A summary
Spring Security, which is a security framework and Servlet Spring AOP based filter. It provides comprehensive security solutions while at the Web request processing stages and methods call-level identification and authorization. Here to explain and too much spring security role will not go into here, please search on their own. The latest version of Spring Security is 4.2.2, but I use the stable version 3.1.3. The following is a simple example of a configuration Spring Security application.
Two to create a new web maven project
After the new good projects in webapp / page directory added two jsp files, admin.jsp and user.jsp.
admin.jsp only those with ROLE_ADMIN , ROLE_USER user permission to access one,
user.jsp allow only those with ROLE_USER user rights to access.
admin.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
<h1>Admin Page</h1>
</body>
</html>user.jsp
<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Insert title here</title>
</head>
<body>
<h1>User Page</h1>
</body>
</html>Three filter configuration
In order to use Spring Security control authority in the project, you must first configure filters in web.xml, so that we can control every request for the project.
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
<display-name>SpringSecurity</display-name>
<!-- 加载配置文件 -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-*.xml</param-value>
</context-param>
<!-- spring security 的过滤器配置 -->
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- 欢迎页面列表 -->
<welcome-file-list>
<welcome-file>/page/admin.jsp</welcome-file>
</welcome-file-list>
</web-app>Four Spring Security configuration
In applicationContext.xml new WEB-INF / config / under the following configuration
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context-3.1.xsd
http://www.springframework.org/schema/tx
http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
http://www.springframework.org/schema/security
http://www.springframework.org/schema/security/spring-security.xsd">
<!--
1.http部分配置如何拦截用户请求。auto-config='true'将自动配置几种常用的权限控制机制，包括form, anonymous, rememberMe。
2.利用intercept-url来判断用户需要具有何种权限才能访问对应的url资源，可以在pattern中指定一个特定的url资源，也可以使用通配符指定一组
类似的url资源。例子中定义的两个intercepter-url，第一个用来控制对/admin.jsp的访问，第二个使用了通配符/**，说明它将控制对系统中所有
url资源的访问。
3.在实际使用中，Spring Security采用的是一种就近原则，就是说当用户访问的url资源满足多个intercepter-url时，系统将使用第一个符合
条件的intercept-url进行权限控制。在我们这个例子中就是，当用户访问/admin.jsp时，虽然两个intercept-url都满足要求，但因为第一个
intercept-url排在上面，所以Spring Security会使用第一个intercept-url中的配置处理对/adminPage.jsp的请求，也就是说
只有那些拥有了ROLE_ADMIN权限的用户才能访问/admin.jsp。
4.access指定的权限都是以ROLE_开头的，实际上这与Spring Security中的Voter机制有着千丝万缕的联系，只有包含了特定前缀的字符串才会
被Spring Security处理。
-->
<http auto-config='true'>
<intercept-url pattern="/page/admin.jsp" access="ROLE_ADMIN" />
<intercept-url pattern="/**" access="ROLE_USER" />
</http>
<!--
1.user-service中定义了两个用户，admin和user。为了简便起见，我们使用明文定义了两个用户对应的密码，这只是为了当前演示的方便，之后的例子中
我们会使用Spring Security提供的加密方式，避免用户密码被他人窃取
2.最重要的部分是authorities，这里定义了这个用户登陆之后将会拥有的权限，它与上面intercept-url中定义的权限内容一一对应。每个用户可以同时
拥有多个权限，例子中的admin用户就拥有ROLE_ADMIN和ROLE_USER两种权限，这使得admin用户在登陆之后可以访问ROLE_ADMIN和ROLE_USER
允许访问的所有资源。与之对应的是，user用户就只拥有ROLE_USER权限，所以他只能访问ROLE_USER允许访问的资源，而不能访问ROLE_ADMIN允许访问
的资源。
-->
<authentication-manager>
<authentication-provider>
<user-service>
<user name="admin" password="123" authorities="ROLE_USER, ROLE_ADMIN" />
<user name="user" password="123" authorities="ROLE_USER" />
</user-service>
</authentication-provider>
</authentication-manager>
</beans:beans>Five pom.xml file
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<!-- 父工程 -->
<parent>
<groupId>com.sunny</groupId>
<artifactId>spring</artifactId>
<version>0.0.1-SNAPSHOT</version>
</parent>
<artifactId>spring-security</artifactId>
<packaging>pom</packaging>
<!-- 子模块 -->
<modules>
<module>spring-security01</module>
</modules>
<!-- 配置属性 -->
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<java-version>1.7</java-version>
<org.springframework-version>3.2.2.RELEASE</org.springframework-version>
<org.aspectj-version>1.6.10</org.aspectj-version>
<org.slf4j-version>1.6.1</org.slf4j-version>
</properties>
<!-- 依赖管理 -->
<dependencyManagement>
<dependencies>
<!-- Spring -->
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>${org.springframework-version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>${org.springframework-version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context-support</artifactId>
<version>${org.springframework-version}</version>
</dependency>
<dependency>
<groupId>commons-logging</groupId>
<artifactId>commons-logging</artifactId>
<version>1.1.3</version>
</dependency>
<!-- Spring security -->
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-core</artifactId>
<version>3.1.4.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-web</artifactId>
<version>3.1.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-config</artifactId>
<version>3.1.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-crypto</artifactId>
<version>3.1.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-taglibs</artifactId>
<version>3.1.3.RELEASE</version>
</dependency>
<!-- JUnit -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>3.8.1</version>
<scope>test</scope>
</dependency>
</dependencies>
</dependencyManagement>
</project>Note, pom file the parent project file, you need to add a reference to the sub-project, not much to say
Such a project to build a complete, deployed to tomcat for testing.
Six results
Enter in your browser: http: // localhost: 8801 / spring-security01, because there is no landing, it is not possible to access index.jsp page, and this time it worked spring security, interception of resources, because there is no compliance with user rights landing, so jump to the landing page where the landing page is automatically generated Spring Security, which is one of the role of auto-config = "true" played.
Then enter the user name and password, admin.jsp successful jump to the page.
Because here there are ROLE_ADMIN admin user and ROLE_USER permissions, user.jsp page ROLE_USER permissions are needed, so the admin user can successfully access and adminPage.jsp index.jsp page.
Here again test user user, attention has landed, you should restart your browser, or else the user will always remember, do not test.
You can see from the figure above, login user, you can access index.jsp page but can not access adminPage.jsp. This is because the user only ROLE_USER user permissions, and adminPage.jsp page needs ROLE_USER privileges, so access is denied.
Above is a simple spring security configuration application.