Spring Boot之旅：Java安全框架Apache Shiro基本配置(一)

第一步：准备开发环境

Spring Boot 版本：1.5.4.RELEASEShiro 版本：1.3.2

第二步：Spring Boot+Shiro配置集成

(1)在pom.xml配置文件中引入相关依赖如下：

			org.springframework.boot
			spring-boot-starter-aop
		
		
			org.springframework.boot
			spring-boot-starter-freemarker
		
		
			org.springframework.boot
			spring-boot-starter-jdbc
		
		
			org.mybatis.spring.boot
			mybatis-spring-boot-starter
			1.3.0
		
		
			org.springframework.boot
			spring-boot-starter-thymeleaf
		
		
			org.springframework.boot
			spring-boot-starter-web
		

		
			mysql
			mysql-connector-java
			runtime
		
		
			org.springframework.boot
			spring-boot-starter-tomcat
			provided
		
		
			org.springframework.boot
			spring-boot-starter-test
			test
		

		
			org.apache.shiro
			shiro-core
			1.3.2
		

		
			org.apache.shiro
			shiro-ehcache
			1.3.2
		

		
			org.apache.shiro
			shiro-web
			1.3.2
		

		
			org.apache.shiro
			shiro-spring
			1.3.2
		

		
			com.github.theborakompanioni
			thymeleaf-extras-shiro
			2.0.0
		

		
			com.alibaba
			druid
			1.1.1
		

(2)Shiro配置如下：

	/**
	 * 此设置相当于在以前web.xml文件中配置shiro环境
	 * 
	 * @return
	 */
	@Bean
	public FilterRegistrationBean createShiroFilter() {
		FilterRegistrationBean registration = new FilterRegistrationBean();
		DelegatingFilterProxy filter = new DelegatingFilterProxy();
		// 如果不设置，将会抛出异常：org.springframework.beans.factory.NoSuchBeanDefinitionException:No
		// bean named 'delegatingFilterProxy' available.
		// 并且在设置targetBeanName时要与ShiroFilterFactoryBean的名称一致，
		// 否则也会抛出异常：org.springframework.beans.factory.NoSuchBeanDefinitionException:No
		// bean named 'shiroFilter' available。
		filter.setTargetBeanName("shiroFilter");
		registration.setFilter(filter);
		registration.addInitParameter("targetFilterLifecycle", "true");
		registration.addUrlPatterns("/*");
		return registration;
	}

	/**
	 * 创建shiro安全管理器，并把自定义的realm添加到shiro的安全管理器中，并且此安全管理器是单例的
	 * 
	 * @return
	 */
	@Bean
	public DefaultWebSecurityManager createSecurityManager() {
		DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
		manager.setCacheManager(createEhCacheManager());
		manager.setRealm(createRealm());
		return manager;
	}

	/**
	 * 配置缓存管理器
	 * 
	 * @return
	 */
	@Bean
	public EhCacheManager createEhCacheManager() {
		EhCacheManager cacheManager = new EhCacheManager();
		String classpathLocation = "classpath:ehcache.xml";
		cacheManager.setCacheManagerConfigFile(classpathLocation);
		return cacheManager;
	}

	/**
	 * 后置处理器自动调用init()和销毁()方法，以实现spring配置的Shiro对象，
	 * 这样你就不必为每个bean定义指定一种方法和方法属性，甚至知道Shiro的对象需要这些方法来调用。
	 * 
	 * @return
	 */
	@Bean(name = "lifecycleBeanPostProcessor")
	public LifecycleBeanPostProcessor createLifecycleBeanPostProcessor() {
		LifecycleBeanPostProcessor lifecycleBeanPostProcessor = new LifecycleBeanPostProcessor();
		return lifecycleBeanPostProcessor;
	}

	@Bean
	public AuthorizationAttributeSourceAdvisor createAuthorizationAttributeSourceAdvisor() {
		AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
		advisor.setSecurityManager(createSecurityManager());
		return advisor;
	}

	/**
	 * 启用shiro注解
	 * 
	 * @return
	 */
	@Bean
	@DependsOn(value = "lifecycleBeanPostProcessor")
	public DefaultAdvisorAutoProxyCreator createDefaultAdvisorAutoProxyCreator() {
		DefaultAdvisorAutoProxyCreator autoProxyCreator = new DefaultAdvisorAutoProxyCreator();
		return autoProxyCreator;
	}

	/**
	 * 此设置相当于以前在application.xml文件中的配置，它定义了web启用的SecurityManager和shiroFilter此处的shiroFilter将从web.xml文件中引用，就是此类的shiroFilter()方法。
	 * 
	 * @return
	 */
	@Bean(name = "shiroFilter") // 此Bean的名称要与DelegatingFilterProxy设置的targetBeanName属性名称一致
	public ShiroFilterFactoryBean createShiroFilterFactory() {
		ShiroFilterFactoryBean factory = new ShiroFilterFactoryBean();
		factory.setSecurityManager(createSecurityManager());
		factory.setLoginUrl("/");
		factory.setSuccessUrl("/index.html");
		factory.setUnauthorizedUrl("/register.html");
		Map filterChainDefinitionMap = new LinkedHashMap();
		filterChainDefinitionMap.put("/static/**", "anon");
		filterChainDefinitionMap.put("/druid/**", "anon");
		filterChainDefinitionMap.put("/login", "anon");
		filterChainDefinitionMap.put("/**", "authc");
		factory.setFilterChainDefinitionMap(filterChainDefinitionMap);
		return factory;
	}

	/**
	 * 自定义realm
	 * 
	 * @return
	 */
	@Bean
	public Realm createRealm() {
		AuthorizingRealm realm = new ShiroRealm();
		// HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
		// credentialsMatcher.setHashAlgorithmName("MD5");
		// credentialsMatcher.setHashIterations(1024);
		// realm.setCredentialsMatcher(credentialsMatcher);
		return realm;
	}

如果想在Java服务器模版引擎Thymeleaf的模版中使用Shiro标签，请继续关注后续文章！！！