修改记录-优化后(springboot+shiro+session+redis+ngnix共享)

1.普通用户实现redis共享session

1.配置

#cache指定缓存类型
spring.cache.type=REDIS

#data-redis
spring.redis.database=15  //单节点配置  可择库
spring.redis.password=
spring.redis.host=192.168.210.*** //单节点配置
spring.redis.port=6379
spring.redis.timeout=2000
spring.redis.jedis.pool.max-active=8
spring.redis.jedis.pool.max-idle=8
spring.redis.jedis.pool.max-wait=-1
spring.redis.jedis.pool.min-idle=0
#集群配置   配置后单节点失效
#spring.redis.cluster.nodes=192.168.43.**:7000,192.168.43.**:7001,192.168.43.**:7000,192.168.43.**:7001,192.168.43.**:7000,192.168.43.**:7001
#spring.redis.cluster.max-redirects=3
#主从节点配置  配置后单节点,集群配置都失效
#spring.redis.sentinel.master=mymaster  
#spring.redis.sentinel.nodes=192.168.210.**:26379

#session share unit MINUTES 指定session在redis中过期时间
session.timeout=3 
#cacheTimeOut unit MINUTES  指定权限信息在redis中过期时间
cache.timeout=12

2.开启缓存

@SpringBootApplication
@EnableCaching //开启缓存
public class OneserviceManagerApplication {
    public static void main(String[] args) {
        SpringApplication.run(OneserviceManagerApplication.class, args);
    }
}

3.编写RedisConfig.java配置类，主要作用是对象序列化

package com.ch.evaluation.config.redis;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.cache.annotation.CachingConfigurerSupport;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.data.redis.connection.RedisConnectionFactory;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.serializer.JdkSerializationRedisSerializer;
import org.springframework.data.redis.serializer.StringRedisSerializer;

@Configuration
public class RedisConfig extends CachingConfigurerSupport {

    @Autowired
    private RedisConnectionFactory redisConnectionFactory;

    /**
     * 获取RedisTemplate对象，处理Redis数据,并且进行最佳序列化
     * @return
     */
    @Bean(name="redisTemplate")
    public RedisTemplate<String, Object> redisTemplate() {
        RedisTemplate<String, Object> template = new RedisTemplate<>();
        //手动序列化
        JdkSerializationRedisSerializer jdkSerializationRedisSerializer = new JdkSerializationRedisSerializer();
        StringRedisSerializer stringRedisSerializer = new StringRedisSerializer();
        template.setKeySerializer(stringRedisSerializer);
        template.setValueSerializer(jdkSerializationRedisSerializer);
        template.setHashKeySerializer(stringRedisSerializer);
        template.setHashValueSerializer(jdkSerializationRedisSerializer);
        //连接Redis
        template.setConnectionFactory(redisConnectionFactory);
        template.afterPropertiesSet();
        return template;
    }
}

4.RedisSessionDao的自定义实现（session的缓存处理）注意修改redis缓存的项目名

package com.ch.evaluation.auth.shiro.cas;

import com.ch.evaluation.common.util.PropertityUtil;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.UnknownSessionException;
import org.apache.shiro.session.mgt.eis.AbstractSessionDAO;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.data.redis.core.RedisTemplate;

import java.io.Serializable;
import java.util.Collection;
import java.util.HashSet;
import java.util.Set;
import java.util.concurrent.TimeUnit;

/**
 * @description：SessionDao自定义实现
 * @author: wangwei
 * @date: 2018年11月27日
 */
@SuppressWarnings("all")
public class RedisSessionDao extends AbstractSessionDAO {
    private final static String PREFIX="evaluation:shiro_redis_session:";
    private static Logger logger = LoggerFactory.getLogger(RedisSessionDao.class);
    private RedisTemplate redisTpl;

    @Override
    public void update(Session session) throws UnknownSessionException {
        if (session==null || session.getId() == null){
            logger.error("redis update session error:session or session id is null");
            return;
        }

        try {
            redisTpl.opsForValue().set(PREFIX+session.getId().toString(), session, PropertityUtil.getPropertity("session.timeout"), TimeUnit.MINUTES);
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
            throw new UnknownSessionException(e);
        }
    }

