1
1
package com .study .config .shiro ;
2
2
3
+ import com .github .pagehelper .util .StringUtil ;
4
+ import com .study .model .Resources ;
5
+ import com .study .service .ResourcesService ;
3
6
import org .apache .shiro .authc .credential .HashedCredentialsMatcher ;
7
+ import org .apache .shiro .spring .LifecycleBeanPostProcessor ;
4
8
import org .apache .shiro .spring .security .interceptor .AuthorizationAttributeSourceAdvisor ;
5
9
import org .apache .shiro .spring .web .ShiroFilterFactoryBean ;
10
+ import org .springframework .beans .factory .annotation .Autowired ;
6
11
import org .springframework .context .annotation .Bean ;
7
12
import org .springframework .context .annotation .Configuration ;
8
13
import org .apache .shiro .web .mgt .DefaultWebSecurityManager ;
9
14
import org .apache .shiro .mgt .SecurityManager ;
10
15
16
+ import javax .annotation .Resource ;
11
17
import java .util .LinkedHashMap ;
18
+ import java .util .List ;
12
19
import java .util .Map ;
13
20
14
21
/**
15
22
* Created by yangqj on 2017年4月23日.
16
23
*/
17
24
@ Configuration
18
25
public class ShiroConfig {
26
+ @ Autowired (required = false )
27
+ private ResourcesService resourcesService ;
19
28
20
29
/**
21
30
* ShiroFilterFactoryBean 处理拦截资源文件问题。
@@ -35,22 +44,36 @@ public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager){
35
44
36
45
// 必须设置 SecurityManager
37
46
shiroFilterFactoryBean .setSecurityManager (securityManager );
47
+ // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
48
+ shiroFilterFactoryBean .setLoginUrl ("/login" );
49
+ // 登录成功后要跳转的链接
50
+ shiroFilterFactoryBean .setSuccessUrl ("/user" );
51
+ //未授权界面;
52
+ shiroFilterFactoryBean .setUnauthorizedUrl ("/403" );
38
53
//拦截器.
39
54
Map <String ,String > filterChainDefinitionMap = new LinkedHashMap <String ,String >();
40
55
41
56
//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
42
57
filterChainDefinitionMap .put ("/logout" , "logout" );
43
- filterChainDefinitionMap .put ("/static/**" ,"anon" );
58
+ filterChainDefinitionMap .put ("/css/**" ,"anon" );
59
+ filterChainDefinitionMap .put ("/js/**" ,"anon" );
60
+ filterChainDefinitionMap .put ("/img/**" ,"anon" );
61
+ filterChainDefinitionMap .put ("/font-awesome/**" ,"anon" );
44
62
//<!-- 过滤链定义,从上向下顺序执行,一般将 /**放在最为下边 -->:这是一个坑呢,一不小心代码就不好使了;
45
63
//<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
46
64
filterChainDefinitionMap .put ("/user" , "authc" );
65
+ //自定义加载权限资源关系
66
+ List <Resources > resourcesList = resourcesService .selectByExample (new Resources ());
67
+ for (Resources resources :resourcesList ){
68
+
69
+ if (StringUtil .isNotEmpty (resources .getResurl ())&& StringUtil .isNotEmpty (resources .getReskey ())) {
70
+ String permission = "perms[" + resources .getReskey ()+ "]" ;
71
+ System .out .println (resources .getResurl ()+"---" +permission );
72
+ filterChainDefinitionMap .put (resources .getResurl (),permission );
73
+ }
74
+ }
47
75
filterChainDefinitionMap .put ("/**" , "authc" );
48
- // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
49
- shiroFilterFactoryBean .setLoginUrl ("/login" );
50
- // 登录成功后要跳转的链接
51
- shiroFilterFactoryBean .setSuccessUrl ("/user" );
52
- //未授权界面;
53
- shiroFilterFactoryBean .setUnauthorizedUrl ("/403" );
76
+
54
77
55
78
shiroFilterFactoryBean .setFilterChainDefinitionMap (filterChainDefinitionMap );
56
79
return shiroFilterFactoryBean ;
@@ -103,4 +126,15 @@ public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(S
103
126
return authorizationAttributeSourceAdvisor ;
104
127
}
105
128
129
+ /**
130
+ * LifecycleBeanPostProcessor,这是个DestructionAwareBeanPostProcessor的子类,
131
+ * 负责org.apache.shiro.util.Initializable类型bean的生命周期的,初始化和销毁。
132
+ * 主要是AuthorizingRealm类的子类,以及EhCacheManager类。
133
+ */
134
+ @ Bean (name = "lifecycleBeanPostProcessor" )
135
+ public LifecycleBeanPostProcessor lifecycleBeanPostProcessor () {
136
+ return new LifecycleBeanPostProcessor ();
137
+ }
138
+
139
+
106
140
}
0 commit comments