shiro實例 環境準備 配置

這裏展示的是使用maven工程的：
pom.xml

<properties>
    <!-- spring版本號 -->
    <spring.version>4.3.2.RELEASE</spring.version>
    <!-- log4j日誌文件管理包版本 -->
    <log4j.version>1.2.17</log4j.version>
    <!-- junit版本號 -->
    <junit.version>4.12</junit.version>
    <!-- mybatis版本號 -->
    <mybatis.version>3.4.1</mybatis.version>
    <!-- aspectj -->
    <aspectj.version>1.8.9</aspectj.version>
    <!-- shiro版本 -->
    <shiro.version>1.2.4</shiro.version>
    <!-- druid 版本 -->
    <druid.version>1.1.2</druid.version>
  </properties>

  <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>${junit.version}</version>
      <scope>test</scope>
    </dependency>

    <!-- springmvc的依賴座標 -->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-core</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-context-support</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aop</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aspects</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-tx</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>${spring.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-web</artifactId>
      <version>${spring.version}</version>
    </dependency>

    <!-- mybatis依賴 -->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis</artifactId>
      <version>3.4.1</version>
      <scope>runtime</scope>
    </dependency>

    <!-- mybatis/springmvc-->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis-spring</artifactId>
      <version>1.3.0</version>
      <scope>runtime</scope>
    </dependency>

    <!-- mysql驅動包 -->
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>5.1.29</version>
    </dependency>

    <!-- 阿里數據連接池依賴 -->
    <dependency>
      <groupId>com.alibaba</groupId>
      <artifactId>druid</artifactId>
      <version>${druid.version}</version>
    </dependency>

    <dependency>
      <groupId>log4j</groupId>
      <artifactId>log4j</artifactId>
      <version>${log4j.version}</version>
    </dependency>

    <!-- 其中包含了衆多的java網絡編程的工具包 -->
    <dependency>
      <groupId>commons-net</groupId>
      <artifactId>commons-net</artifactId>
      <version>3.1</version>
    </dependency>

    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>3.1.0</version>
    </dependency>

    <!-- shiro -->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-core</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-ehcache</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-web</artifactId>
      <version>${shiro.version}</version>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>${shiro.version}</version>
    </dependency>

    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>2.8.2</version>
      <scope>runtime</scope>
    </dependency>

  </dependencies>

web.xml

<!-- shiro filter shiro核心 -->
<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
      <param-name>targetFilter</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>

  <filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

  <!-- Spring監聽器 加載配置 -->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:spring.xml,classpath:spring-shiro.xml</param-value>
  </context-param>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>

  <servlet>
    <servlet-name>springmvc</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:spring-mvc.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
    <!--<async-supported>true</async-supported>-->
  </servlet>
  <servlet-mapping>
    <servlet-name>springmvc</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>

spring.xml

<!-- 導入配置文件 -->
    <context:property-placeholder location="classpath:db.properties"/>

    <!-- druid 數據源 -->
    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource"
          init-method="init" destroy-method="close">
        <property name="driverClassName" value="${jdbc.driverClassName}" />
        <property name="url" value="${jdbc.url}" />
        <property name="username" value="${jdbc.username}" />
        <property name="password" value="${jdbc.password}" />
        <!-- 配置監控統計攔截的filters -->
        <property name="filters" value="stat" />
        <!-- 配置初始化大小、最小、最大 -->
        <property name="maxActive" value="20" />
        <property name="initialSize" value="1" />
        <property name="minIdle" value="1" />
        <!-- 配置獲取連接等待超時的時間 -->
        <property name="maxWait" value="60000" />
        <!-- 配置間隔多久才進行一次檢測，檢測需要關閉的空閒連接，單位是毫秒 -->
        <property name="timeBetweenEvictionRunsMillis" value="60000" />
        <!-- 配置一個連接在池中最小生存的時間，單位是毫秒 -->
        <property name="minEvictableIdleTimeMillis" value="300000" />
        <property name="testWhileIdle" value="true" />
        <property name="testOnBorrow" value="false" />
        <property name="testOnReturn" value="false" />
        <!-- 打開PSCache，並且指定每個連接上PSCache的大小 -->
        <property name="poolPreparedStatements" value="true" />
        <property name="maxOpenPreparedStatements" value="20" />
    </bean>

    <!-- 掃描mybatis -->
    <bean name="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
        <property name="dataSource" ref="dataSource" />
        <property name="typeAliasesPackage" value="com.zm.web_shiro.model" />
        <property name="mapperLocations" value="classpath:mapper/*Mapper.xml" />
    </bean>
    <!-- 掃描Mapper -->
    <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
        <property name="basePackage" value="com.zm.web_shiro.mapper" />
        <property name="sqlSessionFactoryBeanName" value="sqlSessionFactory" />
    </bean>