    @Override
    public void delete(Session session) {
        if (session==null || session.getId() == null){
            logger.error("redis delete session error:session or session id is null");
            return;
        }
        try {
            redisTpl.delete(PREFIX+session.getId().toString());
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
        }
    }

    @Override
    public Collection<Session> getActiveSessions() {
            Set<Session> sessions = new HashSet<Session>();
            Set keys = redisTpl.keys(PREFIX+"*");

            for(Object key : keys){
                Session session=(Session) redisTpl.opsForValue().get(key);
                sessions.add(session);
            }
            return sessions;
    }

    @Override
    protected Serializable doCreate(Session session) {
        if (session==null){
            logger.error("redis create session error:session  is null");
            return null;
        }
        Serializable sessionId = generateSessionId(session);
        assignSessionId(session, sessionId);
        redisTpl.opsForValue().set(PREFIX+sessionId.toString(), session, PropertityUtil.getPropertity("session.timeout"), TimeUnit.MINUTES);
        return sessionId;
    }

    @Override
    protected Session doReadSession(Serializable sessionId) {
        if (sessionId == null){
            logger.error("redis read session error:sessionId is null");
            return null;
        }
        Session session = null;
        try {
            session = (Session) redisTpl.opsForValue().get(PREFIX+sessionId);
        } catch (Exception e) {
            logger.error(e.getMessage(), e);
        }
        return session;
    }

    public void setRedisTpl(RedisTemplate redisTpl) {
        this.redisTpl = redisTpl;
    }
}

5.上面用到了一个工具类加载配置文件

package com.ch.evaluation.common.util;

import java.io.IOException;
import java.io.InputStream;
import java.util.Properties;

public class PropertityUtil {

    public static int getPropertity(String key){
        Properties properties = new Properties();
        ClassLoader load = PropertityUtil.class.getClassLoader();
        InputStream is = load.getResourceAsStream("application.properties");
        try {
            properties.load(is);
            String value = properties.getProperty(key);
            int val = 0;
            if(value!=null){
               val = Integer.parseInt(value);
            }
            return val;
        } catch (IOException e) {
            e.printStackTrace();
        }
        return 0;
    }


}

7..RedisCache的自定义实现（对权限和认证信息的缓存处理）注意修改redis缓存的项目名

package com.ch.evaluation.common.redis;

import com.ch.evaluation.common.util.PropertityUtil;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.springframework.data.redis.core.RedisTemplate;

import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
import java.util.Set;
import java.util.concurrent.TimeUnit;

/**
 * Redis缓存类
 * Created by 005803 on 2017/10/12.
 */

public class RedisCache<K, V> implements Cache<K, V> {

    private RedisTemplate redisTemplate;
    private final static long SUPER_AMDIN_TICKET_EXPARE_TIME =3;
    private static final String PREFIX = "evaluation:shiro_redis_cache:";
    private static final String SUPER_TICKET_KEY = "evaluation:super_ticket:";

    public RedisCache(RedisTemplate redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    @Override
    public V get(K key) throws CacheException {
        return (V) redisTemplate.opsForValue().get(PREFIX + key);
    }

    @Override
    public V put(K key, V value) throws CacheException {
        redisTemplate.opsForValue().set(PREFIX + key, value, PropertityUtil.getPropertity("cache.timeout"), TimeUnit.MINUTES);
        return value;
    }

    @Override
    public V remove(K key) throws CacheException {
        Object value = redisTemplate.opsForValue().get(PREFIX + key);
        redisTemplate.delete(PREFIX + key);
        return (V) value;
    }

    @Override
    public void clear() throws CacheException {
        redisTemplate.delete(keys());
    }

    @Override
    public int size() {
        return keys().size();
    }

    @Override
    public Set<K> keys() {
        Set keys = redisTemplate.keys(PREFIX + "*");
        return keys != null ? keys : Collections.<K>emptySet();
    }

