProcessingFilter,anonymousProcessingFilter, -->
        </property>
    </bean>

    <bean id="httpSessionContextIntegrationFilter"
 
class
=
"org.springframework.security.context.HttpSessionContextIntegrationFilter"
/>

    <!-- login out -->
    <bean id="logoutFilter"
 
class
=
"org.springframework.security.ui.logout.LogoutFilter"
>
        <constructor-arg>
            <list>
                <bean class
=
"org.springframework.security.ui.logout.SecurityContextLogoutHandler"
/>
            </list>
        </constructor-arg>
        <constructor-arg value="/web/page/login/login_out_success.jsp"
/>
        <property name="filterProcessesUrl"
 value=
"/loginout.do"
/>
    </bean>

    <!-- login -->
    <bean id="authenticationProcessingFilter"
 
class
=
"org.springframework.security.ui.webapp.AuthenticationProcessingFilter"
>
        <property name="filterProcessesUrl"
 value=
"/login.do"
/>
        <property name="defaultTargetUrl"
 value=
"/web/page/login/login_name.jsp"
/>
        <property name="authenticationFailureUrl"
 value=
"http://www.baidu.com"
/>
        <property name="authenticationManager"
 ref=
"authenticationManager"
/>
        <property name="rememberMeServices"
 ref=
"rememberMeServices"
/>
    </bean>
    <bean id="authenticationManager"
 
class
=
"org.springframework.security.providers.ProviderManager"
>
        <property name="providers"
>
            <list>
                <ref bean="daoAuthenticationProvider"
/>
                <bean class
=
"org.springframework.security.providers.rememberme.RememberMeAuthenticationProvider"
>
                    <property name="key"
 value=
"hereonline"
/>
                </bean>
                <ref local="anonymousAuthenticationProvider"
/>
            </list>
        </property>
        <property name="sessionController"
 ref=
"concurrentSessionController"
/>
    </bean>

    <bean id="daoAuthenticationProvider"
 
class
=
"org.springframework.security.providers.dao.DaoAuthenticationProvider"
>
        <property name="userDetailsService"
 ref=
"hoUserDAO"
></property>
    </bean>

    <!-- login start end-->


    <!-- url -->
    <bean id="filterSecurityInterceptor"
 
class
=
"org.springframework.security.intercept.web.FilterSecurityInterceptor"
>
        <property name="authenticationManager"
 ref=
"authenticationManager"
/>
        <property name="accessDecisionManager"
 ref=
"accessDecisionManager"
/>
        <property name="objectDefinitionSource"
>
            <value>
                CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON
                PATTERN_TYPE_APACHE_ANT
                /web/page/login/login_id.jsp = PRI_1,PRI_ADMIN
            </value>
        </property>
    </bean>

    <bean id="accessDecisionManager"
 
class
=
"org.springframework.security.vote.AffirmativeBased"
>
        <property name="allowIfAllAbstainDecisions"
 value=
"true"
/>
        <property name="decisionVoters"
>
            <list>
                <ref bean="roleVoter"
/>
            </list>
        </property>
    </bean>

    <bean id="roleVoter"
 
class
=
"org.springframework.security.vote.RoleVoter"
>
        <property name="rolePrefix"
 value=
"PRI_"
></property>
    </bean>

    <!-- exception convert -->
    <bean id="exceptionTranslationFilter"
 
class
=
"org.springframework.security.ui.ExceptionTranslationFilter"
>
        <property name="authenticationEntryPoint"
>
            <ref local="authenticationProcessingFilterEntryPoint"
/>
        </property>
        <property name="accessDeniedHandler"
>
            <bean class
=
"org.springframework.security.ui.AccessDeniedHandlerImpl"
>
                <property name="errorPage"
 value=
"/web/page/login/login_foward_login.jsp"
/>
            </bean>
        </property>
    </bean>

    <bean id="authenticationProcessingFilterEntryPoint"
 
class
=
"org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint"
>
        <property name="loginFormUrl"
 value=
"/web/page/login/login_err.jsp"
/>
    </bean>

    <!-- 設置cookie 屬性-->
    <bean id="rememberMeServices"
 
class
=
"org.springframework.security.ui.rememberme.TokenBasedRememberMeServices"
>
        <property name="tokenValiditySeconds"
 value=
"5"
/>
        <property name="key"
 value=
"hereonline"
/>
        <property name="userDetailsService"
 ref=
"hoUserDAO"
/>
    </bean>

