<!-- UserDetailsService is the most commonly frequently Acegi Security interface implemented by end users -->    <bean id="userDetailsService"      class="org.acegisecurity.userdetails.memory.InMemoryDaoImpl">      <property name="userProperties">          <bean              class="org.springframework.beans.factory.config.PropertiesFactoryBean">              <property name="location"                  value="classpath:users.properties" />          </bean>      </property>  </bean>    

        <property name="usersByUsernameQuery">              <value>                  SELECT email, password, enabled from user u where email = ?               </value>          </property>            <property name="authoritiesByUsernameQuery">              <value>                  SELECT u.email, r.role_name FROM user_role ur, user u, role r WHERE                       ur.user_id = u.user_id and ur.role_id = r.role_id and u.email = ?               </value>          </property>

#  # Structure for the `role` table :   #    DROP TABLE IF EXISTS `role`;    CREATE TABLE `role` (    `role_id` int(11) NOT NULL auto_increment,    `role_name` varchar(50) default NULL,    `description` varchar(20) default NULL,    `enabled` tinyint(1) NOT NULL default '1',    PRIMARY KEY  (`role_id`)  );    #  # Structure for the `user` table :   #    DROP TABLE IF EXISTS `user`;    CREATE TABLE `user` (    `user_id` int(11) NOT NULL auto_increment,    `company_id` int(11) default NULL,    `email` varchar(200) default NULL,    `password` varchar(10) default NULL,    `enabled` tinyint(1) default NULL,    PRIMARY KEY  (`user_id`)  );    #  # Structure for the `user_role` table :   #    DROP TABLE IF EXISTS `user_role`;    CREATE TABLE `user_role` (    `user_role_id` int(11) NOT NULL auto_increment,    `user_id` varchar(50) NOT NULL,    `role_id` int(11) NOT NULL,    PRIMARY KEY  (`user_role_id`)  );  

package org.security;    import org.acegisecurity.GrantedAuthority;    /**   * The class <code>IUserDetails</code> extends the org.acegisecurity.userdetails.UserDetails interface, and provides additional userId, companyId information<br><br>   * @author wade   * @see UserDetails   */  public interface IUserDetails extends org.acegisecurity.userdetails.UserDetails{        public int getUserId();        public void setUserId(int user_id);        public int getCompanyId();        public void setCompanyId(int company_id);            public String getUsername();        public void setUsername(String username);        public GrantedAuthority[] getAuthorities();        public void setAuthorities(GrantedAuthority[] authorities);  }  

package org.security;    import org.acegisecurity.GrantedAuthority;  import org.acegisecurity.userdetails.User;    /**   * The class <code>UserDetailsImpl</code> extends the org.acegisecurity.userdetails.User class, and provides additional userId, companyId information   * @author wade   *    * @see IUserDetails, User   */  public class UserDetailsImpl extends User implements IUserDetails{      private int user_id;      private int company_id;      private String username;      private GrantedAuthority[] authorities;            public UserDetailsImpl(String username, String password, boolean enabled,              boolean accountNonExpired, boolean credentialsNonExpired,              boolean accountNonLocked, GrantedAuthority[] authorities)              throws IllegalArgumentException {          super(username, password, enabled, accountNonExpired, credentialsNonExpired,                  accountNonLocked, authorities);          setUsername(username);          setAuthorities(authorities);              }            public UserDetailsImpl(int userid, int companyid, String username, String password, boolean enabled,              boolean accountNonExpired, boolean credentialsNonExpired,              boolean accountNonLocked, GrantedAuthority[] authorities)              throws IllegalArgumentException {          super(username, password, enabled, accountNonExpired, credentialsNonExpired,                  accountNonLocked, authorities);          this.user_id = userid;          this.company_id = companyid;          setUsername(username);          setAuthorities(authorities);          }        public int getUserId() {          return user_id;      }        public void setUserId(int user_id) {          this.user_id = user_id;      }        public int getCompanyId() {          return company_id;      }        public void setCompanyId(int company_id) {          this.company_id = company_id;      }            public String getUsername() {          return username;      }        public void setUsername(String username) {          this.username = username;      }        public GrantedAuthority[] getAuthorities() {          return authorities;      }        public void setAuthorities(GrantedAuthority[] authorities) {          this.authorities = authorities;      }  }  

SELECT u.user_id, u.company_id, email, password, enabled       FROM role r, user_role ur, user u       WHERE r.role_id = ur.role_id           and ur.user_id = u.user_id           and email = ?       limit 1 

