@Configuration

public class ShiroConfig {

    /**

     * 配置ShiroFilterFactoryBean

     *

     * @param securityManager

     * @return

     */

    @Bean

    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {

        System.out.println("执行 ShiroFilterFactoryBean shiroFilter");

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        //必须设置securityManager

        shiroFilterFactoryBean.setSecurityManager(securityManager);

        //需要登录的接口:如果访问某个接口,需要登录却没有登录,则调用此接口,如果前端后端不分离,则跳转到html页面

        shiroFilterFactoryBean.setLoginUrl("/pub/need_login");

        //登录成功 跳转url,如果前后端分离,则没这个调用 --这里设置为首页就行了

        shiroFilterFactoryBean.setSuccessUrl("/");

        //登录成功,但是没有权限,未授权就会调用这个接口,如果不是前后端分离,则跳转到403页面

        shiroFilterFactoryBean.setUnauthorizedUrl("/pub/not_permit");

        //设置自定义filter

        Map<String, Filter> filterMap = new LinkedHashMap<>();

        filterMap.put("roleOrFilter", new CustomRoleFilter());

        //shiroFilterFactoryBean绑定自定义的filter

        shiroFilterFactoryBean.setFilters(filterMap);

        //过滤器链的map

        //拦截器(过滤器路径,坑一必须要用LinkedhashMap),部分路径无法进行拦截

        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

        /*

        ********************************************

        通常是配置这些过滤器,也可以用个数据库的动态加载,这些数据

         ********************************************/

        //退出过滤器

        filterChainDefinitionMap.put("/logout", "logout");

        //匿名可以访问,也就是游客模式

        filterChainDefinitionMap.put("/pub/**", "anon");

        //登录用户才可以访问

        filterChainDefinitionMap.put("/authc/**", "authc");

        //管理员角色才可以访问

        filterChainDefinitionMap.put("/admin/**", "roles[admin]");

        //有编辑权限才可以访问

        filterChainDefinitionMap.put("/video/update", "perms[video_update]");

        //坑二:过滤器是顺序执行,从上而下,一般来说/** 放到最下面

        //authc: url定义必须通过认证才可以访问

        //anno:  url可以匿名访问

        filterChainDefinitionMap.put("/**", "authc");

        //配置过滤器

  shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return shiroFilterFactoryBean;

    }    

/**

 * 数据域

 *

 * @return

 */

@Bean

public CustomRealm customRealm() {

    CustomRealm customRealm = new CustomRealm();

    //设置加密器--因为数据库中的密码不是明文存储

    customRealm.setCredentialsMatcher(hashedCredentialsMatcher());

    return customRealm;

}

/**

 * 自定义seesionManager

 *      -配置session持久化

 * @return

 */

@Bean

public SessionManager sessionManager() {

    //自定义CustomSessionManager 继承 DefaultWebSessionManager

    CustomSessionManager customSessionManager = new CustomSessionManager();

    //配置session持久化

    customSessionManager.setSessionDAO(redisSessionDAO());

    //超时时间，默认 30分钟，会话超时；方法里面的单位是毫秒

    customSessionManager.setGlobalSessionTimeout(20000);

    return customSessionManager;

}

/**

 * 密码加解密规则 CredentialMatcher-配置在数据域中,用于数据的加解密

 *

 * @return

 */

@Bean

public HashedCredentialsMatcher hashedCredentialsMatcher() {

    HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();

    //设置散列算法:这里使用MD5算法

    hashedCredentialsMatcher.setHashAlgorithmName("md5");

    //散列次数,好比散列两次 相当于md5(md5(x))

    hashedCredentialsMatcher.setHashIterations(2);

    return hashedCredentialsMatcher;

}

/**

 * 配置redisManager

 */

@Bean

public RedisManager getRedisManager() {

    RedisManager redisManager = new RedisManager();

    //默认就是localhost:6379 不写也行

    redisManager.setHost("localhost");

    redisManager.setPort(6379);

    return redisManager;

