基于springsecurity的用户角色权限

<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"> <!-- 自动配置模式，拦截所有请求，有ROLE_USER才可以通过 --> <http auto-config="true"> <intercept-url pattern="/login.jsp*" access="IS_AUTHENTICATED_ANONYMOUSLY" /> <!-- 增加 ROLE_ADMIN角色--> <intercept-url pattern="/admin.jsp" access="ROLE_ADMIN"/> <intercept-url pattern="/**" access="ROLE_USER"/> <form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=1"/> </http> <!-- 认证管理器。用户名密码都集成在配置文件中 --> <authentication-manager> <authentication-provider> <user-service> <!-- 添加ROLE_ADMIN角色 --> <user name="admin" password="admin" authorities="ROLE_USER,ROLE_ADMIN"/> <user name="sharp" password="sharp" authorities="ROLE_USER"/> </user-service> </authentication-provider> </authentication-manager> <!-- 指定中文资源 。默认命名空间是security,所以要加前缀beans: --> <beans:bean id="messageSource" class="org.springframework.context.support.ReloadableResourceBundleMessageSource"> <beans:property name="basename" value="classpath:org/springframework/security/messages_zh_CN"/> </beans:bean> </beans:beans>