spring boot 整合shiro

在上一个记录http://blog.csdn.net/oyh1203/article/details/72235915中初步搭建了一个springboot的项目，现在想将shiro也整合到项目中去，不多说，动手搞，项目结构如图

其它shiro相关的实现类不贴了

shiro配置信息都放到properties文件中文件内容如下

[html]  view plain  copy

1. #SHIRO登录成功的URL地址  
2. shiro.login.successUrl=/sayHello  
3. #SHIRO登录地址  
4. shiro.login.loginUrl=/  
5. #SHIRO无权限跳转地址  
6. shiro.login.unauthorizedUrl=/unauthorizedUrl  
7. #SHIRO密码出错次数  
8. shiro.login.errorTimes=5  
9. #SHIRO有关cache的配置文件路径  
10. shiro.login.cacheFilePath=classpath:xml/spring-shiro-ehcache.xml  
11. #SHIRO加密方式  
12. shiro.login.hashAlgorithmName=MD5  
13. #SHIRO加密次数  
14. shiro.login.hashIterations=3  

shiro配置信息由xml改为代码配置，此处的私有属性通过ConfigurationProperties设置到对应的字段中，使用PropertySource指定配置文件路径，感谢博客园Gin.p
提供的Spring Boot整合shiro出现UnavailableSecurityManagerException异常解决方案

