<dependencies><!--······your dependencies --><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring-boot-web-starter</artifactId><version>1.4.2</version></dependency>
</dependencies>

class CustomRealm extends AuthorizingRealm {@AutowiredUserService userService  //用户对象的管理服务类，提供CURD操作@AutowiredAuthService authService  //权限验证服务类，可根据用户获取相应role和permission/*** 定义如何获取用户信息的业务逻辑，给shiro做登录* @param token 登录TOKEN，包含了用户账号密码* @return* @throws AuthenticationException*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {//登录TOKEN，包含了用户账号密码UsernamePasswordToken upToken = (UsernamePasswordToken) token;String username = upToken.getUsername();//下列多个判断可根据业务自行增删// 判断用户名是否不存在，如果不存在抛出异常if (username == null) {throw new AccountException("Null usernames are not allowed by this realm.");}//通过用户名，从数据库中查询出用户信息User user = userService.findUserByName(username);//如果用户不存在，则抛出账号不存在异常，由控制器决定返回消息为账号或密码错误if (user == null) {throw new UnknownAccountException("No account found for admin [" + username + "]");}// 如果用户账号为锁定状态，则不予登录。if (user.isLocked()) {throw new LockedAccountException("Account [" + username + "] is locked.");}//如果账号超出有效期，则不予登录if (user.isCredentialsExpired()) {String msg = "The credentials for account [" + username + "] are expired";throw new ExpiredCredentialsException(msg);}//查询用户的角色和权限存到SimpleAuthenticationInfo中，这样在其它地方//SecurityUtils.getSubject().getPrincipal() 就能拿出用户的所有信息，包括角色和权限/** 将用户权限和角色存入User对象*/user.setRoles(new HashSet<String>(["admin","teacher"]))user.setPerms(new HashSet<String>(["blog:read","blog:search"]))//构造验证信息返回SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.password, getName())return info}/*** 授权* 定义如何获取用户的角色和权限的逻辑，返回包含用户角色和许可信息* @param principals* @return*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {//null usernames are invalidif (principals == null) {throw new AuthorizationException("PrincipalCollection method argument cannot be null.");}//获取当前用户对应的User对象User user = (User) getAvailablePrincipal(principals);//创建权限对象SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();//设置用户角色（user.getRoles（）是一个Set<String>，【admin,student。。。】）info.setRoles(user.getRoles())//设置用户许可（user.getPerms（）是一个Set<String>，【blog:read,blog:search。。。】）info.setStringPermissions(user.getPerms())return info}
}

@Configuration
class ShiroConfig {/*** 注入自定义权限验证对象*/@Beanpublic CustomRealm customRealm() {CustomRealm realm = new CustomRealm();return new CustomRealm();}/*** SecurityManager是Shiro框架的核心，典型的Facade模式，* Shiro通过SecurityManager来管理内部组件实例，并通过它来提供安全管理的各种服务* 将自定义CustomRealm 注入进SecurityManager*/@Beanpublic DefaultWebSecurityManager defaultWebSecurityManager(CustomRealm customRealm) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();//自定义realmsecurityManager.setRealm(customRealm);return securityManager;}  /*** 为了保证实现了Shiro内部lifecycle函数的bean执行 也是shiro的生命周期*/@Beanpublic LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {return new LifecycleBeanPostProcessor();}@Beanpublic static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();/*** setUsePrefix(true)用于解决一个奇怪的bug。在引入spring aop的情况下。* 在@Controller注解的类的方法中加入@RequiresRole等shiro注解，会导致该方法无法映射请求，* 导致返回404。加入这项配置能解决这个bug*/defaultAdvisorAutoProxyCreator.setUsePrefix(true);return defaultAdvisorAutoProxyCreator;}/***  shiro的统一权限判定*/@Beanpublic ShiroFilterChainDefinition shiroFilterChainDefinition(RequestMapService requestMapService) {DefaultShiroFilterChainDefinition chain = new DefaultShiroFilterChainDefinition();//设置所有路径均不需要登录，可在控制器中添加Shiro注解进行覆盖chain.addPathDefinition("/**", "anon");return chain;}
}

/***  @author Hoody* 自定义sessionId获取方式* 从前端发送的header中获取SessionId,如果没有再从cookie中读取*/
class CustomSessionManager extends DefaultWebSessionManager {/** 存放 sessionID 的header key */private static final String AUTHORIZATION = "X-Token"private static final String REFERENCED_SESSION_ID_SOURCE = "Stateless request"/*** 重写getSessionId方法, 从前端发送的header中获取SessionId,如果没有再从cookie中读取* @param request* @param response* @return*/@Overrideprotected Serializable getSessionId(ServletRequest request, ServletResponse response) {String id = WebUtils.toHttp(request).getHeader(AUTHORIZATION)//如果请求头中有 Authorization 则其值为sessionIdif (!StringUtils.isEmpty(id)) {request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE)request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id)request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE)return id} else {//否则按默认规则从cookie取sessionIdreturn super.getSessionId(request, response)}}
}

@Beanpublic SessionManager sessionManager() {CustomSessionManager customSessionManager = new CustomSessionManager();return customSessionManager;}

