假設獲取到的角色是null，那就放行通過，這主要是對於那些不須要驗證的公共能夠訪問的方法。就不須要權限了。

能夠直接訪問。

package com.ucs.security.context;
import java.util.Collection;
import java.util.Iterator;
import org.apache.log4j.Logger;
import org.springframework.security.access.AccessDecisionManager;
import org.springframework.security.access.AccessDeniedException;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.authentication.InsufficientAuthenticationException;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.stereotype.Service;
@Service("myAccessDecisionManager")
public class MyAccessDecisionManager implements AccessDecisionManager{
	Logger log=Logger.getLogger(MyAccessDecisionManager.class);
	@Override
	public void decide(Authentication authentication, Object object,
			Collection<ConfigAttribute> configAttributes) throws AccessDeniedException,
			InsufficientAuthenticationException {
			// TODO Auto-generated method stub
		//假設相應資源沒有找到角色 則放行
		 	if(configAttributes == null){
		 		
	            return ;
	        }
		
			log.info("object is a URL:"+object.toString());  //object is a URL.
			Iterator<ConfigAttribute> ite=configAttributes.iterator();
			while(ite.hasNext()){
				ConfigAttribute ca=ite.next();
				String needRole=ca.getAttribute();
				for(GrantedAuthority ga:authentication.getAuthorities()){
					if(needRole.equals(ga.getAuthority())){  //ga is user's role.
						return;
					}
				}
			}
			throw new AccessDeniedException("no right");
			
		

		
	}

	@Override
	public boolean supports(ConfigAttribute arg0) {
		// TODO Auto-generated method stub
		return true;
	}

	@Override
	public boolean supports(Class<?> arg0) {
		// TODO Auto-generated method stub
		return true;
	}

}

package com.ucs.security.context;

import java.io.IOException;

import javax.annotation.Resource;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

import org.apache.log4j.Logger;
import org.springframework.security.access.SecurityMetadataSource;
import org.springframework.security.access.intercept.AbstractSecurityInterceptor;
import org.springframework.security.access.intercept.InterceptorStatusToken;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;



public class MySecurityFilter extends AbstractSecurityInterceptor implements Filter {
	Logger log=Logger.getLogger(MySecurityFilter.class);
	
	private FilterInvocationSecurityMetadataSource securityMetadataSource;
	public SecurityMetadataSource obtainSecurityMetadataSource() {
		return this.securityMetadataSource;
	}
	public FilterInvocationSecurityMetadataSource getSecurityMetadataSource() {
		return securityMetadataSource;
	}

	public void setSecurityMetadataSource(
			FilterInvocationSecurityMetadataSource securityMetadataSource) {
		this.securityMetadataSource = securityMetadataSource;
	}

	@Override
	public void destroy() {
		// TODO Auto-generated method stub
		
	}

	@Override
	public void doFilter(ServletRequest req, ServletResponse res,
			FilterChain chain) throws IOException, ServletException {
		FilterInvocation fi=new FilterInvocation(req,res,chain);
		log.info("--------MySecurityFilter--------");
		invok(fi);
	}

	

	private void invok(FilterInvocation fi) throws IOException, ServletException {
		// object為FilterInvocation對象
		//1.獲取請求資源的權限
		//運行Collection<ConfigAttribute> attributes = SecurityMetadataSource.getAttributes(object);
		//2.是否擁有權限
		//獲取安全主體。能夠強制轉換為UserDetails的實例
		//1) UserDetails
		// Authentication authenticated = authenticateIfRequired();
		//this.accessDecisionManager.decide(authenticated, object, attributes);
		//用戶擁有的權限
		//2) GrantedAuthority
		//Collection<GrantedAuthority> authenticated.getAuthorities()
		log.info("用戶發送請求！ ");
		InterceptorStatusToken token = null;
		
		token = super.beforeInvocation(fi);
		
		try {
			fi.getChain().doFilter(fi.getRequest(), fi.getResponse());
		} finally {
			super.afterInvocation(token, null);
		}
	}

