Shiro学习(一)

shiro是apache下的一个开源项目 用于实现对权限的管理,不同于springSecurity,springSecurity是基于url的权限管理,shiro既可以基于url管理权限,也可以进行基于方法的权限管理.我对shiro的介绍主要是基于集成Spring的介绍以及一些常用类.我可能讲得不够具有系统性,但我会把我所理解的都给大家说说,先直接上配置文件,下面几篇文章就围绕这个配置文件进行讲解

xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:p="http://www.springframework.org/schema/p" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xmlns:context="http://www.springframework.org/schema/context"

xmlns:util="http://www.springframework.org/schema/util" xmlns:tx="http://www.springframework.org/schema/tx"

xmlns:aop="http://www.springframework.org/schema/aop"

xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd

http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd

http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd

http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd

http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-4.0.xsd">

 

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="realm" ref="shiroRealm" />

<property name="cacheManager" ref="cacheManager"/>

<property name="sessionManager" ref="sessionManager" />

bean>

 

<bean id="shiroRealm" class="com.hzq.system.service.realm.ShiroRealm">

<property name="credentialsMatcher" ref="credentialsMatcher" />

bean>

<bean id="credentialsMatcher" class="com.hzq.system.shiro.ShiroCredentialsMatcher">

<property name="hashAlgorithmName" value="SHA-1" />

<property name="hashIterations" value="1024" />

<property name="cacheKey" value="passwordRetryCache">property>

<property name="cacheManager" ref="cacheManager">property>

bean>

<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">

<property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>

bean>

<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">

<property name="globalSessionTimeout" value="1000000"/>

<property name="deleteInvalidSessions" value="true"/>

<property name="sessionDAO" ref="sessionDAO"/>

<property name="sessionIdCookieEnabled" value="true"/>

<property name="sessionIdCookie" ref="sessionIdCookie"/>

bean>

<bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">

<constructor-arg value="sid"/>

<property name="httpOnly" value="true"/>

<property name="maxAge" value="-1"/>

bean>

<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">

<property name="activeSessionsCacheName" value="shiro-activeSessionCache"/>

<property name="sessionIdGenerator" ref="sessionIdGenerator"/>

bean>

<bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>

<bean id="shiroSessionListener" class="com.hzq.system.listener.ShiroSessionListener">bean>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<property name="securityManager" ref="securityManager" />

<property name="loginUrl" value="/login" />

<property name="successUrl" value="index" />

<property name="unauthorizedUrl" value="/refuse.jsp" />

<property name="filters">

<entry key="authc" value-ref="formAuthenticationFilter" />

map>

property>

<property name="filterChainDefinitions">

/images/** = anon

/js/** = anon

/styles/** = anon

/validatecode.jsp = anon

/=anon

/kicked =anon

/logout = logout

/**=authc