srping security

如果出现一个帐户登录老出现404，要加上always-use-default-target='true'

如<form-login login-page="/login.jsp"  authentication-failure-url="/login.jsp?error=true"   default-target-url="/login.action" always-use-default-target='true'/>

读用户信息：

public UserInfo getUserInfo() {
  SecurityContext securityContext = (SecurityContext) getRequest()
    .getSession().getAttribute("SPRING_SECURITY_CONTEXT");
  UserInfo userInfo = null;
  if (securityContext != null) {
   userInfo = (UserInfo) securityContext.getAuthentication().getPrincipal();   
  }  
  return userInfo;
 }

页面上读用户信息：

<%
 SecurityContext securityContext = (SecurityContext) session
   .getAttribute("SPRING_SECURITY_CONTEXT");
    UserInfo userInfo = null;
 if (securityContext != null) {
  userInfo = (UserInfo) securityContext.getAuthentication()
    .getPrincipal();
 }
%>

页面判断权限：

<%@ taglib prefix='security'
 uri='http://www.springframework.org/security/tags'%>

<security:authorize ifAnyGranted="ROLE_OWNER">

service层：

public class UserDetailLogic implements UserDetailsService{

 @Override
 public UserDetails loadUserByUsername(String username)
   throws UsernameNotFoundException, DataAccessException {
  
  UserInfo userInfo = userDao.findUnique("from UserInfo e where e.userName = ?", username);
  return userInfo;
 }

}

applicatonContext-security.xml

<?xml version="1.0" encoding="UTF-8"?>

    <b:beans xmlns="http://www.springframework.org/schema/security" 
     xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
     xsi:schemaLocation="http://www.springframework.org/schema/beans  
     http://www.springframework.org/schema/beans/spring-beans.xsd 
        http://www.springframework.org/schema/security  
        http://www.springframework.org/schema/security/spring-security-3.0.xsd"> 
     
     <http auto-config="true" access-denied-page="/accessDenied.jsp"> 
      <!-- 不要过滤图片等静态资源，其中**代表可以跨越目录，*不可以跨越目录。 --> 
      <intercept-url pattern="/**/*.jpg" filters="none" /> 
      <intercept-url pattern="/**/*.png" filters="none" /> 
      <intercept-url pattern="/**/*.gif" filters="none" /> 
      <intercept-url pattern="/**/*.css" filters="none" /> 
      <intercept-url pattern="/**/*.js" filters="none" /> 
     
      <!-- 设置访问权限start -->
      <intercept-url pattern="/**" access="ROLE_ADMIN,ROLE_USER" />
      <!-- 设置访问权限end -->
     
      <!-- 登录页面和忘记密码页面不过滤 --> 
      <intercept-url pattern="/login.*" filters="none" /> 
      <intercept-url pattern="/index.action" filters="none" /> 
      <form-login login-page="/login.jsp"  authentication-failure-url="/login.jsp?error=true"   default-target-url="/login.action" always-use-default-target='true'/> 
      <logout logout-success-url="/login.jsp"/>
      <!-- 检测失效的sessionId,超时时定位到另外一个URL --> 
      <session-management invalid-session-url="/login.jsp" />
       
     </http> 
     
     <authentication-manager>
   <!--<authentication-provider>
         <user-service>
    <user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" />
    <user name="user" password="user" authorities="ROLE_USER" />
   </user-service>
  </authentication-provider>-->
          <authentication-provider user-service-ref="userDetailLogic">
                <password-encoder hash="md5"/>
          </authentication-provider> 
     </authentication-manager> 
     
    </b:beans> 

User:

public class UserInfo implements Cloneable,UserDetails{

@Override
 public Object clone() throws CloneNotSupportedException {
  return super.clone();
 }

}