Index: ssts-web/src/main/resources/spring/security/applicationContext-acegi-security.xml
===================================================================
diff -u -r20599 -r22333
--- ssts-web/src/main/resources/spring/security/applicationContext-acegi-security.xml	(.../applicationContext-acegi-security.xml)	(revision 20599)
+++ ssts-web/src/main/resources/spring/security/applicationContext-acegi-security.xml	(.../applicationContext-acegi-security.xml)	(revision 22333)
@@ -6,41 +6,27 @@
 	http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
 	http://www.springframework.org/schema/security
 	http://www.springframework.org/schema/security/spring-security-3.2.xsd">
-	<!-- 标准配置文件 -->
+	<!-- 广东省人民医院配置文件 -->
 	<debug />
     
+    <!-- 具有2个authentication provider，第一个验证不通过则使用第二个进行验证 -->
     <authentication-manager alias="authenticationManager" >
         <authentication-provider user-service-ref="daoUserDetail">
         	<password-encoder hash="md5" />
     	</authentication-provider>
     </authentication-manager>
     
-	<!-- enable use-expressions -->
-	<!--http auto-config="true" use-expressions="true">
-		<intercept-url pattern="/admin**" access="hasRole('ROLE_ADMIN')" /-->
-
-		<!-- access denied page -->
-		<!--access-denied-handler error-page="/403" /-->
-		<!-- form-login 
-		    login-page="/logon22.jsp" 
-		    default-target-url="/openSystemMainPage.jsp"
-			authentication-failure-url="/logon.jsp?login_error=1" 
-			username-parameter="username"
-			password-parameter="password" /-->
-		<!--logout logout-success-url="/login?logout" /-->
-		<!--csrf /-->
-	<!--/http-->    
+    <authentication-manager id="a2" alias="authenticationManagerForGdsy" >
+    	<authentication-provider ref="preAuthenticationProvider" />
+    </authentication-manager>
     
     <http auto-config="true"  use-expressions="true">
 			<intercept-url pattern="/login" access="permitAll"></intercept-url>
 			<intercept-url pattern="/logout" access="permitAll"></intercept-url>
 			<intercept-url pattern="/accessdenied" access="permitAll"></intercept-url>
 			<intercept-url pattern="/logon.jsp" access="permitAll"></intercept-url>
-			<intercept-url pattern="/logonSSOForGyey.jsp" access="permitAll"></intercept-url>
-			<intercept-url pattern="/logonSSOForCszxyy.jsp" access="permitAll"></intercept-url>
 			<intercept-url pattern="/debug/**" access="permitAll"></intercept-url>
 			<intercept-url pattern="/buttjoint/**" access="permitAll"></intercept-url>
-			<intercept-url pattern="/disinfectsystem/qualitymonitoringWithNoLogon/**" access="permitAll"></intercept-url>
 			<intercept-url pattern="/disinfectsystem/config/**" access="permitAll"></intercept-url>
 			<intercept-url pattern="/disinfectsystem/common/**" access="permitAll"></intercept-url>
 			<intercept-url pattern="/disinfectSystem/fileUploadServlet/**" access="permitAll"></intercept-url>
@@ -73,21 +59,23 @@
 				<concurrency-control max-sessions="1000" error-if-maximum-exceeded="false"
 					session-registry-alias="sessionRegistry" />
 			</session-management>
+			<custom-filter position="PRE_AUTH_FILTER" ref="preAuthFilter" />
 	</http>
- 
+
+	<beans:bean id="preAuthFilter"
+		class="com.forgon.disinfectsystem.security.filter.RequestHeaderAuthenticationFilter">
+		<beans:property name="authenticationManager" ref="authenticationManagerForGdsy" />
+	</beans:bean>
+
+	<beans:bean id="preAuthenticationProvider"
+		class="org.springframework.security.web.authentication.preauth.PreAuthenticatedAuthenticationProvider">
+		<beans:property name="preAuthenticatedUserDetailsService"
+			ref="preAuthUserDetailsService" />
+	</beans:bean>
+
     <beans:bean id="loggerListener"
         class="org.springframework.security.access.event.LoggerListener" />
     
-<!--     <beans:bean id="daoUserDetail" -->
-<!--         class="com.forgon.disinfectsystem.security.userdetails.DaoUserDetailSSTSImpl" > -->
-<!--         <beans:property name="userManager" ref="userManager" /> -->
-<!--         <beans:property name="sysUserManager" ref="sysUserManager" /> -->
-<!--         <beans:property name="directoryHelper" ref="directoryHelper" /> -->
-<!--         <beans:property name="roleManager" ref="roleManager" /> -->
-<!--         <beans:property name ="supplyRoomConfigManager" ref="supplyRoomConfigManager" /> -->
-<!--         <beans:property name ="orgUnitManager" ref="orgUnitManager" /> -->
-<!--     </beans:bean> -->
-
     <beans:bean id="logoutFilter"
     	class="org.springframework.security.web.authentication.logout.LogoutFilter">
     	<!-- 退出后指向的 URL -->
@@ -101,13 +89,5 @@
     	</beans:constructor-arg>
     </beans:bean>
 
-    <!-- 
-    <beans:bean id="jdbcUserDetailsManager"
-        class="org.springframework.security.userdetails.jdbc.JdbcUserDetailsManager">
-        <beans:property name="dataSource"
-            ref="dataSource" />
-    </beans:bean>
-     -->
-
     <beans:bean id="sessionRegistry" class="org.springframework.security.core.session.SessionRegistryImpl"/>
 </beans:beans>
\ No newline at end of file