SpringBoot搭建基于Apache Shiro+Redis的分布式Session共享功能

我们在上一遍文档中已经完成了Shiro验证功能。（http://www.cnblogs.com/nbfujx/p/7773789.html），在此基础上我们将完成分布式Session共享功能。

Redis的使用

Maven Plugin添加Redis相关jar包

   <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-redis</artifactId>
         </dependency>

添加Redis配置文件

 package com.goku.webapi.config.redis;

 import com.fasterxml.jackson.databind.DeserializationFeature;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.cache.CacheManager;
 import org.springframework.cache.annotation.CachingConfigurerSupport;
 import org.springframework.cache.annotation.EnableCaching;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.data.redis.cache.RedisCacheManager;
 import org.springframework.data.redis.connection.RedisConnectionFactory;
 import org.springframework.data.redis.core.RedisTemplate;
 import org.springframework.data.redis.core.StringRedisTemplate;
 import org.springframework.data.redis.serializer.Jackson2JsonRedisSerializer;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
 import com.fasterxml.jackson.annotation.PropertyAccessor;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.springframework.data.redis.serializer.StringRedisSerializer;

 /**
  * Created by nbfujx on 2017/10/19.
  */
 @Configuration
 @EnableCaching
 public class RedisCacheConfig  extends CachingConfigurerSupport {

     @Value("${spring.redis.host}")
     private String host;
     @Value("${spring.redis.port}")
     private int port;
     @Value("${spring.redis.timeout}")
     private int timeout;

     @Bean
     public CacheManager cacheManager(RedisTemplate<Object, Object> redisTemplate) {
         RedisCacheManager cacheManager = new RedisCacheManager(redisTemplate);
         cacheManager.setDefaultExpiration(1800);
         return cacheManager;
     }

     @Bean
     public RedisTemplate<Object, Object> redisTemplate(RedisConnectionFactory factory) {
         RedisTemplate<Object, Object> template = new RedisTemplate<>();
         template.setConnectionFactory(factory);
         template.setKeySerializer(new StringRedisSerializer());
         template.setValueSerializer(new RedisObjectSerializer());
         return template;
     }
 }

添加RedisSessionDAO配置文件

 package com.goku.webapi.config.Shiro;

 import org.apache.shiro.session.Session;
 import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.data.redis.core.RedisTemplate;

 import javax.annotation.Resource;
 import java.io.Serializable;
 import java.util.concurrent.TimeUnit;

 /**
  * Created by nbfujx on 2017-11-08.
  */
 public class RedisSessionDAO  extends EnterpriseCacheSessionDAO {

     // session 在redis过期时间是30分钟30*60
     private static final int EXPIRE_TIME = 1800;
     private static Logger logger = LoggerFactory.getLogger(RedisSessionDAO.class);
     private static String prefix = "shiro-session:";

     @Resource
     private RedisTemplate<String, Object> redisTemplate;

     // 创建session，保存到数据库
     @Override
     protected Serializable doCreate(Session session) {
         Serializable sessionId = super.doCreate(session);
         this.logger.info("创建session:{}", session.getId());
         redisTemplate.opsForValue().set(prefix + sessionId.toString(), session);
         return sessionId;
     }

     // 获取session
     @Override
     protected Session doReadSession(Serializable sessionId) {
         this.logger.info("获取session:{}", sessionId);
         // 先从缓存中获取session，如果没有再去数据库中获取
         Session session = super.doReadSession(sessionId);
         if (session == null) {
             session = (Session) redisTemplate.opsForValue().get(prefix + sessionId.toString());
         }
         return session;
     }

     // 更新session的最后一次访问时间
     @Override
     protected void doUpdate(Session session) {
         super.doUpdate(session);
         this.logger.info("获取session:{}", session.getId());
         String key = prefix + session.getId().toString();
         if (!redisTemplate.hasKey(key)) {
             redisTemplate.opsForValue().set(key, session);
         }
         redisTemplate.expire(key, EXPIRE_TIME, TimeUnit.SECONDS);
     }

