使用EhCache同时缓存数据库数据及其它需要缓存的数据和shrio共享（shiro主要用于会话的存储和持久化），集成整合步骤如下：
一：集成EhCache
<1>、在pom.xml文件中添加以下依赖。
<2>、添加配置文件 ehcache.xml，放在resources下，内容如下。
xsi:noNamespaceSchemaLocation="http://ehcache.org/ehcache.xsd" updateCheck="false"> eternal="false" maxElementsInMemory="1000" overflowToDisk="false" diskPersistent="false" timeToIdleSeconds="0" timeToLiveSeconds="600" memoryStoreEvictionPolicy="LRU" /> name="permissionCache" eternal="false" maxElementsInMemory="100" overflowToDisk="false" diskPersistent="false" timeToIdleSeconds="0" timeToLiveSeconds="300" memoryStoreEvictionPolicy="LRU" />
<3>、在启动类加上启用缓存注解@EnableCaching。
<4>、经过上述步骤后，就可以使用缓存注解@Cacheable，@CachePut等。
二：集成Shiro并使用EhCache缓存
<1> 、在pom.xml文件中添加以下依赖。
<2>、编写Shiro的Realm验证，参考代码如下。
public class ShiroRealm extends AuthorizingRealm {
private Logger logger = LoggerFactory.getLogger(this.getClass());
@Resource
private IUserService iUserService;
@Resource
private ILoginLogService iloginLogService;
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
logger.info("权限配置----->ShiroRealm.doGetAuthorizationInfo()" );
SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
UserInfo userInfo = (UserInfo) principals.getPrimaryPrincipal();
authorizationInfo.addRole(userInfo.getRoleInfo().getRoleCode());
for (Permission p : userInfo.getRoleInfo().getPermissions()) {
authorizationInfo.addStringPermission(p.getPermissionCode());
}
//授权成功添加登录日志
addLoginLog(userInfo);
return authorizationInfo;
}
/*主要是用来进行身份认证的，也就是说验证用户输入的账号和密码是否正确*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
logger.info("ShiroRealm.doGetAuthenticationInfo()" );
//获取用户的输入的账号.
String username = (String) token.getPrincipal();
//通过username从数据库中查找 User对象，如果找到，没找到.
//实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法
UserInfo userInfo = iUserService.findUserInfo(username);
logger.info("----->userInfo=" + userInfo);
if (userInfo == null) {
throw new AccountException();
} else if (userInfo.getState() == 0) {
throw new DisabledAccountException();
} else if (userInfo.getState() == 2) {
throw new LockedAccountException();
}
//保存登录用户ID
Session session = SecurityUtils.getSubject().getSession();
session.setAttribute(Constant.LOGIN_USER_ID, userInfo.getId());
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
userInfo, //用户信息
userInfo.getPassWord(), //密码
ByteSource.Util.bytes(userInfo.getCredentialsSalt()),//salt=username+salt
getName() //realm name
);
return authenticationInfo;
}
private void addLoginLog(UserInfo userInfo) {
LoginLog loginLog = new LoginLog();
loginLog.setUserId(userInfo.getId());
loginLog.setUserName(userInfo.getUserName());
loginLog.setIpAddress(SecurityUtils.getSubject().getSession().getAttribute(Constant.LOGIN_IP_ADDRESS).toString());
loginLog.setGeographyLocation(AddressUtils.getAddressByIp(loginLog.getIpAddress()));
iloginLogService.insert(loginLog);
}
}
<3>、添加Shiro的配置类，参考代码如下。
@Configuration
public class ShiroConfig {
private Logger logger = LoggerFactory.getLogger(this.getClass());
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
logger.info("ShiroConfiguration.shirFilter()" );
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
//获取filters
Map
//将自定义的FormAuthenticationFilter注入shiroFilter中（验证码校验）
filters.put("authc" , new CustomFormAuthenticationFilter());
//拦截器.
Map
// 配置不会被拦截的链接 顺序判断
filterChainDefinitionMap.put("/static/**" , "anon" );
filterChainDefinitionMap.put("/kaptcha/**" , "anon" );
//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
filterChainDefinitionMap.put("/logout" , "logout" );
//:这是一个坑呢，一不小心代码就不好使了;
//
filterChainDefinitionMap.put("/**" , "authc" );
// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
shiroFilterFactoryBean.setLoginUrl("/login" );
// 登录成功后要跳转的链接
shiroFilterFactoryBean.setSuccessUrl("/index" );
//未授权界面;
shiroFilterFactoryBean.setUnauthorizedUrl("/error/403" );
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
}
/**
* 凭证匹配器
* （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了）
*
* @return
*/
@Bean
public HashedCredentialsMatcher hashedCredentialsMatcher() {
HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
hashedCredentialsMatcher.setHashAlgorithmName("md5" );//散列算法:这里使用MD5算法;
hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5(""));
return hashedCredentialsMatcher;
}
/**
* 自定义身份认证realm
*
* @return
*/
@Bean
public ShiroRealm shiroRealm() {
ShiroRealm shiroRealm = new ShiroRealm();
shiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
return shiroRealm;
}
@Bean
public EhCacheManager ehCacheManager(CacheManager cacheManager) {
EhCacheManager em = new EhCacheManager();
//将ehcacheManager转换成shiro包装后的ehcacheManager对象
em.setCacheManager(cacheManager);
//em.setCacheManagerConfigFile("classpath:ehcache.xml");
return em;
}
@Bean
public SessionDAO sessionDAO(){
return new MemorySessionDAO();
}
/**
* shiro session管理
*/
@Bean
public DefaultWebSessionManager sessionManager() {
DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
sessionManager.setSessionDAO(sessionDAO());
return sessionManager;
}
@Bean
public SecurityManager securityManager(EhCacheManager ehCacheManager) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
// 设置realm
securityManager.setRealm(shiroRealm());
// 自定义缓存实现
securityManager.setCacheManager(ehCacheManager);
// 自定义session管理
securityManager.setSessionManager(sessionManager());
return securityManager;
}
/**
* 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
* 配置以下两个bean(DefaultAdvisorAutoProxyCreator和AuthorizationAttributeSourceAdvisor)即可实现此功能
*
* @return
*/
@Bean
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
advisorAutoProxyCreator.setProxyTargetClass(true);
return advisorAutoProxyCreator;
}
/**
* 开启shiro aop注解支持.
* 使用代理方式;所以需要开启代码支持;
*
* @param securityManager
* @return
*/
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
}
注意：
@Bean
public EhCacheManager ehCacheManager(CacheManager cacheManager) {
EhCacheManager em = new EhCacheManager();
//将ehcacheManager转换成shiro包装后的ehcacheManager对象
em.setCacheManager(cacheManager);
//em.setCacheManagerConfigFile("classpath:ehcache.xml");
return em;
}
如上是配置Shiro的缓存管理器org.apache.shiro.cache.ehcach.EhCacheManager，上面方法的参数是把Spring容器中的cacheManager对象注入到EhCacheManager中，这样就实现了Shiro和缓存注解使用同一种缓存方式。
代码示例
Gitee：https://gitee.com/xieke90/common-admin/tree/SpringBoot2.X_EhCache/
如果您觉得本文不错，欢迎Star支持，您的关注是我坚持的动力！