diff --git a/boot-web/pom.xml b/boot-web/pom.xml
index 4df0510..858ba3a 100644
--- a/boot-web/pom.xml
+++ b/boot-web/pom.xml
@@ -58,6 +58,10 @@
+
+ org.springframework
+ spring-context-support
+
org.springframework.boot
@@ -81,16 +85,11 @@
commons-fileupload
${fileUpLoad.version}
-
+
org.crazycake
shiro-redis
- 1.1.0-RELEASE
-
-
- org.apache.shiro
- shiro-quartz
- 1.2.3
+ 2.4.2.1-RELEASE
diff --git a/boot-web/src/main/java/com/xwbing/shiro/FormAuthenticationCaptchaFilter.java b/boot-web/src/main/java/com/xwbing/shiro/FormAuthenticationCaptchaFilter.java
deleted file mode 100644
index 7666f9c..0000000
--- a/boot-web/src/main/java/com/xwbing/shiro/FormAuthenticationCaptchaFilter.java
+++ /dev/null
@@ -1,38 +0,0 @@
-package com.xwbing.shiro;
-
-import org.apache.shiro.authc.AuthenticationToken;
-import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
-import org.apache.shiro.web.util.WebUtils;
-
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-
-/**
- * 项目名称: boot-module-demo
- * 创建时间: 2018/3/29 15:28
- * 作者: xiangwb
- * 说明:
- */
-public class FormAuthenticationCaptchaFilter extends FormAuthenticationFilter {
- public static final String DEFAULT_CAPTCHA_PARAM = "captcha_code";
- private String captchaParam = DEFAULT_CAPTCHA_PARAM;
-
- public String getCaptchaParam() {
- return captchaParam;
- }
-
- protected String getCaptcha(ServletRequest request) {
- return WebUtils.getCleanParam(request, getCaptchaParam());
-
- }
-
- @Override
- protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
- String username = getUsername(request);
- String password = getPassword(request);
- String captcha = getCaptcha(request);
- boolean rememberMe = isRememberMe(request);
- String host = getHost(request);
- return new UsernamePasswordCaptchaToken(username, password.toCharArray(), rememberMe, host, captcha);
- }
-}
diff --git a/boot-web/src/main/java/com/xwbing/shiro/MySessionManager.java b/boot-web/src/main/java/com/xwbing/shiro/MySessionManager.java
deleted file mode 100644
index badc557..0000000
--- a/boot-web/src/main/java/com/xwbing/shiro/MySessionManager.java
+++ /dev/null
@@ -1,41 +0,0 @@
-package com.xwbing.shiro;
-
-import org.apache.commons.lang3.StringUtils;
-import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
-import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
-import org.apache.shiro.web.util.WebUtils;
-
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import java.io.Serializable;
-
-/**
- * 项目名称: boot-module-demo
- * 创建时间: 2018/3/29 16:29
- * 作者: xiangwb
- * 说明: 自定义sessionId获取
- */
-public class MySessionManager extends DefaultWebSessionManager {
- private static final String AUTHORIZATION = "Authorization";
-
- private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request";
-
- public MySessionManager() {
- super();
- }
-
- @Override
- protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
- String id = WebUtils.toHttp(request).getHeader(AUTHORIZATION);
- //如果请求头中有 Authorization 则其值为sessionId
- if (StringUtils.isNotEmpty(id)) {
- request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
- request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
- request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
- return id;
- } else {
- //否则按默认规则从cookie取sessionId
- return super.getSessionId(request, response);
- }
- }
-}
diff --git a/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java b/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java
index d717ec8..087ed75 100644
--- a/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java
+++ b/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java
@@ -8,6 +8,8 @@ import com.xwbing.service.sys.SysAuthorityService;
import com.xwbing.service.sys.SysRoleService;
import com.xwbing.service.sys.SysUserService;
import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
@@ -90,11 +92,11 @@ public class MyShiroRealm extends AuthorizingRealm {
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) {
UsernamePasswordCaptchaToken captchaToken = (UsernamePasswordCaptchaToken) authenticationToken;
//1.校验验证码
-// String captcha = captchaToken.getCaptcha();
-// String imgCode = (String) SecurityUtils.getSubject().getSession().getAttribute(CommonConstant.KEY_CAPTCHA);
-// if (StringUtils.isEmpty(captcha) || !captcha.equalsIgnoreCase(imgCode)) {