	@Override
	public void init(FilterConfig arg0) throws ServletException {
		// TODO Auto-generated method stub
		
	}

	
	public Class<? extends Object> getSecureObjectClass() {
		//以下的MyAccessDecisionManager的supports方面必須放回true,否則會提醒類型錯誤
		return FilterInvocation.class;
	}
	

}

package com.ucs.security.context;

import java.util.ArrayList;
import java.util.Collection;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;
import java.util.Map.Entry;

import javax.annotation.Resource;

import org.apache.log4j.Logger;
import org.springframework.security.access.ConfigAttribute;
import org.springframework.security.access.SecurityConfig;
import org.springframework.security.web.FilterInvocation;
import org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource;
import org.springframework.stereotype.Service;

import com.google.gson.Gson;
import com.ucs.security.face.SecurityTestInterface;
import com.ucs.security.pojo.URLResource;



@Service("mySecurityMetadataSource")
public class MySecurityMetadataSource implements FilterInvocationSecurityMetadataSource{
	//由spring調用
	Logger log=Logger.getLogger(MySecurityMetadataSource.class);
	@Resource
	private SecurityTestInterface dao;
	private static Map<String, Collection<ConfigAttribute>> resourceMap = null;

	/*public MySecurityMetadataSource() {
		
		loadResourceDefine();
	}*/
	

	public Collection<ConfigAttribute> getAllConfigAttributes() {
		// TODO Auto-generated method stub
		return null;
	}

	public boolean supports(Class<?
> clazz) {
		// TODO Auto-generated method stub
		return true;
	}
	//載入全部資源與權限的關系
	private void loadResourceDefine() {
		if(resourceMap == null) {
			resourceMap = new HashMap<String, Collection<ConfigAttribute>>();
			/*List<String> resources ;
			resources = Lists.newArrayList("/jsp/user.do","/jsp/getoutput.do");*/
			List<URLResource> findResources = dao.findResource();
			
			for(URLResource url_resource:findResources){
				Collection<ConfigAttribute> configAttributes = new ArrayList<ConfigAttribute>();
				ConfigAttribute configAttribute = new SecurityConfig(url_resource.getRole_Name());
				for(String resource:url_resource.getRole_url()){
					configAttributes.add(configAttribute);
					resourceMap.put(resource, configAttributes);
				}
				
			}
			//以權限名封裝為Spring的security Object
			
		}
		Gson gson =new Gson();
		log.info("權限資源相應關系："+gson.toJson(resourceMap));
		
		
		Set<Entry<String, Collection<ConfigAttribute>>> resourceSet = resourceMap.entrySet();
		Iterator<Entry<String, Collection<ConfigAttribute>>> iterator = resourceSet.iterator();
		
	}
	//返回所請求資源所須要的權限
	public Collection<ConfigAttribute> getAttributes(Object object) throws IllegalArgumentException {
		
		String requestUrl = ((FilterInvocation) object).getRequestUrl();
		log.info("requestUrl is " + requestUrl);
		if(resourceMap == null) {
			loadResourceDefine();
		}
		log.info("通過資源定位到的權限："+resourceMap.get(requestUrl));
		return resourceMap.get(requestUrl);
	}

}

package com.ucs.security.dao;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
import java.util.Map;

import javax.annotation.Resource;

import org.apache.log4j.Logger;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowCallbackHandler;
import org.springframework.stereotype.Repository;

import com.google.common.collect.Lists;
import com.google.gson.Gson;
import com.ucs.security.face.SecurityTestInterface;
import com.ucs.security.pojo.URLResource;
import com.ucs.security.pojo.Users;

@Repository("SecurityTestDao")
public class SecurityTestDao implements SecurityTestInterface{
	Logger log=Logger.getLogger(SecurityTestDao.class);
	
