<?xml version="1.0" encoding="UTF-8"?>
<b:beans xmlns="http://www.springframework.org/schema/security"
	xmlns:b="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="   
          http://www.springframework.org/schema/beans   
          http://www.springframework.org/schema/beans/spring-beans-4.0.xsd   
          http://www.springframework.org/schema/security
          http://www.springframework.org/schema/security/spring-security-3.2.xsd">

	<!-- 首页和静态资源不用过滤 -->
	<http pattern="/**/static/**" security="none" />
	<!-- 登录页面不过滤 -->
	<http pattern="/signin/**" security="none" />
	<http pattern="/signup/**" security="none" />

	<http auto-config="true" use-expressions="true">
		<!-- 登录配置 -->
		<form-login login-page="/signin"
			authentication-success-handler-ref="customSuccessHandler"
			authentication-failure-handler-ref="customFailureHandler"
			default-target-url="/" username-parameter="j_username"
			password-parameter="j_password" login-processing-url="/j_spring_security_check" />
		<!-- 不允许匿名登录 -->
		<anonymous enabled="false" />

		<logout success-handler-ref="customLogoutSuccessHandler"
			invalidate-session="true" />

		<remember-me />

		<!-- 自定义过滤器， 实现用户管理 -->
		<custom-filter ref="iFilter" before="FILTER_SECURITY_INTERCEPTOR" />
	</http>

	<b:bean id="customSuccessHandler"
		class="com.uas.platform.b2b.support.CustomAuthenticationSuccessHandler" />

	<b:bean id="customFailureHandler"
		class="com.uas.platform.b2b.support.CustomAuthenticationFailureHandler" />

	<b:bean id="customLogoutSuccessHandler"
		class="com.uas.platform.b2b.support.CustomLogoutSuccessHandler" />
	<!-- 自定义过滤器 -->
	<b:bean id="iFilter" class="com.uas.platform.b2b.filter.SecurityInterceptor">
		<b:property name="securityMetadataSource" ref="securityMetadataSource" /><!-- 
			FilterInvocationSecurityMetadataSource 接口实现类 -->
		<b:property name="authenticationManager" ref="authenticationManager" /><!-- 
			鉴定管理类 -->
		<b:property name="accessDecisionManager" ref="accessDecisionManager" /><!-- 
			AccessDecisionManager 接口实现类 -->
	</b:bean>

	<!-- 鉴定管理类配置信息 -->
	<authentication-manager alias="authenticationManager" erase-credentials="false">
		<!-- 鉴定管理类 -->
		<authentication-provider ref="daoAuthenticationProvider" />
	</authentication-manager>

	<b:bean id="daoAuthenticationProvider"
		class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
		<b:property name="userDetailsService" ref="userDetailsManager" />
		<!--没有这个将不能准确地报告登录异常 -->
		<b:property name="hideUserNotFoundExceptions" value="false" />
		<b:property name="passwordEncoder" ref="passwordEncoder" />
		<b:property name="saltSource" ref="saltSource" />
	</b:bean>

	<!-- 用户详细信息获取接口 -->
	<b:bean id="userDetailsManager"
		class="com.uas.platform.b2b.support.CustomUserDetailsService" />

	<!-- 访问决策器， 决定某个用户具体的角色，是否有足够的权限访问某个资源 -->
	<b:bean id="accessDecisionManager"
		class="com.uas.platform.b2b.support.CustomAccessDecisionManager" />

	<!-- 资源源数据定义， 将所有的资源和权限的对应关系建立起来，即定义某一资源可以被哪些角色去访问。 -->
	<b:bean id="securityMetadataSource"
		class="com.uas.platform.b2b.support.CustomSecurityMetadataSource" />

	<!-- 用户详情管理类使用的加密方式 -->
	<b:bean id="passwordEncoder"
		class="org.springframework.security.authentication.encoding.Md5PasswordEncoder" />
	<!--PasswordEncoder密码接口 -->

	<!-- 加密使用盐值 -->
	<b:bean id="saltSource"
		class="org.springframework.security.authentication.dao.ReflectionSaltSource">
		<b:property name="userPropertyToUse" value="username" />
	</b:bean>
</b:beans>