/*** SecurityManager是Shiro框架的核心，典型的Facade模式，* Shiro通过SecurityManager来管理内部组件实例，并通过它来提供安全管理的各种服务* 将自定义CustomRealm 注入进SecurityManager*/@Beanpublic DefaultWebSecurityManager defaultWebSecurityManager(CustomRealm customRealm) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();//自定义realmsecurityManager.setRealm(customRealm);//自定义session管理securityManager.setSessionManager(sessionManager());return securityManager;}

<!--redis--><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-data-redis</artifactId></dependency>

spring:redis:host: localhost #redis服务PIport: 6379      #服务端口

@Autowiredprivate RedisTemplate<String, Object> redisTemplate;//保存redisTemplate.opsForValue().set("key-1", "value-1"); //带有效期的保存redisTemplate.opsForValue().set("key-1", "value-1", 120, TimeUnit.SECONDS);//删除redisTemplate.delete("key-1");

public class RedisSessionDAO extends CachingSessionDAO {//存入Redis中的SessionID的前缀private static final String PREFIX = "SHIRO_SESSION_ID";//有效期（后续使用时会增加时间单位）private static final int EXPRIE = 1200;//Redis 操作工具 详情见本文3.3章节private RedisTemplate<Serializable, Session> redisTemplate;//构造函数public RedisSessionDAO(RedisTemplate<Serializable, Session> redisTemplate) {this.redisTemplate = redisTemplate;}/*** shiro创建session时，将session保存到redis* @param session* @return*/@Overrideprotected Serializable doCreate(Session session) {//生成SessionIDSerializable serializable = this.generateSessionId(session);assignSessionId(session, serializable);//将sessionid作为Key，session作为value存入redisredisTemplate.opsForValue().set(serializable, session);return serializable;}/*** 当用户维持会话时，刷新session的有效时间* @param session*/@Overrideprotected void doUpdate(Session session) {//设置session有效期session.setTimeout(EXPRIE * 1000);//将sessionid作为Key，session作为value存入redis，并设置有效期redisTemplate.opsForValue().set(session.getId(), session, EXPRIE, TimeUnit.SECONDS);}/*** 当用户注销或会话过期时，将session从redis中删除* @param session*/@Overrideprotected void doDelete(Session session) {//null 验证if (session == null) {return;}//从Redis中删除指定SessionId的k-vredisTemplate.delete(session.getId());}/***  shiro通过sessionId获取Session对象，从redis中获取  * @param sessionId* @return*/@Overrideprotected Session doReadSession(Serializable sessionId) {if (sessionId == null) {return null;}//从Redis中读取Session对象Session session = redisTemplate.opsForValue().get(sessionId);return session;}
}

//容器中注册RedisSessionDao@Beanpublic SessionDAO redisSessionDAO(RedisTemplate redisTemplate) {return new RedisSessionDAO(redisTemplate);}/*** 将SessionDao 加入 SecurityManager*/@Beanpublic DefaultWebSecurityManager defaultWebSecurityManager(CustomRealm customRealm,SessionDAO sessionDAO) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();//自定义realmsecurityManager.setRealm(customRealm);//获取SessionManagerDefaultWebSessionManager sessionManager = (DefaultWebSessionManager)securityManager.getSessionManager();//设置自定义sessionDAOsessionManager.setSessionDAO(sessionDAO);return securityManager;}

/*** 登录* @param UsernamePasswordToken  token */public Session login(String username,String password) {Subject currentUser = SecurityUtils.getSubject()currentUser.login(new UsernamePasswordToken(username, password));currentUser.login(token)//从session中取出用户User user = (User) currentUser.getPrincipal()if (user == null) throw new AuthenticationException()//返回登录用户的信息给前台，含用户的所有角色和权限return currentUser.getSession()}

/*** 自定义Session ，增加了用户名信息*/
public class CustomSession extends SimpleSession {private String usernmae;public String getUsernmae() {return usernmae;}public void setUsernmae(String usernmae) {this.usernmae = usernmae;}public CustomSession() {this.usernmae = null;}public CustomSession(String host, String usernmae) {super(host);this.usernmae = usernmae;}
}

/*** 自定义SessionFactory* 提供CustomSession的创建接口实现*/
public class CustomSessionFactory implements SessionFactory {@Overridepublic Session createSession(SessionContext initData) {if (initData != null) {String host = initData.getHost();//通过initData获取到登录的参数，getParameter("username"); ，key值根据前端请求确定String username = ((DefaultWebSessionContext) initData).getServletRequest().getParameter("username");//如果不是匿名登录则创建包含信息的Sessionif (host != null && username != null) {return new CustomSession(host, username);}}//匿名访问，直接创建空Sessionreturn new CustomSession();}
}

//注册Bean@Beanpublic CustomSessionFactory customSessionFactory() {return new CustomSessionFactory();}/*** 将SessionDao 加入 SecurityManager*/@Beanpublic DefaultWebSecurityManager defaultWebSecurityManager(CustomRealm customRealm,CustomSessionFactory customSessionFactory,SessionDAO sessionDAO) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();//自定义realmsecurityManager.setRealm(customRealm);//获取SessionManagerDefaultWebSessionManager sessionManager = (DefaultWebSessionManager)securityManager.getSessionManager();//设置自定义sessionDAOsessionManager.setSessionDAO(sessionDAO);//设置自定义SessionFactorysessionManager.setSessionFactory(customSessionFactory);return securityManager;}

