SpringSecurity定义多个过滤器链的操作代码

要定义多个过滤器链，需要使用Spring Security提供的WebSecurityConfigurerAdapter类，该类可以用于配置Spring Security的安全性过滤器链。

以下是定义多个过滤器链的完整攻略：

1. 创建一个类继承WebSecurityConfigurerAdapter类，并覆盖configure(HttpSecurity http)方法。例如：

```java
@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http.authorizeRequests()
               .antMatchers("/admin/**").hasRole("ADMIN")
               .antMatchers("/**").permitAll()
               .and().formLogin().loginPage("/login")
               .and().logout().logoutUrl("/logout").permitAll();
   }

}
```

在上面的例子中，我们定义了一个SecurityConfig类，它继承了WebSecurityConfigurerAdapter类。在这个类中，我们覆盖了configure(HttpSecurity http)方法来定义一些安全配置。具体来说，我们定义了两个安全过滤器链：
* /admin/**路径下的请求必须具有ROLE_ADMIN角色才能访问。
* 其他请求都允许访问，并设置了表单登录和退出登录功能。

注意，这里只定义了一个过滤器链。

1. 创建一个新的配置类，它也必须继承WebSecurityConfigurerAdapter类，并覆盖configure(HttpSecurity http)方法。例如：

```java
@Configuration
@Order(1)
public class ApiSecurityConfig extends WebSecurityConfigurerAdapter {

   @Override
   protected void configure(HttpSecurity http) throws Exception {
       http.antMatcher("/api/**")
               .authorizeRequests().anyRequest().hasRole("API")
               .and().httpBasic().disable();
   }

}
```

在上面的例子中，我们定义了另一个配置类ApiSecurityConfig，它继承了WebSecurityConfigurerAdapter类，并使用@Order(1)注解指定了它的优先级。另外，我们使用了.antMatcher("/api/**")来匹配以/api/开头的路径，并且设置只有拥有ROLE_API角色的用户才能访问。

1. 将定义好的配置类注册到Spring容器中。例如：

```java
@SpringBootApplication
public class DemoApplication {

   public static void main(String[] args) {
       SpringApplication.run(DemoApplication.class, args);
   }

   @Configuration
   @EnableWebSecurity
   public static class MultiHttpSecurityConfig {

       @Autowired
       private ApiSecurityConfig apiSecurityConfig;

       @Autowired
       private SecurityConfig securityConfig;

       @Bean(name = "apiSecurityFilter")
       public FilterSecurityInterceptor apiSecurityFilter() throws Exception {
           FilterSecurityInterceptor interceptor = new FilterSecurityInterceptor();
           interceptor.setAuthenticationManager(authenticationManager());
           interceptor.setSecurityMetadataSource(securityMetadataSource());
           interceptor.setAccessDecisionManager(accessDecisionManager());
           return interceptor;
       }

       @Bean(name = "securityFilter")
       public FilterSecurityInterceptor securityFilter() throws Exception {
           FilterSecurityInterceptor interceptor = new FilterSecurityInterceptor();
           interceptor.setAuthenticationManager(authenticationManager());
           interceptor.setSecurityMetadataSource(securityMetadataSource());
           interceptor.setAccessDecisionManager(accessDecisionManager());
           return interceptor;
       }

       @Bean
       public FilterRegistrationBean<FilterSecurityInterceptor> apiSecurityFilterRegistration(
               @Qualifier("apiSecurityFilter") FilterSecurityInterceptor filter) {
           FilterRegistrationBean<FilterSecurityInterceptor> registration = new FilterRegistrationBean<>(filter);
           registration.setOrder(1);
           registration.addUrlPatterns("/api/*");
           return registration;
       }

       @Bean
       public FilterRegistrationBean<FilterSecurityInterceptor> securityFilterRegistration(
               @Qualifier("securityFilter") FilterSecurityInterceptor filter) {
           FilterRegistrationBean<FilterSecurityInterceptor> registration = new FilterRegistrationBean<>(filter);
           registration.setOrder(2);
           registration.addUrlPatterns("/*");
           return registration;
       }

       @Bean
       public DefaultWebSecurityExpressionHandler securityExpressionHandler() {
           return new DefaultWebSecurityExpressionHandler();
       }

       @Bean
       public FilterInvocationSecurityMetadataSource securityMetadataSource() {
           return new DefaultFilterInvocationSecurityMetadataSource(
                   new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>() {{
                       put(new AntPathRequestMatcher("/admin/**"), SecurityConfig.createList("ROLE_ADMIN"));
                       put(new AntPathRequestMatcher("/api/**"), SecurityConfig.createList("ROLE_API"));
                       put(new AntPathRequestMatcher("/**"), SecurityConfig.createList("IS_AUTHENTICATED_ANONYMOUSLY"));
                   }});
       }

       @Bean
       public AccessDecisionManager accessDecisionManager() {
           return new AffirmativeBased(Collections.singletonList(new RoleVoter()));
       }

   }

}
```

在上面的例子中，我们在Spring Boot的主类DemoApplication中创建了一个静态内部类MultiHttpSecurityConfig。在该类中，我们获取之前定义好的两个配置类，并创建了两个过滤器实例。然后，我们将这两个实例通过FilterRegistrationBean注册到Spring容器中，并分别为它们指定了不同的URL模式和执行顺序。接着，我们定义了一些辅助类和方法，包括DefaultWebSecurityExpressionHandler、DefaultFilterInvocationSecurityMetadataSource、AccessDecisionManager等。最后，我们使用注解@EnableWebSecurity启用了Spring Security功能。

