<?xml version="1.0" encoding="UTF-8"?>

<beans:beans

    xmlns="http://www.springframework.org/schema/security"

    xmlns:beans="http://www.springframework.org/schema/beans"

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xmlns:dubbo="http://code.alibabatech.com/schema/dubbo"

    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd

                        http://code.alibabatech.com/schema/dubbo http://code.alibabatech.com/schema/dubbo/dubbo.xsd

                        http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

    <http pattern="/*.html" security="none"/>

    <http pattern="/css/**" security="none"/>

    <http pattern="/img/**" security="none"/>

    <http pattern="/js/**" security="none"/>

    <http pattern="/plugins/**" security="none"/>

    <http pattern="/seller/add.do" security="none"/>

    <!-- use-expressions:设置是否启动SpEL表达式，默认值是true。 -->

    <http use-expressions="false">

        <!--

            配置SpringSecurity的拦截路径（拦截规则）

            * pattern:配置拦截规则。   /* 代表的是根路径下的所有资源（不包含子路径） /**代表的是根路径下所有的资源（包含子路径）

            * access:设置角色  角色命名 ROLE_角色名称  如：  ROLE_USER

        -->

        <intercept-url pattern="/**" access="ROLE_SELLER"/>

        <!--

        开启表单验证

            username-parameter="username"

            password-parameter="password"

            login-page            :登录页面名称  以  / 开始

            default-target-url    :登录成功后跳转的页面

            login-processing-url:提交的路径的设置 默认值"/login" 可以修改

        -->

        <form-login login-page="/login.html" default-target-url="/admin/index.html" always-use-default-target="true" authentication-failure-url="/login.html"/>

        <!-- 不使用csrf的校验 -->

        <csrf disabled="true"/>

        <!-- 配置框架页面不拦截 -->

        <headers>

            <frame-options policy="SAMEORIGIN"/>

        </headers>

        <!-- 注销的配置 -->

        <logout logout-url="/logout" logout-success-url="/shoplogin.html" />

    </http>

    <!-- 配置认证管理器 -->

    <authentication-manager>

        <!-- 认证的提供者 -->

        <authentication-provider user-service-ref="userDetailsService">

        </authentication-provider>

    </authentication-manager>

    <!-- 配置自定义的认证类 -->

    <beans:bean id="userDetailsService" class="com.luli.code.service.UserDetailsServiceImpl">

        <beans:property name="sellerService" ref="sellerService"></beans:property>

    </beans:bean>

</beans:beans>

package com.luli.code.service;

import com.luli.code.pojo.Seller;

import org.springframework.security.core.GrantedAuthority;

import org.springframework.security.core.authority.SimpleGrantedAuthority;

import org.springframework.security.core.userdetails.User;

import org.springframework.security.core.userdetails.UserDetails;

import org.springframework.security.core.userdetails.UserDetailsService;

import org.springframework.security.core.userdetails.UsernameNotFoundException;

import java.util.ArrayList;

import java.util.List;

public class UserDetailsServiceImpl implements UserDetailsService {

    private SellerService sellerService;

    public void setSellerService(SellerService sellerService) {

        this.sellerService = sellerService;

    }

    /*自定义登录验证*/

    @Override

    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {

        List<GrantedAuthority> grantedAuthorities = new ArrayList<>();

        grantedAuthorities.add(new SimpleGrantedAuthority("ROLE_SELLER"));

        //查找数据库

        Seller seller = sellerService.findOne(username);

        if(seller != null && ("1").equals(seller.getStatus())) {　　　　

            return new User(username, seller.getPassword(), grantedAuthorities);　　　　//判断账户密码

}else{ return null; } } }