pentair/web/WEB-INF/classes/applicationContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:s="http://www.springframework.org/schema/security"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"
	default-lazy-init="true">

	<description>SpringSecurity安全配置</description>

	<!-- http安全配置 -->
	<s:http auto-config="true" use-expressions="true">		
		
		<s:intercept-url pattern="/favicon.ico" filters="none" />
		<s:intercept-url pattern="/css/**" filters="none" />
		<s:intercept-url pattern="/img/**" filters="none" />
		<s:intercept-url pattern="/js/**" filters="none" />

		<s:intercept-url pattern="/system/user!changePassword*" access="isAuthenticated()" />
		<s:intercept-url pattern="/system/**" access="hasAnyRole('ROLE_ADMIN')" />
		<s:intercept-url pattern="/product/**" access="hasAnyRole('ROLE_ADMIN')" />
		
		<s:intercept-url pattern="/login.action*" filters="none" />
		<s:intercept-url pattern="/*" access="isAuthenticated()" />
		
		<s:form-login login-page="/login.action" default-target-url="/" authentication-failure-url="/login.action?error=1" />
		<s:logout logout-success-url="/login.action" />
		<s:session-management invalid-session-url="/login.action?error=3">
			<s:concurrency-control max-sessions="10" error-if-maximum-exceeded="false" />
		</s:session-management>

		<s:custom-filter after="SECURITY_CONTEXT_FILTER" ref="autoLoginFilter" />
	</s:http>

	<!-- 方法安全配置 -->
	<s:global-method-security secured-annotations="enabled" />

	<!-- 认证配置，如果需要加密密码，请设置hash=sha，并修改UserDetailsServiceImpl -->
	<s:authentication-manager alias="authenticationManager">
		<s:authentication-provider user-service-ref="userDetailsService">
			<s:password-encoder hash="plaintext" />
		</s:authentication-provider>
	</s:authentication-manager>

	<!-- 项目实现的用户查询服务  -->
	<bean id="userDetailsService" class="com.pentair.showcase.security.UserDetailsServiceImpl" />

	<!-- 开发时自动登录的filter -->
	<bean id="autoLoginFilter" class="com.pentair.showcase.security.AutoLoginFilter">
		<property name="enabled" value="${security.autologin.enabled}" />
		<property name="defaultUserName" value="am" />
	</bean>

	<!--JCaptcha验证码服务 -->
	<bean id="captchaService" class="com.octo.captcha.service.image.DefaultManageableImageCaptchaService">
		<property name="captchaEngine">
			<bean class="org.springside.modules.security.jcaptcha.GMailEngine" />
		</property>
		<!-- 
		默认生成的图片180秒过期 , 可另行设置
		<property name="minGuarantedStorageDelayInSeconds" value="180" />
		-->
	</bean>
</beans>