Role-based and resource-based authorization

http://globeeip.iteye.com/blog/1236167


http://www.blogjava.net/amigoxie/archive/2007/10/06/150646.html

http://www.cnblogs.com/zwq194/archive/ 2011/03/07/1974821.html (very good)

http://www.cnblogs.com/cxd4321/archive/2013/09/03/3298559.html The best picture is


http://aiilive.blog.51cto.com /1925756/1297317

http://www.cnblogs.com/zq8024/p/5003050.html should be wrong