spring-shiro 配置

配置

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:util="http://www.springframework.org/schema/util"
       xsi:schemaLocation="
          http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
          http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">
    <!-- realm -->
    <bean id="userRealm" class="ch.entity.user.UserRealm">
        <constructor-arg index="0" name="matcher" ref="credentialsMatcher"/>
        <!-- 打开缓存 -->
        <property name="cachingEnabled" value="true"/>

        <!-- 启用身份验证缓存，即缓存AuthenticationInfo信息，默认false -->
        <property name="authenticationCachingEnabled" value="true"/>
        <!-- 打开授权缓存 -->
        <property name="authorizationCachingEnabled" value="true"/>
        <!-- 缓存AuthenticationInfo信息的缓存名称 -->
        <property name="authenticationCacheName" value="authenticationCache"/>
        <!-- 缓存AuthorizationInfo信息的缓存名称 -->
        <property name="authorizationCacheName" value="authorizationCache"/>
    </bean>
    <!---cookie-->
    <!-- uid(session id) 生成策略 -->
    <bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>

    <!-- 记住密码Cookie -->
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe"/>
        <property name="httpOnly" value="true"/>
        <property name="maxAge" value="#{7 * 24 * 60 * 60}"/>
    </bean>

    <!-- sesisonCookie 设置  -->
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <!-- cookie的名字 -->
        <constructor-arg value="sessionIdCookie"/>
        <property name="httpOnly" value="true"/>
        <!-- 30分钟  单位是秒-->
        <property name="maxAge" value="1800"/>
    </bean>

    <!-- rememberMe管理器,cipherKey生成见{@code Base64Test.java} cookie加密的秘钥-->
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cipherKey"
                  value="#{T(org.apache.shiro.codec.Base64).decode('5aaC5qKm5oqA5pyvAAAAAA==')}"/>
        <property name="cookie" ref="rememberMeCookie"/>
    </bean>

    <!-- 配置自定义缓存管理器，中引入redis缓存管理器或者,用Redis使用redis,用ehcache使用ehcache中 -->
    <!-- 用户授权信息Cache, 采用spring-cache, 具体请查看spring-shirocache.xml -->
    <bean id="shiroSpringCacheManager" class="ch.cache.shirocache.ShiroSpringCacheManager">
        <property name="cacheManager" ref="cacheManager" />
    </bean>

    <!-- 会话管理器 -->
    <bean id="sessionManager" class="ch.cache.session.SessionManager">
        <!-- 设置全局会话超时时间 半小时 -->
        <property name="globalSessionTimeout" value="#{30 * 60 * 1000}"/>
        <property name="sessionValidationInterval" value="120000"/>
        <property name="sessionValidationSchedulerEnabled" value="true"/>
        <property name="sessionIdCookieEnabled" value="true"/>
        <property name="sessionIdCookie" ref="sessionIdCookie"/>
        <property name="sessionDAO" ref="sessionDAO"/>
        <!-- <property name="sessionIdCookie.name" value="TRM_JSESSIONID"/> -->
    </bean>

    <!-- 会话DAO 用于会话的CRUD -->
    <bean id="sessionDAO" class="ch.cache.session.CacheSessionDAO">
        <!-- Session缓存名字，默认就是shiro-activeSessionCache -->
        <property name="activeSessionsCacheName" value="activeSessionCache"/>
        <property name="cacheManager" ref="shiroSpringCacheManager"/>
    </bean>

    <!--配置安全管理器-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!--设置自定义Realm-->
        <property name="realm" ref="userRealm"/>
        <!--将缓存管理器，交给安全管理器-->
        <property name="cacheManager" ref="shiroSpringCacheManager"/>
        <!-- 记住密码管理 -->
        <property name="sessionManager" ref="sessionManager"/>
        <property name="rememberMeManager" ref="rememberMeManager"/>
    </bean>

    <!-- 在方法中 注入  securityManager ，进行代理控制 -->
    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
        <property name="arguments" ref="securityManager"/>
    </bean>

    <!-- shiro密码加密配置 -->
    <bean id="passwordHash" class="ch.cache.PasswordHash">
        <!-- 密码加密 1次md5,增强密码可修改此处 -->
        <property name="algorithmName" value="md5"/>
        <property name="hashIterations" value="1"/>
    </bean>

    <!-- 密码错误5次锁定半小时 -->
    <bean id="credentialsMatcher" class="ch.cache.RetryLimitCredentialsMatcher">
        <constructor-arg ref="shiroSpringCacheManager"/>
        <!-- <property name="cacheManager" ref="shiroSpringCacheManager"/> -->
        <property name="retryLimitCacheName" value="halfHour"/>
        <property name="passwordHash" ref="passwordHash"/>
    </bean>

    <!-- Shiro Filter -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 安全管理器 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 默认的登陆访问url -->
        <property name="loginUrl" value="/views/admin/centre/login.jsp"/>
        <!-- 登陆成功后跳转的url -->
        <property name="successUrl" value="/views/admin/centre/main.jsp"/>
        <!-- 没有权限跳转的url -->
        <property name="unauthorizedUrl" value="/"/>
        <property name="filterChainDefinitions">
            <value>
                <!--
                    anon  不需要认证
                    authc 需要认证
                    user  验证通过或RememberMe登录的都可以
                -->
                /** = anon
                /views/decorator/** = anon
            </value>
        </property>
        <property name="filters">
            <map>
                <entry key="user" value-ref="ajaxSessionFilter" />
            </map>
        </property>
    </bean>
    <!-- ajax session超时时处理 -->
    <bean id="ajaxSessionFilter" class="ch.cache.ShiroAjaxSessionFilter"/>
    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    <!-- 启用shrio 控制器授权注解拦截方式 -->
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>
    <!-- AOP式方法级权限检查  -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor">
        <property name="proxyTargetClass" value="true"/>
    </bean>
</beans>