spring security 3学习

http://blog.youkuaiyun.com/roadmap001/article/details/8147281

http://www.cnblogs.com/yjmyzz/p/how-to-custom-filter-provider-and-token-in-spring-security3.html

SS最基本配置要素(通常在applicationContext-security.xml中)如下：

<http>
        <form-login />
        <logout/>
<http>

该配置定义了form表单username/password验证登录方式，登出机制。此时，SS 3.1将注册11个filter形成filter过滤器链来实现系统的安全处理。这11个filter的逻辑顺序如下：

org.springframework.security.web.context.SecurityContextPersistenceFilter  

org.springframework.security.web.session.ConcurrentSessionFilter     session方面的管理和控制

org.springframework.security.web.authentication.logout.LogoutFilter     负责登出处理

org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter    负责表单认证方式登录处理

org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter

org.springframework.security.web.savedrequest.RequestCacheAwareFilter

org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter

org.springframework.security.web.authentication.AnonymousAuthenticationFilter

org.springframework.security.web.session.SessionManagementFilter     session方面的管理和控制

org.springframework.security.web.access.ExceptionTranslationFilter

org.springframework.security.web.access.intercept.FilterSecurityInterceptor

SS 3.1总共提供了21个filter，这些filter在SS filter过滤器链中的缺省顺序由org.springframework.security.config.http.SecurityFilters枚举类型定义。通过filter机制，SS实现了安全认证和授权等安全相关工作。用户通过配置文件，可以插入、替换或去除已知的filter，搭配自己的SS filter过滤器链，从而实现满足自己特定应用需求的安全处理。

Alias	Filter Class	Namespace Element or Attribute
CHANNEL_FILTER	ChannelProcessingFilter	http/intercept-url@requires-channel
SECURITY_CONTEXT_FILTER	SecurityContextPersistenceFilter	http
CONCURRENT_SESSION_FILTER	ConcurrentSessionFilter	session-management/concurrency-control
HEADERS_FILTER	HeaderWriterFilter	http/headers
CSRF_FILTER	CsrfFilter	http/csrf
LOGOUT_FILTER	LogoutFilter	http/logout
X509_FILTER	X509AuthenticationFilter	http/x509
PRE_AUTH_FILTER	AstractPreAuthenticatedProcessingFilterSubclasses	N/A
CAS_FILTER	CasAuthenticationFilter	N/A
FORM_LOGIN_FILTER	UsernamePasswordAuthenticationFilter	http/form-login
BASIC_AUTH_FILTER	BasicAuthenticationFilter	http/http-basic
SERVLET_API_SUPPORT_FILTER	SecurityContextHolderAwareRequestFilter	http/@servlet-api-provision
JAAS_API_SUPPORT_FILTER	JaasApiIntegrationFilter	http/@jaas-api-provision
REMEMBER_ME_FILTER	RememberMeAuthenticationFilter	http/remember-me
ANONYMOUS_FILTER	AnonymousAuthenticationFilter	http/anonymous
SESSION_MANAGEMENT_FILTER	SessionManagementFilter	session-management
EXCEPTION_TRANSLATION_FILTER	ExceptionTranslationFilter	http
FILTER_SECURITY_INTERCEPTOR	FilterSecurityInterceptor	http
SWITCH_USER_FILTER	SwitchUserFilter	N/A