springSecurity双模认证

package com.berchina.uums.config; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Qualifier; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.PropertySource; import org.springframework.context.support.ReloadableResourceBundleMessageSource; import org.springframework.core.env.Environment; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; import org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.builders.WebSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.core.userdetails.UserDetailsService; import javax.annotation.Resource; /** * Created by on 16/6/16. */ @Configuration public class SecurityConfig { @Configuration @EnableWebSecurity @PropertySource("classpath:config.properties") protected static class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Resource private Environment env; @Bean public ReloadableResourceBundleMessageSource messageSource() {//本地化(不完全) ReloadableResourceBundleMessageSource messageSource = new ReloadableResourceBundleMessageSource(); messageSource.setBasename("classpath:org/springframework/authentication/messages"); return messageSource; } @Autowired @Qualifier("cerUserDetailsServiceImpl") private UserDetailsService cerUserDetailsServiceImpl; @Autowired @Qualifier("daoUserDetailsServiceImpl") private UserDetailsService daoUserDetailsServiceImpl; @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(daoUserDetailsServiceImpl); } @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().anyRequest().authenticated() .and().x509().userDetailsService(cerUserDetailsServiceImpl) .and().formLogin().loginPage("/login").permitAll() .and().logout().logoutUrl("/logout").permitAll() .and().exceptionHandling().accessDeniedPage("/exclude/403"); } @Override public void configure(WebSecurity web) throws Exception { web.ignoring().antMatchers("/static/**", "/exclude/**"); } //暴露AuthenticationManager注册成Bean供@EnableGlobalMethodSecurity使用 @Bean @Override public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } } @Configuration @EnableGlobalMethodSecurity(prePostEnabled = true) protected static class MethodSecurityConfig extends GlobalMethodSecurityConfiguration { } }