Spring Security用戶定義的url攔截器

Question

我已經在我的webapp中實現了spring security。

下面是我的安全confile文件：

<beans:beans xmlns="http://www.springframework.org/schema/security" 
    xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
    http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
    http://www.springframework.org/schema/security 
    http://www.springframework.org/schema/security/spring-security-3.2.xsd"> 

    <!-- enable use-expressions --> 
    <http auto-config="true" use-expressions="true"> 
     <intercept-url pattern="/admin**" access="Admin" /> 

     <!-- access denied page --> 
    <access-denied-handler error-page="/403" /> 
     <form-login 
      login-page="/login" 
      default-target-url="/welcome" 
      authentication-failure-url="/login?error" 
      username-parameter="mobileno" 
      password-parameter="staffpwd" /> 
     <logout logout-success-url="/login?logout" /> 
     <csrf/> 
    </http> 

    <authentication-manager> 
     <authentication-provider> 
      <jdbc-user-service data-source-ref="dataSource" 
      users-by-username-query= 
      "select username,password, enabled from users where username=?" 
      authorities-by-username-query= 
      "select username, role from user_roles where username =? " /> 
     </authentication-provider> 
    </authentication-manager> 

</beans:beans> 

在攔截網址現在/管理URL只允許管理員角色的用戶。現在，我必須添加一條新規則，如果某人未經過驗證或被阻止，則該用戶不得訪問該網址。基於數據庫表格計算的業務邏輯更少。那麼我該如何配置這些用戶定義的攔截器。

它是我第一次做彈簧安全，請告訴我怎麼做到這一點。

感謝

Answer 1

<http auto-config="true" use-expressions="true"> 
    <!-- static resource --> 
    <intercept-url pattern="/403" access="permitAll" /> 
    <intercept-url pattern="/login" access="permitAll" /> 

    <!-- only user with Admin role can access --> 
    <intercept-url pattern="/admin**" access="hasRole('Admin')" /> 

    <!-- other urls should be authenticated --> 
    <intercept-url pattern="/**" access="isFullyAuthenticated()" /> 

    <!-- access denied page --> 
    <access-denied-handler error-page="/403" /> 
    <form-login 
     login-page="/login" 
     default-target-url="/welcome" 
     authentication-failure-url="/login?error" 
     username-parameter="mobileno" 
     password-parameter="staffpwd" /> 
    <logout logout-success-url="/login?logout" /> 
    <csrf/> 
</http> 

現在我要添加新的規則，如果有人未經過驗證，或者如果阻塞則該用戶不能訪問url.There少基於數據庫表更多的商業邏輯計算

如果您需要執行更復雜的業務，你應該實現自己的UserDetailsService或AuthenticationProvider