SELECT u.email, r.role_name       FROM user_role ur, user u, role r       WHERE ur.user_id = u.user_id           and ur.role_id = r.role_id           and u.email = ? 

package org.security.acegi;    import java.sql.ResultSet;  import java.sql.SQLException;  import java.sql.Types;  import java.util.List;    import javax.sql.DataSource;    import org.acegisecurity.GrantedAuthority;  import org.acegisecurity.GrantedAuthorityImpl;  import org.acegisecurity.userdetails.UsernameNotFoundException;  import org.acegisecurity.userdetails.jdbc.JdbcDaoImpl;    import org.security.IUserDetails;  import org.security.UserDetailsImpl;  import org.springframework.dao.DataAccessException;  import org.springframework.jdbc.core.SqlParameter;  import org.springframework.jdbc.object.MappingSqlQuery;    /**   * The class AcegiJdbcDaoImpl provides the method to get IUserDetail information from db which contains userId, companyId and UserDetail information.   *    * @author wade   *   */  public class AcegiJdbcDaoImpl extends JdbcDaoImpl {       public static final String DEF_USERS_BY_USERNAME_QUERY =           "SELECT u.user_id, u.company_id, email, password, enabled from role r, user_role ur, user u where r.role_id = ur.role_id and ur.user_id = u.user_id and email = ? limit 1";       public static final String DEF_AUTHORITIES_BY_USERNAME_QUERY =           "SELECT username,authority FROM authorities WHERE username = ?";        protected MappingSqlQuery rolesByUsernameMapping;      protected MappingSqlQuery usersByNameMapping;                private String authoritiesByUsernameQuery;      private String rolePrefix = "";      private String usersByUsernameQuery;      private boolean usernameBasedPrimaryKey = true;            public AcegiJdbcDaoImpl(){          usersByUsernameQuery = DEF_USERS_BY_USERNAME_QUERY;          authoritiesByUsernameQuery = DEF_AUTHORITIES_BY_USERNAME_QUERY;      }      public String getAuthoritiesByUsernameQuery() {          return authoritiesByUsernameQuery;      }        public String getRolePrefix() {          return rolePrefix;      }        public String getUsersByUsernameQuery() {          return usersByUsernameQuery;      }        protected void initMappingSqlQueries() {          this.usersByNameMapping = new UsersByUsernameMapping(getDataSource());          this.rolesByUsernameMapping = new AuthoritiesByUsernameMapping(getDataSource());      }        /**       * Allows the default query string used to retrieve authorities based on username to be overriden, if       * default table or column names need to be changed. The default query is {@link       * #DEF_AUTHORITIES_BY_USERNAME_QUERY}; when modifying this query, ensure that all returned columns are mapped       * back to the same column names as in the default query.       *       * @param queryString The query string to set       */      public void setAuthoritiesByUsernameQuery(String queryString) {          authoritiesByUsernameQuery = queryString;      }        /**       * Allows a default role prefix to be specified. If this is set to a non-empty value, then it is       * automatically prepended to any roles read in from the db. This may for example be used to add the       * <code>ROLE_</code> prefix expected to exist in role names (by default) by some other Acegi Security framework       * classes, in the case that the prefix is not already present in the db.       *       * @param rolePrefix the new prefix       */      public void setRolePrefix(String rolePrefix) {          this.rolePrefix = rolePrefix;      }        /**       * If <code>true</code> (the default), indicates the {@link #getUsersByUsernameQuery()} returns a username       * in response to a query. If <code>false</code>, indicates that a primary key is used instead. If set to       * <code>true</code>, the class will use the database-derived username in the returned <code>UserDetailsImpl</code>.       * If <code>false</code>, the class will use the {@link #loadUserByUsername(String)} derived username in the       * returned <code>UserDetailsImpl</code>.       *       * @param usernameBasedPrimaryKey <code>true</code> if the mapping queries return the username <code>String</code>,       *        or <code>false</code> if the mapping returns a database primary key.       */      public void setUsernameBasedPrimaryKey(boolean usernameBasedPrimaryKey) {          this.usernameBasedPrimaryKey = usernameBasedPrimaryKey;      }        /**       * Allows the default query string used to retrieve users based on username to be overriden, if default       * table or column names need to be changed. The default query is {@link #DEF_USERS_BY_USERNAME_QUERY}; when       * modifying this query, ensure that all returned columns are mapped back to the same column names as in the       * default query. If the 'enabled' column does not exist in the source db, a permanent true value for this column       * may be returned by using a query similar to <br><pre>       * "SELECT username,password,'true' as enabled FROM users WHERE username = ?"</pre>       *       * @param usersByUsernameQueryString The query string to set       */      public void setUsersByUsernameQuery(String usersByUsernameQueryString) {          this.usersByUsernameQuery = usersByUsernameQueryString;      }            public IUserDetails loadUserByUsername(String username)          throws UsernameNotFoundException, DataAccessException {          List users = usersByNameMapping.execute(username);            if (users.size() == 0) {              throw new UsernameNotFoundException("User not found");          }            IUserDetails user = (IUserDetails) users.get(0); // contains no GrantedAuthority[]            List dbAuths = rolesByUsernameMapping.execute(user.getUsername());            addCustomAuthorities(user.getUsername(), dbAuths);            if (dbAuths.size() == 0) {              throw new UsernameNotFoundException("User has no GrantedAuthority");          }            GrantedAuthority[] arrayAuths = (GrantedAuthority[]) dbAuths.toArray(new GrantedAuthority[dbAuths.size()]);            user.setAuthorities(arrayAuths);            if (!usernameBasedPrimaryKey) {              user.setUsername(username);          }            return user;      }            /**       * Query object to look up a user's authorities.       */      protected class AuthoritiesByUsernameMapping extends MappingSqlQuery {          protected AuthoritiesByUsernameMapping(DataSource ds) {              super(ds, authoritiesByUsernameQuery);              declareParameter(new SqlParameter(Types.VARCHAR));              compile();          }            protected Object mapRow(ResultSet rs, int rownum)              throws SQLException {              String roleName = rolePrefix + rs.getString(2);              GrantedAuthorityImpl authority = new GrantedAuthorityImpl(roleName);                return authority;          }      }        /**       * Query object to look up a user.       */      protected class UsersByUsernameMapping extends MappingSqlQuery {          protected UsersByUsernameMapping(DataSource ds) {              super(ds, usersByUsernameQuery);              declareParameter(new SqlParameter(Types.VARCHAR));              compile();          }            protected Object mapRow(ResultSet rs, int rownum)              throws SQLException {              int user_id = rs.getInt(1);              int company_id = rs.getInt(2);              String username = rs.getString(3);              String password = rs.getString(4);              boolean enabled = rs.getBoolean(5);                            IUserDetails user = new UserDetailsImpl(username, password, enabled, true, true, true,                      new GrantedAuthority[] {new GrantedAuthorityImpl("HOLDER")});              user.setUserId(user_id);              user.setCompanyId(company_id);              return user;          }      }  }  

