将 Shiro 作为应用的权限基础 五：SpringMVC+Apache Shiro+JPA（hibernate）整合配置

配置web.xml,applicationContext.xml, spring-mvc.xml,applicationContext-shiro.xml，而且都有详细的说明。

Web.xml是web项目最基本的配置文件，看这个配置，可以快速知道web项目使用什么框架，它就像一个面板，切入我们想用的插件。

applicationContext.xml是spring的基本配置，主要配置数据源、JPA实体管理器工厂、事务

spring-mvc.xml是SpringMVC的配置，

applicationContext-shiro.xml是shiro的配置，主要配置securityManager、shiroFilter

Web.xml

1. <span style="font-size:18px"><?xml version="1.0"encoding="UTF-8"?>
2. <web-appxmlns:xsiweb-appxmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns="http://java.sun.com/xml/ns/javaee"xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">
3. <context-param>
4. <param-name>contextConfigLocation</param-name>
5. <param-value>classpath*:applicationContext*.xml</param-value>
6. </context-param>
7. <!--防止发生java.beans.Introspector内存泄露,应将它配置在ContextLoaderListener的前面 -->
8. <!--详细描述见http://blog.csdn.net/jadyer/article/details/11991457 -->
9. <listener>
10. <listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>
11. </listener>
12. <!--实例化Spring容器 -->
13. <!--应用启动时,该监听器被执行,它会读取Spring相关配置文件,其默认会到WEB-INF中查找applicationContext.xml-->
14. <listener>
15. <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
16. </listener>
17. <!-- 配置编码过滤器 -->
18. <filter>
19. <filter-name>characterEncodingFilter</filter-name>
20. <filter-class>
21. org.springframework.web.filter.CharacterEncodingFilter
22. </filter-class>
23. <init-param>
24. <param-name>encoding</param-name>
25. <param-value>UTF-8</param-value>
26. </init-param>
27. <init-param>
28. <param-name>forceEncoding</param-name>
29. <param-value>true</param-value>
30. </init-param>
31. </filter>
32. <filter-mapping>
33. <filter-name>characterEncodingFilter</filter-name>
34. <url-pattern>/*</url-pattern>
35. </filter-mapping>
36. <!-- 配置spring管理OpenEntityManagerInViewFilter-->
37. <!--OpenEntityManagerInViewFilter会让session一直到view层调用结束后才关闭
38. Spring针对Hibernate的非JPA实现用的是OpenSessionInViewFilter，原理与这个大同小异
39. -->
40. <filter>
41. <filter-name>hibernateFilter</filter-name>
42. <filter-class>
43. org.springframework.orm.jpa.support.OpenEntityManagerInViewFilter
44. </filter-class>
45. </filter>
46. <filter-mapping>
47. <filter-name>hibernateFilter</filter-name>
48. <url-pattern>/*</url-pattern>
49. </filter-mapping>
50. <!-- Shiro filter-->
51. <!--这里filter-name必须对应applicationContext.xml中定义的<beanid="shiroFilter"/> -->
52. <filter>
53. <filter-name>shiroFilter</filter-name>
54. <filter-class>
55. org.springframework.web.filter.DelegatingFilterProxy
56. </filter-class>
57. <init-param>
58. <!--该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理-->
59. <param-name>targetFilterLifecycle</param-name>
60. <param-value>true</param-value>
61. </init-param>
62. </filter>
63. <filter-mapping>
64. <filter-name>shiroFilter</filter-name>
65. <url-pattern>/*</url-pattern>
66. </filter-mapping>
67. <!-- 配置Log4j
68. 把log4j 的默认配置文件(log4j.properties)放在classpath中，
69. 通常是/web-inf/classes目录下.这种方式是log4j的 默认配置方式，
70. 无须其他配置。缺点就是无法灵活的通过配置文件来指定log4j.properties的文件位置
71. webAppRootKey是log4j在容器中的唯一标识，缺省为"webapp.root"
72. -->
73. <!--        <context-param>
74. <param-name>webAppRootKey</param-name>
75. <param-value>spring_springmvc_jpa.root</param-value>
76. </context-param>
77. <context-param>
78. <param-name>log4jConfigLocation</param-name>
79. <param-value>classpath:log4j.properties</param-value>
80. </context-param>
81. <listener>
82. <listener-class>
83. org.springframework.web.util.Log4jConfigListener
84. </listener-class>
85. </listener> -->
86. <!-- SpringMVC核心分发器 -->
87. <servlet>
88. <servlet-name>dispatcherServlet</servlet-name>
89. <servlet-class>
90. org.springframework.web.servlet.DispatcherServlet
91. </servlet-class>
92. <init-param>
93. <param-name>contextConfigLocation</param-name>
94. <param-value>classpath:spring-mvc.xml</param-value>
95. </init-param>
96. <load-on-startup>1</load-on-startup>
97. </servlet>
98. <servlet-mapping>
99. <servlet-name>dispatcherServlet</servlet-name>
100. <url-pattern>/</url-pattern>
101. </servlet-mapping>
102. <welcome-file-list>
103. <welcome-file>login.jsp</welcome-file>
104. </welcome-file-list>
105. <!--默认欢迎页 -->
106. <!--Servlet2.5中可直接在此处执行Servlet应用,如<welcome-file>servlet/InitSystemParamServlet</welcome-file>-->
107. <!--这里使用了SpringMVC提供的<mvc:view-controller>标签,实现了首页隐藏的目的,详见spring-mvc.xml-->
108. <!--
109. <welcome-file-list>
110. <welcome-file>login.jsp</welcome-file>
111. </welcome-file-list>
112. --></span>

