异常信息：
在使用SpringSecurity3.0.4时出现如下异常，
2010-12-02 10:23:07.890:INFO:/info_platform:Initializing Spring root WebApplicationContext
Hibernate: select resource0_.id as id12_0_, authority2_.id as id1_1_, resource0_.position as position12_0_, resource0_.resource_type as resource3_12_0_, resource0_.value as value12_0_, authority2_.name as name1_1_, authorityl1_.resource_id as resource1_12_0__, authorityl1_.permission_id as permission2_0__ from resource resource0_ left outer join permission_resource authorityl1_ on resource0_.id=authorityl1_.resource_id left outer join permissions authority2_ on authorityl1_.permission_id=authority2_.id where resource0_.resource_type=? order by resource0_.position ASC, authority2_.id asc
[orm:10:23:13] ERROR [main] ContextLoader.initWebApplicationContext(220) | Context initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChainProxy': Cannot resolve reference to bean 'filterSecurityInterceptor' while setting bean property 'filterChainMap' with key [/**] with key [9]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterSecurityInterceptor' defined in file [E:\workshop\eclipse_jee\info_platform\target\classes\applicationContext-security.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: An AuthenticationManager is required

Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterSecurityInterceptor' defined in file [E:\workshop\eclipse_jee\info_platform\target\classes\applicationContext-security.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: An AuthenticationManager is required

Caused by: java.lang.IllegalArgumentException: An AuthenticationManager is required

2010-12-02 10:23:13.765:WARN::Failed startup of context org.mortbay.jetty.plugin.Jetty6PluginWebAppContext@10f3a9c{/info_platform,E:\workshop\eclipse_jee\info_platform\src\main\webapp}
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChainProxy': Cannot resolve reference to bean 'filterSecurityInterceptor' while setting bean property 'filterChainMap' with key [/**] with key [9]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterSecurityInterceptor' defined in file [E:\workshop\eclipse_jee\info_platform\target\classes\applicationContext-security.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: An AuthenticationManager is required

2010-12-02 10:23:13.765:WARN::Nested in org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.security.filterChainProxy': Cannot resolve reference to bean 'filterSecurityInterceptor' while setting bean property 'filterChainMap' with key [/**] with key [9]; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'filterSecurityInterceptor' defined in file [E:\workshop\eclipse_jee\info_platform\target\classes\applicationContext-security.xml]: Invocation of init method failed; nested exception is java.lang.IllegalArgumentException: An AuthenticationManager is required:
java.lang.IllegalArgumentException: An AuthenticationManager is required
    at org.springframework.util.Assert.notNull(Assert.java:112)
    at org.springframework.security.access.intercept.AbstractSecurityInterceptor.afterPropertiesSet(AbstractSecurityInterceptor.java:118)

原因：
看异常信息可知是缺少AuthenticationManager，也就是在创建filterSecurityInterceptor这个bean时缺少AuthenticationManager！

