shiro与spring整合

1.依赖包准备
利用maven整合，在pom中维护shiro的依赖包:

<properties>
    <shiro.version>1.2.3</shiro.version>
</properties>
<!--核心包-->
<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${shiro.version}</version>
</dependency>
<!--与spring整合包-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--单点登录依赖包-->      
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-cas</artifactId>
    <version>${shiro.version}</version>
    <exclusions>
        <exclusion>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
        </exclusion>
    </exclusions>
</dependency>
<!--WEB相关包-->   
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--缓存包-->  
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>${shiro.version}</version>
</dependency>

2.登录过滤器配置—-web.xml
设置targetFilterLifecycle为true 使spring管理init(),以管理其生命周期。

<!-- Apache Shiro -->
<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>

<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

3.ShiroFilterFactoryBean配置，作为filter的引用bean。其id值要与filter的name名一致。

<!-- 安全认证过滤器 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager" />
    <!-- loginUrl认证提交地址，如果没有认证将会请求此地址进行认证，请求此地址将由formAuthenticationFilter进行表单认证 -->
    <property name="loginUrl" value="${adminPath}/login" />
    <property name="successUrl" value="${adminPath}?login" />
    <!-- 通过unauthorizedUrl指定没有权限操作时跳转页面-->
        <!-- <property name="unauthorizedUrl" value="/test.jsp" /> -->
    <!--自定义过滤器-->
    <property name="filters">
          <map>
              <entry key="cas" value-ref="casFilter"/>
              <entry key="authc" value-ref="formAuthenticationFilter"/>
          </map>
     </property>
    <property name="filterChainDefinitions">
        <ref bean="shiroFilterChainDefinitions"/>
    </property>
</bean>

（1）上面自定义的authc权限认证器，需要new 一个class formAuthenticationFilter， 继承FormAuthenticationFilter。用来实现自己的表单验证权限认证。

（2）对上面的securityManager配置如下：

<!-- 定义Shiro安全管理配置 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- 自定义登录验证数据源realm -->
        <property name="realm" ref="systemAuthorizingRealm" />
        <property name="sessionManager" ref="sessionManager" />
        <property name="cacheManager" ref="shiroCacheManager" />
</bean>

其中自定义的realm验证，需要写一个class systemAuthorizingRealm继承AuthorizingRealm，以实现自定义realm源获取问题。可查询自己的数据库来验证用户名密码。

<bean id="sessionManager" class="com.thinkgem.jeesite.common.security.shiro.session.SessionManager"> 
        <property name="sessionDAO" ref="sessionDAO"/>
        <!-- 会话超时时间，单位：毫秒  -->
        <property name="globalSessionTimeout" value="${session.sessionTimeout}"/>
        <!-- 定时清理失效会话, 清理用户直接关闭浏览器造成的孤立会话   -->
        <property name="sessionValidationInterval" value="${session.sessionTimeoutClean}"/>
<!--        <property name="sessionValidationSchedulerEnabled" value="false"/> -->
        <property name="sessionValidationSchedulerEnabled" value="true"/>
        <property name="sessionIdCookie" ref="sessionIdCookie"/>
        <property name="sessionIdCookieEnabled" value="true"/>
</bean>

<bean id="sessionDAO" class="com.thinkgem.jeesite.common.security.shiro.session.CacheSessionDAO">
        <property name="sessionIdGenerator" ref="idGen" />
        <property name="activeSessionsCacheName" value="activeSessionsCache" />
        <property name="cacheManager" ref="shiroCacheManager" />
</bean>

<bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg name="name" value="jeesite.session.id"/>
</bean>

cachemanager配置：

<bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManager" ref="cacheManager"/>
</bean>

4.配置shiro过滤权限

<!-- Shiro权限过滤过滤器定义 -->
    <bean name="shiroFilterChainDefinitions" class="java.lang.String">
        <constructor-arg>
            <value>
                /static/** = anon
                /userfiles/** = anon
                ${adminPath}/cas = cas
                ${adminPath}/login = authc
                ${adminPath}/edu/eduOfflineTrainingSignup/findRankInfo = anon
                ${adminPath}/edu/eduOfflineTrainingSignup/findRankOfficeInfo = anon
                ${adminPath}/logout = logout
                ${adminPath}/** = user
                /act/editor/** = user
                /ReportServer/** = user
            </value>
        </constructor-arg>
    </bean>