@Bean:在配置类上打个一个 @Configuration 注解,表示声明该类为 Spring 的配置类。在创建一个方法,方法返回对象即我们要创建的对象 Person , 返回该对象的实例。在方法上打上注解 @Bean即表示声明该方法返回的实例是受 Spring 管理的 Bean。
用ShiroFilterFactoryBean 来创建拦截器
用LinkedHashMap添加拦截的uri,其中authc指定需要认证的uri,anon指定排除认证的uri
System.setSecurityManager(new SecurityManager());//编码方式启动
开启shiro注解:配置以下两个bean(DefaultAdvisorAutoProxyCreator(可选)和AuthorizationAttributeSourceAdvisor)
SHpackage com.dahaiwuliang.code.shiro.config;
import com.dahaiwuliang.code.shiro.realm.MyRealm;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.mgt.SecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import java.util.LinkedHashMap;
import java.util.Map;
/**
* Shiro配置类
*
* Filter Chaind定义说明
* 1、一个URL可以配置多个Filter,使用逗号分割
* 2、当设置多个过滤器时,全部验证通过,才视为通过
* 3、部分过滤器可以指定参数,如perms,roles
*/
@Configuration
public class ShiroConfig {
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
//必须设置securityManager
shiroFilterFactoryBean.setSecurityManager(securityManager);
//如果不设置,默认会自动寻找Web工程根目录下的"login.jsp"页面
shiroFilterFactoryBean.setLoginUrl("/");
//拦截器
Map<String,String> filterChainDefinitionMap = new LinkedHashMap<>();
//过滤链定义,从上往下执行,一般将/**放在最下面 这是个坑,一不小心代码就不好使了
// authc:所有的url必须认证通过才可以访问 anon:所有url都可以匿名访问
//配置不会被拦截的链接 顺序判断
filterChainDefinitionMap.put("/","anon");
filterChainDefinitionMap.put("/static/**","anon");
filterChainDefinitionMap.put("/ueditor/**","anon");
filterChainDefinitionMap.put("/upload/**","anon");
filterChainDefinitionMap.put("/user/register.html","anon");
filterChainDefinitionMap.put("/user/login.html","anon");
filterChainDefinitionMap.put("/user/findPassword.html","anon");
filterChainDefinitionMap.put("/user/register","anon");
filterChainDefinitionMap.put("/user/login","anon");
filterChainDefinitionMap.put("/user/sendEmail","anon");
filterChainDefinitionMap.put("/user/checkYzm","anon");
filterChainDefinitionMap.put("/user/bindEmail","anon");
filterChainDefinitionMap.put("/QQ/qqLogin","anon");
filterChainDefinitionMap.put("/article/**","anon");
filterChainDefinitionMap.put("/comment/**","anon");
filterChainDefinitionMap.put("/connect","anon");
filterChainDefinitionMap.put("/buyVIP","anon");
filterChainDefinitionMap.put("/fbzyzjf","anon");
filterChainDefinitionMap.put("/admin/login.html","anon");
filterChainDefinitionMap.put("/user/bindEmail.html","anon");
//配置退出过滤器,其中的具体的退出代码Shiro已经帮我们实现了
filterChainDefinitionMap.put("/user/logout","logout");
filterChainDefinitionMap.put("/**","authc");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
}
@Bean
public SecurityManager securityManager(){
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
//设置realm
securityManager.setRealm(myRealm());
return securityManager;
}
/**
* 身份认证realm
* @return
*/
@Bean
public MyRealm myRealm(){
MyRealm myRealm = new MyRealm();
return myRealm;
}
/**
* Shiro生命周期处理器
*/
@Bean
public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
return new LifecycleBeanPostProcessor();
}
/**
* 开启Shrio的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
* 配置以下两个Bean即可实现这个功能
*/
@Bean
@DependsOn("lifecycleBeanPostProcessor")
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
advisorAutoProxyCreator.setProxyTargetClass(true);
return advisorAutoProxyCreator;
}
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
return authorizationAttributeSourceAdvisor;
}
}