    <!-- 添加事務註解支持 -->
    <tx:annotation-driven transaction-manager="txManager"/>
    <bean id="txManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
        <property name="dataSource" ref="dataSource"/>
    </bean>

db.properties

jdbc.driverClassName=com.mysql.jdbc.Driver 
jdbc.url=jdbc:mysql://localhost:3306/數據庫名
jdbc.username=用戶名
jdbc.password=密碼

spring-mvc.xml

 <!-- 使用spring組件掃描@controller -->
    <context:component-scan base-package="com.zm.web_shiro.web"/>
    <!-- 通過annotation-driven可以替代下邊的處理器映射器和適配器 -->

    <!-- 視圖解析器 -->
    <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <!--<property name="viewClass" value="org.springframework.web.servlet.view.JstlView" />-->
        <property name="prefix" value="/"/>
        <property name="suffix" value=".jsp"/>
    </bean>

    <mvc:default-servlet-handler/>
    <mvc:annotation-driven/>

spring-shiro.xml

<!-- 會話管理器 -->
    <bean id="sessionManager"
          class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="globalSessionTimeout" value="1800000"/>
        <property name="deleteInvalidSessions" value="true"/>
        <property name="sessionValidationSchedulerEnabled" value="true" />
        <property name="sessionValidationScheduler" ref="sessionValidationScheduler" />
        <property name="sessionDAO" ref="sessionDAO" />
        <property name="sessionIdCookieEnabled" value="true" />
        <property name="sessionIdCookie" ref="sessionIdCookie" />
        <property name="cacheManager" ref="cacheManager" />
    </bean>

    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
        <property name="sessionIdGenerator" ref="sessionIdGenerator" />
        <property name="activeSessionsCacheName" value="shiro-activeSessionCache" />
    </bean>

    <bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>

    <!-- 會話驗證調度器 -->
    <bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.ExecutorServiceSessionValidationScheduler">
        <property name="interval" value="1800000" />
        <property name="sessionManager" ref="sessionManager" />
    </bean>

    <!-- 會話管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 設置安全管理器的安全數據源爲自定義的 Realm -->
        <!-- By default the servlet container sessions will be used.  Uncomment this line
            to use shiro's native sessions (see the JavaDoc for more): -->
        <property name="realm" ref="myRealm"/>
        <property name="sessionManager" ref="sessionManager"/>
        <property name="cacheManager" ref="cacheManager"/>
        <property name="rememberMeManager" ref="rememberMeManager" />
    </bean>

    <!-- 配置緩存管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
    </bean>

    <!-- rememberMe管理器 -->
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
    <!-- rememberMe cookie加密的密鑰 建議每個項目都不一樣 默認AES算法 密鑰長度（128 256 512 位）-->
    <property name="cipherKey"
    value="#{T(org.apache.shiro.codec.Base64).decode('3AvVhmFLUs0KTA3Kprsdag==')}"/>
    <property name="cookie" ref="rememberMeCookie"/>
</bean>

    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie" >
        <constructor-arg value="sid" />
        <property name="httpOnly" value="true" />
        <property name="maxAge" value="-1" /><!--每當瀏覽器關閉清除-->
    </bean>
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe"/>
        <property name="httpOnly" value="true"/>
        <property name="maxAge" value="604800"/> <!--7天 -->
    </bean>

    <bean id="myRealm" class="com.zm.web_shiro.realm.CustomRealm">
       <!-- <property name="userService" ref="userService"/>-->
        <!-- 配置緩存相關 -->
        <!-- 啓用緩存 -->
        <property name="cachingEnabled" value="true"/>
        <!-- 開啓認證緩存-->
        <property name="authenticationCachingEnabled" value="true"/>
        <!-- 指定認證緩存的名字(與 ehcache.xml 中聲明的相同) -->
        <property name="authenticationCacheName" value="authenticationCache"/>
        <!--開啓授權緩存-->
        <property name="authorizationCachingEnabled" value="true"/>
        <!-- 指定授權緩存的名字(與 ehcache.xml 中聲明的相同) -->
        <property name="authorizationCacheName" value="authorizationCache"/>
    </bean>