-// throw new AuthenticationException("验证码错误");
-// }
+ String captcha = captchaToken.getCaptcha();
+ String imgCode = (String) SecurityUtils.getSubject().getSession().getAttribute(CommonConstant.KEY_CAPTCHA);
+ if (StringUtils.isEmpty(captcha) || !captcha.equalsIgnoreCase(imgCode)) {
+ throw new AuthenticationException("验证码错误");
+ }
//2.查是否有此用户
SysUser user = sysUserService.getByUserName(captchaToken.getUsername());
if (user == null) {
diff --git a/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java b/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java
index 756250a..d6e9388 100644
--- a/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java
+++ b/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java
@@ -8,7 +8,13 @@ import org.apache.shiro.web.filter.authc.AnonymousFilter;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
+import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
+import org.crazycake.shiro.RedisCacheManager;
+import org.crazycake.shiro.RedisManager;
+import org.crazycake.shiro.RedisSessionDAO;
+import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -30,18 +36,14 @@ import java.util.Map;
* 说明: anon,authc
*/
@Configuration
-@PropertySource("classpath:shiro.properties")
+@PropertySource("classpath:redis.properties")
public class ShiroConfig {
- @Value("${rememberMeCookieMaxAge}")
- private Integer rememberMeCookieMaxAge;
- @Value("${globalSessionTimeout}")
- private Long globalSessionTimeout;
- @Value("${sessionValidationInterval}")
- private String sessionValidationInterval;
- @Value("${sessionsCacheName}")
- private String sessionsCacheName;
- @Value("${sessionIdCookieName}")
- private String sessionIdCookieName;
+ @Value("${host}")
+ private String host;
+ @Value("${port}")
+ private Integer port;
+ @Value("${timeout}")
+ private Integer timeOut;
/**
* 此处核心,对多个filter进行管理，其它filer设置不自动加载，作为过滤链条使用
@@ -98,89 +100,68 @@ public class ShiroConfig {
//登出
chains.put("/user/logout", "anon");
//必须通过验证或者rememberMe
- chains.put("/**", "user,authc");
+ chains.put("/**", "user,authc,sessionFilter");
shiroFilterFactoryBean.setFilterChainDefinitionMap(chains);
return shiroFilterFactoryBean;
}
- /////////////////securityManager///////////////////
+ ///////////////////////securityManager///////////////////
@Bean
public SecurityManager securityManager() {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(shiroRealm());
-// securityManager.setCacheManager(cacheManager());
-// securityManager.setSessionManager(defaultWebSessionManager());
+ securityManager.setCacheManager(cacheManager());
+ securityManager.setSessionManager(sessionManager());
securityManager.setRememberMeManager(rememberMeManager());
return securityManager;
}
- ///////////////////shiroRealm///////////////////
+ ///////////////////////shiroRealm///////////////////
@Bean
- @DependsOn(value = "lifecycleBeanPostProcessor")
+ @DependsOn("lifecycleBeanPostProcessor")
public MyShiroRealm shiroRealm() {
MyShiroRealm myShiroRealm = new MyShiroRealm();
-// myShiroRealm.setCacheManager(cacheManager());
+ myShiroRealm.setCacheManager(cacheManager());
myShiroRealm.setAuthorizationCachingEnabled(false);
-// //启用身份验证缓存,即缓存AuthenticationInfo信息，默认false
-// myShiroRealm.setAuthenticationCachingEnabled(true);
-// //缓存AuthenticationInfo信息的缓存名称
-// myShiroRealm.setAuthenticationCacheName("authenticationCache");
-// //缓存AuthorizationInfo信息的缓存名称
-// myShiroRealm.setAuthorizationCacheName("authorizationCache");
return myShiroRealm;
}
- ///////////////////cacheManager////////////////
-// @Bean
-// public RedisCacheManager cacheManager() {
-// RedisManager redisManager = new RedisManager();
-// redisManager.setExpire(333333333);
-// redisManager.setHost("192.168.11.202");
-// redisManager.setPort(6379);
-// RedisCacheManager cacheManager = new RedisCacheManager();
-// cacheManager.setRedisManager(redisManager);
-// return cacheManager;
-// }
-// //////////////////////sessionManager//////////////////
-//
-// @Bean
-// public SessionManager defaultWebSessionManager() {
-// DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
-// sessionManager.setCacheManager(cacheManager());
-// sessionManager.setGlobalSessionTimeout(globalSessionTimeout);
-// sessionManager.setDeleteInvalidSessions(true);
