springboot + shiro的配置

第一次写博客好紧张，为了使自己使用过的技术不被忘记，在此将一些配置方法记下来，方便自己复习 呵呵

今天写的是springboot+shiro的配置

首先需要在application.yml的配置文件中加入shiro的配置文件路径，方便项目启动时就能找到shiro配置文件的位置写法如下：

# Shiro
shiro:
    configLocation: classpath:/ehcache-shiro.xml

 然后在resources下添加 ehcache-shiro.xml文件 xml文件中的内容是：

<?xml version="1.0" encoding="UTF-8"?>
<ehcache updateCheck="false" name="shiroCache">
    <defaultCache
            maxElementsInMemory="10000"
            eternal="false"
            timeToIdleSeconds="120"
            timeToLiveSeconds="120"
            overflowToDisk="false"
            diskPersistent="false"
            diskExpiryThreadIntervalSeconds="120"
            />
</ehcache>

再把 ShiroConfiguration.java文件放在项目的config下，内容如下：

/**
 * Shiro 配置
 * @author yincl
 * @date 2016年9月2日
 */
@Configuration 
public class ShiroConfiguration { 
	@SuppressWarnings("unused")
	private static final Logger logger = LoggerFactory.getLogger(ShiroConfiguration.class);
	
	
	public EhCacheManager getEhCacheManager() {
		EhCacheManager em = new EhCacheManager(); 
		em.setCacheManagerConfigFile("classpath:ehcache-shiro.xml"); 
		return em;  
		} 
	/**
	 * 注册DelegatingFilterProxy（Shiro）
	 * @return
	 */
	@Bean public FilterRegistrationBean filterRegistrationBean() {
		FilterRegistrationBean filterRegistration = new FilterRegistrationBean(); 
		filterRegistration.setFilter(new DelegatingFilterProxy("shiroFilter")); 
		// 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 
		filterRegistration.addInitParameter("targetFilterLifecycle", "true"); 
		filterRegistration.setEnabled(true); 
		filterRegistration.addUrlPatterns("/*"); 
		return filterRegistration; 
		} 
	@Bean(name = "lifecycleBeanPostProcessor") 
	public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() { 
		return new LifecycleBeanPostProcessor(); 
		} 
	@Bean 
	public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
		DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator(); 
		daap.setProxyTargetClass(true); 
		return daap; 
		} 
	@Bean(name = "securityManager") 
	public DefaultWebSecurityManager getDefaultWebSecurityManager(MyShiroRealm myShiroRealm) { 
		DefaultWebSecurityManager dwsm = new DefaultWebSecurityManager(); 
		dwsm.setRealm(myShiroRealm); 
		// <!-- 用户授权/认证信息Cache, 采用EhCache 缓存 --> 
		dwsm.setCacheManager(getEhCacheManager()); 
		return dwsm; 
		} 
	@Bean 
	public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(MyShiroRealm myShiroRealm) {
		AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor(); 
		aasa.setSecurityManager(getDefaultWebSecurityManager(myShiroRealm)); 
		return new AuthorizationAttributeSourceAdvisor(); 
		} 
	 
	/**
	 * 加载shiroFilter权限控制规则（从数据库读取然后配置)
	 * @param shiroFilterFactoryBean
	 * @param stuService
	 * @param scoreDao
	 */
	@Bean(name = "shiroFilter")
	public ShiroFilterFactoryBean getShiroFilterFactoryBean(MyShiroRealm myShiroRealm) {
		ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
		shiroFilterFactoryBean.setSecurityManager(getDefaultWebSecurityManager(myShiroRealm));
		shiroFilterFactoryBean.setLoginUrl("/login");
		shiroFilterFactoryBean.setSuccessUrl("/login_enter");
		shiroFilterFactoryBean.setUnauthorizedUrl("/403");
		Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); 
		filterChainDefinitionMap.put("/test", "anon");
		filterChainDefinitionMap.put("/bbbb", "authc,perms[emp]");
		/*filterChainDefinitionMap.put("/testtt", "authc");
		filterChainDefinitionMap.put("/**", "user");*/
		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
		return shiroFilterFactoryBean;
	}
	
}

controller层代码:

    /**
     * 用户的登录功能
     * @return
     */
	public Result userLogins(String loginName,String password,String verifyImageNum, String timestampId) {
		Map map = new HashMap<>();
		map.put("loginName", loginName);
		map.put("password", password);
		return userService.logins(map);
	}

service层代码：

/**
	 * 用户的登录功能
	 * 
	 * @param user
	 * @param bindingResult
	 * @param redirectAttributes
	 * @param model
	 * @return
	 */
	public Result logins(Map map) {
		String username = (String) map.get("loginName");
		User user1 = null;
		if (Validator.isMobile(username)) {
			user1 = userDao.findUserByPhone(username);
		} else if (Validator.isEmail(username)) {
			user1 = userDao.findUserByEmail(username);
		} else {
			user1 = userDao.findUserByNickName(username);
		}
		if (user1 == null) {
			return Result.fail("昵称/手机号/email没有在平台注册！");
		}
		String md5Password = Md5Utils.md5(Md5Utils.md5((String) map.get("password")) + user1.getSalt());
		UsernamePasswordToken token = new UsernamePasswordToken(user1.getPhone(), md5Password); // 获取当前的Subject
		Subject currentUser = SecurityUtils.getSubject();
		try {
			currentUser.login(token);
		} catch (UnknownAccountException uae) {
			return Result.fail("message", "未知账户");
		} catch (IncorrectCredentialsException ice) {
			return Result.fail("message", "密码不正确");
		} catch (LockedAccountException lae) {
			return Result.fail("message", "账户已锁定");
		} catch (ExcessiveAttemptsException eae) {
			return Result.fail("message", "用户名或密码错误次数过多");
		} catch (AuthenticationException ae) {
			ae.printStackTrace();
			return Result.fail("message", "用户名或密码不正确");
		}
		// 验证是否登录成功
		if (currentUser.isAuthenticated()) {

               此处编辑自己的业务逻辑...


		} else {
			token.clear();
			return Result.fail("请重新登录");
		}
	}

添加上这部分代码你就可以使用shiro来控制你项目的登陆的权限等......

如有不妥的地方望大牛多多指点......