shiro在Spring MVC + hibernate 中配置

spring-config-shiro.xml

配置：

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

       xmlns:util="http://www.springframework.org/schema/util"

       xmlns:aop="http://www.springframework.org/schema/aop"

       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

       xsi:schemaLocation="

       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
       http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
    <!-- 缓存管理器 -->

    <bean id="cacheManager" class="com.rimi.orthopedics.security.cache.SpringCacheManagerWrapper">

        <property name="cacheManager" ref="springCacheManager"/>

    </bean>

    <!-- 凭证匹配器 -->

    <bean id="credentialsMatcher" class="com.rimi.orthopedics.security.credentials.RetryLimitHashedCredentialsMatcher">

        <constructor-arg ref="cacheManager"/>

        <property name="hashAlgorithmName" value="md5"/>

        <property name="hashIterations" value="2"/>

        <property name="storedCredentialsHexEncoded" value="true"/>

    </bean>

    

    <!-- Realm实现 -->

    <bean id="adminRealm" class="com.rimi.orthopedics.security.realm.AdminRealm">

        <property name="credentialsMatcher" ref="credentialsMatcher"/>

        <property name="cachingEnabled" value="true"/>

        <property name="authenticationCachingEnabled" value="true"/>

        <property name="authenticationCacheName" value="authenticationCache"/>

        <property name="authorizationCachingEnabled" value="true"/>

        <property name="authorizationCacheName" value="authorizationCache"/>

    </bean>

    <!-- 会话ID生成器 -->

    <bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>

    <!-- 会话Cookie模板 -->

    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">

        <constructor-arg value="sid"/>

        <property name="httpOnly" value="true"/>

        <property name="maxAge" value="-1"/>

    </bean>

    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">

        <constructor-arg value="rememberMe"/>

        <property name="httpOnly" value="true"/>

        <property name="maxAge" value="2592000"/><!-- 30天 -->

    </bean>

    <!-- rememberMe管理器 -->

    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">

        <!-- rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度（128 256 512 位）-->

        <property name="cipherKey"

                  value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}"/>

        <property name="cookie" ref="rememberMeCookie"/>

    </bean>

    <!-- 会话DAO -->

    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">

        <property name="activeSessionsCacheName" value="shiro-activeSessionCache"/>

        <property name="sessionIdGenerator" ref="sessionIdGenerator"/>

    </bean>

    <!-- 会话验证调度器 -->

    <bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler">

        <property name="sessionValidationInterval" value="1800000"/>

        <property name="sessionManager" ref="sessionManager"/>

    </bean>

    <!-- 会话管理器 -->

    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">

        <property name="globalSessionTimeout" value="1800000"/>

        <property name="deleteInvalidSessions" value="true"/>

        <property name="sessionValidationSchedulerEnabled" value="true"/>

        <property name="sessionValidationScheduler" ref="sessionValidationScheduler"/>

        <property name="sessionDAO" ref="sessionDAO"/>

        <property name="sessionIdCookieEnabled" value="true"/>

        <property name="sessionIdCookie" ref="sessionIdCookie"/>

    </bean>

    <!-- 安全管理器 -->

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="adminRealm"/>

        <property name="sessionManager" ref="sessionManager"/>

        <property name="cacheManager" ref="cacheManager"/>

        <property name="rememberMeManager" ref="rememberMeManager"/>

    </bean>

    <!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) -->

    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">

        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>

        <property name="arguments" ref="securityManager"/>

    </bean>

    <!-- 基于Form表单的身份验证过滤器 -->

    <bean id="formAuthenticationFilter" class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">

        <property name="usernameParam" value="username"/>

        <property name="passwordParam" value="password"/>

        <property name="rememberMeParam" value="rememberMe"/>

        <property name="loginUrl" value="/login"/>

    </bean>

    <!--  Shiro的Web过滤器 

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"/>

        <property name="loginUrl" value="/login"/>

        <property name="filters">

            <util:map>

                

            <entry key="sysUser" value-ref="sysUserFilter"/>

            </util:map>

        </property>

        <property name="filterChainDefinitions">

            <value>

                / = anon

                /login = authc

                /logout = logout

                /** = user

            </value>

        </property>

    </bean> -->

    

    <bean id="chainDefinitionSectionMetaSource" class="com.rimi.orthopedics.security.filter.ChainDefinitionSectionMetaSource">
   <!-- 默认的连接配置 -->
   <property name="filterChainDefinitions">
       <value>
       
/ = anon
           /login = authc
           /dispatcher = authc
           /logout = logout
       </value>
   </property>
</bean>

    <!-- Define the Shiro Filter here (as a FactoryBean) instead of directly in web.xml -

         web.xml uses the DelegatingFilterProxy to access this bean.  This allows us

         to wire things with more control as well utilize nice Spring things such as

         PropertiesPlaceholderConfigurer and abstract beans or anything else we might need: -->

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"/>

        <property name="loginUrl" value="/login"/>

        <property name="successUrl" value="/dispatcher"/>

        <property name="unauthorizedUrl" value="/web/noaccess"/>

        <property name="filters">

            <util:map>

            <entry key="authc" value-ref="formAuthenticationFilter"/>

                <entry key="anyRoles">

                    <bean class="com.rimi.orthopedics.security.filter.AnyRolesFilter"/>

                </entry>

            </util:map>

        </property>

        <property name="filterChainDefinitionMap" ref="chainDefinitionSectionMetaSource" />

    </bean>

    <!-- Shiro生命周期处理器-->

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

</beans>