Spring Security XML config

конфиги (спринг-докс)
https://ru.wikibooks.org/wiki/Spring_Security/%D0%9A%D0%BE%D0%BD%D1%84%D0%B8%D0%B3%D1%83%D1%80%D0%B8%D1%80%D0%BE%D0%B2%D0%B0%D0%BD%D0%B8%D0%B5_%D1%81_%D0%BF%D0%BE%D0%BC%D0%BE%D1%89%D1%8C%D1%8E_%D0%BF%D1%80%D0%BE%D1%81%D1%82%D1%80%D0%B0%D0%BD%D1%81%D1%82%D0%B2%D0%B0_%D0%B8%D0%BC%D1%91%D0%BD


 web.xml
<filter>
   <filter-name>springSecurityFilterChain</filter-name>
   <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
   <filter-name>springSecurityFilterChain</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping>

security-config.xml
https://habr.com/ru/post/203318/
<beans:beans xmlns="http://www.springframework.org/schema/security"
      xmlns:beans="http://www.springframework.org/schema/beans"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://www.springframework.org/schema/beans
                 http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                 http://www.springframework.org/schema/security
                 http://www.springframework.org/schema/security/spring-security-3.0.xsd">

enables @Secured
<global-method-security secured-annotations="enabled" />

создаете прототип приложения или просто начинаете интеграцию Spring Security в свое приложение, когда вы не хотите тратить время на настройку базы данных или написание реализации UserDetailsService.

<user-service id="userDetailsService">
   <user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
   <user name="bob" password="bobspassword" authorities="ROLE_USER" />
</user-service>

JdbcDaoImpl - пример конфигурации
использовать различные СУБД, просто изменяя DriverManagerDataSource

<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource">
  <property name="driverClassName" value="org.hsqldb.jdbcDriver"/>
  <property name="url" value="jdbc:hsqldb:hsql://localhost:9001"/>
  <property name="username" value="sa"/>
  <property name="password" value=""/>
</bean>

<bean id="userDetailsService" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
  <property name="dataSource" ref="dataSource"/>
</bean>

<http access-denied-page="/error403.jsp">
   <intercept-url pattern="/index*" access="ROLE_USER,ROLE_ANONYMOUS"/>
   <intercept-url pattern="/add*" access="ROLE_USER"/>
   <intercept-url pattern="/delete/*" access="ROLE_ADMIN"/>
   <form-login login-page="/login.jsp" default-target-url="/index" authentication-failure-url="/login.jsp?error=true"/>
   <logout logout-url="/logout" logout-success-url="/index"/>
   <anonymous username="guest" granted-authority="ROLE_ANONYMOUS"/>
   <remember-me/>
</http>

<authentication-manager>
   <authentication-provider>
      <user-service>
         <user name="admin" password="pass" authorities="ROLE_ADMIN,ROLE_USER"/>
         <user name="user1" password="1111" authorities="ROLE_USER"/>
         <user name="user2" password="2222" disabled="true" authorities="ROLE_USER"/>
      </user-service>
   </authentication-provider>
</authentication-manager>
</beans:beans>