shiro权限框架配置详解

1、加入shiro相关依赖的jar包

pom.xml部分内容如下：

 1 <dependency>
 2     <groupId>org.apache.shiro</groupId>
 3     <artifactId>shiro-spring</artifactId>
 4     <version>1.3.2</version>
 5 </dependency>
 6 <dependency>
 7     <groupId>org.apache.shiro</groupId>
 8     <artifactId>shiro-core</artifactId>
 9     <version>1.3.2</version>
10 </dependency>

 

2、配置web.xml文件

 1 <!DOCTYPE web-app PUBLIC
 2  "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
 3  "http://java.sun.com/dtd/web-app_2_3.dtd" >
 4 
 5 <web-app>
 6     <display-name>spring.shiro</display-name>
 7     <context-param>
 8         <param-name>contextConfigLocation</param-name>
 9         <param-value>classpath:applicationContext.xml</param-value>
10     </context-param>
11     <!-- 防止中文乱码过滤器配置 -->
12     <filter>
13         <filter-name>springFilter</filter-name>
14         <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
15         <init-param>
16             <param-name>encoding</param-name>
17             <param-value>utf-8</param-value>
18         </init-param>
19     </filter>
20     <!-- 配置shiro filter过滤器，被定义在classpath:applicationContext.xml文件里 
21         DelegatingFilterProxy实际上是Filter的代理对象，默认情况下，spring会到IOC容器中查找和<filter-name>对应的filter bean，
22         也可以通过targetBeanName的初始化参数来配置filter bean的id。
23     -->
24     <filter>
25         <filter-name>shiroFilter</filter-name>
26         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
27         <init-param>
28             <param-name>targetFilterLifecycle</param-name>
29             <param-value>true</param-value>
30         </init-param>
31     </filter>
32 
33     <filter-mapping>
34         <filter-name>springFilter</filter-name>
35         <url-pattern>/*</url-pattern>
36     </filter-mapping>
37 
38 
39     <filter-mapping>
40         <filter-name>shiroFilter</filter-name>
41         <url-pattern>/*</url-pattern>
42     </filter-mapping>
43     <!-- 配置自动加载 classpath:applicationContext.xml-->
44     <listener>
45         <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
46     </listener>
47     <servlet>
48         <servlet-name>springShiro</servlet-name>
49         <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
50         <!-- 配置springmvc -->
51         <init-param>
52             <param-name>contextConfigLocation</param-name>
53             <param-value>classpath:springmvc.xml</param-value>
54         </init-param>
55         <load-on-startup>1</load-on-startup>
56     </servlet>
57     <servlet-mapping>
58         <servlet-name>springShiro</servlet-name>
59         <url-pattern>*.do</url-pattern>
60     </servlet-mapping>
61 
62     <welcome-file-list>
63         <welcome-file>login.jsp</welcome-file>
64     </welcome-file-list>
65 </web-app>

 

3、配置applicationContext.xml

1)、配置securityManager，也就是shiro的核心。

2)、配置cacheManager(缓存管理)