    <!-- cookie 自動登錄 -->
    <bean id="rememberMeProcessingFilter"
 
class
=
"org.springframework.security.ui.rememberme.RememberMeProcessingFilter"
>
        <property name="rememberMeServices"
 ref=
"rememberMeServices"
/>
        <property name="authenticationManager"
 ref=
"authenticationManager"
/>
    </bean>

    <!-- 阻止用戶在成功登錄之後再進行一次成功登錄  -->
    <bean id="concurrentSessionController"
 
class
=
"org.springframework.security.concurrent.ConcurrentSessionControllerImpl"
>
        <property name="maximumSessions"
 value=
"1"
/>
        <property name="exceptionIfMaximumExceeded"
 value=
"true"
/>
        <property name="sessionRegistry"
 ref=
"sessionRegistry"
/>
    </bean>
    <!-- 通過監聽HttpSessionEventPublisher 發的不的時間記錄用戶Session 併發數 -->
    <bean id="sessionRegistry"
 
class
=
"org.springframework.security.concurrent.SessionRegistryImpl"
/>

    <bean id="concurrentSessionFilter"
 
class
=
"org.springframework.security.concurrent.ConcurrentSessionFilter"
>
        <property name="sessionRegistry"
 ref=
"sessionRegistry"
/>
        <property name="expiredUrl"
 value=
"/web/page/login/session_err.jsp"
/>
    </bean>


    <!-- 匿名用戶處理過濾器 -->
    <bean id="anonymousProcessingFilter"
 
class
=
"org.springframework.security.providers.anonymous.AnonymousProcessingFilter"
>
        <property name="key"
 value=
"hereonline"
/>
        <property name="userAttribute"
 value=
"ANONYMOUSUSER,PRI_ANONYMOUSUSER"
/>
    </bean>
    <!-- 匿名用戶認證提供 -->
    <bean id="anonymousAuthenticationProvider"
 
class
=
"org.springframework.security.providers.anonymous.AnonymousAuthenticationProvider"
>
        <property name="key"
 value=
"hereonline"
/>
    </bean>

    <!-- acegi的通道過濾器 -->
    <bean id="channelProcessingFilter"
 
class
=
"org.springframework.security.securechannel.ChannelProcessingFilter"
>
        <property name="channelDecisionManager"
 ref=
"channelDecisionManager"
/>
        <property name="filterInvocationDefinitionSource"
>
            <value>
                CONVERT_URL_TO_UPPERCASE_BEFORE_COMPARISON
                /A/web/page/login/login_name.jsp/Z=REQUIRES_SECURE_CHANNEL
                /A/j_acegi_security_check.*/Z=REQUIRES_SECURE_CHANNEL
                /A.*/Z=REQUIRES_INSECURE_CHANNEL
            </value>
        </property>
    </bean>

    <bean id="channelDecisionManager"
 
class
=
"org.springframework.security.securechannel.ChannelDecisionManagerImpl"
>
        <property name="channelProcessors"
>
            <list>
                <ref local="secureChannelProcessor"
/>
                <bean class
=
"org.springframework.security.securechannel.InsecureChannelProcessor"
/>
            </list>
        </property>
    </bean>

    <bean id="secureChannelProcessor"
 
class
=
"org.springframework.security.securechannel.SecureChannelProcessor"
>
        <property name="entryPoint"
 ref=
"retryWithHttpsEntryPoint"
/>
    </bean>

    <bean id="retryWithHttpsEntryPoint"
 
class
=
"org.springframework.security.securechannel.RetryWithHttpsEntryPoint"
>
        <property name="portMapper"
 ref=
"portMapper"
/>
    </bean>

    <bean id="portMapper"
 
class
=
"org.springframework.security.util.PortMapperImpl"
>
        <property name="portMappings"
>
            <map>
                <entry key="8888"
 value=
"8443"
></entry>
            </map>
        </property>
    </bean>



    <bean id="loggerListener"
 
class
=
"org.springframework.security.event.authentication.LoggerListener"
/>

    <bean class
=
"cn.com.hereonline.sso.listener.LoginSuccessListener"
/>

</beans>