-// sessionManager.setSessionValidationSchedulerEnabled(true);
-// sessionManager.setDeleteInvalidSessions(true);
-//// sessionManager.setSessionValidationScheduler(sessionValidationScheduler());
-// sessionManager.setSessionIdCookie(sessionIdCookie());
-// sessionManager.setSessionIdCookieEnabled(true);
-// sessionManager.setSessionDAO(sessionDAO());
-// return sessionManager;
-// }
-//
-// @Bean
-// public SimpleCookie sessionIdCookie() {
-// SimpleCookie simpleCookie = new SimpleCookie(sessionIdCookieName);
-// simpleCookie.setHttpOnly(true);
-// simpleCookie.setMaxAge(-1);//
-// return simpleCookie;
-// }
-//
-// @Bean
-// public EnterpriseCacheSessionDAO sessionDAO() {
-// EnterpriseCacheSessionDAO sessionDAO = new EnterpriseCacheSessionDAO();
-// sessionDAO.setActiveSessionsCacheName("shiro-activeSessionCache");
-// sessionDAO.setSessionIdGenerator(new JavaUuidSessionIdGenerator());
-// return sessionDAO;
-// }
+ ///////////////////////redisManager///////////////////
+ @Bean
+ public RedisManager redisManager() {
+ RedisManager redisManager = new RedisManager();
+ redisManager.setHost("192.168.11.202");
+ redisManager.setPort(6379);
+ redisManager.setExpire(1800);//配置缓存过期时间
+ redisManager.setTimeout(10000);
+ return redisManager;
+ }
- //////////////rememberMeManager//////////////////
+ ///////////////////////cacheManager///////////////////
+ @Bean
+ @DependsOn("lifecycleBeanPostProcessor")
+ public RedisCacheManager cacheManager() {
+ RedisCacheManager redisCacheManager = new RedisCacheManager();
+ redisCacheManager.setRedisManager(redisManager());
+ return redisCacheManager;
+ }
- /**
- * cookie管理对象,记住我功能
- *
- * @return
- */
+ ///////////////////////sessionManager///////////////////
+ @Bean
+ public DefaultWebSessionManager sessionManager() {
+ DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
+ sessionManager.setSessionDAO(redisSessionDAO());
+ return sessionManager;
+ }
+
+ @Bean
+ public RedisSessionDAO redisSessionDAO() {
+ RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
+ redisSessionDAO.setRedisManager(redisManager());
+ return redisSessionDAO;
+ }
+
+ ///////////////////////rememberMeManager///////////////////
@Bean
public CookieRememberMeManager rememberMeManager() {
CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
@@ -190,11 +171,6 @@ public class ShiroConfig {
return cookieRememberMeManager;
}
- /**
- * cookie对象;
- *
- * @return
- */
@Bean
public SimpleCookie rememberMeCookie() {
//这个参数是cookie的名称,对应前端的checkbox的name = rememberMe
@@ -204,7 +180,7 @@ public class ShiroConfig {
return simpleCookie;
}
- /////////////////////////urlPermissionsFilter//////////////////
+ ///////////////////////urlPermissionsFilter///////////////////
@Bean
public FilterRegistrationBean urlPermissionsFilterRegistrationBean(UrlPermissionsFilter urlPermissionsFilter) {
FilterRegistrationBean registration = new FilterRegistrationBean(urlPermissionsFilter);
@@ -218,14 +194,18 @@ public class ShiroConfig {
return new UrlPermissionsFilter();
}
- /////////////////////sessionFilter//////////////////////////////////////
+ /**
+ * session超时过滤
+ *
+ * @return
+ */
@Bean(name = "sessionFilter")
public SessionFilter sessionFilter() {
return new SessionFilter();
}
/**
- * 保证实现了Shiro内部lifecycle函数的bean执行 Shiro生命周期处理器
+ * Shiro生命周期处理器
*
* @return
*/
@@ -234,6 +214,7 @@ public class ShiroConfig {
return new LifecycleBeanPostProcessor();
}
+
/**
* AOP式方法级权限检查
*
@@ -246,4 +227,15 @@ public class ShiroConfig {
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
+
+ /**
+ * Spring的一个bean，由Advisor决定对哪些类的方法进行AOP代理。
+ */
+ @Bean
+ @ConditionalOnMissingBean
+ public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
+ DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
+ defaultAAP.setProxyTargetClass(true);
+ return defaultAAP;
+ }
}
diff --git a/boot-web/src/main/resources/shiro.properties b/boot-web/src/main/resources/shiro.properties
deleted file mode 100644
index 49c04a9..0000000
--- a/boot-web/src/main/resources/shiro.properties
+++ /dev/null
@@ -1,7 +0,0 @@
-### s
-rememberMeCookieMaxAge=604800
-globalSessionTimeout=1800000
-sessionValidationInterval=60000
-sessionsCacheName=shiro-activeSessionCache
-sessionIdCookieName=drore.session.ywjpjScenic.id
-path=/
\ No newline at end of file