Shiro（十二）Spring集成

在前面我们讲到了在SpringBoot项目中集成Shiro框架，这里我们讲一下在Spring集成Shiro框架。

Spring集成Shiro可以帮助我们快速实现基于授权的安全管理，极大地减轻了安全管理的复杂度。下面简单介绍一下Spring集成Shiro的几个步骤：

1. 引入Shiro依赖

在pom.xml文件中引入Shiro的依赖，可以使用以下依赖：

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.6.0</version>
</dependency>

2. 配置ShiroFilter

将ShiroFilter注入到Spring容器中，并进行相应的配置。配置内容包括：ShiroFilter的URL模式、ShiroFilter的过滤器链等。示例代码如下：

@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

    filterChainDefinitionMap.put("/login", "anon");
    filterChainDefinitionMap.put("/logout", "logout");

    filterChainDefinitionMap.put("/**", "authc");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

    shiroFilterFactoryBean.setLoginUrl("/login");
    shiroFilterFactoryBean.setSuccessUrl("/index");
    shiroFilterFactoryBean.setUnauthorizedUrl("/403");

    return shiroFilterFactoryBean;
}

3. 配置Realm

将Realm注入到Spring容器中，并进行相应的配置。Realm主要负责进行用户认证和授权，需要根据实际的业务规则进行相应的配置。示例代码如下：

@Bean
public CustomRealm customRealm() {
    CustomRealm customRealm = new CustomRealm();
    customRealm.setCredentialsMatcher(hashedCredentialsMatcher());
    return customRealm;
}

@Bean
public HashedCredentialsMatcher hashedCredentialsMatcher() {
    HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
    hashedCredentialsMatcher.setHashAlgorithmName("MD5");
    hashedCredentialsMatcher.setHashIterations(2);
    return hashedCredentialsMatcher;
}

4. 配置SecurityManager

将SecurityManager注入到Spring容器中，并进行相应的配置。SecurityManager主要负责管理Realm、缓存等。示例代码如下：

@Bean
public DefaultWebSecurityManager securityManager(CustomRealm customRealm) {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    securityManager.setRealm(customRealm);
    securityManager.setRememberMeManager(cookieRememberMeManager());
    securityManager.setCacheManager(cacheManager());
    return securityManager;
}

5. 配置注解支持

在Spring配置文件中添加Shiro注解支持，这样就可以使用Shrio的@RequiresPermissions等注解了。示例代码如下：

@Bean
public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
    return new LifecycleBeanPostProcessor();
}

@Bean
@DependsOn("lifecycleBeanPostProcessor")
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
    DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
    advisorAutoProxyCreator.setProxyTargetClass(true);
    return advisorAutoProxyCreator;
}

@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
    AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
    authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
    return authorizationAttributeSourceAdvisor;
}

通过以上的配置，即可完成Spring与Shiro的集成，实现基于授权的安全管理。在实际开发中，还需要根据具体业务需求进行相应的配置和优化。