Shiro之集成Spring技术（二）

Web环境下使用Shiro

与Spring + SpringMVC集成

在web环境下使用shiro的话，一般都是与spring+springmvc集成

1、新建一个动态web项目（Shiro2）

2、加入Spring的Jar包（SSM整合中的spring文件夹下）

com.springsource.net.sf.cglib-2.2.0.jar
com.springsource.org.aopalliance-1.0.0.jar
com.springsource.org.aspectj.weaver-1.6.8.RELEASE.jar
commons-logging-1.2.jar
spring-aop-4.0.0.RELEASE.jar
spring-aspects-4.0.0.RELEASE.jar
spring-beans-4.0.0.RELEASE.jar
spring-context-4.0.0.RELEASE.jar
spring-core-4.0.0.RELEASE.jar
spring-expression-4.0.0.RELEASE.jar
spring-jdbc-4.0.0.RELEASE.jar
spring-orm-4.0.0.RELEASE.jar
spring-test-4.0.0.RELEASE.jar
spring-tx-4.0.0.RELEASE.jar

导入Spring mvc的jar包：

spring-web-4.0.0.RELEASE.jar
spring-webmvc-4.0.0.RELEASE.jar

3、配置Spring（在web.xml文件下）

    <context-param>
		<param-name>contextConfigLocation</param-name>
		<param-value>classpath:spring/applicationContext.xml</param-value>
	</context-param>
	<listener>
		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
	</listener>

4、新建一个源码文件夹（config），新建一个包spring，新建一个spring bean configuration.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">
	<!-- Spring不扫描Controller扫描其他所有.不需要禁用默认规则 -->
	<context:component-scan base-package="com.example">
		<context:exclude-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>

</beans>

5、配置Spring mvc（在web.xml文件下）

<!-- 前端控制器 -->
	<servlet>
		<servlet-name>springDispatcherServlet</servlet-name>
		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
		<init-param>
			<param-name>contextConfigLocation</param-name>
			<param-value>classpath:spring/applicationContext-mvc.xml</param-value>
		</init-param>
		<load-on-startup>1</load-on-startup>
	</servlet>
	<servlet-mapping>
		<servlet-name>springDispatcherServlet</servlet-name>
		<url-pattern>/</url-pattern>
	</servlet-mapping>
	<!--字符编码过滤器 -->
	<filter>
		<filter-name>CharacterEncodingFilter</filter-name>
		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
		<init-param>
			<param-name>encoding</param-name>
			<param-value>utf-8</param-value>
		</init-param>
		<init-param>
			<param-name>forceEncoding</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>CharacterEncodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
	<!-- 支持rest风格的过滤器 -->
	<filter>
		<filter-name>HiddenHttpMethodFilter</filter-name>
		<filter-class>org.springframework.web.filter.HiddenHttpMethodFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>HiddenHttpMethodFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

6、在源码文件夹（config）下的spring包下新建一个applicationContext-mvc.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:mvc="http://www.springframework.org/schema/mvc"
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">
	
	<!-- SpringMVC只扫描控制器 ,禁用默认规则-->
	<context:component-scan base-package="com.example" use-default-filters="false">
		<context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
	</context:component-scan>
	
	<!-- 视图解析器 -->
	<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="prefix" value="/"></property>
		<property name="suffix" value=".jsp"></property>
	</bean>
	<!-- 扫静态资源 -->
	<mvc:default-servlet-handler/>
	<!-- 扫动态资源 -->
	<mvc:annotation-driven></mvc:annotation-driven>
</beans>

7、在WebContent下新建两个Jsp文件，若能成功访问，即Spirng与SpirngMvc配置成功

8、加入Shiro的jar包

log4j-1.2.15.jar
shiro-core-1.2.1.jar
shiro-ehcache-1.2.1.jar
shiro-spring-1.2.1.jar
shiro-web-1.2.1.jar
slf4j-api-1.7.2.jar
slf4j-log4j12-1.7.2.jar

