1.加入依赖
<dependency>
<groupId>org.crazycake</groupId>
<artifactId>shiro-redis</artifactId>
<version>2.4.2.1-RELEASE</version>
</dependency>
<dependency>
<groupId>redis.clients</groupId>
<artifactId>jedis</artifactId>
<version>2.7.2</version>
</dependency>
2.配置shiro
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
<!-- shiro的核心 所有安全操作都将通过securityManager来处理 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- 缓存管理器 -->
<property name="cacheManager" ref="cacheManager" />
<!-- session模式 native本地 http网络 -->
<!-- <property name="sessionMode" value="native" /> -->
<!-- realm 获取安全数据(如用户、角色、权限) -->
<property name="realm" ref="jdbcRealm" />
<property name="sessionManager" ref="sessionManager" />
</bean>
<!-- shiro redisManager -->
<bean id="redisManager" class="org.crazycake.shiro.RedisManager">
<property name="host" value="127.0.0.1" />
<property name="port" value="7000" />
<property name="expire" value="1800" />
<property name="timeout" value="180000" />
<!-- <property name="password" value="111111" /> -->
</bean>
<!-- redisSessionDAO -->
<bean id="redisSessionDAO" class="org.crazycake.shiro.RedisSessionDAO">
<property name="redisManager" ref="redisManager" />
</bean>
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="sessionIdUrlRewritingEnabled" value="false" />
<property name="sessionDAO" ref="redisSessionDAO"></property>
</bean>
<!-- 缓存管理器 -->
<!-- cacheManager -->
<bean id="cacheManager" class="org.crazycake.shiro.RedisCacheManager">
<property name="redisManager" ref="redisManager" />
</bean>
<!-- 查询安全数据(用户,角色,权限等) -->
<bean id="jdbcRealm" class="com.zcl.oa.shiro.CustomJdbcRealm">
<!-- 数据源 -->
<property name="dataSource" ref="dataSource"></property>
<!-- 开启查询权限 -->
<property name="permissionsLookupEnabled" value="true"></property>
<!-- 授权登录sql -->
<property name="authenticationQuery"
value="SELECT ui.pw FROM USER_INFO ui WHERE ui.login = ?"></property>
<!-- 查询角色sql -->
<property name="userRolesQuery"
value="select ri.rolename from role_info ri,user_role ur,user_info ui where ri.roleid=ur.roleid and ur.userid=ui.userid and ui.login = ?"></property>
<!-- 查询权限sql -->
<property name="permissionsQuery"
value="select rp.permissionid from role_permission rp,role_info ri where ri.roleid=rp.roleid and ri.rolename = ?"></property>
</bean>
<!-- 将shiro bean的生命周期交给spring管理 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<!-- 开启Shiro的注解 -->
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor" />
<bean
class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/login.jsp" />
<property name="successUrl" value="/index.jsp" />
<!-- 未授权跳转地址 -->
<!-- <property name="unauthorizedUrl" value="/s/unauthorized" /> -->
<!--
? 匹配任意一个字符 /login? /login1 /logina
* 匹配任意字符 /login* /login123 /loginabc123
/** 匹配任意地址 /login/** /login/xxx/xxx/xxx
shiro 过滤器
anon 无需授权即可访问
authc 必须登录才能访问,不包括记住我登录
user 授权即可访问,包括记住我登录
logout 退出拦截器
-->
<property name="filterChainDefinitions">
<value>
/logout = logout
/images/** = anon
/userInfoAction_login.action* = anon
/json/** = anon
/css/** = anon
/js/** = anon
/** = authc
</value>
</property>
</bean>
</beans>