3)、配置Realm，自己定义的shiroRealm，必须实现org.apache.shiro.realm.Realm这个接口

4)、配置lifecycleBeanPostProcessor，可以自动的来调用配置在spring IOC 容器中shiro bean的生命周期方法 

5)、配置可以使用shiro注解，但必须在配置 lifecycleBeanPostProcessor才可以使用

6)、配置shiroFilter

整个配置文件如下：

 1 <?xml version="1.0" encoding="UTF-8"?>
 2 <beans xmlns="http://www.springframework.org/schema/beans"
 3     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
 4     xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context"
 5     xmlns:tx="http://www.springframework.org/schema/tx" xmlns:util="http://www.springframework.org/schema/util"
 6     xsi:schemaLocation="
 7         http://www.springframework.org/schema/beans 
 8         http://www.springframework.org/schema/beans/spring-beans.xsd
 9         http://www.springframework.org/schema/util
10         http://www.springframework.org/schema/util/spring-util.xsd
11         http://www.springframework.org/schema/aop 
12         http://www.springframework.org/schema/aop/spring-aop.xsd
13         http://www.springframework.org/schema/context
14         http://www.springframework.org/schema/context/spring-context.xsd
15         http://www.springframework.org/schema/tx
16         http://www.springframework.org/schema/tx/spring-tx.xsd
17         http://www.springframework.org/schema/p
18         http://www.springframework.org/schema/p/spring-p.xsd
19         ">
20     <!-- 
21     1. 配置securityManager，也就是shiro的核心。
22      -->
23     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
24         <property name="realm" ref="myRealm" />
25         <!-- 缓存管理器 -->
26         <property name="cacheManager" ref="cacheManager" />
27     </bean>
28     <!-- 
29     2. 配置cacheManager(缓存管理)
30      -->
31     <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager">
32     </bean>
33     <!-- 
34     3. 配置Realm，自己定义的shiroRealm，必须实现org.apache.shiro.realm.Realm这个接口
35      -->
36     <bean id="myRealm" class="maven.spring.shiro.realms.ShiroRealm"></bean>
37     <!-- 
38     4.配置lifecycleBeanPostProcessor， 可以自动的来调用配置在spring IOC 容器中shiro bean的生命周期方法 -->
39     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
40     <!-- 
41     5.启用IOC容器中使用shiro的注解，但必须在配置 lifecycleBeanPostProcessor才可以使用-->
42     <bean
43         class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
44         depends-on="lifecycleBeanPostProcessor" />
45     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
46         <property name="securityManager" ref="securityManager"/>
47     </bean>
48     <!-- 
49     6. 配置shiroFilter
50     6.1 id必须和web.xml 文件中配置的DelegatingFilterProxy的filter-name一致
51      -->
52     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
53         <property name="securityManager" ref="securityManager" />
54         <property name="loginUrl" value="/login.jsp" />
55         <property name="successUrl" value="/user/list.do" />
56         <property name="unauthorizedUrl" value="/login.jsp" />
57         <!-- 配置哪些页面需要受保护
58             以及访问这些页面需要的权限
59             anon可以被匿名访问，或者说游客可以访问
60             authc 必须认证之后才能访问，即登录后才能访问的页面
61          -->
62         <property name="filterChainDefinitions">
63             <value>
64                 /login = anon
65                 /index = anon
66                 /** = authc
67             </value>
68         </property>
69 
70     </bean>
71 
72     <context:component-scan base-package="maven.spring.shiro">
73         <context:exclude-filter type="annotation"
74             expression="org.springframework.stereotype.Controller" />
75     </context:component-scan>
76 </beans> 

3、配置springmvc文件

 1 <?xml version="1.0" encoding="UTF-8"?>
 2 <beans xmlns="http://www.springframework.org/schema/beans"
 3     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
 4     xmlns:context="http://www.springframework.org/schema/context" xmlns:tx="http://www.springframework.org/schema/tx"
 5     xmlns:mvc="http://www.springframework.org/schema/mvc"
 6     xsi:schemaLocation="
 7         http://www.springframework.org/schema/mvc 
 8         http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd  
 9         http://www.springframework.org/schema/tx
10         http://www.springframework.org/schema/tx/spring-tx.xsd
11         http://www.springframework.org/schema/mvc
12         http://www.springframework.org/schema/beans/spring-mvc.xsd
13         http://www.springframework.org/schema/beans
14         http://www.springframework.org/schema/beans/spring-beans.xsd
15         http://www.springframework.org/schema/context
16         http://www.springframework.org/schema/context/spring-context.xsd">
17 
18     <!-- 配置渲染器 -->
19 
20     <bean id="jspViewResolver"
21         class="org.springframework.web.servlet.view.InternalResourceViewResolver">
22         <property name="viewClass"
23             value="org.springframework.web.servlet.view.JstlView" />
24         <property name="prefix" value="/WEB-INF/jsp/" />
25         <property name="suffix" value=".jsp" />
26     </bean>
27     <mvc:default-servlet-handler />
28     <mvc:annotation-driven />
29     <context:component-scan
30         base-package="maven.spring.shiro.web.controller"></context:component-scan>
31 </beans>

这样，整个配置文件就配置完成了。