     // 删除session
     @Override
     protected void doDelete(Session session) {
         this.logger.info("删除session:{}", session.getId());
         super.doDelete(session);
         redisTemplate.delete(prefix + session.getId().toString());
     }
 }

添加ShiroCache配置文件

 package com.goku.webapi.config.Shiro;

 import org.apache.shiro.cache.Cache;
 import org.apache.shiro.cache.CacheException;
 import org.springframework.data.redis.core.RedisTemplate;

 import java.util.ArrayList;
 import java.util.Collection;
 import java.util.List;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;

 /**
  * Created by nbfujx on 2017/11/8.
  */
 public class  ShiroCache<K, V> implements Cache<K, V> {

     private static final String REDIS_SHIRO_CACHE = "shiro-cache:";
     private static final long GLOB_EXPIRE = 30;
     private String cacheKey;
     private RedisTemplate<K, V> redisTemplate;

     public ShiroCache(RedisTemplate<K, V> client, String name) {
         this.cacheKey = REDIS_SHIRO_CACHE + name + ":";
         this.redisTemplate = client;
     }

     @Override
     public V get(K key) throws CacheException {
         redisTemplate.boundValueOps(getCacheKey(key)).expire(GLOB_EXPIRE, TimeUnit.MINUTES);
         return redisTemplate.boundValueOps(getCacheKey(key)).get();
     }

     @Override
     public V put(K key, V value) throws CacheException {
         V old = get(key);
         redisTemplate.boundValueOps(getCacheKey(key)).set(value);
         return old;
     }

     @Override
     public V remove(K key) throws CacheException {
         V old = get(key);
         redisTemplate.delete(getCacheKey(key));
         return old;
     }

     @Override
     public void clear() throws CacheException {
         redisTemplate.delete(keys());
     }

     @Override
     public int size() {
         return keys().size();
     }

     @Override
     public Set<K> keys() {
         return redisTemplate.keys(getCacheKey("*"));
     }

     @Override
     public Collection<V> values() {
         Set<K> set = keys();
         List<V> list = new ArrayList<>();
         for (K s : set) {
             list.add(get(s));
         }
         return list;
     }

     private K getCacheKey(Object k) {
         return (K) (this.cacheKey + k);
     }
 }

添加RedisCacheManager配置文件

 package com.goku.webapi.config.Shiro;

 import javax.annotation.Resource;

 import com.goku.webapi.config.Shiro.ShiroCache;
 import org.apache.shiro.cache.AbstractCacheManager;
 import org.apache.shiro.cache.Cache;
 import org.apache.shiro.cache.CacheException;
 import org.springframework.data.redis.core.RedisTemplate;
 /**
  * Created by nbfujx on 2017-11-08.
  */
 public class RedisCacheManager extends AbstractCacheManager {

     @Resource
     private RedisTemplate<String, Object> redisTemplate;

     @Override
     protected Cache<String, Object> createCache(String name) throws CacheException {
         return new ShiroCache<>(redisTemplate, name);
     }
 }

调整ShiroConfi配置文件

 package com.goku.webapi.config.Shiro;

 import org.apache.shiro.session.mgt.SessionManager;
 import org.apache.shiro.spring.LifecycleBeanPostProcessor;
 import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
 import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
 import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
 import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
 import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.DependsOn;

 import javax.servlet.Filter;
 import java.util.LinkedHashMap;
 import java.util.Map;

 /**
  * shiro配置类
  * Created by nbfujx on 2017/11/7.
  */
 @Configuration
 public class ShiroConfig {

     /**
      * LifecycleBeanPostProcessor，这是个DestructionAwareBeanPostProcessor的子类，
      * 负责org.apache.shiro.util.Initializable类型bean的生命周期的，初始化和销毁。
      * 主要是AuthorizingRealm类的子类，以及EhCacheManager类。
      */
     @Bean(name = "lifecycleBeanPostProcessor")
     public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
         return new LifecycleBeanPostProcessor();
     }

