<filter-mapping>
<!-- Make sure any request you want accessible to Shiro is filtered. /* catches all -->
<!-- requests. Usually this filter mapping is defined first (before all others) to -->
<!-- ensure that Shiro works in subsequent filters in the filter chain: -->
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
<dispatcher>INCLUDE</dispatcher>
<dispatcher>ERROR</dispatcher>
</filter-mapping>
参数TargetFilterLifecycle:缺省值为false,即生命周期由Spring app context管理。设置为true时由servlet container管理。
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
另外,DefaultSecurityManager继承RealmSecurityManager。因此,当需要多个realm时可以使用"realms"property。
ShiroFilterFactoryBean提供了Filters属性,关于Filters:
This property is optional: this {@code FactoryBean} implementation will discover all beans in the
* web application context that implement the {@link Filter} interface and automatically add them to this filter
* map under their bean name.
如果需要的话可以配置一下,如:
public void setFilterChainDefinitions(String definitions) {
Ini ini = new Ini();
ini.load(definitions);
//did they explicitly state a 'urls' section? Not necessary, but just in case:
Ini.Section section = ini.getSection(IniFilterChainResolverFactory.URLS);
if (CollectionUtils.isEmpty(section)) {
//no urls section. Since this _is_ a urls chain definition property, just assume the
//default section contains only the definitions:
section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
}
setFilterChainDefinitionMap(section);
}
于是我们便可以使用filterChainDefinitionMap这一property。我们可以写一个继承FactoryBean<Section>的类动态构成一个filterChainDefinitionMap。(Ps:Section是实现Map<String,String>的Ini的静态内部类。)