shiro 配置总结

1.web.xml中配置xml文件的路径和过滤器
 <!-- Spring ApplicationContext配置文件的路径,可使用通配符,多个路径用,号分隔
         此参数用于后面的Spring Context Loader -->
     <context-param>
         <param-name>contextConfigLocation</param-name>
         <param-value>
             classpath*:/applicationContext.xml
             classpath*:/applicationContext-shiro.xml
         </param-value>
     </context-param>  
 <!-- Shiro Security filter-->
     <filter>
         <filter-name>shiroFilter</filter-name>
         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
             <init-param>
                 <param-name>targetFilterLifecycle</param-name>
                  <param-value>true</param-value>
                </init-param>
     </filter>
     <filter-mapping>
         <filter-name>shiroFilter</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>  
 2.applicationContext-shiro.xml中配置
 
     <!-- 项目自定义的Realm -->
     <bean id="shiroDbRealm" class="com.pqc.tbk.service.account.ShiroDbRealm">
         <property name="userService" ref="userService"></property>
     </bean>

     <!-- 用户授权信息Cache 可以省略-->
     <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />

     <!-- Shiro's main business-tier object for web-enabled applications -->
     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"       depends-on="userDao">
         <property name="realm" ref="shiroDbRealm" />
         <property name="cacheManager" ref="cacheManager" />
     </bean>
     

     <!-- Shiro Filter -->
     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
         <property name="securityManager" ref="securityManager" />
         <property name="loginUrl" value="/user/loginTest" />
         <property name="successUrl" value="/" />
         <property name="filterChainDefinitions">
             <!-- 访问这些路径需要哪些哪些权限认证 此处很关键*****-->
             <value>
                 /user/loginTest = authc
                 /user/logout = logout
                 /static/** = anon
                 /** = user
              </value>
         </property>
     </bean>
     
     <!-- AOP式方法级权限检查   这两个类主要用于注解-->
     <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
         <property name="securityManager" ref="securityManager"/>
     </bean>
     <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>  
 3.spring-mvc.xml中配置
  
 <!-- shiro -->
     <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">  
         <property name="exceptionMappings">  
             <props>  
                 <prop key="org.apache.shiro.authz.UnauthorizedException">error/403</prop>  
             </props>  
         </property>  
     </bean>  
     <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
         <property name="securityManager" ref="securityManager"/>
     </bean>  
 4.define your ShiroDbRealm
  
 5.pox.xml
 <!-- SECURITY begin -->
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-core</artifactId>
             <version>${shiro.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-spring</artifactId>
             <version>${shiro.version}</version>
         </dependency>
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-web</artifactId>
             <version>${shiro.version}</version>
         </dependency>
         <!-- SECURITY end -->