    @Override
    public Collection<V> values() {
        Set<K> keys = keys();
        Collection<V> c = new HashSet<>();
        for (K key : keys) {
            c.add((V) redisTemplate.opsForValue().get(key));
        }
        return c;
    }

    public V putSuper(K key, V value) throws CacheException {
        redisTemplate.opsForHash().put(SUPER_TICKET_KEY,key,value);
        redisTemplate.expire(SUPER_TICKET_KEY,SUPER_AMDIN_TICKET_EXPARE_TIME,TimeUnit.MINUTES);
        return value;
    }

    public Set<V> getAllSuperKeys() throws CacheException {
        return redisTemplate.opsForHash().keys(SUPER_TICKET_KEY);
    }

    public V getSuper(K key) throws CacheException {
        return (V) redisTemplate.opsForHash().get(SUPER_TICKET_KEY,key);
    }

    public void deleteSuper(K key) throws CacheException {
        redisTemplate.opsForHash().delete(SUPER_TICKET_KEY,key);
    }

    public boolean hasKey(K key) throws CacheException {
        return redisTemplate.opsForHash().hasKey(SUPER_TICKET_KEY,key);
    }
}

8..Redis缓存管理器的配置RedisCacheManager.java

package com.ch.evaluation.common.redis;

import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.apache.shiro.cache.CacheManager;
import org.springframework.data.redis.core.RedisTemplate;

import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.ConcurrentMap;

/**
 * Redis缓存管理器
 * Created by wangwei on 2018/10/19.
 */
public class RedisCacheManager implements CacheManager {

    private RedisTemplate redisTemplate;
    private final ConcurrentMap<String, Cache> caches = new ConcurrentHashMap<>();

    public void setRedisTemplate(RedisTemplate redisTemplate) {
        this.redisTemplate = redisTemplate;
    }

    @Override
    public <K, V> Cache<K, V> getCache(String name) throws CacheException {
        Cache cache = caches.get(name);
        if (cache == null) {
            cache = new RedisCache(redisTemplate);
            caches.put(name, cache);
        }
        return cache;
    }

}

9.在你自定义的shiro的realm中重写key的策略

public class ExtendCasRealm extends CasRealm {
    
    private static Logger LOGGER = LoggerFactory.getLogger(ExtendCasRealm.class);
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
         ......................
    }
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        ........................
    }
     ....................
     ..................
    @Override
    protected Object getAuthorizationCacheKey(PrincipalCollection principals) {
        return principals.getPrimaryPrincipal() + ":authorization";
    }

    @Override
    protected Object getAuthenticationCacheKey(PrincipalCollection principals) {
        return principals.getPrimaryPrincipal() + ":authentication";
    }

    @Override
    protected Object getAuthenticationCacheKey(AuthenticationToken token) {
        return token.getPrincipal() + ":authentication";
    }
}

10.基本上配置以上信息就可以用了，值得注意的是要在ShiroCasConfig中配置这些Bean的关联关系，记得session的获取方式有两种，一种是servlet的session一种是shiro默认的session管理器DefaultWebSessionManager ，我们要记得注入DefaultWebSessionManager 管理器，不然程序执行过程中可能会默认执行isServletContainerSessions方法导致抛出一个session类型的异常

贴一下ShiroCasConfig配置

package com.ch.evaluation.config.shirocas;

import com.ch.evaluation.auth.shiro.cas.ExtendCasRealm;
import com.ch.evaluation.auth.shiro.cas.RedisSessionDao;
import com.ch.evaluation.auth.shiro.filter.ExtendAuthorizationFilter;
import com.ch.evaluation.auth.shiro.filter.ExtendCasFilter;
import com.ch.evaluation.auth.shiro.filter.ExtendLogoutFilter;
import com.ch.evaluation.auth.shiro.service.IAuthorizationService;
import com.ch.evaluation.common.constants.WebConstants;
import com.ch.evaluation.common.redis.RedisCacheManager;
import org.apache.shiro.cache.MemoryConstrainedCacheManager;
import org.apache.shiro.cas.CasSubjectFactory;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.web.filter.DelegatingFilterProxy;

import javax.servlet.Filter;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;


/**
 * Created by sunyong - 20170906
 */
@Configuration
public class ShiroCasConfig {

