<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
 xmlns:beans="http://www.springframework.org/schema/beans"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
    http://www.springframework.org/schema/security
    http://www.springframework.org/schema/security/spring-security-2.0.4.xsd">

 <!-- org.springframework.security.providers.dao.cache.EhCacheBasedUserCache -->
 <beans:bean id="userCache" class="org.springframework.security.providers.dao.cache.EhCacheBasedUserCache">
  <beans:property name="cache" ref="userEhCache" />
 </beans:bean>
 <beans:bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean" />
 <beans:bean id="userEhCache" class="org.springframework.cache.ehcache.EhCacheFactoryBean">
  <beans:property name="cacheManager" ref="cacheManager" />
  <beans:property name="cacheName" value="userCache" />
 </beans:bean>

 <!-- jsp 资源保护 -->
 <http auto-config="true" access-denied-page="/common/403.jsp"
  session-fixation-protection="none">
  <!-- intercept-url pattern="/admin.jsp" requires-channel="https"/ -->
  <!-- <intercept-url pattern="/" filters="none" />限制匿名登陆 -->
  <form-login login-page="/login.jsp"
   authentication-failure-url="/login.jsp?error=true"
   default-target-url="/" />
  <logout logout-success-url="/login.jsp" />
  <port-mappings>
   <port-mapping http="8080" https="9443" />
  </port-mappings>
  <concurrent-session-control max-sessions="1"
   exception-if-maximum-exceeded="true" />
  <!-- 匿名身份:Guest -->
  <anonymous username="Guest" />
 </http>

 


 <!-- 用户 合法性认证 -->
 <authentication-provider>
  <password-encoder hash="md5" />
  <jdbc-user-service data-source-ref="dataSource"
   users-by-username-query="SELECT userinfo_name,userinfo_pwd,1 AS 'enabled' 
          FROM up_userinfo 
          WHERE userinfo_name = ? "
   authorities-by-username-query="SELECT  up_userinfo.userinfo_name,('ROLE_'+LTRIM(str(up_role.role_id))) as 'role'  FROM 
           up_userrole inner join 
           up_userinfo on up_userrole.userinfo_id=up_userinfo.userinfo_id inner join 
           up_role on up_role.role_id=up_userrole.role_id
           WHERE up_userinfo.userinfo_name  = ? "
   cache-ref="userCache" />
 </authentication-provider>

 <beans:bean id="filterSecurityInterceptor"
  class="org.springframework.security.intercept.web.FilterSecurityInterceptor"
  autowire="byType">
  <custom-filter before="FILTER_SECURITY_INTERCEPTOR" />
  <beans:property name="objectDefinitionSource"
   ref="filterInvocationDefinitionSource" />
 </beans:bean>

 <!-- 根据数据库中的内容自动为用户授权 -->
 <beans:bean id="filterInvocationDefinitionSource"
  class="org.springframework.security.SecureFilter.MySecureResourceFilter">
  <beans:property name="dataSource" ref="dataSource" />
  <beans:property name="resourceQuery"
   value="select distinct  _source.resource_link, ('ROLE_'+LTRIM(str(_role.role_id))) as ROLE ,_role.role_name from 
         up_role _role  JOIN up_privilege _pri 
         ON _role.role_id=_pri.role_id  JOIN up_resource _source 
         ON _pri.resource_id=_source.resource_id 
         WHERE _source.resource_link not like ''" />
 </beans:bean>

 <!-- 数据源 -->
 <beans:bean id="dataSource"
  class="org.springframework.jdbc.datasource.DriverManagerDataSource">
  <beans:property name="driverClassName"
   value="net.sourceforge.jtds.jdbc.Driver" />
  <beans:property name="url"
   value="jdbc:jtds:sqlserver://localhost:1433;DatabaseName=eBuilder_egov;useLOBs=false" />
  <beans:pr