9、配置Shiro的过滤器（web.xml文件中配置）

<!-- shiro的过滤器 -->
	<filter>
		<filter-name>htmlShiroFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
		<init-param>
			<param-name>targetFilterLifecycle</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>htmlShiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

10、在源码包下（config下）新建一个application-shiro.xml文件（配置shiro）

10.1导入ehcache的jar包和配置文件（在src下面新建一个ehcache包，在包下新建一个ehcache-shiro.xml）（资源文件中有）
ehcache-core-2.4.3.jar

10.2 自定义Realm（在com.example.realms包下新建一个ShiroRealm类）

public class ShiroRealm implements Realm{

	@Override
	public AuthenticationInfo getAuthenticationInfo(AuthenticationToken arg0) throws AuthenticationException {
		return null;
	}

	@Override
	public String getName() {
		return null;
	}

	@Override
	public boolean supports(AuthenticationToken arg0) {
		return false;
	}
}

 application-shiro.xml文件：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
	<!-- 1、配置shiro的securityManager -->
	<bean id="securityManager"
		class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="cacheManager" ref="cacheManager" />
		<property name="sessionMode" value="native" />
		<property name="realm" ref="jdbcRealm" />
	</bean>
	<!-- 2、配置cacheManager，缓存管理器 -->
	<!-- 2.1 导入ehcache的jar包和配置文件 -->
	<bean id="cacheManager"
		class="org.apache.shiro.cache.ehcache.EhCacheManager">
		<property name="cacheManagerConfigFile"
			value="classpath:ehcache/ehcache-shiro.xml" />
	</bean>
	<!-- 3、配置realm,新建一个ShiroRealm类，实现Realm接口 -->
	<bean id="jdbcRealm" class="com.example.realms.ShiroRealm" />
	<!-- 4、配置生命周期的运行处理器，可以自动调用配置在spring ioc容器中的shiro bean的生命周期方法 -->
	<bean id="lifecycleBeanPostProcessor"
		class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
	<!-- 5、使用ioc容器中shiro的注解，但是必须在配置了这个之后才可以使用 -->
	<bean
		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
		depends-on="lifecycleBeanPostProcessor" />
	<bean
		class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
		<property name="securityManager" ref="securityManager" />
	</bean>
	<!-- 6、 htmlShiroFilter的配置
		6.1、id必须与web.xml文件中配置的名称一致 
		6.2、loginUrl、\successUrl、unauthorizedUrl对应反应页面（自己新建） -->
	<bean id="htmlShiroFilter"
		class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl" value="/login.jsp" />
		<property name="successUrl" value="/success.jsp" />
		<property name="unauthorizedUrl" value="/unauthorized.jsp" />
		<!-- 6.3、配置哪些页面需要受保护，以及访问这些页面需要的权限 -->
		<!--anon:可以被匿名访问 authc:必须认证之后才可以访问的页面 -->
		<property name="filterChainDefinitions">
			<value>
				/login.jsp = anon
				/** = authc
			</value>
		</property>
	</bean>
</beans>

若使用高版本shiro，sessionMode废弃：

<!-- 1、配置shiro的securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="cacheManager" ref="cacheManager"/>
    <property name="sessionManager" ref="sessionManager"/>
    <property name="realm" ref="realm"/>
</bean>
<!--3、sessionMode被废弃后，使用DefaultWebSessionManager来设置-->
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    <!-- session的失效时长，单位毫秒 1小时: 3600000, itzixi站点设置以 6小时 为主：21600000 -->
    <!-- 设置全局会话超时时间，默认30分钟，即如果30分钟内没有访问会话将过期 1800000 -->
    <property name="globalSessionTimeout" value="21600000"/>
    <!-- 删除失效的session -->
    <property name="deleteInvalidSessions" value="true"/>
    <!-- 是否开启会话验证器，默认是开启的 -->
    <property name="sessionValidationSchedulerEnabled" value="true"/>
</bean>