	@Resource
	private JdbcTemplate jdbcTamplate;
	public boolean getinput() {
		log.info("getinput");
		return true;
	}
	
	public boolean geoutput() {
		log.info("geoutput");
		return true;
	}

	public boolean addreport_admin() {
		log.info("addreport_admin");
		return true;
	}

	public boolean deletereport_admin() {
		log.info("deletereport_admin");
		return true;
	}


	public Users findbyUsername(String name) {
		final Users users = new Users();  
		jdbcTamplate.query("SELECT * FROM USER WHERE logname = ?
",  
		                    new Object[] {name},  
		                    new RowCallbackHandler() {  
								@Override
								public void processRow(java.sql.ResultSet rs)
										throws SQLException {
								 users.setName(rs.getString("logname"));
								 users.setPassword(rs.getString("password"));
								 users.setRole(rs.getString("role_ids"));
								}  
		                    });  
		log.info(users.getName()+"    "+users.getPassword()+"    "+users.getRole());
		return users;
	}

	
		
	@Override
	public void user_login() {
		log.info("擁有ROLE_USER權限的方法訪問：user_login");
		
	}

	@Override
	//獲取全部資源鏈接
	public List<URLResource> findResource() {
		
		List<URLResource> uRLResources =Lists.newArrayList();
		Map<String,Integer[]> role_types=new HashMap<String, Integer[]>();
		List<String> role_Names=Lists.newArrayList();
		List list_role=jdbcTamplate.queryForList("select role_type,power_ids from role");
		Iterator it_role = list_role.iterator();
		while(it_role.hasNext()){
			Map role_map=(Map)it_role.next();
			String object = (String)role_map.get("power_ids");
			String type = (String)role_map.get("role_type");
			role_Names.add(type);
			String[] power_ids = object.split(",");
			Integer[] int_pow_ids=new Integer[power_ids.length];
			for(int i=0;i<power_ids.length;i++){
				int_pow_ids[i]=Integer.parseInt(power_ids[i]);
			}
			role_types.put(type, int_pow_ids);
		}
		for(String name:role_Names){
			URLResource resource=new URLResource();
			Integer[] ids=role_types.get(name);//更具角色獲取權限id
			List<Integer> all_res_ids=Lists.newArrayList();
			List<String> urls=Lists.newArrayList();
			for(Integer id:ids){//更具權限id獲取資源id
				List resource_ids=jdbcTamplate.queryForList("select resource_ids from power where id =?",new Object[]{id});
				Iterator it_resource_ids = resource_ids.iterator();
				while(it_resource_ids.hasNext()){
					Map resource_ids_map=(Map)it_resource_ids.next();
					String[] ids_str=((String)resource_ids_map.get("resource_ids")).split(",");
					for(int i=0;i<ids_str.length;i++){
						all_res_ids.add(Integer.parseInt(ids_str[i]));
					}
				}
			}
			for(Integer id:all_res_ids){
				List resource_urls=jdbcTamplate.queryForList("select resource_url from resource where id=?
",new Object[]{id});
				Iterator it_res_urls = resource_urls.iterator();
				while(it_res_urls.hasNext()){
					Map res_url_map=(Map)it_res_urls.next();
					urls.add(((String)res_url_map.get("resource_url")));
				}
			}
			//將相應的權限關系加入到URLRsource
			resource.setRole_Name(name);
			resource.setRole_url(urls);
			uRLResources.add(resource);
		}
		
		Gson gson =new Gson();
		log.info("權限資源相應關系:"+gson.toJson(uRLResources));
		return uRLResources;
	}

}

package com.ucs.security.face;

import java.util.List;

import javax.annotation.security.RolesAllowed;

import com.ucs.security.pojo.URLResource;
import com.ucs.security.pojo.Users;

public interface SecurityTestInterface {

	boolean getinput();

	boolean geoutput();
	[email protected]("ROLE_ADMIN")//擁有ROLE_ADMIN權限的用戶才可進入此方法
	boolean addreport_admin();
	[email protected]("ROLE_ADMIN")
	boolean deletereport_admin();
	
	Users findbyUsername(String name);
	[email protected]("ROLE_USER")
	void user_login();

	List<URLResource> findResource();

}