springmvc+shiro

web.xml配置shiroFilter

    <!-- Apache Shiro -->    <filter>        <filter-name>shiroFilter</filter-name>        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>        <init-param>            <param-name>targetFilterLifecycle</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>shiroFilter</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping>

配置文件：spring-content-shiro.xml

配置SecurityManager

    <!-- 定义Shiro安全管理配置 -->    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">        <property name="realm" ref="systemAuthorizingRealm" />        <property name="sessionManager" ref="sessionManager" />        <property name="cacheManager" ref="shiroCacheManager" />    </bean>

配置realm（自定义数据源）

    <!-- 項目自定义的Realm -->    <bean id="systemAuthorizingRealm" class="com.plife.sys.security.SystemAuthorizingRealm">        <property name="sysUserService" ref="sysUserServiceImple" />        <property name="sessionDAO" ref="sessionDAO" />    </bean>//sysUserService操作数据库 用户、密码表//sessionDAO 操作自定义的session 

自定义会话管理配置sessionManager

    <!-- 自定义会话管理配置 -->    <bean id="sessionManager" class="com.plife.base.session.SessionManager">        <property name="sessionDAO" ref="sessionDAO"/>        <!-- 会话超时时间，单位：毫秒  -->        <property name="globalSessionTimeout" value="${session.sessionTimeout}"/>        <!-- 定时清理失效会话, 清理用户直接关闭浏览器造成的孤立会话   -->        <property name="sessionValidationInterval" value="${session.sessionTimeoutClean}"/>        <!--        <property name="sessionValidationSchedulerEnabled" value="false"/> -->        <property name="sessionValidationSchedulerEnabled" value="true"/>        <property name="sessionIdCookie" ref="sessionIdCookie"/>        <property name="sessionIdCookieEnabled" value="true"/>    </bean>

配置session实际操作bean：sessionDAO

    <!-- 自定义Session存储容器 -->    <!--    <bean id="sessionDAO" class="com.thinkgem.jeesite.common.security.shiro.session.JedisSessionDAO"> -->    <!--        <property name="sessionIdGenerator" ref="idGen" /> -->    <!--        <property name="sessionKeyPrefix" value="${redis.keyPrefix}_session_" /> -->    <!--    </bean> -->    <bean id="sessionDAO" class="com.plife.base.session.CacheSessionDAO">        <property name="sessionIdGenerator" ref="idGen" />        <property name="activeSessionsCacheName" value="activeSessionsCache" />        <property name="cacheManager" ref="shiroCacheManager" />    </bean>

配置session的缓存shiroCacheManager

    <!-- 自定义系统缓存管理器-->    <bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">        <property name="cacheManager" ref="cacheManager"/>    </bean>    <!-- 缓存配置 -->    <bean id="cacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean">        <property name="configLocation" value="classpath:${ehcache.configFile}" />    </bean>

配置session id的生成策略

public class IdGen implements IdGenerator, SessionIdGenerator 

aop 检测

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>    <!-- AOP式方法级权限检查  -->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">        <property name="proxyTargetClass" value="true" />    </bean>    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">        <property name="securityManager" ref="securityManager"/>    </bean>