注意，我们还使用了@Order注解来指定ApiSecurityConfig类的执行顺序为1，而SecurityConfig类的执行顺序则默认为2。

这样，我们就定义了两个不同的过滤器链，一个处理所有路径，另一个只处理/api/路径下的请求。

下面是另一个示例，假设我们要定义一个过滤器链，只有满足特定条件的请求才会被认证：

@Configuration
@EnableWebSecurity
public class MultiHttpSecurityConfig {

    @Autowired
    private SpecialConditionFilter specialConditionFilter;

    @Bean(name = "specialConditionFilter")
    public FilterSecurityInterceptor specialConditionFilter() throws Exception {
        FilterSecurityInterceptor interceptor = new FilterSecurityInterceptor();
        interceptor.setAuthenticationManager(authenticationManager());
        interceptor.setSecurityMetadataSource(securityMetadataSource());
        interceptor.setAccessDecisionManager(accessDecisionManager());
        return interceptor;
    }

    @Bean
    public FilterRegistrationBean<FilterSecurityInterceptor> specialConditionFilterRegistration(
            @Qualifier("specialConditionFilter") FilterSecurityInterceptor filter) {
        FilterRegistrationBean<FilterSecurityInterceptor> registration = new FilterRegistrationBean<>(filter);
        registration.setOrder(1);
        registration.addUrlPatterns("/*");
        return registration;
    }

    @Bean
    public DefaultWebSecurityExpressionHandler securityExpressionHandler() {
        return new DefaultWebSecurityExpressionHandler();
    }

    @Bean
    public FilterInvocationSecurityMetadataSource securityMetadataSource() {
        return new DefaultFilterInvocationSecurityMetadataSource(
                new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>() {{
                    put(new AntPathRequestMatcher("/admin/**"), SecurityConfig.createList("ROLE_ADMIN"));
                    put(new AntPathRequestMatcher("/**"), SecurityConfig.createList("IS_AUTHENTICATED_ANONYMOUSLY"));
                }});
    }

    @Bean
    public AccessDecisionManager accessDecisionManager() {
        return new AffirmativeBased(Collections.singletonList(new RoleVoter()));
    }

    @Bean
    public SpecialCondition specialCondition() {
        return new SpecialCondition();
    }

    @Bean
    public SpecialConditionEvaluationContextExtension specialConditionExtension() {
        return new SpecialConditionEvaluationContextExtension();
    }

    public static class SpecialConditionFilter extends AbstractAuthenticationProcessingFilter {

        protected SpecialConditionFilter() {
            super(new AntPathRequestMatcher("/*"));
        }

        @Override
        public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
                throws AuthenticationException, IOException, ServletException {
            SpecialCondition specialCondition = findSpecialCondition(request);
            if (specialCondition != null && specialCondition.getValue() == 123) {
                return getAuthenticationManager().authenticate(new UsernamePasswordAuthenticationToken(
                        specialCondition, null, Collections.singletonList(new SimpleGrantedAuthority("SPECIAL"))));
            } else {
                return getAuthenticationManager().authenticate(new UsernamePasswordAuthenticationToken(
                        null, null, Collections.singletonList(new SimpleGrantedAuthority("ANONYMOUS"))));
            }
        }

        private SpecialCondition findSpecialCondition(HttpServletRequest request) {
            // ...
        }

    }

    public static class SpecialConditionEvaluationContextExtension implements EvaluationContextExtension {

        @Override
        public String getExtensionId() {
            return "specialCondition";
        }

        @Override
        public ExtensionPropertyAccessors getPropertyAccessors() {
            return new ExtensionPropertyAccessors() {

                @Override
                public boolean canRead(EvaluationContext context, Object target, String name)
                        throws AccessException {
                    if (target instanceof SpecialCondition && "value".equals(name)) {
                        return true;
                    }
                    return false;
                }

                @Override
                public TypedValue read(EvaluationContext context, Object target, String name) throws AccessException {
                    if (target instanceof SpecialCondition && "value".equals(name)) {
                        return new TypedValue(((SpecialCondition) target).getValue());
                    }
                    throw new NoSuchPropertyException(target.getClass(), name);
                }

                @Override
                public boolean canWrite(EvaluationContext context, Object target, String name)
                        throws AccessException {
                    return false;
                }

                @Override
                public void write(EvaluationContext context, Object target, String name, Object newValue)
                        throws AccessException {
                    throw new NoSuchPropertyException(target.getClass(), name);
                }

            };
        }

    }

    public static class SpecialCondition {

        public int getValue() {
            return 123;
        }

    }

}

在这个示例中，我们创建了一个名为SpecialCondition的Java类，它只有一个名为value的int类型属性，表示特定条件。然后，我们创建了一个SpecialConditionFilter类，它是AbstractAuthenticationProcessingFilter类的子类，用于处理所有路径。在这个过滤器中，我们查找请求中是否符合特定条件，并根据结果来选择不同的认证方式。最后，我们通过SpecialConditionEvaluationContextExtension扩展了表达式语言的功能，使其能够访问到SpecialCondition类中的value属性。此外，我们还定义了一些Spring Bean，并将它们注册到Spring容器中。

这就是定义多个过滤器链的完整攻略，其中包含两个不同的示例。这些示例有助于理解如何在Spring Security中定义和配置多个过滤器链。