shiro结合springMVC配置相关

web.xml中：

 <!--指定Spring的config文件地址 -->    <context-param>        <param-name>contextConfigLocation</param-name>        <param-value>            /WEB-INF/applicationContext.xml            /WEB-INF/shiro-conf.xml            /WEB-INF/context-component.xml        </param-value>    </context-param>

 <!--Shiro Filter -->    <filter>        <filter-name>shiroFilter</filter-name>        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>        <init-param>            <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->            <param-name>targetFilterLifecycle</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>shiroFilter</filter-name>        <!--<url-pattern>*.do</url-pattern>-->        <url-pattern>/*</url-pattern>    </filter-mapping>

applicationContext.xml

   <!-- 为安全检查使用Shiro 的注解（例如，@RequiresRoles，@RequiresPermissions 等等）。 -->    <!--以下两个bean的配置是为了在Controller层使用元注释控制权限 -->    <!--如果使用spring-mvc一定要不要放在webroot的配置文件中 -->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"          depends-on="lifecycleBeanPostProcessor"/>    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">        <property name="securityManager" ref="securityManager"/>    </bean>    <!--交由shiro管理bean的生命周期-->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"          depends-on="lifecycleBeanPostProcessor"/>    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

shiro-conf.xml

   <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">        <property name="securityManager" ref="securityManager"/>        <property name="loginUrl" value="/login.do"/>        <property name="filters">            <map>                <entry key="authc" value-ref="authcFilter"/>                <entry key="user" value-ref="userFilter"/>            </map>        </property>        <property name="filterChainDefinitions">            <value>                /login.do = authc                <!--方便测试-->                <!--/** =anon-->                **.do = user            </value>        </property>    </bean>    <!-- Shiro Filter -->    <bean id="authcFilter" class="cn.com.a.credit.common.security.shiro.CredirAuthenticationFilter"/>    <bean id="userFilter" class="cn.com.a.credit.common.security.shiro.CreditUserFilter"/>    <!-- Shiro's main business-tier object for web-enabled applications -->    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">        <property name="realms">            <list>                <ref bean="shiroDbRealm"/>            </list>        </property>        <!--<property name="cacheManager" ref="shiroEhcacheManager"/>-->        <property name="rememberMeManager" ref="rememberMeManager"/>    </bean>    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/><!--项目自定义的Realm -->    <!--为防止bean注入时的先后依赖问题，shiroDbRealm里面依赖的dao都需要用depends-on声明-->    <bean id="shiroDbRealm" class="cn.com.a.credit.common.security.shiro.ShiroDbRealm" depends-on="userDao,operationLogDao">        <property name="credentialsDigest" ref="credentialsDigest"/>    </bean>    <!-- 用户授权信息Cache, 采用EhCache -->    <!--TODO 需要时再打开下面注释-->    <!--<bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">-->        <!--<property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>-->    <!--</bean>-->    <!--rememberMe管理器 -->    <bean id="rememberMeManager"          class="org.apache.shiro.web.mgt.CookieRememberMeManager">        <property name="cookie" ref="rememberMeCookie"/>    </bean>    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">        <constructor-arg value="rememberMeClub"/>        <property name="httpOnly" value="true"/>        <!-- 300天 -->        <property name="maxAge" value="25920000"/>    </bean>

注意，shiro处于filter级别，过滤的时候spring-mvc.xml中配置的bean还没有被初始出来。
需要在appliactionContext中添加如下代码，再扫描一次。

  <context:component-scan base-package="cn.com.sgcc.credit.core"/>

参考：http://blog.csdn.net/cenkunjj/article/details/51078101
这位作者尝试把 mvc的配置文件写到web.xml中一次。原理一样