    <bean id="userDetailsService"          class="org.security.acegi.AcegiJdbcDaoImpl">          <property name="dataSource">              <ref bean="dataSource" />          </property>            <property name="usersByUsernameQuery">              <value>                  SELECT u.user_id, u.company_id, email, password, enabled                      from role r, user_role ur, user u where r.role_id = ur.role_id and ur.user_id = u.user_id                       and email = ?                      limit 1              </value>          </property>            <property name="authoritiesByUsernameQuery">              <value>                  SELECT u.email, r.role_name FROM user_role ur, user u, role r WHERE                  ur.user_id = u.user_id and ur.role_id = r.role_id and u.email = ?              </value>          </property>      </bean>  

    <bean id="filterInvocationInterceptor"          class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">          <property name="authenticationManager" ref="authenticationManager" />          <property name="accessDecisionManager">              <bean class="org.acegisecurity.vote.AffirmativeBased">                  <property name="allowIfAllAbstainDecisions" value="false" />                  <property name="decisionVoters">                      <list>                          <bean class="org.acegisecurity.vote.RoleVoter" />                          <bean class="org.acegisecurity.vote.AuthenticatedVoter" />                      </list>                  </property>              </bean>          </property>                    <property name="objectDefinitionSource">              <value><![CDATA[                  CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON                  PATTERN_TYPE_APACHE_ANT                  /secure/extreme/**=ROLE_SUPERVISOR                  /secure/**=IS_AUTHENTICATED_REMEMBERED                  /project/**=IS_AUTHENTICATED_REMEMBERED                  /task/**=ROLE_DEVELOPER                                  /**=IS_AUTHENTICATED_ANONYMOUSLY              ]]></value>          </property>      </bean>  

