<beans:beans xmlns="http://www.springframework.org/schema/security"
             xmlns:beans="http://www.springframework.org/schema/beans"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/security
        http://www.springframework.org/schema/security/spring-security.xsd">

    <!-- 不需要控制权限的资源 -->
    <http pattern="/resources/**" security="none"/>

    <http use-expressions="false">
        <!-- 登录页面不需要控制权限 -->
        <intercept-url pattern="/manage/login" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
        <!-- 访问其他所有页面都需要有USER权限 -->
        <intercept-url pattern="/manage/**" access="ROLE_ADMIN"/>
        <!-- 登录功能 -->
        <form-login login-page="/manage/login" authentication-failure-url="/manage/login?error"/>
        <!-- 登出功能 -->
        <logout/>
    </http>

    <authentication-manager>
        <authentication-provider>
            <user-service>
                <!-- 这里创建两个用户，可以通过用户名密码登录 -->
                <user name="admin" password="123456" authorities="ROLE_ADMIN"/>
            </user-service>
        </authentication-provider>
    </authentication-manager>

</beans:beans>