shiro-redis实现session存储到redis

　　shiro-redis开源项目已经很好的将shiro与redis整合到一起，实现了将session存入redis，可以方便的用于session共享实现集群部署。

　　git地址:https://github.com/alexxiyang/shiro-redis ，文档:http://alexxiyang.github.io/shiro-redis/

　　官方的文档已经非常详细了，基本上照着文档进行修改原来的配置就可以了。

1.在原生的shiro基础上新增的jar包:

commons-pool2-2.6.1.jar
jedis-2.9.0.jar
shiro-redis-3.2.2.jar

2.修改配置:

下面是参考的配置，将对应的bean以及依赖关系修改为下面的配置即可

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
 http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/context
 http://www.springframework.org/schema/context/spring-context-3.2.xsd http://www.springframework.org/schema/aop
 http://www.springframework.org/schema/aop/spring-aop-3.2.xsd http://www.springframework.org/schema/tx
 http://www.springframework.org/schema/tx/spring-tx-3.2.xsd ">

    <!-- shiro-redis configuration [start] -->

    <!-- Redis Manager [start] -->
    <bean id="redisManager" class="org.crazycake.shiro.RedisManager">
        <property name="host" value="127.0.0.1:6379" />
    </bean>
    <!-- Redis Manager [end] -->

    <!-- Redis session DAO [start] -->
    <bean id="redisSessionDAO" class="org.crazycake.shiro.RedisSessionDAO">
        <property name="redisManager" ref="redisManager" />
    </bean>
    <bean id="sessionManager"
        class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="sessionDAO" ref="redisSessionDAO" />
    </bean>
    <!-- Redis session DAO [end] -->

    <!-- Redis cache manager [start] -->
    <bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager">
        <property name="redisManager" ref="redisManager" />
    </bean>
    <!-- Redis cache manager [end] -->

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="sessionManager" ref="sessionManager" />
        <property name="cacheManager" ref="cacheManager" />

        <!-- other configurations -->
        <property name="realm" ref="exampleRealm" />
        <property name="rememberMeManager.cipherKey" value="kPH+bIxk5D2deZiIxcaaaA==" />
    </bean>

    <!-- shiro-redis configuration [end] -->
</beans>  

 需要注意:

　　1.存入session的信息要实现Serializable接口(包括其依赖的成员属性等bean也要实现)

　　2.对存入session的bean要有个唯一标识，且要设值到cacheManager，比如:

package cn.xm.exam.bean.system;

import java.io.Serializable;
import java.util.Date;
import java.util.List;

public class User implements Serializable{
    /**
     *
     */
    private static final long serialVersionUID = -3207880482640325843L;

    private String userid;

    private String useridcard;

    private String password;

    private String username;

    private String departmentname;

    private String departmentid;

    private String employeeid;

    private String userphoto;

    private String phone;

    private String isuse;

    private Date datatime;

    private Date logintime;
    private List<Role> roles; //用户所拥有的角色

    private List<String> permissions;//用户所拥有的权限code集合

    public List<Role> getRoles() {
        return roles;
    }

    public void setRoles(List<Role> roles) {
        this.roles = roles;
    }

    public String getUserid() {
        return userid;
    }

    public void setUserid(String userid) {
        this.userid = userid == null ? null : userid.trim();
    }

    public String getUseridcard() {
        return useridcard;
    }

    public void setUseridcard(String useridcard) {
        this.useridcard = useridcard == null ? null : useridcard.trim();
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password == null ? null : password.trim();
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username == null ? null : username.trim();
    }

    public String getDepartmentname() {
        return departmentname;
    }

    public void setDepartmentname(String departmentname) {
        this.departmentname = departmentname == null ? null : departmentname.trim();
    }

    public String getEmployeeid() {
        return employeeid;
    }

    public void setEmployeeid(String employeeid) {
        this.employeeid = employeeid == null ? null : employeeid.trim();
    }

    public String getUserphoto() {
        return userphoto;
    }

    public void setUserphoto(String userphoto) {
        this.userphoto = userphoto == null ? null : userphoto.trim();
    }

    public String getIsuse() {
        return isuse;
    }

    public void setIsuse(String isuse) {
        this.isuse = isuse == null ? null : isuse.trim();
    }

    public String getDepartmentid() {
        return departmentid;
    }

    public void setDepartmentid(String departmentid) {
        this.departmentid = departmentid;
    }

    public String getPhone() {
        return phone;
    }

    public void setPhone(String phone) {
        this.phone = phone;
    }

    public List<String> getPermissions() {
        return permissions;
    }

    public void setPermissions(List<String> permissions) {
        this.permissions = permissions;
    }

    public Date getDatatime() {
        return datatime;
    }

    public void setDatatime(Date datatime) {
        this.datatime = datatime;
    }

    public Date getLogintime() {
        return logintime;
    }

    public void setLogintime(Date logintime) {
        this.logintime = logintime;
    }

}

在配置cacheManager的时候如下:

    <!-- Redis cache manager [start] -->
    <bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager">
        <property name="redisManager" ref="redisManager" />
        <!-- shiro-redis will call userInfo.getUserid() to get the id for storing Redis object.  -->
        <property name="principalIdFieldName" value="userid" />
    </bean>
    <!-- Redis cache manager [end] -->

最终我的完整的shiro相关配置:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
 http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/context
 http://www.springframework.org/schema/context/spring-context-3.2.xsd http://www.springframework.org/schema/aop
 http://www.springframework.org/schema/aop/spring-aop-3.2.xsd http://www.springframework.org/schema/tx
 http://www.springframework.org/schema/tx/spring-tx-3.2.xsd ">