11、改动web.xml文件
将：

<context-param>
	<param-name>contextConfigLocation</param-name>
	<param-value>classpath:spring/applicationContext.xml</param-value>
</context-param>

改为：

<context-param>
	<param-name>contextConfigLocation</param-name>
	<param-value>
		classpath:spring/applicationContext.xml
		classpath:spring/applicationContext-shiro.xml
	</param-value>
</context-param>

12、访问login.jsp文件就可以访问，而其他的页面都不可以访问，都被重定向到其他页面

与Springboot集成

pom.xml文件

<!--Shiro相关-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>${shiro.version}</version>
        </dependency>
<!--Shiro相关 end-->

1、新建ShiroConfig类

package com.dcampus.common.config;


import com.dcampus.common.security.LoginRealm;
import com.dcampus.common.security.ShiroLoginFilter;
import com.dcampus.common.service.ShiroLogin;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.mgt.RememberMeManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.filter.DelegatingFilterProxy;

import javax.servlet.Filter;
import java.util.LinkedHashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 必须设置 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 拦截器.
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
        // 配置不会被拦截的链接 顺序判断
        filterChainDefinitionMap.put("/js/**", "anon");
        filterChainDefinitionMap.put("/themes/**", "anon");
        filterChainDefinitionMap.put("/pages/**", "anon");
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/login/**", "anon");
        //swagger应该放行的东西，start
        filterChainDefinitionMap.put("/swagger-ui.html", "anon");
        filterChainDefinitionMap.put("/swagger-resources/**", "anon");
        filterChainDefinitionMap.put("/v2/**", "anon");
        filterChainDefinitionMap.put("/webjars/**", "anon");
        //swagger应该放行的东西，end
        // 拦截其他所有
        filterChainDefinitionMap.put("/**", "authc");
        Map<String, Filter> filters = new LinkedHashMap<>();
        //配置了自定义的ShiroLoginFilter，设置不关于页面，返回json
        filters.put("authc", new ShiroLoginFilter());
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        shiroFilterFactoryBean.setFilters(filters);
        return shiroFilterFactoryBean;
    }

    /**
     * securityManager
     *
     * @param loginRealm
     * @param rememberMeManager
     * @param sessionManager
     * @return
     */
    @Bean
    public DefaultWebSecurityManager securityManager(LoginRealm loginRealm, RememberMeManager rememberMeManager, DefaultWebSessionManager sessionManager) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 设置realm.
        securityManager.setRealm(loginRealm);
        // 设置rememberMeManager
        securityManager.setRememberMeManager(rememberMeManager);
        // 设置SessionManager
        securityManager.setSessionManager(sessionManager);
        return securityManager;
    }


    /**
     * 身份认证realm; (这个需要自己写，账号密码校验；权限等)
     *
     * @return
     */
    @Bean
    public LoginRealm loginRealm(ShiroLogin shiroLogin) {
        LoginRealm myLoginRealm = new LoginRealm();
        myLoginRealm.setShiroLogin(shiroLogin);
        return myLoginRealm;
    }


    /**
     * rememberManager
     */
    @Bean
    public RememberMeManager rememberMeManager(SimpleCookie simpleCookie) {
        CookieRememberMeManager manager = new CookieRememberMeManager();
        manager.setCookie(simpleCookie);
        //自己设置一个key
        manager.setCipherKey(Base64.decode("xxxxx"));
        return manager;
    }


    @Bean
    public SimpleCookie simpleCookie() {
        SimpleCookie cookie = new SimpleCookie("rememberMe");
        cookie.setHttpOnly(true);
        cookie.setMaxAge(60 * 60 * 24);
        return cookie;
    }



