最近开始学习Shiro,记录一下Shiro整合SSM的步骤,期间也碰到许多小问题,和大家分享一下。
开发工具:IDEA
Demo框架:Spring+SpringMVC+Mybatis+Maven
1.添加Shiro相关jar包,Demo是使用Maven管理,在pom.xml添加以下配置。
<properties>
<shiro.version>1.3.2</shiro.version>
</properties>
<dependencies>
<!--Shiro-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>${shiro.version}</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>${shiro.version}</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>${shiro.version}</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-ehcache</artifactId>
<version>${shiro.version}</version>
</dependency>
</dependencies>
2.在web.xml添加Shiro过滤器,需要注意filter-name必须和之后applicationContext中配置保持一致!!!
<!--Shiro过滤器-->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
3.在Spring配置文件中添加Shiro相关配置
<!--Shiro配置-->
<!--
1.配置SecurityManager
-->
<bean class="org.apache.shiro.web.mgt.DefaultWebSecurityManager" id="securityManager">
<property name="authenticator" ref="authenticator"/>
<property name="realms">
<list>
<ref bean="md5Realm" />
<ref bean="sha1Realm" />
</list>
</property>
</bean>
<!--
2.配置realm
2.1) 使用实现了org.apache.shiro.realm.Realm接口的realm
-->
<bean class="org.apache.shiro.authc.pam.ModularRealmAuthenticator" id="authenticator">
<property name="realms">
<list>
<ref bean="md5Realm" />
<ref bean="sha1Realm" />
</list>
</property>
</bean>
<bean class="com.dream.shiro.MD5Realm" id="md5Realm">
<property name="credentialsMatcher">
<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
<property name="hashAlgorithmName" value="MD5"/>
<property name="hashIterations" value="1024"/>
</bean>
</property>
</bean>
<bean class="com.dream.shiro.SHA1Realm" id="sha1Realm">
<property name="credentialsMatcher">
<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
<property name="hashAlgorithmName" value="SHA1"/>
<property name="hashIterations" value="1024"/>
</bean>
</property>
</bean>
<!--
3.配置shiro过滤器
3.1) id必须和web.xml中配置的shiroFilter filterName一致.
-->
<bean class="org.apache.shiro.spring.web.ShiroFilterFactoryBean" id="shiroFilter">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login.jsp"/>
<property name="successUrl" value="/index.jsp"/>
<property name="unauthorizedUrl" value="/error.jsp"/>
<!--
配置需要受保护的页面
以及访问这些页面需要的权限
1) anon可以匿名访问的页面
2) authc 必须认证(登录)后才可以访问的页面
-->
<property name="filterChainDefinitions">
<value>
<!--加载静态资源-->
/asset/** = anon
/login.jsp = anon
/login = anon
/logout = logout
<!--除以上配置外,其他请求全部必须认证-->
/** = authc
</value>
</property>
</bean>
3.在Spring IOC容器中开启Shiro注解,注解一般在Controller中,所以我们要在SpringMVC的配置文件中添加开启注解的配置。
<!--Shiro配置-->
<!--
1.配置lifecycleBeanPostProcessor,可以在Spring IOC容器中调用shiro的生命周期方法.
-->
<bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor" id="lifecycleBeanPostProcessor" />
<!--
2.启用Spring IOC容器Shiro注解,但必须配置了lifecycleBeanPostProcessor后才可以使用
-->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />
<!--
3.开启Spring AOC Shiro注解支持
-->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
至此,启动Tomcat没有报错就整合完成啦。