    @Value("${cas.server.url}")
    private String casServerUrl;

    @Value("${shiro.cas-server}")
    private String casServerUrlPrefix;

    @Value("${shiro.server}")
    private String shiroServerUrlPrefix;

    private static final String CAS_FILTER_NAME = "casFilter";
    private static final String SHIRO_FILTER_NAME = "shiroFilter";
    private static final String AUTH_FILTER_NAME = "authFilter";
    private static final String LOGOUT_FILTER_NAME = "logoutFilter";

    /**
     * 注册DelegatingFilterProxy（Shiro）
     */
    @Bean
    public FilterRegistrationBean<DelegatingFilterProxy> filterRegistrationBean() {
        FilterRegistrationBean<DelegatingFilterProxy> filterRegistration = new FilterRegistrationBean<DelegatingFilterProxy>();
        filterRegistration.setFilter(new DelegatingFilterProxy(SHIRO_FILTER_NAME));
        filterRegistration.addInitParameter("targetFilterLifecycle", "true");
        filterRegistration.setEnabled(true);
        filterRegistration.addUrlPatterns("/*");
        return filterRegistration;
    }

    /**
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(
            DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

    /**
     * 会话管理器
     * @auth 011336
     * @DATE 2018/10/15
     * @return
     */
    @Bean(name = "sessionManager")
    public DefaultWebSessionManager getDefaultWebSessionManager(RedisSessionDao sessionDAO, RedisCacheManager redisCacheManager) {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        //sessionManager.setGlobalSessionTimeout(sessionTimeout);
        sessionManager.setDeleteInvalidSessions(true);
        //sessionManager.setSessionValidationSchedulerEnabled(true);
        sessionManager.setSessionDAO(sessionDAO);
        sessionManager.setCacheManager(redisCacheManager);
        // TODO simpleCookie
        return sessionManager;
    }

    /**
     * 实例化SecurityManager，该类是shiro的核心类
     *
     * @return
     */
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(ExtendCasRealm extendCasRealm,
                    DefaultWebSessionManager sessionManager, RedisCacheManager redisCacheManager) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(extendCasRealm);
        securityManager.setCacheManager(redisCacheManager);
        securityManager.setSessionManager(sessionManager);
        securityManager.setSubjectFactory(new CasSubjectFactory());
        return securityManager;
    }

    /**
     * RedisSessionDao
     * @auth 011336
     * @DATE 2018/10/15
     * @return
     */
    @Bean
    public RedisSessionDao getRedisSessionDao(RedisTemplate redisTemplate) {
        RedisSessionDao sessionDAO = new RedisSessionDao();
        sessionDAO.setRedisTpl(redisTemplate);
        return sessionDAO;
    }

    /**
     * redisCacheManager
     * @auth 011336
     * @DATE 2018/10/15
     * @return
     */
    @Bean
    public RedisCacheManager getRedisCacheManager(RedisTemplate redisTemplate) {
        RedisCacheManager redisCacheManager = new RedisCacheManager();
        redisCacheManager.setRedisTemplate(redisTemplate);
        return redisCacheManager;
    }

    /**
     * 配置Realm，由于我们使用的是CasRealm，所以已经集成了单点登录的功能
     *
     * @param authorizationService
     * @return
     */
    @Bean
    public ExtendCasRealm getExtendCasRealm(IAuthorizationService authorizationService,
                                            RedisCacheManager redisCacheManager ){
        ExtendCasRealm extendCasRealm = new ExtendCasRealm();
        extendCasRealm.setAuthorizationService(authorizationService);
        // cas登录服务器地址前缀
        extendCasRealm.setCasServerUrlPrefix(casServerUrlPrefix);
        // 客户端回调地址，登录成功后的跳转地址(自己的服务地址)
        extendCasRealm.setCasService(shiroServerUrlPrefix + WebConstants.CAS_FILTER_URI);
        extendCasRealm.setCachingEnabled(true);
        extendCasRealm.setAuthenticationCachingEnabled(true);
        extendCasRealm.setAuthenticationCacheName("authenticationCache");
        extendCasRealm.setAuthorizationCachingEnabled(true);
        extendCasRealm.setAuthorizationCacheName("authorizationCache");
        extendCasRealm.setCacheManager(redisCacheManager);
        return extendCasRealm;
    }

