//这段是原有的，
            final List<Authentication> chainedAuthenticationsList = serviceTicket.getGrantingTicket().getChainedAuthentications();
            final Authentication authentication = chainedAuthenticationsList.get(chainedAuthenticationsList.size() - 1);
            final Principal principal = authentication.getPrincipal();
            
            //下面这些是我加的：
            //取得用户名
            String username = principal.getId();
            
            //截取网址前半段，如http://www.a.com:8080/UserManage/xxx/bbb只截取到UserManage
            String url = service.toString();
            int index = url.indexOf("/", url.indexOf("/", 8)+1);
            String myUrl = url.substring(0, index+1);
            
            // 看是否有权限
             String sql = "SELECT count(*) as myCount from sub_system s inner join user_system us on s.id = us.system_id inner join user u on us.user_id = u.id where us.enable=1 and u.username = '" + username + "' and s.system_url like '" + myUrl + "%'";
             List xx = getJdbcTemplate().queryForList(sql);
            long count = (Long)((Map) xx.get(0)).get("myCount");
            if(count==0){
                throw new TicketValidationException(serviceTicket.getService());
            }

    <bean id="centralAuthenticationService" class="org.jasig.cas.CentralAuthenticationServiceImpl"
          p:ticketGrantingTicketExpirationPolicy-ref="grantingTicketExpirationPolicy"
          p:serviceTicketExpirationPolicy-ref="serviceTicketExpirationPolicy"
          p:authenticationManager-ref="authenticationManager"
          p:ticketGrantingTicketUniqueTicketIdGenerator-ref="ticketGrantingTicketUniqueIdGenerator"
          p:ticketRegistry-ref="ticketRegistry"
          p:servicesManager-ref="servicesManager"
          p:persistentIdGenerator-ref="persistentIdGenerator"
          p:uniqueTicketIdGeneratorsForService-ref="uniqueIdGeneratorsMap"
          p:dataSource-ref="dataSource"/>

catch (final TicketValidationException e) {
                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                log.warn(e, e);

                onFailedValidation(request, response);

                if (this.exceptionOnValidationFailure) {
                    throw new ServletException(e);
                }

                return;
            }catch (final RuntimeException e) {
                //client去server端验证，server端抛异常，会导致client端返回ioException。
                response.setStatus(HttpServletResponse.SC_FORBIDDEN);
                log.warn(e, e);

                onFailedValidation(request, response);

                if (this.exceptionOnValidationFailure) {
                    //throw new ServletException(e);
                    //跳转到login页面了。
                    response.sendRedirect(casServerUrlPrefix + "login");
                }

                return;
            }

        //取cas login地址
        //http://10.0.103.135:8080/cas/
        casServerUrlPrefix = getPropertyFromInitParams(filterConfig, "casServerUrlPrefix", null);