    <!-- 自定義filter -->
    <bean id="VcodeControlFilter" class="com.zm.web_shiro.web.filter.VcodeControlFilter" />
    <bean id="accessControlFilter" class="com.zm.web_shiro.web.filter.CustomAccessControlFilter" />
    <bean id="KickoutSessionControlFilter" class="com.zm.web_shiro.web.filter.KickoutSessionControlFilter" >
        <property name="sessionManager" ref="sessionManager"/>
        <property name="cacheManager" ref="cacheManager"/>
        <property name="kickoutAfter" value="false"/>
        <property name="maxSession" value="1"/>
        <property name="kickoutUrl" value="/jsp/login.jsp?kickout=1"/>
    </bean>

    <bean id="userService" class="com.zm.web_shiro.service.impl.UserServiceImpl" />
    <!-- Shiro生命週期處理器 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    <!-- 此處名字需與web.xml中相同 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/jsp/login.jsp"/>
        <property name="unauthorizedUrl" value="/jsp/unauthorized.jsp"/>
        <property name="filterChainDefinitions">
            <value>
                /index.jsp = anon
                /unauthorized.jsp = anon
                /jsp/login.jsp = anon
                /jsp/admin.jsp = authc,KickoutSessionControlFilter
                /jsp/user.jsp = user,KickoutSessionControlFilter
                /login/doLogout = logout
                /login/code = VcodeControlFilter
                /login/** = accessControlFilter
                /jsp/** = user,KickoutSessionControlFilter
                <!-- 資源 -->
                /css/** = anon
                /js/** = anon
            </value>
        </property>
        <property name="filters">
            <map>
                <entry key="accessControlFilter" value-ref="accessControlFilter" />
                <entry key="KickoutSessionControlFilter" value-ref="KickoutSessionControlFilter" />
                <entry key="VcodeControlFilter" value-ref="VcodeControlFilter" />
            </map>
        </property>
    </bean>

ehcache-shiro.xml

<ehcache>
    <!--diskStore：緩存數據持久化的目錄 地址  -->
    <diskStore path="E:\cache\ehcache" />
    <!--<diskStore path="java.io.tmpdir"/>--> <!-- 系統的默認臨時文件路徑 -->
    <defaultCache
            maxElementsInMemory="10000"
            maxElementsOnDisk="10000000"
            eternal="false"
            timeToIdleSeconds="120"
            timeToLiveSeconds="120"
            overflowToDisk="false"
            diskPersistent="false"
            diskExpiryThreadIntervalSeconds="120"
            memoryStoreEvictionPolicy="LRU"
    />
    <!-- 登錄記錄緩存 鎖定10分鐘 -->
    <cache name="passwordRetryCache"
           maxEntriesLocalHeap="2000"
           eternal="false"
           timeToIdleSeconds="3600"
           timeToLiveSeconds="0"
           overflowToDisk="false"
           statistics="true">
    </cache>
    <!-- 併發登陸，管理會話緩存 -->
    <cache name="shiro-activeSessionCache" eternal="false"
           maxElementsInMemory="10000"
           overflowToDisk="true"
           timeToIdleSeconds="0"
           timeToLiveSeconds="0"/>
    <!-- 授權緩存 -->
    <cache name="authenticationCache"
           maxEntriesLocalHeap="2000"
           eternal="false"
           timeToIdleSeconds="3600"
           overflowToDisk="false"
           statistics="true">
    </cache>
    <!-- 認證緩存 -->
    <cache name="authorizationCache"
           maxEntriesLocalHeap="2000"
           eternal="false"
           timeToIdleSeconds="3600"
           overflowToDisk="false"
           statistics="true">
    </cache>
</ehcache>

log4j.properties

#定義LOG輸出級別
log4j.rootLogger=INFO,Console,File
#定義日誌輸出目的地爲控制檯
log4j.appender.Console=org.apache.log4j.ConsoleAppender
log4j.appender.Console.Target=system.out
#可以靈活地指定日誌輸出格式，下面一行是指定具體的格式 %d [%t]%-5p [%c] - %m%n
log4j.appender.Console.layout = org.apache.log4j.PatternLayout
log4j.appender.Console.layout.ConversionPattern=[%d{yyyy-MM-dd HH\:mm\:ss}][%c]%m%n

#文件大小到達指定尺寸的時候產生一個新的文件
log4j.appender.File = org.apache.log4j.RollingFileAppender
#指定輸出目錄
log4j.appender.File.File = e:/logs/web_shiro.log
#定義文件最大大小
log4j.appender.File.MaxFileSize = 10MB
# 輸出所以日誌，如果換成DEBUG表示輸出DEBUG以上級別日誌
log4j.appender.File.Threshold = ALL
log4j.appender.File.layout = org.apache.log4j.PatternLayout
log4j.appender.File.layout.ConversionPattern =[%p] [%d{yyyy-MM-dd HH\:mm\:ss}][%c]%m%n