shiro配置----spring.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">


    <!-- =========================================================
         Shiro Core Components - Not Spring Specific
         ========================================================= -->
    <!-- Shiro's main business-tier object for web-enabled applications
         (use DefaultSecurityManager instead when there is no web environment)-->
    <!-- 
    开始配置SecurityManager
    1、缓存管理器
    2、realm：用来访问安全数据
    -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="cacheManager" ref="cacheManager"/>
        <property name="realm" ref="myRealm"/>
    </bean>


    <!-- 缓存管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/> 
    </bean>


    <bean id="myRealm" class="com.atguigu.shiro.realm.MyRealm">
    <property name="credentialsMatcher">
    <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    <!-- 指定好加密算法 -->
    <property name="hashAlgorithmName" value="MD5" />
    <!-- 指定好加密的次数 -->
    <property name="hashIterations" value="1024" />
    </bean>
    </property>
    </bean>


    <!-- =========================================================
         Shiro Spring-specific integration
         ========================================================= -->
    <!-- Post processor that automatically invokes init() and destroy() methods
         for Spring-configured Shiro objects so you don't have to
         1) specify an init-method and destroy-method attributes for every bean
            definition and
         2) even know which Shiro objects require these methods to be
            called. -->
    <!-- 使用LifecycleBeanPostProcessor 来管理shiro的bean的生命周期 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>


    <!-- Enable Shiro Annotations for Spring-configured beans.  Only run after
         the lifecycleBeanProcessor has run: -->
    <!-- 开启shiro的注解
    注意：只有在配置了lifecycleBeanProcessor以后才生效
     -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>


    <!-- Define the Shiro Filter here (as a FactoryBean) instead of directly in web.xml -
         web.xml uses the DelegatingFilterProxy to access this bean.  This allows us
         to wire things with more control as well utilize nice Spring things such as
         PropertiesPlaceholderConfigurer and abstract beans or anything else we might need: -->
    <!-- shiroFilter采用的是org.apache.shiro.spring.web.ShiroFilterFactoryBean
    filterChainDefinitions：用来配置资源和权限的关系
    ① anon：不进行校验
    ② authc：进行验证
     -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <!-- 引用上面定义的securityManager -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 定义登录的页面 -->
        <property name="loginUrl" value="/login.jsp"/>
        <!-- 未授权的页面 -->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
        <property name="filterChainDefinitions">

            <value>

<!-- /资源 =  过滤器名 -->   

            /doLogout = logout

<!-- /资源 =  过滤器名[ 权限名 1，权限名2，.....] --> 

            /user.jsp = roles[user]
            /admin.jsp = roles[admin]
            /doLogin = anon
                # everything requires authentication:
                /** = authc
            </value>
        </property>
    </bean>
</beans>