applicationContext.xml

1. <span style="font-size:18px"><?xml version="1.0"encoding="UTF-8"?>
2. <beansxmlnsbeansxmlns="http://www.springframework.org/schema/beans"
3. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4. xmlns:aop="http://www.springframework.org/schema/aop"
5. xmlns:tx="http://www.springframework.org/schema/tx"
6. xmlns:context="http://www.springframework.org/schema/context"
7. xmlns:p="http://www.springframework.org/schema/p"
8. xmlns:cache="http://www.springframework.org/schema/cache"
9. xmlns:jaxws="http://cxf.apache.org/jaxws"
10. xsi:schemaLocation="
11. http://www.springframework.org/schema/beans
12. http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
13. http://www.springframework.org/schema/tx
14. http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
15. http://www.springframework.org/schema/aop
16. http://www.springframework.org/schema/aop/spring-aop-3.1.xsd
17. http://www.springframework.org/schema/context
18. http://www.springframework.org/schema/context/spring-context-3.1.xsd
19. http://www.springframework.org/schema/cache
20. http://www.springframework.org/schema/cache/spring-cache-3.1.xsd
21. http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd ">
22. <!-- 注解支持 -->
23. <context:annotation-config />
24. <!-- 启动组件扫描，排除@Controller组件，该组件由SpringMVC配置文件扫描-->
25. <context:component-scanbase-packagecontext:component-scanbase-package="org.shiro.demo">
26. <context:exclude-filter type="annotation"
27. expression="org.springframework.stereotype.Controller"/>
28. </context:component-scan>
29. <!-- 属性文件位置 -->
30. <context:property-placeholderlocationcontext:property-placeholderlocation="classpath:jdbc.properties" />
31. <!-- 数据源 -->
32. <bean id="dataSource"class="com.jolbox.bonecp.BoneCPDataSource"
33. destroy-method="close">
34. <!-- 数据库驱动 -->
35. <property name="driverClass"value="${jdbc.driverClassName}" />
36. <!-- 相应驱动的jdbcUrl-->
37. <property name="jdbcUrl"value="${jdbc.url}" />
38. <!-- 数据库的用户名 -->
39. <property name="username"value="${jdbc.username}" />
40. <!-- 数据库的密码 -->
41. <property name="password"value="${jdbc.password}" />
42. </bean>
43. <!-- JPA实体管理器工厂 -->
44. <bean id="entityManagerFactory"
45. class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">
46. <property name="dataSource"ref="dataSource" />
47. <property name="jpaVendorAdapter"ref="hibernateJpaVendorAdapter" />
48. <!-- 加入定制化包路径 -->
49. <property name="packagesToScan"value="org.shiro.demo.entity" />
50. <property name="jpaProperties">
51. <props>
52. <propkeypropkey="hibernate.current_session_context_class">thread</prop>
53. <propkeypropkey="hibernate.hbm2ddl.auto">update</prop><!--validate/update/create -->
54. <propkeypropkey="hibernate.show_sql">false</prop>
55. <propkeypropkey="hibernate.format_sql">false</prop>
56. <!-- 建表的命名规则 -->
57. <propkeypropkey="hibernate.ejb.naming_strategy">org.hibernate.cfg.ImprovedNamingStrategy</prop>
58. </props>
59. </property>
60. </bean>
61. <!-- 设置JPA实现厂商的特定属性 -->
62. <bean id="hibernateJpaVendorAdapter"
63. class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter">
64. <property name="databasePlatform"value="${hibernate.dialect}"/>
65. </bean>
66. <!-- 事务管理器 -->
67. <bean id="txManager"
68. class="org.springframework.orm.jpa.JpaTransactionManager">
69. <property name="entityManagerFactory"ref="entityManagerFactory" />
70. </bean>
71. <!-- 注解式事务 -->
72. <tx:annotation-driventransaction-managertx:annotation-driventransaction-manager="txManager" />
73. </beans></span>