[java]  view plain  copy

1. package com.test.ouyang.configure;  
2.   
3. import java.util.LinkedHashMap;  
4. import java.util.logging.Logger;  
5.   
6. import org.apache.shiro.cache.ehcache.EhCacheManager;  
7. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;  
8. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;  
9. import org.springframework.beans.factory.annotation.Qualifier;  
10. import org.springframework.boot.context.properties.ConfigurationProperties;  
11. import org.springframework.boot.web.servlet.FilterRegistrationBean;  
12. import org.springframework.context.annotation.Bean;  
13. import org.springframework.context.annotation.Configuration;  
14. import org.springframework.context.annotation.PropertySource;  
15. import org.springframework.web.filter.DelegatingFilterProxy;  
16.   
17. import com.test.ouyang.realm.ResourceCheckFilter;  
18. import com.test.ouyang.realm.RetryLimitHashedCredentialsMatcher;  
19. import com.test.ouyang.realm.UserRealm;  
20.   
21. @Configuration  
22. @ConfigurationProperties(ignoreUnknownFields = false,prefix = "shiro.login")  
23. @PropertySource("classpath:config/shiro.properties")  
24. public class ShiroConfiguration {  
25.     private Logger log_ = Logger.getLogger(ShiroConfiguration.class.getName());  
26.       
27.     private String successUrl ;  
28.     private String loginUrl ;  
29.     private String unauthorizedUrl ;  
30.     private String cacheFilePath ;  
31.     private int errorTimes ;  
32.     private String hashAlgorithmName ;  
33.     private int hashIterations ;  
34.       
35.     public String getSuccessUrl() {  
36.         return successUrl;  
37.     }  
38.     public void setSuccessUrl(String successUrl) {  
39.         this.successUrl = successUrl;  
40.     }  
41.     public String getLoginUrl() {  
42.         return loginUrl;  
43.     }  
44.     public void setLoginUrl(String loginUrl) {  
45.         this.loginUrl = loginUrl;  
46.     }  
47.     public String getUnauthorizedUrl() {  
48.         return unauthorizedUrl;  
49.     }  
50.     public void setUnauthorizedUrl(String unauthorizedUrl) {  
51.         this.unauthorizedUrl = unauthorizedUrl;  
52.     }  
53.     public String getCacheFilePath() {  
54.         return cacheFilePath;  
55.     }  
56.     public void setCacheFilePath(String cacheFilePath) {  
57.         this.cacheFilePath = cacheFilePath;  
58.     }  
59.     public int getErrorTimes() {  
60.         return errorTimes;  
61.     }  
62.     public void setErrorTimes(int errorTimes) {  
63.         this.errorTimes = errorTimes;  
64.     }  
65.     public String getHashAlgorithmName() {  
66.         return hashAlgorithmName;  
67.     }  
68.     public void setHashAlgorithmName(String hashAlgorithmName) {  
69.         this.hashAlgorithmName = hashAlgorithmName;  
70.     }  
71.     public int getHashIterations() {  
72.         return hashIterations;  
73.     }  
74.     public void setHashIterations(int hashIterations) {  
75.         this.hashIterations = hashIterations;  
76.     }  
77.     /** 
78.      * delegatingFilterProxy方法参考http://www.cnblogs.com/ginponson/p/6217057.html 
79.      * 修复Spring Boot整合shiro出现UnavailableSecurityManagerException 问题 
80.      * 此处设置相当于在web.xml中增加filter 
81.      * */  
82.     @Bean  
83.     public FilterRegistrationBean delegatingFilterProxy(){  
84.         FilterRegistrationBean filterRegistrationBean = new FilterRegistrationBean();  
85.         DelegatingFilterProxy proxy = new DelegatingFilterProxy();  
86.         proxy.setTargetFilterLifecycle(true);  
87.         proxy.setTargetBeanName("shiroFilter");  
88.         filterRegistrationBean.setFilter(proxy);  
89.         return filterRegistrationBean;  
90.     }  
91.   
92.     @Bean(name="resourceCheckFilter")  
93.     public ResourceCheckFilter  resourceCheckFilter(){  
94.         ResourceCheckFilter resourceCheckFilter = new ResourceCheckFilter(unauthorizedUrl);  
95.         return resourceCheckFilter;  
96.     }  
97.     //  SHIRO核心拦截器配置  
98.     @Bean(name="shiroFilter")  
99.     public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") DefaultWebSecurityManager securityManager) {  
100.         log_.info("successUrl:"+successUrl+"\t loginUrl:"+loginUrl+"\t unauthorizedUrl:"+unauthorizedUrl);  
101.         ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();  
102.         bean.setSecurityManager(securityManager);  
103.         bean.setSuccessUrl(successUrl);  
104.         bean.setLoginUrl(loginUrl);  
105.         bean.setUnauthorizedUrl(unauthorizedUrl);  
106.         //配置访问权限  
107.         LinkedHashMap<String, String> filterChainDefinitionMap=new LinkedHashMap<String, String>();  
108.         filterChainDefinitionMap.put("/adminView", "authc,resourceCheckFilter");  
109.         filterChainDefinitionMap.put("/testView", "authc,resourceCheckFilter");  
110.         filterChainDefinitionMap.put("/guestView", "authc,resourceCheckFilter");  
111.         filterChainDefinitionMap.put("/", "anon");  
112.         filterChainDefinitionMap.put("/static/**", "anon");  
113.         bean.setFilterChainDefinitionMap(filterChainDefinitionMap);  
114.         return bean ;  
115.     }  
116.     //配置SHIRO核心安全事务管理器  
117.     @Bean(name="securityManager")  
118.     public DefaultWebSecurityManager securityManager(@Qualifier("userRealm") UserRealm userRealm){  
119.         DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();  
120.         defaultWebSecurityManager.setRealm(userRealm);  
121.         return defaultWebSecurityManager;  
122.     }  
123.     //配置自定义的权限登录器  
124.     @Bean(name="userRealm")  
125.     public UserRealm userRealm(@Qualifier("credentialsMatcher") RetryLimitHashedCredentialsMatcher credentialsMatcher){  
126.         UserRealm userRealm = new UserRealm();  
127.         userRealm.setCredentialsMatcher(credentialsMatcher);  
128.         return userRealm;  
129.     }  
130.     //配置密码对比  
131.     @Bean(name="credentialsMatcher")  
132.     public RetryLimitHashedCredentialsMatcher credentialsMatcher(@Qualifier("cacheManager") EhCacheManager cacheManager){  
133.         RetryLimitHashedCredentialsMatcher credentialsMatcher = new RetryLimitHashedCredentialsMatcher(cacheManager,errorTimes,hashAlgorithmName,hashIterations);  
134.         return credentialsMatcher;  
135.     }  
136.     //配置缓存管理  
137.     @Bean(name="cacheManager")  
138.     public EhCacheManager cacheManager(){  
139.         EhCacheManager cacheManager = new EhCacheManager();  
140.         cacheManager.setCacheManagerConfigFile(cacheFilePath);  
141.         return cacheManager;  
142.     }  
143. }  

登录方法中使用shiro来校验用户信息

[java]  view plain  copy

1. @RequestMapping("/login")  
2.     public String login(@RequestParam(value="account")String account,@RequestParam(value="password") String password){  
3.         Subject subject = SecurityUtils.getSubject();  
4.         log_.info("account:"+account+"\t password:"+password);  
5.         if(!account.equals(subject.getPrincipal())||!subject.isAuthenticated()){  
6.             UsernamePasswordToken token = new UsernamePasswordToken(account, password);  
7.             try {  
8.                 subject.login(token);  
9.             } catch (UnknownAccountException  uae) {  
10.                 //用户名不存在  
11.                 log_.info("用户名或密码错误");  
12.             }catch (IncorrectCredentialsException  ice) {  
13.                 //密码错误  
14.                 log_.info("用户名或密码错误");  
15.             }catch (LockedAccountException lae) {   
16.                 //账户被锁定  
17.                 log_.info("账户被锁定");  
18.             }catch(ExcessiveAttemptsException eae){  
19.                 //登录失败次数超过系统最大次数,请稍后重试  
20.                 log_.info("登录失败次数超过系统最大次数,请稍后重试!");  
21.             }catch (Exception e) {  
22.                 //出现其他异常  
23.             }  
24.         }  
25.         return "index";  
26.     }