89 lines
3.7 KiB
Java
89 lines
3.7 KiB
Java
package com.chinaweal.youfool.prj.config;
|
||
|
||
import com.chinaweal.youfool.framework.springboot.user.shiro.JWTRestfulFilter;
|
||
import com.chinaweal.youfool.framework.springboot.user.shiro.RestShiroFilterFactoryBean;
|
||
import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;
|
||
import org.apache.shiro.mgt.DefaultSubjectDAO;
|
||
import org.apache.shiro.mgt.SecurityManager;
|
||
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
|
||
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
|
||
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
|
||
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
|
||
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
|
||
import org.springframework.context.annotation.Bean;
|
||
|
||
import javax.annotation.PostConstruct;
|
||
import javax.servlet.Filter;
|
||
import java.util.LinkedHashMap;
|
||
import java.util.Map;
|
||
|
||
/**
|
||
* shiro配置
|
||
*/
|
||
//@Configuration
|
||
public class ShiroConfig {
|
||
|
||
@Bean
|
||
public ShiroFilterFactoryBean factory(SecurityManager securityManager) {
|
||
ShiroFilterFactoryBean factoryBean = new RestShiroFilterFactoryBean();
|
||
factoryBean.setSecurityManager(securityManager);
|
||
|
||
Map<String, Filter> filterMap = factoryBean.getFilters();
|
||
//注：restful如: /xxx==GET = jwtRestful[org:dept:list]这里的 getUrl，getMethod 和 getPerms 分别对应 /xxx，GET 和 org:dept:list。
|
||
filterMap.put("jwtRestful", new JWTRestfulFilter());
|
||
factoryBean.setFilters(filterMap);
|
||
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
|
||
filterChainDefinitionMap.put("/xxx==GET", "jwtRestful[org:dept:list]");
|
||
filterChainDefinitionMap.put("/**", "jwtRestful");
|
||
factoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
|
||
return factoryBean;
|
||
}
|
||
|
||
@PostConstruct
|
||
public void loadShiro() throws Exception {
|
||
}
|
||
|
||
/**
|
||
* 注入 securityManager
|
||
*/
|
||
@Bean
|
||
public SecurityManager securityManager() {
|
||
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
|
||
//securityManager.setRealm(userRealm);
|
||
/*
|
||
* 关闭shiro自带的session，详情见文档
|
||
* http://shiro.apache.org/session-management.html#SessionManagement-StatelessApplications%28Sessionless%29
|
||
*/
|
||
DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();
|
||
DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();
|
||
defaultSessionStorageEvaluator.setSessionStorageEnabled(false);
|
||
subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);
|
||
securityManager.setSubjectDAO(subjectDAO);
|
||
return securityManager;
|
||
}
|
||
|
||
/**
|
||
* 添加注解支持
|
||
*/
|
||
@Bean
|
||
public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
|
||
DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
|
||
// 强制使用cglib，防止重复代理和可能引起代理出错的问题
|
||
// https://zhuanlan.zhihu.com/p/29161098
|
||
defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
|
||
return defaultAdvisorAutoProxyCreator;
|
||
}
|
||
|
||
@Bean
|
||
public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
|
||
return new LifecycleBeanPostProcessor();
|
||
}
|
||
|
||
@Bean
|
||
public AuthorizationAttributeSourceAdvisor authorizationAttribute() {
|
||
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
|
||
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
|
||
return authorizationAttributeSourceAdvisor;
|
||
}
|
||
}
|