    /**
     * 注册单点登出的listener
     *
     * @return
     */
    @Bean
    @Order(Ordered.HIGHEST_PRECEDENCE) // 优先级需要高于Cas的Filter
    public ServletListenerRegistrationBean<SingleSignOutHttpSessionListener> singleSignOutHttpSessionListener() {
        ServletListenerRegistrationBean<SingleSignOutHttpSessionListener> bean = new ServletListenerRegistrationBean<SingleSignOutHttpSessionListener>();
        bean.setListener(new SingleSignOutHttpSessionListener());
        bean.setEnabled(true);
        return bean;
    }

    /**
     * 注册单点登出filter
     *
     * @return
     */
    @Bean
    public FilterRegistrationBean<SingleSignOutFilter> singleSignOutFilter() {
        FilterRegistrationBean<SingleSignOutFilter> bean = new FilterRegistrationBean<SingleSignOutFilter>();
        bean.setName("singleSignOutFilter");
        bean.setFilter(new SingleSignOutFilter());
        bean.addUrlPatterns("/*");
        bean.setEnabled(true);
        return bean;
    }

    /**
     * CAS过滤器
     *
     * @return
     */
    //@Bean(name = CAS_FILTER_NAME)
    public ExtendCasFilter getExtendCasFilter() {
        ExtendCasFilter casFilter = new ExtendCasFilter();
        casFilter.setName(CAS_FILTER_NAME);
        casFilter.setEnabled(true);
        // String loginUrl = casServerUrl + "/login?service=" + shiroServerUrlPrefix + CAS_FILTER_URI;
        casFilter.setFailureUrl("/error/casfailure");
        casFilter.setExtendFailureUrl("/error/casfailure"); // 由于原failuserUrl为私有字段，在扩展类中不能获取到值
        return casFilter;
    }

    /**
     * extAuth Filter
     */
    //@Bean(name = AUTH_FILTER_NAME)
    public ExtendAuthorizationFilter getExtendAuthorizationFilter(
            IAuthorizationService authorizationService) {
        ExtendAuthorizationFilter extAuthFilter = new ExtendAuthorizationFilter();
        extAuthFilter.setName(AUTH_FILTER_NAME);
        extAuthFilter.setEnabled(true);
        extAuthFilter.setAuthorizationService(authorizationService);
        return extAuthFilter;
    }

    /**
     * extLogout Filter
     */
    //@Bean(name = LOGOUT_FILTER_NAME)
    public ExtendLogoutFilter getExtendLogoutFilter(IAuthorizationService authorizationService) {
        ExtendLogoutFilter extLogoutFilter = new ExtendLogoutFilter();
        extLogoutFilter.setName(LOGOUT_FILTER_NAME);
        extLogoutFilter.setEnabled(true);
        extLogoutFilter.setAuthorizationService(authorizationService);
        extLogoutFilter.setRedirectUrl(casServerUrl + "/logout?service=" + shiroServerUrlPrefix);
        return extLogoutFilter;
    }

    /**
     * 使用工厂模式，创建并初始化ShiroFilter
     *
     * @param securityManager
     * @param authorizationService
     * @return
     */
    @Bean(name = SHIRO_FILTER_NAME)
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager,
                                                            IAuthorizationService authorizationService) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        String loginUrl = casServerUrl + "/login?service=" + shiroServerUrlPrefix + WebConstants.CAS_FILTER_URI;
        shiroFilterFactoryBean.setLoginUrl(loginUrl);
        shiroFilterFactoryBean.setSuccessUrl("/");
        shiroFilterFactoryBean.setUnauthorizedUrl("/error/unauthorized");
        Map<String, Filter> filters = new HashMap<>();
        filters.put(CAS_FILTER_NAME, getExtendCasFilter());
        filters.put(LOGOUT_FILTER_NAME, getExtendLogoutFilter(authorizationService));
        filters.put(AUTH_FILTER_NAME, getExtendAuthorizationFilter(authorizationService));
        shiroFilterFactoryBean.setFilters(filters);

