2.1 Spring Security是什么？

HTTP BASIC authentication headers (an IETF RFC-based standard)

HTTP Digest authentication headers (an IETF RFC-based standard)

HTTP X.509 client certificate exchange (an IETF RFC-based standard)

LDAP (a very common approach to cross-platform authentication needs, especially in large environments)

Form-based authentication (for simple user interface needs)

OpenID authentication

Authentication based on pre-established request headers (such as Computer Associates Siteminder)

JA-SIG Central Authentication Service (otherwise known as CAS, which is a popular open source single sign-on system)

Transparent authentication context propagation for Remote Method Invocation (RMI) and HttpInvoker (a Spring remoting protocol)

Automatic "remember-me" authentication (so you can tick a box to avoid re-authentication for a predetermined period of time)

Anonymous authentication (allowing every unauthenticated call to automatically assume a particular security identity)

Run-as authentication (which is useful if one call should proceed with a different security identity)

Java Authentication and Authorization Service (JAAS)

JEE container autentication (so you can still use Container Managed Authentication if desired)

Kerberos

Java Open Source Single Sign On (JOSSO) *

OpenNMS Network Management Platform *

AppFuse *

AndroMDA *

Mule ESB *

Direct Web Request (DWR) *

Grails *

Tapestry *

JTrac *

Jasypt *

Roller *

Elastic Path *

Atlassian Crowd *

Your own authentication systems (see below)