/*** 定义如何获取用户信息的业务逻辑，给shiro做登录* @param token 登录TOKEN，包含了用户账号密码* @return* @throws AuthenticationException*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {//登录TOKEN，包含了用户账号密码UsernamePasswordToken upToken = (UsernamePasswordToken) token;String username = upToken.getUsername();//下列多个判断可根据业务自行增删//''''''省略其他判断 ，省略部分参考本文 2.1章节//通过此方法对session进行单用户处理this.checkIsLogin(upToken)//查询用户的角色和权限存到SimpleAuthenticationInfo中，这样在其它地方//SecurityUtils.getSubject().getPrincipal() 就能拿出用户的所有信息，包括角色和权限/** 将用户权限和角色存入User对象*/user.setRoles(new HashSet<String>(["admin","teacher"]))user.setPerms(new HashSet<String>(["blog:read","blog:search"]))//构造验证信息返回SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.password, getName())return info}/***  单用户登录判断*  1.通过SecurityUtils获取到SessionDao*  2.通过username查询是否已经存在登录的Session*  3.如果存在，则从Shiro中删除Session* @param token*/ private void checkIsLogin(UsernamePasswordToken token) {DefaultWebSecurityManager securityManager = (DefaultWebSecurityManager) SecurityUtils.getSecurityManager()DefaultWebSessionManager sessionManager = (DefaultWebSessionManager) securityManager.getSessionManager()RedisSessionDAO sessionDAO = (RedisSessionDAO) sessionManager.getSessionDAO()Session session = sessionDAO.getSessionByUsername(token.getUsername())if (session != null) {sessionDAO.delete(session);}}

public class RedisSessionDAO extends CachingSessionDAO implements CacheManagerAware {//Redis存储Session的key前缀private static final String PREFIX = "SHIRO_SESSION_ID";//Redis存储Username与SessionID 的key前缀private static final String USERNAME_PREFIX = "USERNAME_SESSION_ID";//过期有效期private static final int EXPRIE = 10000;//Redis操作工具类private RedisTemplate<Serializable, Object> redisTemplate;//构造函数public RedisSessionDAO(RedisTemplate<Serializable, Object> redisTemplate) {this.redisTemplate = redisTemplate;}//创建session@Overrideprotected Serializable doCreate(Session session) {//通过Session转型为自定义SessionCustomSession customSession = (CustomSession) session;//生成SessionIdSerializable serializable = this.generateSessionId(session);assignSessionId(session, serializable);//保存k-v：sessionID-Session对象到 RedisredisTemplate.opsForValue().set(PREFIX + serializable, session);//判断如果当前用户不是是匿名登录if (customSession.getUsernmae() != null) {//在Redis中保存 键值对 用户名-SessionIDredisTemplate.opsForValue().set(USERNAME_PREFIX + customSession.getUsernmae(), serializable);}return serializable;}//更新session有效期@Overrideprotected void doUpdate(Session session) {session.setTimeout(EXPRIE * 1000);CustomSession customSession = (CustomSession) session;//将sessionid作为Key，session作为value存入redis，并设置有效期redisTemplate.opsForValue().set(PREFIX + session.getId(), session, EXPRIE, TimeUnit.SECONDS);//判断如果当前用户不是是匿名登录if (customSession.getUsernmae() != null) {//在Redis中更新 键值对 用户名-SessionID的有效期redisTemplate.opsForValue().set(USERNAME_PREFIX + customSession.getUsernmae(), session.getId(), EXPRIE, TimeUnit.SECONDS);}}@Overrideprotected void doDelete(Session session) {if (session == null) {return;}CustomSession customSession = (CustomSession) session;redisTemplate.delete(PREFIX + session.getId());//判断如果当前用户不是是匿名登录if (customSession.getUsernmae() != null) {/在Redis中删除 键值对 用户名-SessionIDredisTemplate.delete(USERNAME_PREFIX + customSession.getUsernmae());}}/*** 从Redis读取Session，* 如果未读取到，有2种情况，Session过期，或者被重新登录踢出，则抛出异常* @param sessionId* @return*/@Overrideprotected Session doReadSession(Serializable sessionId) {if (sessionId == null) {return null;}//尝试读取SessionSession session = (Session) redisTemplate.opsForValue().get(PREFIX + sessionId);//如果未读取到有2种情况，Session过期，或者被重新登录踢出，则抛出异常if (session == null) {throw new SignOutException("Account Sign in offsite");}return session;}//根据用户名获取Sessionpublic Session getSessionByUsername(String username) {String sessionId = this.getSessionIdByUsername(username);return doReadSession(sessionId);}//根据用户名获取SessionIdpublic String getSessionIdByUsername(String username) {return (String) redisTemplate.opsForValue().get(USERNAME_PREFIX + username);}
}