        loadShiroFilterChain(shiroFilterFactoryBean);
        return shiroFilterFactoryBean;
    }

    private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean) {
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put(WebConstants.CAS_FILTER_URI, CAS_FILTER_NAME);
        filterChainDefinitionMap.put("/logout", LOGOUT_FILTER_NAME);
        filterChainDefinitionMap.put("/static/**", "anon");
        filterChainDefinitionMap.put("/css/**", "anon");
        filterChainDefinitionMap.put("/front/**", "anon");
        filterChainDefinitionMap.put("/img/**", "anon");
        filterChainDefinitionMap.put("/js/**", "anon");
        filterChainDefinitionMap.put("/plugin/**", "anon");
        filterChainDefinitionMap.put("/home/**", "anon");
        filterChainDefinitionMap.put("/super", "anon");
        filterChainDefinitionMap.put("/interface/**", "anon");
        filterChainDefinitionMap.put("/super/login", "anon");
        filterChainDefinitionMap.put("/error/**", "anon");
        filterChainDefinitionMap.put("/**", AUTH_FILTER_NAME);
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    }
}

二：超管redis的session共享

1..把原来的SuperAdminTickeUtils更名为SuperAdminTicketManager，或者删除替换也行。记得把其他用到这个类的地方改一下就行，不详细说改了啥了。

package com.ch.evaluation.auth.shiro;

import com.ch.evaluation.auth.shiro.entity.AuthorizationUser;
import com.ch.evaluation.common.redis.RedisCache;
import com.ch.evaluation.common.redis.RedisCacheManager;
import org.jasig.cas.client.authentication.AttributePrincipalImpl;
import org.jasig.cas.client.validation.Assertion;
import org.jasig.cas.client.validation.AssertionImpl;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import java.util.*;

@Component
public class SuperAdminTicketManager {
    private static Logger LOGGER = LoggerFactory.getLogger(SuperAdminTicketManager.class);
    private final static  String SUPER_AMDIN_TICKET_SUFFIX = ".superadmin.com";
    private final static long SUPER_AMDIN_TICKET_TIME = 1000 * 60 * 3;
    private final static String SUPER_TICKET = "superTicket";
    @Autowired
    private RedisCacheManager redisCacheManager;

    public String putTicket(AuthorizationUser user) {
        RedisCache cache = (RedisCache)redisCacheManager.getCache(SUPER_TICKET);
        String ticket = getTicket();
        cache.putSuper(ticket,user);
        return ticket;
    }

    public boolean validTiket(String ticket) {
        RedisCache cache = (RedisCache)redisCacheManager.getCache(SUPER_TICKET);
        clearTicketMap(cache);
        return cache.hasKey(ticket);
    }

    public boolean endsWith(String ticket) {
        return ticket.endsWith(SUPER_AMDIN_TICKET_SUFFIX);
    }

    private static String getTicket() {
        return UUID.randomUUID() + SUPER_AMDIN_TICKET_SUFFIX;
    }

    private void clearTicketMap(RedisCache cache) {
        Long currentTime = new Date().getTime();
        Set<String> keys= cache.getAllSuperKeys();
        for (Object key:keys) {
            AuthorizationUser user = (AuthorizationUser)cache.getSuper(key);
            if((currentTime - user.getTime()) > SUPER_AMDIN_TICKET_TIME){
                LOGGER.info("super.ticket has expired and delete from redis!");
                cache.deleteSuper(key);
            }
        }
    }

    public final Assertion getSuperAdminAssertion(String ticket) {
        Assertion assertion = null;
        final Map<String, Object> attributes = new HashMap<String, Object>();
        RedisCache cache = (RedisCache)redisCacheManager.getCache(SUPER_TICKET);
        AuthorizationUser user = (AuthorizationUser)cache.getSuper(ticket);
        if (null != user) {
            attributes.put("user_id", user.getUserId());
            attributes.put("user_name", user.getUserName());
            attributes.put("password", user.getPassword());
            assertion = new AssertionImpl(new AttributePrincipalImpl(user.getUserAccount(), attributes));
        }
        cache.deleteSuper(ticket);
        return assertion;
    }
}

