首先原版的shiro简单配置,之前有发过
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:webflow="http://www.springframework.org/schema/webflow-config"
xmlns:p="http://www.springframework.org/schema/p"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:c="http://www.springframework.org/schema/c"
xmlns:util="http://www.springframework.org/schema/util"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/webflow-config http://www.springframework.org/schema/webflow-config/spring-webflow-config-2.3.xsd">
<!-- 加载shiro-cas的 .properties 文件 -->
<context:property-placeholder location="classpath:shiro.properties" ignore-unresolvable="true"/>
<!-- shiro普通realm -->
<bean id="myRealm" class="com.hky.utils.shiro.MyRealm"></bean>
<!-- securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="rememberMeManager">
<bean class="org.apache.shiro.web.mgt.CookieRememberMeManager">
<property name="cookie">
<bean class="org.apache.shiro.web.servlet.SimpleCookie">
<constructor-arg name="name" value="RememberMe" />
<property name="maxAge" value="604800" />
</bean>
</property>
</bean>
</property>
<!-- <property name="realm" ref="iniRealm" /> -->
<property name="realm" ref="myRealm" />
</bean>
<!-- shiroFilter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/login/index.shtml" />
<property name="successUrl" value="/home/index.shtml" />
<!-- 未登录用户url -->
<property name="unauthorizedUrl" value="/login/index.shtml" />
<property name="filters">
<map>
<!--退出过滤器-->
<entry key="logout" value-ref="systemLogoutFilter" />
</map>
</property>
<property name="filterChainDefinitions">
<value>
<!-- anon表示此地址不需要任何权限即可访问 -->
/login/** = anon
<!-- 登出过滤器 -->
/user/logout**=logout
<!--所有的请求(除去配置的静态资源请求或请求地址为anon的请求)都要通过登录验证,如果未登录则跳到/login-->
/** = authc
<!-- /static/**=anon -->
<!-- perms[user:query]表示访问此连接需要权限为user:query的用户 -->
<!-- /user=perms[user:query] -->
<!-- roles[manager]表示访问此连接需要用户的角色为manager -->
<!-- /user/add=roles[manager] -->
<!-- /user/del/**=roles[admin] -->
<!-- /user/edit/**=roles[manager] -->
<!-- -->
</value>
</property>
</bean>
<!-- 自定义登出过滤,对应地址/user/logout**=logout -->
<bean id="systemLogoutFilter" class="com.hky.utils.shiro.SystemLogoutFilter"></bean>
<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
</beans>
这里还缺点什么—-缓存
缓存用redis实现,进行整合的步骤:
1.首先在securityManager中加入缓存cacheManager
<!-- Shiro默认会使用Servlet容器的Session,可通过sessionMode属性来指定使用Shiro原生Session -->
<!-- 这里主要是设置自定义的单Realm应用,若有多个Realm,可使用'realms'属性代替 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="myRealm" />
<!-- sessionManager -->
<property name="sessionManager" ref="sessionManager" />
<property name="rememberMeManager" ref="rememberMeManager"/>
<!-- cacheManager -->
<property name="cacheManager" ref="cacheManager" />
</bean>
<!-- cacheManager -->
<bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager">
<property name="redisManager" ref="redisManager" />
</bean>
org.crazycake.shiro.RedisCacheManager类是jar包中类,是别人写好的。可以通过maven引入:
(当然,如果觉得他写的不好可以拓展他的类,也可以全部自己写,那么脑子有包。。。其实,可以继承他的类,然后再去加入自己的东西!要不工作量有点大的)
<dependency>
<groupId>org.crazycake</groupId>
<artifactId>shiro-redis</artifactId>
<version>2.4.2.1-RELEASE</version>
</dependency>
改变redisManager,根据jar包的参数,加入进去:
<!-- shiro redisManager -->
<bean id="redisManager" class="com.shiro.utils.RedisManagerEx">
<property name="jedisPool" ref="jedisPool"/>
<!--
<property name="host" value="127.0.0.1"/>
<property name="port" value="6379"/>
<property name="expire" value="1800"/>
optional properties:
<property name="timeout" value="10000"/>
<property name="password" value="123456"/>
-->
</bean>
其中的RedisManagerEx就是根据jar包参数拓展出来的类,把原来配置的jedisPool注入进去,这样就好了。
package com.shiro.utils;
import org.crazycake.shiro.RedisManager;
import redis.clients.jedis.JedisPool;
/**
* redisManager扩展类;
* 加入自己管理的jedisPool.
* @author mac
*
*/
public class RedisManagerEx extends RedisManager{
private static JedisPool jedisPool;
public static JedisPool getJedisPool() {
return jedisPool;
}
public static void setJedisPool(JedisPool jedisPool) {
RedisManagerEx.jedisPool = jedisPool;
}
}
接下来:配置上面写到的
<!-- sessionManager -->
<property name="sessionManager" ref="sessionManager" />
<property name="rememberMeManager" ref="rememberMeManager"/>
<!-- sessionManager -->
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="globalSessionTimeout" value="2592000"/>
<property name="sessionDAO" ref="redisSessionDAO" />
<!-- 是否删除无效的,默认也是开启 -->
<property name="deleteInvalidSessions" value="true" />
<!-- 会话Cookie模板 -->
<property name="sessionIdCookie" ref="sessionIdCookie" />
</bean>
<!-- redisSessionDAO -->
<bean id="redisSessionDAO" class="org.crazycake.shiro.RedisSessionDAO">
<property name="redisManager" ref="redisManager" />
</bean>
<!-- 会话Cookie模板 -->
<bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
<!--cookie的name,我故意取名叫xxxxbaidu -->
<constructor-arg value="v_v-mbd"/>
<property name="httpOnly" value="true"/>
<!--cookie的有效时间主要的 -->
<property name="maxAge" value="2592000"/>
</bean>
<!-- rememberMe管理器 -->
<bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
<!-- rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度(128 256 512 位)-->
<property name="cipherKey"
value="#{T(org.apache.shiro.codec.Base64).decode('3AvVhmFLUs0KTA3Kprsdag==')}"/>
<property name="cookie" ref="rememberMeCookie"/>
</bean>
<!-- 用户信息记住我功能的相关配置 -->
<bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
<constructor-arg value="hankeyan"/>
<property name="httpOnly" value="true"/>
<!-- 配置存储rememberMe Cookie的domain为 一级域名
<property name="domain" value=".game.net"/>
-->
<property name="maxAge" value="2592000"/><!-- 30天时间,记住我30天 -->
</bean>
好了, 可以了, 去领盒饭吧!