1.加入依赖
<dependency> <groupId>org.crazycake</groupId> <artifactId>shiro-redis</artifactId> <version>2.4.2.1-RELEASE</version> </dependency> <dependency> <groupId>redis.clients</groupId> <artifactId>jedis</artifactId> <version>2.7.2</version> </dependency>2.配置shiro
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"> <!-- shiro的核心 所有安全操作都将通过securityManager来处理 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <!-- 缓存管理器 --> <property name="cacheManager" ref="cacheManager" /> <!-- session模式 native本地 http网络 --> <!-- <property name="sessionMode" value="native" /> --> <!-- realm 获取安全数据（如用户、角色、权限） --> <property name="realm" ref="jdbcRealm" /> <property name="sessionManager" ref="sessionManager" /> </bean> <!-- shiro redisManager --> <bean id="redisManager" class="org.crazycake.shiro.RedisManager"> <property name="host" value="127.0.0.1" /> <property name="port" value="7000" /> <property name="expire" value="1800" /> <property name="timeout" value="180000" /> <!-- <property name="password" value="111111" /> --> </bean> <!-- redisSessionDAO --> <bean id="redisSessionDAO" class="org.crazycake.shiro.RedisSessionDAO"> <property name="redisManager" ref="redisManager" /> </bean> <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> <property name="sessionIdUrlRewritingEnabled" value="false" /> <property name="sessionDAO" ref="redisSessionDAO"></property> </bean> <!-- 缓存管理器 --> <!-- cacheManager --> <bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager"> <property name="redisManager" ref="redisManager" /> </bean> <!-- 查询安全数据（用户，角色，权限等） --> <bean id="jdbcRealm" class="com.zcl.oa.shiro.CustomJdbcRealm"> <!-- 数据源 --> <property name="dataSource" ref="dataSource"></property> <!-- 开启查询权限 --> <property name="permissionsLookupEnabled" value="true"></property> <!-- 授权登录sql --> <property name="authenticationQuery" value="SELECT ui.pw FROM USER_INFO ui WHERE ui.login = ?"></property> <!-- 查询角色sql --> <property name="userRolesQuery" value="select ri.rolename from role_info ri,user_role ur,user_info ui where ri.roleid=ur.roleid and ur.userid=ui.userid and ui.login = ?"></property> <!-- 查询权限sql --> <property name="permissionsQuery" value="select rp.permissionid from role_permission rp,role_info ri where ri.roleid=rp.roleid and ri.rolename = ?"></property> </bean> <!-- 将shiro bean的生命周期交给spring管理 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /> <!-- 开启Shiro的注解 --> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" /> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager" /> </bean> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <property name="loginUrl" value="/login.jsp" /> <property name="successUrl" value="/index.jsp" /> <!-- 未授权跳转地址 --> <!-- <property name="unauthorizedUrl" value="/s/unauthorized" /> --> <!-- ? 匹配任意一个字符 /login? /login1 /logina * 匹配任意字符 /login* /login123 /loginabc123 /** 匹配任意地址 /login/** /login/xxx/xxx/xxx shiro 过滤器 anon 无需授权即可访问 authc 必须登录才能访问，不包括记住我登录 user 授权即可访问，包括记住我登录 logout 退出拦截器 --> <property name="filterChainDefinitions"> <value> /logout = logout /images/** = anon /userInfoAction_login.action* = anon /json/** = anon /css/** = anon /js/** = anon /** = authc </value> </property> </bean> </beans>