2.修改之前用到这个类的地方

2.1 修改ExtendCasRealm  新增一处  改三处

@Autowired
private SuperAdminTicketManager superAdminTicketManager;

@Override
   protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
       CasToken casToken = (CasToken) token;
       if (token == null) {
           return null;
       }
       String ticket = (String)casToken.getCredentials();
       if (!StringUtils.hasText(ticket)) {
           return null;
       }
       boolean superAdminFlag = superAdminTicketManager.endsWith(ticket);
　　　　...........

private Assertion getSuperAdminAssertion(CasToken casToken, String ticket) 
      throws CasAuthenticationException {
   if (!superAdminTicketManager.validTiket(ticket)) {
           throw new CasAuthenticationException("Invalid super ticket [" + ticket + "]");
       }
   Assertion casAssertion = superAdminTicketManager.getSuperAdminAssertion(ticket);
   return casAssertion;
}

2.2SuperAdminServiceImpl 中新增一处  改一处

@Autowired
private SuperAdminTicketManager superAdminTicketManager;

....

    String ticket = superAdminTicketManager.putTicket(user);
      return ticket;
   }


}

3.序列化：实现接口后鼠标放在类上alt+Enter就可以生成uid

public class AuthorizationUser implements Serializable {

    private static final long serialVersionUID = -5556165398740497973L;

三：超管登录密码加密

1.引入js文件夹到plugin

2.layout-superlogin.html中引入JS

 <script class="custom-script" src="../../static/plugin/crypto-js/crypto-js.js" th:src="@{/plugin/crypto-js/crypto-js.js}"></script>
 <script class="custom-script" src="../../static/plugin/crypto-js/core.js" th:src="@{/plugin/crypto-js/core.js}"></script>
 <script class="custom-script" src="../../static/plugin/crypto-js/aes.js" th:src="@{/plugin/crypto-js/aes.js}"></script>

3.编写superlogin.js文件

var key = CryptoJS.enc.Utf8.parse("1234123412ABCDEF");  //十六位十六进制数作为密钥
var iv = CryptoJS.enc.Utf8.parse('ABCDEF1234123412');   //十六位十六进制数作为密钥偏移量
//解密方法
function Decrypt(word) {
    var encryptedHexStr = CryptoJS.enc.Hex.parse(word);
    var srcs = CryptoJS.enc.Base64.stringify(encryptedHexStr);
    var decrypt = CryptoJS.AES.decrypt(srcs, key, { iv: iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7 });
    var decryptedStr = decrypt.toString(CryptoJS.enc.Utf8);
    return decryptedStr.toString();
}

//加密方法
function Encrypt(word) {
    var srcs = CryptoJS.enc.Utf8.parse(word);
    var encrypted = CryptoJS.AES.encrypt(srcs, key, { iv: iv, mode: CryptoJS.mode.CBC, padding: CryptoJS.pad.Pkcs7 });
    return encrypted.ciphertext.toString().toUpperCase();
}
function superLogin(){
    var passWord = $("#signin-superamdin-password").val();
    if(passWord==null || passWord==""){
        passWord ="";
    }else{
        passWord = passWord.trim();
    }
    var prefix = getTimeStr("prefix");
    var suffix = getTimeStr("suffix");
    passWord = prefix+passWord+suffix
    var aesPassWord = Encrypt(passWord);
    $("#submit-superamdin-password").val(aesPassWord);
    return true;
}
function getTimeStr(flag){
    var myDate = new Date();

    var year = myDate.getFullYear(); //获取完整的年份(4位,1970-????)
    var month = myDate.getMonth()+1; //获取当前月份(0-11,0代表1月)
    month = month > 9 ? month : "0"+month;
    var day =  myDate.getDate(); //获取当前日(1-31)
    day = day > 9 ? day : "0"+day;
    var hours =  myDate.getHours(); //获取当前小时数(0-23)
    hours = hours > 9 ? hours : "0"+hours;
    var minutes =  myDate.getMinutes(); //获取当前分钟数(0-59)
    minutes = minutes > 9 ? minutes : "0"+minutes;
    var seconds =  myDate.getSeconds(); //获取当前秒数(0-59)
    seconds = seconds > 9 ? seconds : "0"+seconds;
    if(flag=="prefix"){
        return ""+year+month+day
    }else{
        return ""+hours+minutes+seconds
    }
}

