spring security中自定义authenticationProcessingFilter

http://hszdz.iteye.com/blog/337652

<http entry-point-ref="authenticationProcessingFilterEntryPoint">
		<intercept-url pattern="/admin/**" access="ROLE_ADMIN"/>
		<intercept-url pattern="/user/**" access="ROLE_USER,ROLE_ADMIN"/>
	</http>
	<authentication-provider user-service-ref="securityManager"/>
	<beans:bean id="authenticationProcessingFilter" class="haotian.haocms.security.CustomAuthenticationProcessingFilter">
		<custom-filter position="AUTHENTICATION_PROCESSING_FILTER"/>
		<beans:property name="authenticationManager" ref="authenticationManager"/>
		<beans:property name="defaultTargetUrl" value="/user/userList.action"/>
	</beans:bean>
	<authentication-manager alias="authenticationManager"/>
	<beans:bean id="authenticationProcessingFilterEntryPoint" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilterEntryPoint">
		<beans:property name="loginFormUrl" value="/loginPage.action"/>
		<beans:property name="forceHttps" value="false"/>
	</beans:bean>

public Authentication attemptAuthentication(   
            HttpServletRequest httpServletRequest)   
            throws AuthenticationException {   
        String check_code = httpServletRequest.getParameter("j_checkcode");   
        String sys_code = (String) httpServletRequest.getSession()   
                .getAttribute(checkCodeName);   
  
        if (sys_code == null) {   
            throw new AuthCodeValidationException("验证码不正确");   
        } else if (!sys_code.equals(check_code)) {   
            String username = obtainUsername(httpServletRequest);   
            httpServletRequest.getSession().setAttribute(   
                    SPRING_SECURITY_LAST_USERNAME_KEY, username);   
            // 用户输入的值与看到的不一致,抛出异常   
            throw new AuthCodeValidationException("验证码输入不正确");   
        }   
        return super.attemptAuthentication(httpServletRequest);   
    }