     /**
      * ShiroRealm，这是个自定义的认证类，继承自AuthorizingRealm，
      * 负责用户的认证和权限的处理，可以参考JdbcRealm的实现。
      */
     @Bean(name = "shiroRealm")
     @DependsOn("lifecycleBeanPostProcessor")
     public ShiroRealm shiroRealm() {
         ShiroRealm realm = new ShiroRealm();
         realm.setCacheManager(redisCacheManager());
         return realm;
     }

     @Bean
     public RedisCacheManager redisCacheManager() {
         return new RedisCacheManager();
     }

     @Bean(name = "redisSessionDAO")
     public RedisSessionDAO sessionDAO() {
         RedisSessionDAO sessionDAO = new RedisSessionDAO();
         return sessionDAO;
     }

     /**
      * SessionManager session管理
      */
     @Bean
     public SessionManager sessionManager() {
         DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
         sessionManager.setSessionDAO(sessionDAO());
         sessionManager.setGlobalSessionTimeout(1800);
         sessionManager.setCacheManager(redisCacheManager());
         return sessionManager;
     }

     /**
      * SecurityManager，权限管理，这个类组合了登陆，登出，权限，session的处理，是个比较重要的类。
      */
     @Bean(name = "securityManager")
     public DefaultWebSecurityManager securityManager() {
         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
         securityManager.setRealm(shiroRealm());
         securityManager.setCacheManager(redisCacheManager());
         securityManager.setSessionManager(sessionManager());
         return securityManager;
     }

     /**
      * ShiroFilterFactoryBean，是个factorybean，为了生成ShiroFilter。
      * 它主要保持了三项数据，securityManager，filters，filterChainDefinitionManager。
      */
     @Bean(name = "shiroFilter")
     public ShiroFilterFactoryBean shiroFilterFactoryBean() {
         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
         shiroFilterFactoryBean.setSecurityManager(securityManager());

         Map<String, Filter> filters = new LinkedHashMap<String, Filter>();
         shiroFilterFactoryBean.setFilters(filters);

         Map<String, String> filterChainDefinitionManager = new LinkedHashMap<String, String>();
         filterChainDefinitionManager.put("/login", "anon");
         filterChainDefinitionManager.put("/logout", "anon");
         filterChainDefinitionManager.put("/sysUser/*", "authc,perms");//"authc,perms[sysUser:*]");
         filterChainDefinitionManager.put("/sysMenu/*", "authc,perms");//"authc,perms[sysUser:*]");
         filterChainDefinitionManager.put("/*", "anon");
         shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionManager);

         shiroFilterFactoryBean.setLoginUrl("/notAuthc");
         shiroFilterFactoryBean.setSuccessUrl("/");
         shiroFilterFactoryBean.setUnauthorizedUrl("/notAuthz");
         return shiroFilterFactoryBean;
     }

     /**
      * DefaultAdvisorAutoProxyCreator，Spring的一个bean，由Advisor决定对哪些类的方法进行AOP代理。
      */
     @Bean
     @DependsOn("lifecycleBeanPostProcessor")
     public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
         DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
         defaultAAP.setProxyTargetClass(true);
         return defaultAAP;
     }

     /**
      * AuthorizationAttributeSourceAdvisor，shiro里实现的Advisor类，
      * 内部使用AopAllianceAnnotationsAuthorizingMethodInterceptor来拦截用以下注解的方法。
      */
     @Bean
     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {
         AuthorizationAttributeSourceAdvisor aASA = new AuthorizationAttributeSourceAdvisor();
         aASA.setSecurityManager(securityManager());
         return aASA;
     }

 }

新增RedisCacheManager，RedisSessionDAO，sessionManager相关bean，

securityManager 增加 securityManager.setSessionManager(sessionManager());

Shiro-Redis的使用验证

先进行登录验证操作

查看redis存储数据

进行数据查询

查看日志是否从redis获取

GITHUB

github : https://github.com/nbfujx/learn-java-demo/tree/master/Goku.WebService.Simple.Redis.Shiro