<beans:beans xmlns="http://www.springframework.org/schema/security"
			 xmlns:beans="http://www.springframework.org/schema/beans"
			 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
			 xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">

	<!-- 不需要控制权限的资源 -->
	<http security="none" pattern="/resources/**" />
	<http security="none" pattern="/**/*.html" />
	<http security="none" pattern="/**/*.jsp" />

	<http use-expressions="false">
		<!-- 登录页面不需要控制权限 -->
		<intercept-url pattern="/manage/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
		<!-- 访问其他所有页面都需要有USER权限 -->
		<intercept-url pattern="/manage/**" access="ROLE_ADMIN" />
		<!-- 登录功能 -->
		<form-login login-page="/manage/login" authentication-failure-url="/manage/login?error"/>
		<!-- 登出功能 -->
		<logout />
	</http>

	<authentication-manager>
		<authentication-provider>
			<user-service>
				<!-- 这里创建两个用户，可以通过用户名密码登录 -->
				<user name="admin" password="123456" authorities="ROLE_ADMIN" />
			</user-service>
		</authentication-provider>
	</authentication-manager>

</beans:beans>