    <!-- Redis Manager [start] -->
    <bean id="redisManager" class="org.crazycake.shiro.RedisManager">
        <property name="host" value="127.0.0.1:6379" />
    </bean>
    <!-- Redis Manager [end] -->

    <!-- Redis session DAO [start] -->
    <bean id="redisSessionDAO" class="org.crazycake.shiro.RedisSessionDAO">
        <property name="redisManager" ref="redisManager" />
    </bean>

    <!-- Redis cache manager [start] -->
    <bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager">
        <property name="redisManager" ref="redisManager" />
        <!-- shiro-redis will call userInfo.getUserid() to get the id for storing Redis object.  -->
        <property name="principalIdFieldName" value="userid" />
    </bean>
    <!-- Redis cache manager [end] -->

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm" />
        <!-- 记住我 -->
        <property name="rememberMeManager" ref="rememberMeManager" />
        <!-- 注入缓存管理器 -->
        <property name="cacheManager" ref="cacheManager" />
        <!-- 注入session管理器 -->
        <property name="sessionManager" ref="sessionManager" />
    </bean>

    <!-- 自定义Realm -->
    <bean id="myRealm" class="cn.xm.exam.utils.realm.MyRealm" />

    <!-- 自定义form认证过虑器 -->
    <!-- 基于Form表单的身份验证过滤器，不配置将也会注册此过虑器，表单中的用户账号、密码及loginurl将采用默认值，建议配置 -->
    <bean id="formAuthenticationFilter"
        class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter ">

        <property name="usernameParam" value="username" />

        <property name="passwordParam" value="password" />

        <property name="rememberMeParam" value="rememberMe" />
    </bean>

    <!-- ehcache缓存管理器 -->
    <bean id="cacheManager222" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml" />
    </bean>

    <!-- session会话管理器 -->
    <bean id="sessionManager"
        class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <!-- session失效时间 单位毫秒 -->
        <property name="globalSessionTimeout" value="18000000" />
        <!-- 删除失效的session -->
        <property name="deleteInvalidSessions" value="true" />

        <property name="sessionDAO" ref="redisSessionDAO" />
    </bean>

    <!-- rememberMeManager管理器，写cookie，取出cookie生成用户信息 -->
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cookie" ref="rememberMeCookie" />
    </bean>
    <!-- 会话Cookie模板 -->
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="sid" />
        <property name="httpOnly" value="true" />
        <property name="maxAge" value="-1" />
    </bean>
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe" />
        <property name="httpOnly" value="true" />
        <property name="maxAge" value="2592000" /><!-- 30天 -->
    </bean>

    <!-- 自定义form认证过虑器 -->
    <bean id="permfilter" class="cn.xm.exam.utils.realm.ShiroPermsFilter"
        scope="prototype">
    </bean>

    <!-- logout -->
    <bean id="logoutFilter" class="org.apache.shiro.web.filter.authc.LogoutFilter">
        <!-- <property name="redirectUrl" value="/index.jsp" /> -->
        <property name="redirectUrl" value="/view/index/studyMainpage2.jsp" />
    </bean>

    <!-- shiro 过滤器 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <!-- loginUrl认证提交地址，如果没有认证将会请求此地址进行认证，请求此地址将由formAuthenticationFilter进行表单认证 -->
        <!-- <property name="loginUrl" value="/index.jsp" /> -->
        <property name="loginUrl" value="/view/index/studyMainpage2.jsp" />
        <!-- 认证成功统一跳转到first.action，建议不配置，shiro认证成功自动到上一个请求路径 -->
        <!--  <property name="successUrl" value="/login"/>  -->
        <!-- 通过unauthorizedUrl指定没有权限操作时跳转页面-->
        <property name="unauthorizedUrl" value="unauthorized.jsp" /> 

           <property name="filters">
            <map>
                <entry key="logout" value-ref="logoutFilter" />
            </map>
        </property>

        <!-- 过虑器链定义，从上向下顺序执行，一般将/**放在最下边 -->
        <property name="filterChainDefinitions">
            <value>
                <!-- 对静态资源设置匿名访问 -->
                / = anon <!-- 不拦截首页的地址 -->
                /index.jsp = anon
                /WS/** = anon
                /newsIP_**.action = anon
                /train_**.action = anon
                /dic_***.action = anon
                /unauthorized.jsp = anon
                /user_login.action = anon
                /view/public/** = anon
                /view/index/** = anon
                /bs/** = anon
                /controls/** = anon
                /css/** = anon
                /image/** = anon
                /js/** = anon
                /META-INF/** = anon

                <!-- 请求 logout.action地址，shiro去清除session-->
                /logout.action = logout

                <!-- /** = authc 所有url都必须认证通过才可以访问-->
                /** = authc

            </value>
        </property>
    </bean>

    <!-- 开启Shiro注解 -->
    <!-- <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
        depends-on="lifecycleBeanPostProcessor"> <property name="proxyTargetClass"
        value="true"></property> </bean> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/> </bean> -->

    <aop:config proxy-target-class="true"></aop:config>
    <bean
        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    </bean>

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
</beans>  

　　接下来正常访问即可。session的修改以及清空都交给redis即可。我们手动清空redis之后相当于清除所有session。会将我们的信息都存入redis:

　　对于集群的redis也都有相关介绍，对于哨兵模式的集群和主从复制的集群都有相关配置，需要的时候查阅文档就可以了。

我的项目的git地址:https://github.com/qiao-zhi/Exam/tree/sessionRedis