spring-mvc.xml

1. <span style="font-size:18px"><?xml version="1.0"encoding="UTF-8"?>
2. <beansxmlnsbeansxmlns="http://www.springframework.org/schema/beans"
3. xmlns:mvc="http://www.springframework.org/schema/mvc"
4. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5. xmlns:context="http://www.springframework.org/schema/context"
6. xsi:schemaLocation="
7. http://www.springframework.org/schema/beans
8. http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
9. http://www.springframework.org/schema/context
10. http://www.springframework.org/schema/context/spring-context-3.1.xsd
11. http://www.springframework.org/schema/mvc
12. http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd">
13. <!--启用SpringMVC的注解功能,它会自动注册HandlerMapping、HandlerAdapter、ExceptionResolver的相关实例-->
14. <mvc:annotation-driven />
15. <!-- SpringMVC的扫描范围 -->
16. <context:component-scanbase-packagecontext:component-scanbase-package="org.shiro.demo.controller" />
17. <!--默认访问跳转到登录页面，即定义无Controller的path<->view直接映射 -->
18. <mvc:view-controller path="/"view-name="redirect:/login"/>
19. <!-- 静态文件访问 -->
20. <mvc:resources mapping="/resources/**"location="/resources/" />
21. <!-- 配置SpringMVC的视图解析器 -->
22. <!--其viewClass属性的默认值就是org.springframework.web.servlet.view.JstlView -->
23. <beanclassbeanclass="org.springframework.web.servlet.view.InternalResourceViewResolver">
24. <!-- <property name="viewClass"value="org.springframework.web.servlet.view.JstlView" /> -->
25. <property name="prefix"value="/" />
26. <property name="suffix"value=".jsp" />
27. </bean>
28. <!-- 配置SpringMVC的异常解析器 -->
29. <beanclassbeanclass="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
30. <property name="exceptionMappings">
31. <props>
32. <!-- 发生授权异常时，跳到指定页 -->
33. <propkeypropkey="org.apache.shiro.authz.UnauthorizedException">/system/error</prop>
34. <!--SpringMVC在超出上传文件限制时，会抛出org.springframework.web.multipart.MaxUploadSizeExceededException-->
35. <!--遇到MaxUploadSizeExceededException异常时，自动跳转到/WEB-INF/error_fileupload.jsp页面-->
36. <!-- <propkey="org.springframework.web.multipart.MaxUploadSizeExceededException">WEB-INF/error_fileupload</prop>-->
37. </props>
38. </property>
39. </bean>
40. </beans></span>

ehcache-shiro.xml

1. <span style="font-size:18px"><?xml version="1.0"encoding="UTF-8"?>
2. <beansxmlnsbeansxmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3. xsi:schemaLocation="http://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans-3.2.xsd"
4. default-lazy-init="true">
5. <description>Shiro安全配置</description>
6. <!-- shiro securityManager -->
7. <!--Shiro默认会使用Servlet容器的Session,可通过sessionMode属性来指定使用Shiro原生Session -->
8. <!--即<property name="sessionMode"value="native"/>,详细说明见官方文档 -->
9. <!--这里主要是设置自定义的单Realm应用,若有多个Realm,可使用'realms'属性代替 -->
10. <bean id="securityManager"
11. class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
12. <property name="realm"ref="shiroDbRealm" />
13. <!-- <property name="cacheManager"ref="myShiroEhcacheManager" /> -->
14. <!-- <property name="sessionMode" value="native"/>
15. <property name="sessionManager" ref="sessionManager"/>
16. -->
17. </bean>
18. <!-- 用户授权信息Cache,采用EhCache -->
19. <bean id="myShiroEhcacheManager"class="org.apache.shiro.cache.ehcache.EhCacheManager">
20. <property name="cacheManagerConfigFile"value="classpath:ehcache-shiro.xml"/>
21. </bean>
22. <!--继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户的认证和授权 -->
23. <beanidbeanid="shiroDbRealm"class="org.shiro.demo.service.realm.ShiroDbRealm"depends-on="baseService">
24. <propertynamepropertyname="userService" ref="userService"/>
25. </bean>
26. <!--Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 -->
27. <!-- Shiro Filter -->
28. <bean id="shiroFilter"
29. class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
30. <!-- Shiro的核心安全接口,这个属性是必须的 -->
31. <property name="securityManager"ref="securityManager" />
32. <!--要求登录时的链接,非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->
33. <property name="loginUrl"value="/" />
34. <!--登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) -->
35. <property name="successUrl"value="/system/main" />
36. <!-- 用户访问未对其授权的资源时,所显示的连接 -->
37. <property name="unauthorizedUrl"value="/system/error" />
38. <!-- Shiro过滤链的定义 -->
39. <!--此处可配合这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839 -->
40. <!--下面value值的第一个'/'代表的路径是相对于HttpServletRequest.getContextPath()的值来的 -->
41. <!--anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 -->
42. <!--authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter-->
43. <propertynamepropertyname="filterChainDefinitions">
44. <value>
45. /login = anon
46. /validateCode = anon
47. /** = authc
48. </value>
49. </property>
50. </bean>
51. <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
52. <bean id="lifecycleBeanPostProcessor"
53. class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
54. <!--开启Shiro的注解，实现对Controller的方法级权限检查(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证-->
55. <!--配置以下两个bean即可实现此功能 -->
56. <!--Enable Shiro Annotations for Spring-configured beans. Only run after thelifecycleBeanProcessor has run -->
57. <bean
58. class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
59. depends-on="lifecycleBeanPostProcessor" >
60. <property name="proxyTargetClass"value="true" />
61. </bean>
62. <bean
63. class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
64. <property name="securityManager"ref="securityManager" />
65. </bean>
66. </beans></span>