DROP TABLE IF EXISTS `resource`;    CREATE TABLE `resource` (    `resource_id` int(11) NOT NULL auto_increment,    `parent_resource_id` int(11) default NULL,    `resource_name` varchar(50) default NULL,    `description` varchar(100) default NULL,    PRIMARY KEY  (`resource_id`)  );    #  # Structure for the `resource_role` table :   #    DROP TABLE IF EXISTS `resource_role`;    CREATE TABLE `resource_role` (    `resource_role_id` int(11) NOT NULL auto_increment,    `resource_id` int(11) NOT NULL,    `role_id` int(11) NOT NULL,    PRIMARY KEY  (`resource_role_id`)  );

package org.security.acegi;    import java.sql.ResultSet;  import java.sql.SQLException;  import java.util.HashMap;  import java.util.Iterator;  import java.util.List;  import java.util.Map;    import javax.sql.DataSource;    import org.acegisecurity.ConfigAttributeDefinition;  import org.acegisecurity.SecurityConfig;  import org.acegisecurity.intercept.web.FilterInvocationDefinitionMap;  import org.acegisecurity.intercept.web.FilterInvocationDefinitionSource;  import org.acegisecurity.intercept.web.PathBasedFilterInvocationDefinitionMap;  import org.acegisecurity.intercept.web.RegExpBasedFilterInvocationDefinitionMap;  import org.apache.commons.logging.Log;  import org.apache.commons.logging.LogFactory;    import org.security.IResourceRole;  import org.security.ResourceRoleImpl;  import org.security.event.IPermissionListener;  import org.security.event.PermissionEventPublisher;    import org.springframework.beans.factory.InitializingBean;  import org.springframework.jdbc.core.support.JdbcDaoSupport;  import org.springframework.jdbc.object.MappingSqlQuery;    /**   *    * The class <code>AcegiJdbcDefinitionSourceImpl</code> is proxy to   * PathBasedFilterInvocationDefinitionMap or RegExpBasedFilterInvocationDefinitionMap, This class get the permission   * settings from the database, the default sql script is: SELECT resource, role   * FROM role_permission, if it doesn't match your needs, changed it in bean   * setting. <br>   *    * <br>   * $log$<br>   * <br>   *    * @author $Author: wade $   * @see   */  public class AcegiJdbcDefinitionSourceImpl extends JdbcDaoSupport implements          InitializingBean, FilterInvocationDefinitionSource{      private Log logger = LogFactory.getLog(this.getClass());        public static final String DEF_PERMISSIONS_QUERY = "SELECT resource, role FROM role_permission";            /** The Perl5 expression */      String PERL5_KEY = "PATTERN_TYPE_PERL5";        /** The ant path expression */      String ANT_PATH_KEY = "PATTERN_TYPE_APACHE_ANT";        /* Set default to Ant Path Expression*/      private String resourceExpression = ANT_PATH_KEY;        private boolean convertUrlToLowercaseBeforeComparison = false;        private FilterInvocationDefinitionMap definitionSource = null;        private String permissionsQuery;        private String rolePrefix = "";        public AcegiJdbcDefinitionSourceImpl() {          permissionsQuery = DEF_PERMISSIONS_QUERY;      }        public String getAuthoritiesByUsernameQuery() {          return permissionsQuery;      }        public String getRolePrefix() {          return rolePrefix;      }        /**       * Allows the default query string used to retrieve permissions to be       * overriden, if default table or column names need to be changed. The       * default query is {@link #DEF_PERMISSIONS_QUERY}; when modifying this       * query, ensure that all returned columns are mapped back to the same       * column names as in the default query.       *        * @param queryString       *            The query string to set       */      public void setPermissionsQuery(String queryString) {          permissionsQuery = queryString;      }        /**       * Allows a default role prefix to be specified. If this is set to a       * non-empty value, then it is automatically prepended to any roles read in       * from the db. This may for example be used to add the <code>ROLE_</code>       * prefix expected to exist in role names (by default) by some other Acegi       * Security framework classes, in the case that the prefix is not already       * present in the db.       *        * @param rolePrefix       *            the new prefix       */      public void setRolePrefix(String rolePrefix) {          this.rolePrefix = rolePrefix;      }        /**       * Init the permission list from db       *        */      protected void initMap() {          // return if we have got the latest permission list          if (definitionSource != null) {              return;          }            logger.debug("getting permissions from db");           if (PERL5_KEY.equals(getResourceExpression())) {               definitionSource = new RegExpBasedFilterInvocationDefinitionMap();          } else if (ANT_PATH_KEY.equals(getResourceExpression())) {              definitionSource = new PathBasedFilterInvocationDefinitionMap();          } else {              throw new IllegalArgumentException("wrong resourceExpression value");          }            definitionSource.setConvertUrlToLowercaseBeforeComparison(isConvertUrlToLowercaseBeforeComparison());            MappingSqlQuery permissionsMapping = new PermissionsMapping(                  getDataSource());          List<IResourceRole> resources = permissionsMapping.execute();            Map<String, String> map = new HashMap<String, String>();          for (int i = 0; i < resources.size(); i++) {              ConfigAttributeDefinition defn = new ConfigAttributeDefinition();                String resource = resources.get(i).getResource();              if (map.containsKey(resource)) {                  continue;              } else {                  map.put(resource, resource);              }                for (int j = i; j < resources.size(); j++) {                  IResourceRole resourceRole = resources.get(j);                  if (resource.equals(resourceRole.getResource())) {                      defn.addConfigAttribute(new SecurityConfig(resourceRole                              .getRole()));                      // logger.debug("added role: " + resourceRole.getRole());                  }              }                definitionSource.addSecureUrl(resources.get(i).getResource(), defn);              // logger.debug("added roles to :" +              // resources.get(i).getResource());          }      }        /**       * Query object to look up a user's authorities.       */      protected class PermissionsMapping extends MappingSqlQuery {          protected PermissionsMapping(DataSource ds) {              super(ds, permissionsQuery);              compile();          }            protected IResourceRole mapRow(ResultSet rs, int rownum)                  throws SQLException {              String resource = rs.getString(1);              String role = rolePrefix + rs.getString(2);              IResourceRole resourceRole = new ResourceRoleImpl(resource, role);                return resourceRole;          }      }        public ConfigAttributeDefinition getAttributes(Object object)              throws IllegalArgumentException {          initMap();            if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {              return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).getAttributes(object);          }else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {              return ((PathBasedFilterInvocationDefinitionMap) definitionSource).getAttributes(object);          }                    throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class                      + " or " + PathBasedFilterInvocationDefinitionMap.class);       }        public Iterator getConfigAttributeDefinitions() {          initMap();          if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {              return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).getConfigAttributeDefinitions();          }else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {              return ((PathBasedFilterInvocationDefinitionMap) definitionSource).getConfigAttributeDefinitions();          }                    throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class                      + " or " + PathBasedFilterInvocationDefinitionMap.class);       }        public boolean supports(Class clazz) {          initMap();                    if (definitionSource instanceof RegExpBasedFilterInvocationDefinitionMap) {              return ((RegExpBasedFilterInvocationDefinitionMap) definitionSource).supports(clazz);          }else if(definitionSource instanceof PathBasedFilterInvocationDefinitionMap) {              return ((PathBasedFilterInvocationDefinitionMap) definitionSource).supports(clazz);          }                    throw new IllegalStateException("wrong type of " + definitionSource + ", it should be " + RegExpBasedFilterInvocationDefinitionMap.class                  + " or " + PathBasedFilterInvocationDefinitionMap.class);       }              public String getResourceExpression() {          return resourceExpression;      }        public void setResourceExpression(String resourceExpression) {          this.resourceExpression = resourceExpression;      }        public boolean isConvertUrlToLowercaseBeforeComparison() {          return convertUrlToLowercaseBeforeComparison;      }        public void setConvertUrlToLowercaseBeforeComparison(              boolean convertUrlToLowercaseBeforeComparison) {          this.convertUrlToLowercaseBeforeComparison = convertUrlToLowercaseBeforeComparison;      }        }  