    @Bean
    public DefaultWebSessionManager sessionManager() {
        DefaultWebSessionManager manager = new DefaultWebSessionManager();
        manager.setGlobalSessionTimeout(21600000);
        manager.setDeleteInvalidSessions(true);
        manager.setSessionValidationSchedulerEnabled(true);
        return manager;
    }






    @Bean
    public FilterRegistrationBean delegatingFilterProxy() {
        FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();
        DelegatingFilterProxy proxy = new DelegatingFilterProxy();
        proxy.setTargetFilterLifecycle(true);
        proxy.setTargetBeanName("shiroFilter");
        filterRegistrationBean.setFilter(proxy);
        return filterRegistrationBean;
    }
    


    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }
    

    /**
     * 开启代码权限注解支持
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

    /**
     * 解决权限注解不生效问题
     */
    @Bean
    public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        creator.setProxyTargetClass(true);
        return creator;
    }


}

2、LoginRealm：密码校验，权限授予等操作

**
 * 本地登陆Realm
 */
public class LoginRealm extends AuthorizingRealm {

	//用于数据库查询的service
    private ShiroLogin shiroLogin;

    /**
     * 认证回调函数, 登录时调用
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
        String username = token.getUsername();
        if (StringUtils.isBlank(username)) {
            throw new UnknownAccountException("用户名不能为空");
        }
        User user = shiroLogin.getUserByAccount(username);
        if (user != null) {
            if (user.getUserBaseStatus().equalsIgnoreCase(User.USER_STATUS_NORMAL)) {
                //realmName:当前realm对象的name,直接调用父类的getName()方法即可
                String realmName = getName();
                Principal principal = new Principal(user);
                return new SimpleAuthenticationInfo(principal, user.getPassword(), realmName);
            } else {
                throw new LockedAccountException("用户被禁用！");
            }
        } else {
            throw new UnknownAccountException("用户不存在");
        }
    }

    /**
     * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        Principal principal = null;
        Collection<Principal> pColl = principals.fromRealm(getName());
        if (pColl != null && !pColl.isEmpty()) {
            principal = pColl.iterator().next();
        }
        if (principal == null) {
            return null;
        }
        User user = shiroLogin.getUserByAccount(principal.getUsername());
        if (user != null) {
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //加载启用的自定义权限信息
            Set<UserRole> urSet = user.getUserRoles();
            if (urSet != null) {
                for (UserRole ur : urSet) {
                    info.addRole(ur.getRole().getName());
                    Set<RolePerm> rpSet = ur.getRole().getRolePerms();
                    if (rpSet != null) {
                        for (RolePerm rp : rpSet) {
                            info.addStringPermission(rp.getPerm().getId());
                        }
                    }
                }
            }
            return info;
        } else {
            return null;
        }
    }

    
    public void setShiroLogin(ShiroLogin shiroLogin) {
        this.shiroLogin = shiroLogin;
    }

}

3、Principal类：用于权限信息封装

/**
 * 授权用户信息，权限模块中登录用户信息封装
 */
public class Principal implements Serializable {

	private static final long serialVersionUID = 1L;
	
	private Long id;
	private String username;
	private String name;
	private Map<String, Object> cacheMap;

	public Principal(User user) {
		this.id = user.getId();
		this.username = user.getAccount();
		this.name = user.getName();
	}

	public Principal(Long id, String account, String name) {
		this.id = id;
		this.username = account;
		this.name = name;
	}
	
	
	public Long getId() {
		return id;
	}
	public String getUsername() {
		return username;
	}
	public String getName() {
		return name;
	}
	public Map<String, Object> getCacheMap() {
		if (cacheMap==null){
			cacheMap = new HashMap<String, Object>();
		}
		return cacheMap;
	}

	public void setCacheMap(Map<String, Object> cacheMap) {
		this.cacheMap = cacheMap;
	}
}