}

/**

 * 配置具体cache实现类RedisCacheManager

 * 为什么要使用缓存:

 * 缓存组件位于SecurityManager中,在CustomRealm数据域中,由于授权方法中每次都要查询数据库,性能受影响,因此将数据缓存起来,提高查询效率

 * 除了使用Redis缓存,还能使用shiro-ehcache

 *

 * @return

 */

public RedisCacheManager redisCacheManager() {

    RedisCacheManager redisCacheManager = new RedisCacheManager();

    redisCacheManager.setRedisManager(getRedisManager());

    //设置过期时间，单位是秒，20s,

    redisCacheManager.setExpire(20);

    return redisCacheManager;

}

/**

 * 自定义session持久化

 *

 * @return

 */

public RedisSessionDAO redisSessionDAO() {

    /*

      为啥session也要持久化？

            重启应用，用户无感知，可以继续以原先的状态继续访问

      注意点：

            DO对象需要实现序列化接口 Serializable

            logout接口和以前一样调用，请求logout后会删除redis里面的对应的key,即删除对应的token

     */

    RedisSessionDAO redisSessionDAO = new RedisSessionDAO();

    redisSessionDAO.setRedisManager(getRedisManager());

    //配置自定义sessionId,shiro自动生成色sessionId不满足条件时可以使用

    redisSessionDAO.setSessionIdGenerator(new CustomSessionIdGenerator());

    return redisSessionDAO;

}

    /**

     * LifecycleBeanPostProcessor

     * 管理shiro一些bean的生命周期 即bean初始化 与销毁

     *

     * @return

     */

    @Bean

    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {

        return new LifecycleBeanPostProcessor();

    }

    /**

     * AuthorizationAttributeSourceAdvisor

     * 作用：加入shiro注解的使用，不加入这个AOP注解不生效(shiro的注解 例如 @RequiresGuest)

     */

    @Bean

    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {

        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new

                AuthorizationAttributeSourceAdvisor();

        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());

        return authorizationAttributeSourceAdvisor;

    }

    /**

     * DefaultAdvisorAutoProxyCreator

     * 作用: 用来扫描上下文寻找所有的Advistor(通知器), 将符合条件的Advisor应用到切入点的Bean中，需

     * 要在LifecycleBeanPostProcessor创建后才可以创建

     *

     * @return

     */

    @Bean

    @DependsOn("lifecycleBeanPostProcessor")

    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {

        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new

                DefaultAdvisorAutoProxyCreator();

        defaultAdvisorAutoProxyCreator.setUsePrefix(true);

        return defaultAdvisorAutoProxyCreator;

    }

}

/**

 * 自定义Filter

 * 问题:为什么要自定义filter:

 * 因为配置role[admin,root] ,只有同时满足admin和root才能够访问,显然这是不合理的

 * 实际是超级管理员有全部权限

 */

public class CustomRoleFilter extends AuthorizationFilter {

    @Override

    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {

        //获取当前访问路径所有角色的集合

        Subject subject = getSubject(request, response);

        String[] rolesArray = (String[]) mappedValue;

        //没有角色显示,可以直接访问

        if (rolesArray == null || rolesArray.length == 0) {

            //no roles specified, so nothing to check - allow access.

            return true;

        }

        //当前subject是roles中的任意一个,则有权限访问

        Set<String> roles = CollectionUtils.asSet(rolesArray);

        for (String role : roles) {

            if (subject.hasRole(role)) {

                return true;

            }

        }

        return subject.hasAllRoles(roles);

    }

}

 /** @Discription 自定义SessionMananger 为什么要自定义自定义SessionMananger?

 * 原因:

 * 因为前后端分离的情况下 不是靠session,而是靠token去交互,因此需要自定义这个sessionId的获取

 * 即重写父类的方法(父类是从头中拿sessionId)

 *

 */

public class CustomSessionManager extends DefaultWebSessionManager {

    //这个key 放在请求头中,可以自己定义 ,通常是设置为token或者authorization

    private static final String AUTHORIZATION = "token";

    public CustomSessionManager() {

        super();

    }

    @Override

    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {

        //将ServletRequest转换成HttpServletRequest

        String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATION);

        if (sessionId != null) {

//            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, "cookie");

//

//            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);

//            //automatically mark it valid here.  If it is invalid, the

//            //onUnknownSession method below will be invoked and we'll remove the attribute at that time.