    <bean style="COLOR: #006080">"filterInvocationInterceptor"          class="org.acegisecurity.intercept.web.FilterSecurityInterceptor">          <property style="COLOR: #006080">"authenticationManager"              ref="authenticationManager" />          <property style="COLOR: #006080">"accessDecisionManager">              <bean class="org.acegisecurity.vote.AffirmativeBased">                  <property style="COLOR: #006080">"allowIfAllAbstainDecisions"                      value="false" />                  <property style="COLOR: #006080">"decisionVoters">                      <list>                          <bean class="org.acegisecurity.vote.RoleVoter" />                          <bean                              class="org.acegisecurity.vote.AuthenticatedVoter" />                      </list>                  </property>              </bean>          </property>                    <property style="COLOR: #006080">"objectDefinitionSource">              <ref bean="rolePermissionService"/>          </property>      </bean>        <bean style="COLOR: #006080">"rolePermissionService"          class="org.security.acegi.AcegiJdbcDefinitionSourceImpl">          <property style="COLOR: #006080">"dataSource">              <ref bean="dataSource" />          </property>          <property style="COLOR: #006080">"permissionsQuery">              <value>                  SELECT resource_name, role_name FROM resource_role rr, resource re, role ro                  WHERE rr.role_id = ro.role_id and rr.resource_id = re.resource_id              </value>          </property>          <property style="COLOR: #006080">"convertUrlToLowercaseBeforeComparison" value="false"></property>          <property style="COLOR: #006080">"resourceExpression" value="PATTERN_TYPE_APACHE_ANT"></property>      </bean>

