springboot+shiro：ShiroConfiguration配置

1.EhCacheManager EhCache缓存管理也可将shiro session存入redis中

    @Beanpublic EhCacheManager getEhCacheManager() {EhCacheManager em = new EhCacheManager();em.setCacheManagerConfigFile("classpath:ehcache-shiro.xml");return em;}

ehcache-shiro.xml中的配置

<?xml version="1.0" encoding="utf-8"?><ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="ehcache.xsd"><diskStore path="java.io.tmpdir"/><defaultCache maxElementsInMemory="10000" eternal="false" timeToIdleSeconds="30" timeToLiveSeconds="30" overflowToDisk="false"/><!--配置自定义缓存maxElementsInMemory：缓存中允许创建的最大对象数eternal：缓存中对象是否为永久的，如果是，超时设置将被忽略，对象从不过期。timeToIdleSeconds：缓存数据的钝化时间，也就是在一个元素消亡之前，两次访问时间的最大时间间隔值，这只能在元素不是永久驻留时有效，如果该值是 0 就意味着元素可以停顿无穷长的时间。timeToLiveSeconds：缓存数据的生存时间，也就是一个元素从构建到消亡的最大时间间隔值，这只能在元素不是永久驻留时有效，如果该值是0就意味着元素可以停顿无穷长的时间。overflowToDisk：内存不足时，是否启用磁盘缓存。memoryStoreEvictionPolicy：缓存满了之后的淘汰算法。--><cache name="erpCache"maxElementsInMemory="10000"eternal="true"overflowToDisk="false"timeToIdleSeconds="0"timeToLiveSeconds="600"memoryStoreEvictionPolicy="LFU" />
</ehcache>

2.配置 LifecycleBeanPostProcessor（管理shiro Bean的生命周期)

 public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {return new LifecycleBeanPostProcessor();}

3.配置 DefaultAdvisorAutoProxyCreator（用来扫描上下文，寻找所有的Advistor，将这些Advistor应用到符合其定义的切入点的Bean中）

	@Beanpublic DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();daap.setProxyTargetClass(true);return daap;}

4.配置SecurityManager (管理器，管理subject及其相关的登陆验证，授权等，需配置realm和缓存管理)

    @Bean(name = "securityManager")public DefaultWebSecurityManager getDefaultWebSecurityManager(SystemAuthorizingRealm realm) {DefaultWebSecurityManager dwsm = new DefaultWebSecurityManager();dwsm.setRealm(realm);
//      <!-- 用户授权/认证信息Cache, 采用EhCache 缓存 ,此处是使用EhCache,可换成redis缓存--> dwsm.setCacheManager(getEhCacheManager());return dwsm;}

5.配置 AuthorizationAttributeSourceAdvisor（开启shiro spring aop 权限注解支持，即：@RequiresPermissions(“权限code”)

    @Beanpublic AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();aasa.setSecurityManager(securityManager);return aasa;}

6.配置shiroFilter

    @Bean(name = "shiroFilter")public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager, UserService userService,MaterialCategoryService materialCategoryMapper,PermissionsServcie permissionsServcie,OrgService orgService) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();// 必须设置 SecurityManager  shiroFilterFactoryBean.setSecurityManager(securityManager);// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面shiroFilterFactoryBean.setLoginUrl("/login");// 登录成功后要跳转的连接shiroFilterFactoryBean.setSuccessUrl("/user");shiroFilterFactoryBean.setUnauthorizedUrl("/403");//设置过滤链的私有方法loadShiroFilterChain(shiroFilterFactoryBean, userService,materialCategoryMapper,permissionsServcie,orgService);return shiroFilterFactoryBean;}

7.private loadShiroFilterChain 私有过滤链定义，供6使用

/*** 加载shiroFilter权限控制规则（从数据库读取然后配置）*/private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean, UserService userService, MaterialCategoryService materialCategoryMapper, PermissionsServcie permissionsServcie, OrgService orgService) {//拦截规则，//CaptchaFormAuthenticationFilter extends FormAuthenticationFilter（shiro认证）//MapLogoutFilter  extends org.apache.shiro.web.filter.authc.LogoutFilter(shiro Logout)Map<String, Filter> filters = shiroFilterFactoryBean.getFilters();filters.put("authc", new CaptchaFormAuthenticationFilter(userService,materialCategoryMapper, permissionsServcie,orgService));filters.put("logout", new MapLogoutFilter());/// 下面这些规则配置最好配置到配置文件中 ///Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();// authc：该过滤器下的页面必须验证后才能访问，它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilterfilterChainDefinitionMap.put("/myCode/**", "authc");// 这里为了测试，只限制/user，实际开发中请修改为具体拦截的请求规则// anon：它对应的过滤器里面是空的,什么都没做logger.info("##################从数据库读取权限规则，加载到shiroFilter中##################");filterChainDefinitionMap.put("/user/edit/**", "authc,perms[user:edit]");// 这里为了测试，固定写死的值，也可以从数据库或其他配置中读取//什么请求对应什么拦截规则filterChainDefinitionMap.put("/login", "authc");filterChainDefinitionMap.put("/logout", "logout");filterChainDefinitionMap.put("/**", "anon");//anon 可以理解为不拦截shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);}