//            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);

            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,

                    ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);

            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);

            //automatically mark it valid here.  If it is invalid, the

            //onUnknownSession method below will be invoked and we'll remove the attribute at that time.

            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);

            return sessionId;

        } else {

            return super.getSessionId(request, response);

        }

    }

}

**

 * 自定义的realm 数据域

 */

public class CustomRealm extends AuthorizingRealm {

    @Autowired

    private UserService userService;

    /**

     * 权限校验的时候会调用

     *

     * @param principals

     * @return

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        System.out.println("授权 doGetAuthorizationInfo");

        //从token中获取用户信息,token代表用户输入

//        String username = (String) principals.getPrimaryPrincipal();

        User newUser = (User) principals.getPrimaryPrincipal();

//        使用原因？

//        授权的时候每次都去查询数据库，对于频繁访问的接口，性能和响应速度比较慢，所以使用缓存

        //提高性能的方法1-使用redis缓存:

        //      将信息放到缓存,例如redis,但是要设置缓存失效时间,因为可能更新数据库了,但是缓存没有更新

        //提高性能的方法2-使用shiro-redis集成的缓存:

        //      shiro-redis的缓存配置在SecurityManager中

        User user = userService.findAllUserInfoByUsername(newUser.getUsername());

        List<String> stringRoleList = new ArrayList<>();

        List<String> stringPermissionList = new ArrayList<>();

        List<Role> roleList = user.getRoleList();

        for (Role role : roleList) {

            stringRoleList.add(role.getName());

            List<Permission> permissionList = role.getPermissionList();

            for (Permission p : permissionList) {

                if (p != null) {

                    stringPermissionList.add(p.getName());

                }

            }

        }

        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();

        //将用户对应的角色和权限信息 放到权限器中

        simpleAuthorizationInfo.addStringPermissions(stringPermissionList);

        simpleAuthorizationInfo.addRoles(stringRoleList);

        return simpleAuthorizationInfo;

    }

    /**

     * 用户登录的时候会调用

     *

     * @param token

     * @return

     * @throws AuthenticationException

     */

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        System.out.println("认证 doGetAuthenticationInfo");

        //从token中获取用户信息,token代表用户输入

        String username = (String) token.getPrincipal();

        User user = userService.findAllUserInfoByUsername(username);

        //取密码

        String password = user.getPassword();

        if (password == null || "".equals(password)) {

            return null;

        }

        return new SimpleAuthenticationInfo(user, password, this.getClass().getName());

    }

}

/*

*       原有的问题

        class java.lang.String must has getter for field: authCacheKey or id\nWe need a

        field to identify this Cache Object in Redis. So you need to defined an id field

        which you can get unique id to identify this principal. For example, if you use

        UserInfo as Principal class, the id field maybe userId, userName, email, etc. For

        example, getUserId(), getUserName(), getEmail(), etc.\nDefault value is

        authCacheKey or id, that means your principal object has a method called

        \"getAuthCacheKey()\" or \"getId()\""

        改造原有的逻辑，修改缓存的唯一key

        doGetAuthorizationInfo 方法

        原有：

        String username = (String)principals.getPrimaryPrincipal();

        User user = userService.findAllUserInfoByUsername(username);

        改为

        User newUser = (User)principals.getPrimaryPrincipal();

        User user = userService.findAllUserInfoByUsername(newUser.getUsername());

        doGetAuthenticationInfo方法

        原有：

        return new SimpleAuthenticationInfo(username, user.getPassword(),

        this.getClass().getName());

        改为

        return new SimpleAuthenticationInfo(user, user.getPassword(),

        this.getClass().getName());

*

*

* */