package org.security;    import java.io.IOException;  import java.util.Iterator;  import java.util.LinkedHashMap;  import java.util.Map;  import java.util.Set;    import javax.servlet.FilterChain;  import javax.servlet.ServletException;  import javax.servlet.ServletRequest;  import javax.servlet.ServletResponse;    import org.acegisecurity.AccessDeniedException;  import org.acegisecurity.Authentication;  import org.acegisecurity.ConfigAttributeDefinition;  import org.acegisecurity.GrantedAuthority;  import org.acegisecurity.GrantedAuthorityImpl;  import org.acegisecurity.intercept.web.FilterInvocation;  import org.acegisecurity.intercept.web.FilterInvocationDefinitionSource;  import org.acegisecurity.intercept.web.FilterSecurityInterceptor;  import org.acegisecurity.providers.UsernamePasswordAuthenticationToken;  import org.springframework.beans.factory.annotation.Autowired;  import org.springframework.mock.web.MockHttpServletRequest;  import org.springframework.mock.web.MockHttpServletResponse;    import org.security.BaseSpringTestCase;  import org.security.IResourceRole;  import org.security.IUserDetails;  import org.security.ResourceRoleImpl;  import org.security.acegi.AcegiJdbcDaoImpl;    /**   *    * The class <code>AcegiPermissionTestCase</code> test acegi permission settings<br><br>   * $log$<br><br>   * @author $Author: wade $   * @version $Revision: 1.0 $   * @see   */  public class AcegiPermissionTestCase extends BaseSpringTestCase {      @Autowired      private FilterInvocationDefinitionSource objectDefinitionSource;            @Autowired      private AcegiJdbcDaoImpl userDetailsService;            @Autowired      private FilterSecurityInterceptor filterInvocationInterceptor;            /**       * Get Authentication Token by username       * @param username       * @return Authentication       */      protected Authentication getAuthentication(String username){          IUserDetails userDetail = userDetailsService.loadUserByUsername(username);          Authentication authenticated;          if(userDetail.isEnabled()){              authenticated = new UsernamePasswordAuthenticationToken(userDetail, username, userDetail.getAuthorities());          }else{  //            authenticated = new AnonymousAuthenticationToken(username, userDetail, userDetail.getAuthorities());              authenticated = new UsernamePasswordAuthenticationToken(null, null, new GrantedAuthority[]{new GrantedAuthorityImpl("ROLE_ANONYMOUS")});          }                    return authenticated;      }            /**       * get FilterInvocation from the url        * @param url       * @return FilterInvocation       */      protected FilterInvocation getRequestedResource(String url){          MockHttpServletRequest request = new MockHttpServletRequest();          request.setServletPath(url);                    MockHttpServletResponse response = new MockHttpServletResponse();          FilterChain filterchain = new FilterChain(){              public void doFilter(ServletRequest arg0, ServletResponse arg1)                      throws IOException, ServletException {                          }};                    FilterInvocation object = new FilterInvocation(request, response, filterchain);                    return object;      }            /**       * throws AccessDeniedException if no permission        * @param username       * @param uri       */      public void checkPermission(boolean shouldHasPermission, String username, String url){          Authentication authenticated = getAuthentication(username);          FilterInvocation object = getRequestedResource(url);                    ConfigAttributeDefinition attr = objectDefinitionSource.getAttributes(object);          boolean hasPermission = false;                    try{              filterInvocationInterceptor.getAccessDecisionManager().decide(authenticated, object, attr);              hasPermission = true;          }catch(AccessDeniedException e){              hasPermission = false;                      }                    if(hasPermission){              assertTrue(username + " shouldn't be able to access " + url, shouldHasPermission);              }else{              assertFalse(username + " should be able to access " + url, shouldHasPermission);              }      }              public void testPermissionForAdmin(){          Map<IResourceRole, Boolean> map = new LinkedHashMap<IResourceRole, Boolean>();                    map.put(new ResourceRoleImpl("/admin/index.jsp", "admin"    ), true);          map.put(new ResourceRoleImpl("/admin/index.jsp", "project"    ), false);          map.put(new ResourceRoleImpl("/admin/index.jsp", "dev"        ), false);          map.put(new ResourceRoleImpl("/admin/index.jsp", "disabled"    ), false);                    map.put(new ResourceRoleImpl("/admin", "admin"    ), true);          map.put(new ResourceRoleImpl("/admin", "project"), false);          map.put(new ResourceRoleImpl("/admin", "dev"    ), false);          map.put(new ResourceRoleImpl("/admin", "disabled"), false);                        map.put(new ResourceRoleImpl("/project/index.jsp", "admin"    ), true);          map.put(new ResourceRoleImpl("/project/index.jsp", "project"), true);          map.put(new ResourceRoleImpl("/project/index.jsp", "dev"    ), false);          map.put(new ResourceRoleImpl("/project/index.jsp", "disabled"), false);                    map.put(new ResourceRoleImpl("/project", "admin"    ), true);          map.put(new ResourceRoleImpl("/project", "project"    ), true);          map.put(new ResourceRoleImpl("/project", "dev"        ), false);          map.put(new ResourceRoleImpl("/project", "disabled"    ), false);                    map.put(new ResourceRoleImpl("/developer/index.jsp", "admin"    ), true);          map.put(new ResourceRoleImpl("/developer/index.jsp", "project"    ), true);          map.put(new ResourceRoleImpl("/developer/index.jsp", "dev"        ), true);          map.put(new ResourceRoleImpl("/developer/index.jsp", "disabled"    ), false);                    map.put(new ResourceRoleImpl("/developer", "admin"        ), true);          map.put(new ResourceRoleImpl("/developer", "project"    ), true);          map.put(new ResourceRoleImpl("/developer", "dev"        ), true);          map.put(new ResourceRoleImpl("/developer", "disabled"    ), false);                    map.put(new ResourceRoleImpl("/index.jsp", "admin"    ), true);          map.put(new ResourceRoleImpl("/index.jsp", "project"), true);          map.put(new ResourceRoleImpl("/index.jsp", "dev"    ), true);          map.put(new ResourceRoleImpl("/index.jsp", "disabled"), true);                            map.put(new ResourceRoleImpl("/acegilogin.jsp", "admin"    ), true);          map.put(new ResourceRoleImpl("/acegilogin.jsp", "project"    ), true);          map.put(new ResourceRoleImpl("/acegilogin.jsp", "dev"    ), true);          map.put(new ResourceRoleImpl("/acegilogin.jsp", "disabled"    ), true);                    Set<IResourceRole> keySet= map.keySet();          Iterator<IResourceRole> ita = keySet.iterator();          while(ita != null && ita.hasNext()){              IResourceRole resourceRole = ita.next();              boolean expectedPermission = map.get(resourceRole);                checkPermission(expectedPermission, resourceRole.getRole(), resourceRole.getResource());          }                  }  }  

