springboot集成shiro demo

package com.xl.practice.springbootshiropractice.shiro; import java.util.ArrayList; import java.util.HashMap; import java.util.LinkedHashMap; import java.util.List; import java.util.Map; import javax.servlet.Filter; import org.apache.shiro.authc.credential.HashedCredentialsMatcher; import org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.realm.Realm; import org.apache.shiro.spring.LifecycleBeanPostProcessor; import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.web.mgt.DefaultWebSecurityManager; import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration public class ShiroConfiguration { @Bean public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } @Bean public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator autoProxyCreator = new DefaultAdvisorAutoProxyCreator(); autoProxyCreator.setProxyTargetClass(true); return autoProxyCreator; } @Bean public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) { System.out.println("ShiroConfiguration.shirFilter()"); ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面。 shiroFilterFactoryBean.setLoginUrl("/notLogin"); //未授权访问，跳转的地址setUnauthorizedUrl方法只针对部分过滤器有效，有些过滤器是无效的 // shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized"); // 必须设置 SecurityManager shiroFilterFactoryBean.setSecurityManager(securityManager); // 拦截器 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); /** * 自定义拦截器 */ Map<String, Filter> customisedFilter = new HashMap<>(); customisedFilter.put("url", new CustomisedURLPathMatchingFilter()); // 配置映射关系 filterChainDefinitionMap.put("/login", "anon"); filterChainDefinitionMap.put("/**", "authc"); filterChainDefinitionMap.put("/**", "url"); shiroFilterFactoryBean.setFilters(customisedFilter); shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilterFactoryBean; } @Bean public SecurityManager securityManager() { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); // 配置自定义的认证（用户账号\密码认证） CustomisedAuthenticator customisedAuthenticator = new CustomisedAuthenticator(); // 配置认证策略，只要有一个Realm认证成功即可，并且返回所有认证成功信息 customisedAuthenticator.setAuthenticationStrategy(new AtLeastOneSuccessfulStrategy()); securityManager.setAuthenticator(customisedAuthenticator); // 配置自定义的授权（角色或者权限等） CustomisedAuthorizer customisedAuthorizer = new CustomisedAuthorizer(); securityManager.setAuthorizer(customisedAuthorizer); // 单个realm //securityManager.setRealm(getUserRealm()); List<Realm> realms = new ArrayList<Realm>(); realms.add(getUserRealm()); realms.add(getAnotherRealm()); // 多realm securityManager.setRealms(realms); return securityManager; } @Bean public UserRealm getUserRealm() { UserRealm myShiroRealm = new UserRealm(); // 启用身份验证缓存，即缓存AuthenticationInfo信息，默认false； myShiroRealm.setAuthenticationCachingEnabled(true); myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher()); return myShiroRealm; } @Bean public AnotherRealm getAnotherRealm() { AnotherRealm anotherRealm = new AnotherRealm(); // 启用身份验证缓存，即缓存AuthenticationInfo信息，默认false； anotherRealm.setAuthenticationCachingEnabled(true); anotherRealm.setCredentialsMatcher(hashedCredentialsMatcher()); return anotherRealm; } /** * 凭证匹配器 （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了 * 所以我们需要修改下doGetAuthenticationInfo中的代码; ） * * @return */ @Bean public HashedCredentialsMatcher hashedCredentialsMatcher() { HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher(); hashedCredentialsMatcher.setHashAlgorithmName("md5");// 散列算法:这里使用MD5算法; // hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5("")); return hashedCredentialsMatcher; } /** * 开启shiro aop注解支持. 使用代理方式;所以需要开启代码支持; * * @param securityManager * @return */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor(); authorizationAttributeSourceAdvisor.setSecurityManager(securityManager); return authorizationAttributeSourceAdvisor; } }