4、ShiroLoginFilter ：自定义未登录，权限失败等相关的数据返回

public class ShiroLoginFilter extends FormAuthenticationFilter {

    /**
     * 如果isAccessAllowed返回false 则执行onAccessDenied
     *
     * @param request
     * @param response
     * @param mappedValue
     * @return
     */
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        if (request instanceof HttpServletRequest) {
            if (((HttpServletRequest) request).getMethod().toUpperCase().equals("OPTIONS")) {
                return true;
            }
        }
        return super.isAccessAllowed(request, response, mappedValue);
    }

    /**
     * 在访问controller前判断是否登录，返回json，不进行重定向。
     *
     * @param request
     * @param response
     * @return true-继续往下执行，false-该filter过滤器已经处理，不继续执行其他过滤器
     * @throws Exception
     */
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        //这里是个坑，如果不设置的接受的访问源，那么前端都会报跨域错误，因为这里还没到corsConfig里面
        httpServletResponse.setHeader("Access-Control-Allow-Origin", ((HttpServletRequest) request).getHeader("Origin"));
        httpServletResponse.setHeader("Access-Control-Allow-Credentials", "true");
        httpServletResponse.setContentType("application/json");
        JSONObject jsonObject = new JSONObject();
        jsonObject.put("success", "false");
        jsonObject.put("message", "认证失败");
        httpServletResponse.getWriter().write(jsonObject.toJSONString());
        return false;
    }
}

集成细节

Shiro Filter的工作 原理

细节

1、web.xml文件中配置shiro的过滤器名称htmlShiroFilter要与application-shiro中的filter配置的id相同

若不一致，则会抛出: NoSuchBeanDefinitionException，因为 shiro会来IOC容器中查找和一致的bean

若不想一致：在web.xml的shiroFilter里面增加这样一个属性

<!-- DelegatingFilterProxy是Filter的一个代理对象，他会默认去找与 <filter-name>相同的bean，而
			可以用targetBeanName来指定去找相应名称的bean-->
   <init-param>
       <param-name>targetBeanName</param-name>
       <param-value>abc</param-value>
   </init-param>

2、url的配置（限制是否认证才可访问）

url部分的配置，其格式是:ur=拦截器[参数]，拦截器[参数]

anon（ anonymous）拦截器表示匿名访问（即不需要登录即可访问）

autho（ authentication）拦截器表示需要身份认证通过后才能访问

logout 登出，请求的url是登出功能

例如：（第一次优先匹配，对同一个url限制多次时，以第一次为主）

<property name="filterChainDefinitions">
	<value>
         /login.jsp = anon
         /shiro/logonout = logout
         /** = authc
	</value>
</property>

常用的一些过滤需要的标签等数据

<!-- 
	 自带的的认证授权过滤器：
	 anon，authcBasic，auchc，user是认证过滤器
     perms，roles，ssl，rest，port是授权过滤器
	 anon   org.apache.shiro.web.filter.authc.AnonymousFilter   
    	 表示可以匿名使用， 没有参数
	 authc  org.apache.shiro.web.filter.authc.FormAuthenticationFilter 
    	 表示需要认证(登录)才能使用，没有参数
	 roles  org.apache.shiro.web.filter.authz.RolesAuthorizationFilter  
		例子/admin/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过
	 perms  org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter 
		例子/admin/user/**=perms[user:add:*],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过
	 port   org.apache.shiro.web.filter.authz.PortFilter
		例子/admin/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString
	 rest   org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
		例子/admin/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。
	 authcBasic org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
		例如/admin/user/**=authcBasic没有参数表示httpBasic认证
	 ssl    org.apache.shiro.web.filter.authz.SslFilter
		例子/admin/user/**=ssl没有参数，表示安全的url请求，协议为https
	 user   org.apache.shiro.web.filter.authc.UserFilter
		例如/admin/user/**=user没有参数表示必须存在用户，当登入操作时不做检查
	 logout org.apache.shiro.web.filter.authc.LogoutFilter
		例如/admin/user/**=logout没有参数表示退出登录
-->