public interface IPermissionListener {      public void updatePermission(Class eventSource);  }

package org.security.event;    import java.util.HashMap;  import java.util.Iterator;  import java.util.Map;    import org.apache.commons.logging.Log;  import org.apache.commons.logging.LogFactory;      /**   * The class PermissionEventPublisher provides a way to notify the IPermissionListener that the permission has been changed.   * @author wade   *   */  public class PermissionEventPublisher {      private static Log logger = LogFactory.getLog(PermissionEventPublisher.class);            private static Map<IPermissionListener, IPermissionListener> observerList =           new HashMap<IPermissionListener, IPermissionListener>();            /**       * Attach a listener for permission event       *        * @param subject       * @param listener       */      public static void attach(IPermissionListener listener){          observerList.put(listener, listener);                    if(logger.isDebugEnabled()){              logger.debug("Added listener: " + listener.getClass().getName());          }      }            /**       * Detatch from the event updater       * @param listener       */      public static void detatch(IPermissionListener listener){          observerList.remove(listener);                    if(logger.isDebugEnabled()){              logger.debug("Removeded listener: " + listener.getClass().getName());          }      }            /**       * send message to each listener.       * @param eventSource       */      public static void update(Class eventSource){          if(logger.isDebugEnabled()){              logger.debug("permission changed from "+eventSource.getName());          }                    Iterator<IPermissionListener> ita = observerList.keySet().iterator();          while(ita.hasNext()){              IPermissionListener permissionListener = ita.next();              permissionListener.updatePermission(eventSource);                            if(logger.isDebugEnabled()){                  logger.debug("call update for listener=" + permissionListener.getClass().getName());              }          }      }  }  