3.1:替换html部分的form部分

4.可直接替换superloginController.java   详情如下

4.1：校验是否超时，获取时间差

public boolean checkLogionTime(String rangeTime){
        String strDate = rangeTime;
        //注意：SimpleDateFormat构造函数的样式与strDate的样式必须相符
        SimpleDateFormat simpleDateFormat=new SimpleDateFormat("yyyyMMddHHmmss");
        SimpleDateFormat df=new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); //加上时间
        //必须捕获异常
        Date date= null;
        try {
            date = simpleDateFormat.parse(strDate);
        } catch (ParseException e) {
            e.printStackTrace();
        }
        long min = getDatePoor(new Date(),date);
        if(min>=loginTimeOut) {
            return false;
        }else{
            return true;
        }
    }
    //计算时间差  差多少分钟   绝对值
    public static long getDatePoor(Date endDate, Date loginDate) {
        long nd = 1000 * 24 * 60 * 60;
        long nh = 1000 * 60 * 60;
        long nm = 1000 * 60;
        // long ns = 1000;
        // 获得两个时间的毫秒时间差异
        long diff = endDate.getTime() - loginDate.getTime();
        // 计算差多少分钟
        long min = diff % nd % nh / nm;
        return Math.abs(min);
    }

4.2：验证之前解密   直接加在原来的步骤中就好

public String login(ModelMap modal, String superAdminUsername, String superAdminPassword,
                        HttpServletRequest request, HttpServletResponse response) {
        if (StringUtils.isNotBlank(superAdminUsername) && StringUtils.isNotBlank(superAdminPassword)) {
            try {
                String str = AesUtil.desEncrypt(superAdminPassword);
                superAdminPassword = str.substring(8, str.length() - 6);
                String rangeTime =  str.substring(0,8)+str.substring(str.length()-6);
                boolean b = checkLogionTime(rangeTime);
                if(!b) {
                    modal.put(ErrorConstants.ERROR_MESSAGE, ErrorConstants.ERROR_SUPERADMIN_003);
                    return "views/superLoginPage";
                }
            } catch (Exception e) {
                LOGGER.error("decrypt applicationMetadataId failed", e);
            }
            SuperAdmin superAdmin = new SuperAdmin();
            superAdmin.setUsername(superAdminUsername.trim());

有个超时时间的设置在propertity中

# unit minutes
super.login.timeOut=5

5.后台要引入一个解密的Java工具类，ErrorConstants中加一个错误提示信息

public final static String ERROR_SUPERADMIN_003 = "登陆超时，不安全的请求！"; // 判断登录请求超过一定时间为不安全请求

完事！

 

四：单点登录ticket验证地址变更

1.ShiroCasConfig中假如如下配置

  @Value("${cas.server.url}")
  private String casServerUrl;

替换如下内容

  //@Bean(name = LOGOUT_FILTER_NAME)
    public ExtendLogoutFilter getExtendLogoutFilter(IAuthorizationService authorizationService) {
        ExtendLogoutFilter extLogoutFilter = new ExtendLogoutFilter();
        extLogoutFilter.setName(LOGOUT_FILTER_NAME);
        extLogoutFilter.setEnabled(true);
        extLogoutFilter.setAuthorizationService(authorizationService);
        extLogoutFilter.setRedirectUrl(casServerUrl + "/logout?service=" + shiroServerUrlPrefix);
        return extLogoutFilter;
    }

@Bean(name = SHIRO_FILTER_NAME)
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager,
                                                        IAuthorizationService authorizationService) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    String loginUrl = casServerUrl + "/login?service=" + shiroServerUrlPrefix + WebConstants.CAS_FILTER_URI;
    shiroFilterFactoryBean.setLoginUrl(loginUrl);

完事！