springboot 集成 shiro

如果没有了解shiro 可以先去学习shiro：https://www.cnblogs.com/wujiaofen/p/11088973.html

springboot 整合shiro：

1、 在spring boot 项目中导入jar

2、    
3、            
4、                org.apache.shiro
5、                shiro-spring
6、                1.4.0
7、            
8、            
9、            
10、                org.springframework.boot
11、                spring-boot-starter-cache
12、            
13、            
14、                net.sf.ehcache
15、                ehcache
16、            
17、            
18、                org.apache.shiro
19、                shiro-ehcache
20、                1.4.0
21、            
22、            
23、                net.sf.json-lib
24、                json-lib
25、                2.2.3
26、                jdk15
27、        

2、创建基本配置类shiroConfig 和缓存类

/**
 * shiro 配置类
 * @author Administrator
 *
 */
@Configuration
public class ShiroConfig {

    /**
     * shiro 过滤器配置
     * @param securityManager
     * @return
     */
    
    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager)
    {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);    
        /**
         * 过滤器链，对URL配置过滤规则 
         * authc：所有url都必须认证通过才可以访问
         * anon：所有url都都可以匿名访问
         * user：表示身份认证通过或通过记住我认证通过的可以访问
         * 注意点：过滤链定义，从上向下顺序执行，一般将/**放在最为下边 
         * 
         */
        Map filterChainDefinitionMap = new LinkedHashMap<>();
        //initPermission
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/initPermission", "anon");
        filterChainDefinitionMap.put("/static/**", "anon");
        filterChainDefinitionMap.put("/logout", "logout"); //配置退出
        filterChainDefinitionMap.put("/**", "user");
        //如果没有认证将要跳转的登陆地址，http可访问的url，如果不在表单认证过虑器FormAuthenticationFilter中指定此地址就为身份认证地址
        shiroFilterFactoryBean.setLoginUrl("/login");
        shiroFilterFactoryBean.setSuccessUrl("/index");
        //shiroFilterFactoryBean.setUnauthorizedUrl("/403");
        
        
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }
    
    /**
     * 加密方式
     * @return
     */
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher()
    {
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");
        //散列次数
        hashedCredentialsMatcher.setHashIterations(2);
        return hashedCredentialsMatcher;
    }
    
    /**
     * 认证配置
     * @return
     */
    @Bean
    public MyRealm getRealm()
    {
        MyRealm  myRealm = new MyRealm();
        myRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        myRealm.setCacheManager(ehCacheManager());
        return myRealm;
    }
    
    /**
     * 安全管理器配置
     * @return
     */
    @Bean
    public SecurityManager getSecurityManager()
    {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(getRealm());
        securityManager.setCacheManager(ehCacheManager());
        //注入记住我管理器
        securityManager.setRememberMeManager(rememberMeManager());
        return securityManager;
    }
    
    /**
     * 缓存管理器
     * @return
     */
    @Bean
    public EhCacheManager ehCacheManager(){
        EhCacheManager cacheManager = new EhCacheManager();
        cacheManager.setCacheManagerConfigFile("classpath:shiro-ehcache.xml");
        return cacheManager;
    }
    
    /**
      * cookie对象;
      * rememberMeCookie()方法是设置Cookie的生成模版，比如cookie的name，cookie的有效时间等等。
      * @return
     */
    @Bean
    public SimpleCookie rememberMeCookie(){
          //System.out.println("ShiroConfiguration.rememberMeCookie()");
          //这个参数是cookie的名称，对应前端的checkbox的name = rememberMe
          SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
          //
          simpleCookie.setMaxAge(259200);
          return simpleCookie;
    }
    
    /**
      * cookie管理对象;
      * rememberMeManager()方法是生成rememberMe管理器，而且要将这个rememberMe管理器设置到securityManager中
      * @return
     */
    @Bean
    public CookieRememberMeManager rememberMeManager(){
          //System.out.println("ShiroConfiguration.rememberMeManager()");
          CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
          cookieRememberMeManager.setCookie(rememberMeCookie());
          //rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度(128 256 512 位)
          cookieRememberMeManager.setCipherKey(Base64.decode("2AvVhdsgUs0FSA3SDFAdag=="));
          return cookieRememberMeManager;
    }

    /**
     * 开启@RequirePermission注解的配置
     * 要结合DefaultAdvisorAutoProxyCreator一起使用，或者导入aop的依赖
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager)
    {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
    
    /**
     * aop代理
     * @return
     */
    @Bean
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
          DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
          advisorAutoProxyCreator.setProxyTargetClass(true);
          return advisorAutoProxyCreator;
    }
    /**
     * 定义Spring MVC的异常处理器
     * @return
     */
    @Bean
    public SimpleMappingExceptionResolver createSimpleMappingExceptionResolver() {
        SimpleMappingExceptionResolver r = new SimpleMappingExceptionResolver();
        Properties mappings = new Properties();
        mappings.setProperty("DatabaseException", "databaseError");//数据库异常处理
        mappings.setProperty("UnauthorizedException","403");//处理shiro的认证未通过异常
        r.setExceptionMappings(mappings);  // None by default
        r.setDefaultErrorView("error");    // No default
        r.setExceptionAttribute("ex");     // Default is "exception"
        return r;
    }
}

缓存配置类：

@Configuration
public class EhcacheConfig {

    /**
     * 设置为共享模式
     * @return
     */
    @Bean
    public EhCacheManagerFactoryBean ehCacheManagerFactoryBean() {
        EhCacheManagerFactoryBean cacheManagerFactoryBean = new EhCacheManagerFactoryBean();
        cacheManagerFactoryBean.setShared(true);
        return cacheManagerFactoryBean;
    }
}

同时需要在resources 源目录添加shiro-ehcache.xml

"1.0" encoding="UTF-8"?>
"false" dynamicConfig="false">
    "java.io.tmpdir"/>
    "users"
           timeToLiveSeconds="300"
           maxEntriesLocalHeap="1000"/>
    
    "defaultCache"
                  maxElementsInMemory="10000"
                  eternal="false"
                  timeToIdleSeconds="120"
                  timeToLiveSeconds="120"
                  overflowToDisk="false"
                  maxElementsOnDisk="100000"
                  diskPersistent="false"
                  diskExpiryThreadIntervalSeconds="120"
                  memoryStoreEvictionPolicy="LRU"/>

3、自定义Realm 继承AuthorizingRealm 实现doGetAuthenticationInfo【认证】doGetAuthorizationInfo【授权】即可