解决办法：
在filterSecurityInterceptor这个过滤器bean的定义处加上缺少的AuthenticationManager即可！
修正前的在SpringSecurity3的配置文件applicationContext-security.xml中的片段如下：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:s="http://www.springframework.org/schema/security"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsdhttp://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"default-lazy-init="true"><description>SpringSecurity安全配置</description><!-- http安全配置 --><s:http auto-config="true" use-expressions="true"><!-- 对登录页面不进行拦截，至于后面的*，是因为请求的页面可能包含一些参数！ --><s:intercept-url pattern="/login.jsp*" filters="none"/><s:intercept-url pattern="/static/**" filters="none"/><s:intercept-url pattern="/decorators/**" filters="none"/><s:intercept-url pattern="/uploads/**" filters="none"/><s:intercept-url pattern="/common/**" filters="none"/><!-- 配置登录页面！设置always-use-default-target成"true"，用户登录后总是会转发到default-target-url指定的位置，无论他们在登录页面之前访问的什么位置。 解决使用局部刷新功能的环境下，用户在Login之后应该自动跳到Login之前访问的安全资源导致的页面只显示局部的问题！--><s:form-login login-page="/login" default-target-url="/index.jsp" authentication-failure-url="/login?error=true" always-use-default-target="true"/><s:logout logout-success-url="/index.jsp"/><!-- 注意：在SS3.0.x中，自定义的filter的配置要放在s:http里 --><s:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/><s:custom-filter ref="reAuthenticationFilter" before="FORM_LOGIN_FILTER"/><!-- TODO 自定义的未授权访问拒绝的处理器 --><s:access-denied-handler ref="accessDeniedHandler"/></s:http><!--<s:http auto-config="true" access-decision-manager-ref="accessDecisionManager"><s:form-login login-page="/logreg.action" default-target-url="/"authentication-failure-url="/logreg.action?error=true" /><s:logout logout-success-url="/" /><s:remember-me key="e37f4b31-0c45-11dd-bd0b-0800200c9a66" /></s:http>--><bean id="reAuthenticationFilter" class="com.leeoo.common.web.access.filter.ReAuthenticationFilter"><property name="userDetailsService" ref="userDetailsService" /></bean><bean id="accessDeniedHandler" class="com.leeoo.common.security.AccessDenied4AjaxHandlerImpl"><property name="accessDeniedUrl" value="/common/403.jsp"/></bean><!-- 认证配置，使用userDetailsService提供的用户信息 --><s:authentication-manager alias="authenticationManager"><s:authentication-provider user-service-ref="userDetailsService"><!-- 可设置hash使用sha1或md5散列密码后再存入数据库，默认是不加密的纯文本明文，默认的加密方式请参考BasePasswordEncoder类--><s:password-encoder hash="md5"><!-- 将每个用户的username作为盐值（加密种子） --><s:salt-source user-property="username"/></s:password-encoder></s:authentication-provider></s:authentication-manager><!-- 项目实现的用户查询服务 --><bean id="userDetailsService" class="com.leeoo.info_platform.account.service.UserDetailsServiceImpl" /><!--JCaptcha验证码服务<bean id="captchaService" class="com.octo.captcha.service.image.DefaultManageableImageCaptchaService"><property name="captchaEngine"><bean class="com.zenithen.skynet.skynet.security.jcaptcha.GMailEngine" /></property>默认生成的图片180秒过期 , 可另行设置<property name="minGuarantedStorageDelayInSeconds" value="180" /></bean> --><!-- 重新定义的FilterSecurityInterceptor,使用databaseDefinitionSource提供的url-授权关系定义 --><!-- <bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> SpringSecurity2.0.x中使用 --><bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"><!--<s:custom-filter before="FILTER_SECURITY_INTERCEPTOR" /><s:custom-filter ref="databaseDefinitionSource" before="FILTER_SECURITY_INTERCEPTOR"/>--><property name="accessDecisionManager" ref="accessDecisionManager" /><property name="securityMetadataSource" ref="databaseDefinitionSource" /><!-- <property name="objectDefinitionSource" ref="databaseDefinitionSource" /> 注：objectDefinitionSource在SS3中已经标记为过时了，要换用securityMetadataSource --></bean><!-- DefinitionSource工厂,使用resourceDetailsService提供的URL-授权关系. --><!--<bean id="databaseDefinitionSource" class="com.leeoo.info_platform.service.account.DefinitionSourceFactoryBean"><property name="resourceDetailsService" ref="resourceDetailsService" /></bean>--><bean id="databaseDefinitionSource" class="com.leeoo.info_platform.common.web.access.intercept.MyFilterInvocationSecurityMetadataSource"><constructor-arg index="0"><bean class="org.springframework.security.web.util.AntUrlPathMatcher"/></constructor-arg><constructor-arg index="1" ref="resourceDetailsService"/></bean><!-- 项目实现的URL-授权查询服务 --><bean id="resourceDetailsService" class="com.leeoo.info_platform.account.service.ResourceDetailsServiceImpl" /><!-- 授权判断配置, 将授权名称的默认前缀由ROLE_改为A_. --><!-- <bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased"> SpringSecurity2.0.x中使用 --><bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"><property name="decisionVoters"><list><!-- <bean class="org.springframework.security.vote.RoleVoter"> SpringSecurity2.0.x中使用 --><bean class="org.springframework.security.access.vote.RoleVoter"><property name="rolePrefix" value="A_"/></bean><!-- <bean class="org.springframework.security.vote.AuthenticatedVoter" /> SpringSecurity2.0.x中使用 --><bean class="org.springframework.security.access.vote.AuthenticatedVoter" /></list></property></bean>
</beans>

