shiro配置----spring.xml

<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">


    <!-- =========================================================
         Shiro Core Components - Not Spring Specific
         ========================================================= -->
    <!-- Shiro's main business-tier object for web-enabled applications
         (use DefaultSecurityManager instead when there is no web environment)-->
    <!-- 
    開始配置SecurityManager
    1、緩存管理器
    2、realm：用來訪問安全數據
    -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="cacheManager" ref="cacheManager"/>
        <property name="realm" ref="myRealm"/>
    </bean>


    <!-- 緩存管理器 -->
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/> 
    </bean>


    <bean id="myRealm" class="com.atguigu.shiro.realm.MyRealm">
    <property name="credentialsMatcher">
    <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    <!-- 指定好加密算法 -->
    <property name="hashAlgorithmName" value="MD5" />
    <!-- 指定好加密的次數 -->
    <property name="hashIterations" value="1024" />
    </bean>
    </property>
    </bean>


    <!-- =========================================================
         Shiro Spring-specific integration
         ========================================================= -->
    <!-- Post processor that automatically invokes init() and destroy() methods
         for Spring-configured Shiro objects so you don't have to
         1) specify an init-method and destroy-method attributes for every bean
            definition and
         2) even know which Shiro objects require these methods to be
            called. -->
    <!-- 使用LifecycleBeanPostProcessor 來管理shiro的bean的生命週期 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>


    <!-- Enable Shiro Annotations for Spring-configured beans.  Only run after
         the lifecycleBeanProcessor has run: -->
    <!-- 開啓shiro的註解
    注意：只有在配置了lifecycleBeanProcessor以後才生效
     -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>


    <!-- Define the Shiro Filter here (as a FactoryBean) instead of directly in web.xml -
         web.xml uses the DelegatingFilterProxy to access this bean.  This allows us
         to wire things with more control as well utilize nice Spring things such as
         PropertiesPlaceholderConfigurer and abstract beans or anything else we might need: -->
    <!-- shiroFilter採用的是org.apache.shiro.spring.web.ShiroFilterFactoryBean
    filterChainDefinitions：用來配置資源和權限的關係
    ① anon：不進行校驗
    ② authc：進行驗證
     -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <!-- 引用上面定義的securityManager -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 定義登錄的頁面 -->
        <property name="loginUrl" value="/login.jsp"/>
        <!-- 未授權的頁面 -->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
        <property name="filterChainDefinitions">

            <value>

<!-- /資源 =  過濾器名 -->   

            /doLogout = logout

<!-- /資源 =  過濾器名[ 權限名 1，權限名2，.....] --> 

            /user.jsp = roles[user]
            /admin.jsp = roles[admin]
            /doLogin = anon
                # everything requires authentication:
                /** = authc
            </value>
        </property>
    </bean>
</beans>