spring + shiro +ehcache + redis整合自我总结1

通过maven方式添加支持jar包：

xi <!--shiro--> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.3.0</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-web</artifactId> <version>1.3.0</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>1.3.0</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.3.0</version> </dependency> <!--ehcache--> <dependency> <groupId>net.sf.ehcache</groupId> <artifactId>ehcache-core</artifactId> <version>${ehcache.version}</version> </dependency> <dependency> <groupId>net.sf.ehcache</groupId> <artifactId>ehcache-web</artifactId> <version>${ehcache-web.version}</version> </dependency> <!--redis and jedis--> <dependency> <groupId>redis.clients</groupId> <artifactId>jedis</artifactId> <version>2.9.0</version> </dependency> <dependency> <groupId>commons-pool</groupId> <artifactId>commons-pool</artifactId> <version>1.6</version> </dependency>

spring + shiro 配置：

web.xml中的配置： <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:spring-common.xml,classpath:spring-mybatis.xml,classpath:spring-shiro.xml</param-value> </context-param> <!-- Apache Shiro 1.3.0 --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <init-param> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>

spring-shiro.xml配置：

<bean id="userFormAuthenticationFilter" class="com.lf.security.UserFormAuthenticationFilter"/> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <property name="loginUrl" value="/login.do" /> <property name="successUrl" value="/main.do" /> <property name="filters"> <map> <entry key="authc" value-ref="userFormAuthenticationFilter"/> </map> </property> <property name="filterChainDefinitions"> <value> /login.do = authc /= authc </value> </property> </bean> <!-- Shiro security manager --> <bean id="systemAuthorizingRealm" class="com.lf.security.SystemAuthorizingRealm"></bean> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="systemAuthorizingRealm" /> <property name="cacheManager" ref="shiroEhcacheManager"/> <property name="sessionManager" ref="sessionManager" /> </bean> (1)、其中spring-shiro.xml中id=shiroFilter的ID名字和web.xml中的filter-name名字要一致； (2)、<ptoperty name="filter">表示 这样使用authc的时候就是我们自定一个过滤器了，如果觉得用同个名字不好也可以自己定义名字！  UserFormAuthenticationFilter的配置如下： public class UserFormAuthenticationFilter extends FormAuthenticationFilter{} (3)、其中SystemAuthorizingRealm类如下继承关系： public class SystemAuthorizingRealm extends AuthorizingRealm {} (4）、整个过滤过程如下：当请求/login.do的时候，shiro进行拦截，进入UserFormAuthenticationFilter类，如上面配置的shiro过滤链，执行的方法有：executeLogin（FormAuthenticationFilter类中的方法） @Override protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception { CustomUsernamePasswordToken cupToken = createToken(request,response); try{ /**验证码确认*/ doCaptchaValidate(request,cupToken); /**登录信息验证*/ Subject subject = getSubject(request, response); subject.login(cupToken); return onLoginSuccess(cupToken,subject,request,response); }catch(AuthenticationException authenticationException){ return onLoginFailure(cupToken,authenticationException,request,response); } } 在执行subject.login()方法的时候，shiro内部的工作流程，会主动调用上面配置的SystemAuthorizingRealm类中的身份认证方法doGetAuthenticationInfo（），进行身份认证， 认证成功以后就会调用到相应的Controller类中，标注有@RequestMapping(value =  "/login")方法上面，跳转到制定的页面，如果在指定的Controller层方法中有shiro的权限/角色等，如@RequiresPermissions("user")，@RequiresRoles("user")等，那么系统就会进入SystemAuthorizingRealm类中的doGetAuthorizationInfo进行权限认证，更细的信息，请在debug中进行查看。