1、配置web.xml檔案：

<!-- 指定spring security的配置檔案--> <context-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/spring-security.xml</param-value> </context-param> <!-- spring security 的 Filter Chain 代理 --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class> org.springframework.web.filter.DelegatingFilterProxy </filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 取得Spring的Context --> <listener> <listener-class> org.springframework.web.context.ContextLoaderListener </listener-class> </listener>

2、配置spring-security.xml（該檔名字與web.xml中的<context-param />中的相對應） ：

<?xml version="1.0" encoding="UTF-8"?> <beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-2.0.4.xsd"> <http auto-config="true"> <!-- 登入頁面不攔截，任何人都可以訪問到 --> <intercept-url pattern="/login.jsp" filters="none" /> <!-- 需要攔截的路徑，pattern表示要攔截的路徑，access表示能夠訪問的角色 --> <intercept-url pattern="/a/*" access="ROLE_A,ROLE_ADMIN,ROLE_SUPER" /> <intercept-url pattern="/a/aa/*" access="ROLE_AA,ROLE_ADMIN,ROLE_SUPER" /> <intercept-url pattern="/b/*" access="ROLE_B,ROLE_ADMIN,ROLE_SUPER" /> <intercept-url pattern="/b/bb/*" access="ROLE_BB,ROLE_ADMIN,ROLE_SUPER" /> <!-- 指定登入頁面 --> <form-login login-page="/login.jsp" /> <!-- 指定退出後要顯示的頁面 --> <logout logout-success-url="/index.jsp"></logout> <!-- 同步session控制 --> <concurrent-session-control max-sessions="1" /> </http> <!-- 認證提供器 --> <authentication-provider> <password-encoder hash="plaintext"></password-encoder> <user-service> <user password="super" name="super" authorities="ROLE_SUPER" /> <user password="admin" name="admin" authorities="ROLE_ADMIN" /> <user password="a" name="a" authorities="ROLE_A" /> <user password="b" name="b" authorities="ROLE_B" /> <user password="aa" name="aa" authorities="ROLE_AA" /> <user password="bb" name="bb" authorities="ROLE_BB" /> </user-service> </authentication-provider> </beans:beans>