修正后的在SpringSecurity3的配置文件applicationContext-security.xml中的片段如下：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:s="http://www.springframework.org/schema/security"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsdhttp://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.0.xsd"default-lazy-init="true"><description>SpringSecurity安全配置</description><!-- http安全配置 --><s:http auto-config="true" use-expressions="true"><!-- 对登录页面不进行拦截，至于后面的*，是因为请求的页面可能包含一些参数！ --><s:intercept-url pattern="/login.jsp*" filters="none"/><s:intercept-url pattern="/static/**" filters="none"/><s:intercept-url pattern="/decorators/**" filters="none"/><s:intercept-url pattern="/uploads/**" filters="none"/><s:intercept-url pattern="/common/**" filters="none"/><!-- 配置登录页面！设置always-use-default-target成"true"，用户登录后总是会转发到default-target-url指定的位置，无论他们在登录页面之前访问的什么位置。 解决使用局部刷新功能的环境下，用户在Login之后应该自动跳到Login之前访问的安全资源导致的页面只显示局部的问题！--><s:form-login login-page="/login" default-target-url="/index.jsp" authentication-failure-url="/login?error=true" always-use-default-target="true"/><s:logout logout-success-url="/index.jsp"/><!-- 注意：在SS3.0.x中，自定义的filter的配置要放在s:http里 --><s:custom-filter ref="filterSecurityInterceptor" before="FILTER_SECURITY_INTERCEPTOR"/><s:custom-filter ref="reAuthenticationFilter" before="FORM_LOGIN_FILTER"/><!-- TODO 自定义的未授权访问拒绝的处理器 --><s:access-denied-handler ref="accessDeniedHandler"/></s:http><!--<s:http auto-config="true" access-decision-manager-ref="accessDecisionManager"><s:form-login login-page="/logreg.action" default-target-url="/"authentication-failure-url="/logreg.action?error=true" /><s:logout logout-success-url="/" /><s:remember-me key="e37f4b31-0c45-11dd-bd0b-0800200c9a66" /></s:http>--><bean id="reAuthenticationFilter" class="com.leeoo.info_platform.common.web.access.filter.ReAuthenticationFilter"><property name="userDetailsService" ref="userDetailsService" /></bean><bean id="accessDeniedHandler" class="com.leeoo.common.security.AccessDenied4AjaxHandlerImpl"><property name="accessDeniedUrl" value="/common/403.jsp"/></bean><!-- 认证配置，使用userDetailsService提供的用户信息 --><s:authentication-manager alias="authenticationManager"><s:authentication-provider user-service-ref="userDetailsService"><!-- 可设置hash使用sha1或md5散列密码后再存入数据库，默认是不加密的纯文本明文，默认的加密方式请参考BasePasswordEncoder类--><s:password-encoder hash="md5"><!-- 将每个用户的username作为盐值（加密种子） --><s:salt-source user-property="username"/></s:password-encoder></s:authentication-provider></s:authentication-manager><!-- 项目实现的用户查询服务 --><bean id="userDetailsService" class="com.leeoo.info_platform.account.service.UserDetailsServiceImpl" /><!--JCaptcha验证码服务<bean id="captchaService" class="com.octo.captcha.service.image.DefaultManageableImageCaptchaService"><property name="captchaEngine"><bean class="com.zenithen.skynet.skynet.security.jcaptcha.GMailEngine" /></property>默认生成的图片180秒过期 , 可另行设置<property name="minGuarantedStorageDelayInSeconds" value="180" /></bean> --><!-- 重新定义的FilterSecurityInterceptor,使用databaseDefinitionSource提供的url-授权关系定义 --><!-- <bean id="filterSecurityInterceptor" class="org.springframework.security.intercept.web.FilterSecurityInterceptor"> SpringSecurity2.0.x中使用 --><bean id="filterSecurityInterceptor" class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"><!--<s:custom-filter before="FILTER_SECURITY_INTERCEPTOR" /><s:custom-filter ref="databaseDefinitionSource" before="FILTER_SECURITY_INTERCEPTOR"/>--><property name="authenticationManager" ref="authenticationManager" /><property name="accessDecisionManager" ref="accessDecisionManager" /><property name="securityMetadataSource" ref="databaseDefinitionSource" /><!-- <property name="objectDefinitionSource" ref="databaseDefinitionSource" /> 注：objectDefinitionSource在SS3中已经标记为过时了，要换用securityMetadataSource --></bean><!-- DefinitionSource工厂,使用resourceDetailsService提供的URL-授权关系. --><!--<bean id="databaseDefinitionSource" class="com.leeoo.info_platform.service.account.DefinitionSourceFactoryBean"><property name="resourceDetailsService" ref="resourceDetailsService" /></bean>--><bean id="databaseDefinitionSource" class="com.leeoo.info_platform.common.web.access.intercept.MyFilterInvocationSecurityMetadataSource"><constructor-arg index="0"><bean class="org.springframework.security.web.util.AntUrlPathMatcher"/></constructor-arg><constructor-arg index="1" ref="resourceDetailsService"/></bean><!-- 项目实现的URL-授权查询服务 --><bean id="resourceDetailsService" class="com.leeoo.info_platform.account.service.ResourceDetailsServiceImpl" /><!-- 授权判断配置, 将授权名称的默认前缀由ROLE_改为A_. --><!-- <bean id="accessDecisionManager" class="org.springframework.security.vote.AffirmativeBased"> SpringSecurity2.0.x中使用 --><bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"><property name="decisionVoters"><list><!-- <bean class="org.springframework.security.vote.RoleVoter"> SpringSecurity2.0.x中使用 --><bean class="org.springframework.security.access.vote.RoleVoter"><property name="rolePrefix" value="A_"/></bean><!-- <bean class="org.springframework.security.vote.AuthenticatedVoter" /> SpringSecurity2.0.x中使用 --><bean class="org.springframework.security.access.vote.AuthenticatedVoter" /></list></property></bean>
</beans>