public class AcegiJdbcDefinitionSourceImpl extends JdbcDaoSupport implements          InitializingBean, FilterInvocationDefinitionSource, IPermissionListener {        public AcegiJdbcDefinitionSourceImpl() {          permissionsQuery = DEF_PERMISSIONS_QUERY;            //attach to event publisher, so the class can get the notify when permission changes          PermissionEventPublisher.attach(this);      }        /**       * Set definitionSource to null, so we can get a refreshed permission list from db       */      public void updatePermission(Class eventSource) {          definitionSource = null;      }  }

/**       * Get current user which stored in session       * You must set a user when using junit test       * @return IUserDetails       */      public static IUserDetails getUser(){          //if not in unit test environment, get the current user using acegi          if ((SecurityContextHolder.getContext() == null)                  || !(SecurityContextHolder.getContext() instanceof SecurityContext)                  || (((SecurityContext) SecurityContextHolder.getContext())                          .getAuthentication() == null)) {              return null;          }            Authentication auth = SecurityContextHolder.getContext().getAuthentication();          if (auth.getPrincipal() == null) {              return null;          }                    IUserDetails user = null;          if (auth.getPrincipal() instanceof IUserDetails) {              user = (IUserDetails)auth.getPrincipal();           }                    return user;      }      

public class AuthorizedTag extends ConditionalTagSupport {      protected Log logger = LogFactory.getLog(this.getClass());            @Autowired      private FilterInvocationDefinitionSource objectDefinitionSource;            @Autowired          private FilterSecurityInterceptor filterInvocationInterceptor;            private String url;            /**       * Get Authentication Token from  IUserDetails object       * @param user       * @return Authentication       */      protected Authentication getAuthentication(IUserDetails user){          IUserDetails userDetail = user;          Authentication authenticated;            if(userDetail == null){              authenticated = new UsernamePasswordAuthenticationToken(null, null, new GrantedAuthority[]{new GrantedAuthorityImpl("ROLE_ANONYMOUS")});                      }else{              if(userDetail.isEnabled()){                  authenticated = new UsernamePasswordAuthenticationToken(userDetail, userDetail.getUsername(), userDetail.getAuthorities());              }else{                  authenticated = new AnonymousAuthenticationToken(userDetail.getUsername(), userDetail, userDetail.getAuthorities());              }          }                    return authenticated;      }                /**       * get FilterInvocation from the url        * @param url       * @return FilterInvocation       */      protected FilterInvocation getRequestedResource(String url){          MockHttpServletRequest request = new MockHttpServletRequest(pageContext.getServletContext());          request.setServletPath(url);                    FilterChain filterchain = new FilterChain(){              public void doFilter(ServletRequest arg0, ServletResponse arg1)                      throws IOException, ServletException {                          }};                    FilterInvocation object = new FilterInvocation(request, pageContext.getResponse(), filterchain);                    return object;      }            @Override      protected boolean condition() throws JspTagException {          boolean result = false;                    IUserDetails user = CurrentUser.getUser();                    ServletContext servletContext = pageContext.getServletContext();                  WebApplicationContext wac = WebApplicationContextUtils.getRequiredWebApplicationContext(servletContext);          wac.getAutowireCapableBeanFactory().autowireBeanProperties(this, AutowireCapableBeanFactory.AUTOWIRE_BY_TYPE, false);                    ConfigAttributeDefinition attr = objectDefinitionSource.getAttributes(getRequestedResource(url));                  try{              filterInvocationInterceptor.getAccessDecisionManager().decide(getAuthentication(user), url, attr);              result = true;          }catch(AccessDeniedException e){              result = false;              if(user == null){                  logger.debug("anonymous has no permission on :" + url);              }else{                  logger.debug(user.getUsername() + " has no permission on :" + url);              }          }                    return result;      }        public String getUrl() {          return url;      }        public void setUrl(String url) {          this.url = url;      }    }

<auth:ifAuthrized url="/admin">  <p><a href="admin">Admin page</a></p>  </auth:ifAuthrized>