public int vote(Authentication authentication, Object object, Collection<ConfigAttribute> attributes) { 
  int result = ACCESS_ABSTAIN; 
  Collection<? extends GrantedAuthority> authorities = extractAuthorities(authentication); 
  for (ConfigAttribute attribute : attributes) { 
    if (this.supports(attribute)) { 
      result = ACCESS_DENIED; 
      // Attempt to find a matching granted authority 
      for (GrantedAuthority authority : authorities) { 
        if (attribute.getAttribute().equals(authority.getAuthority())) { 
          return ACCESS_GRANTED; 
        } 
      } 
    } 
  } 
  return result; 
} 
Collection<? extends GrantedAuthority> extractAuthorities(Authentication authentication) { 
  return authentication.getAuthorities(); 
} 

public class DefaultAccessDecisionManager extends AbstractAccessDecisionManager { 
  public void decide( Authentication authentication, Object object,  
      Collection<ConfigAttribute> configAttributes)  
    throws AccessDeniedException, InsufficientAuthenticationException{ 
    SysUser user = (SysUser)authentication.getPrincipal(); 
    logger.info("访问资源的用户为"+user.getUsername()); 
    //如果访问资源不需要任何权限则直接通过 
    if( configAttributes == null ) { 
      return ; 
    } 
    Iterator<ConfigAttribute> ite = configAttributes.iterator(); 
    //遍历configAttributes看用户是否有访问资源的权限 
    while( ite.hasNext()){ 
      ConfigAttribute ca = ite.next(); 
      String needRole = ((SecurityConfig)ca).getAttribute(); 
      //ga 为用户所被赋予的权限。 needRole 为访问相应的资源应该具有的权限。 
      for( GrantedAuthority ga: authentication.getAuthorities()){ 
        if(needRole.trim().equals(ga.getAuthority().trim())){ 
          return; 
        } 
      } 
    } 
    throw new AccessDeniedException(""); 
  } 
} 

<bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"> 
  <property name="rolePrefix" value="AUTH_"></property> 
</bean> 

<sec:http auto-config="true" access-decision-manager-ref="accessDecisionManager"> 
  <sec:access-denied-handler ref="accessDeniedHandler"/> 
  <sec:session-management invalid-session-url="/login.jsp" /> 
  <sec:intercept-url pattern="/app.jsp" access="AUTH_GG_FBGBGG"/> 
  <sec:intercept-url pattern="/**" access="IS_AUTHENTICATED_FULLY" /> 
  <sec:form-login login-page="/login.jsp" authentication-failure-url="/login.jsp" 
    default-target-url="/index.jsp"/> 
</sec:http> 
<bean id="accessDecisionManager" class="org.springframework.security.access.vote.AffirmativeBased"> 
  <constructor-arg name="decisionVoters"> 
    <list> 
      <ref bean="roleVoter"/> 
      <ref bean="authenticatedVoter"/> 
    </list> 
  </constructor-arg> 
  <property name="messageSource" ref="messageSource"></property> 
</bean> 
<bean id="roleVoter" class="org.springframework.security.access.vote.RoleVoter"> 
  <property name="rolePrefix" value=""></property> 
</bean> 
<bean id="authenticatedVoter" class="org.springframework.security.access.vote.AuthenticatedVoter" />