<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

    <!-- 数据库保存的密码是使用MD5算法加密的，所以这里需要配置一个密码匹配对象 -->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="md5" />
        <property name="hashIterations" value="1" />
    </bean>

    <!-- 缓存管理 -->
    <!--<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"></bean>-->

    <!-- Ehcache缓存管理器 -->
    <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:config/spring/security/ehcache-shiro.xml"/>
    </bean>
    <!-- 会话Cookie模板 -->
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="sid"/>
        <property name="httpOnly" value="true"/>
        <property name="maxAge" value="-1"/>
    </bean>
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe"/>
        <property name="httpOnly" value="true"/>
        <!-- 30天 -->
        <property name="maxAge" value="2592000"/>
    </bean>

    <!-- rememberMe管理器 -->
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cipherKey" value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}"/>
        <property name="cookie" ref="rememberMeCookie"/>
    </bean>

    <!--
      使用Shiro自带的JdbcRealm类
      指定密码匹配所需要用到的加密对象
      指定存储用户、角色、权限许可的数据源及相关查询语句
     -->
    <bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
        <property name="permissionsLookupEnabled" value="true"></property>
        <property name="dataSource" ref="dataSource"></property>
        <property name="authenticationQuery" 
                  value="SELECT password FROM users WHERE username = ?"></property>
        <property name="userRolesQuery"
                  value="SELECT role_name from USER_ROLE left join ROLE using(role_id) left join USERS using(user_id) WHERE username = ?"></property>
        <property name="permissionsQuery"
                  value="SELECT PERMISSION_SIGN FROM ROLE_PERMISSION left join ROLE using(role_id) left join PERMISSION using(permission_id) WHERE role_name = ?"></property>
    </bean>

    <!--自定义认证-->
    <!--<bean id="myRealm" class="cn.orson.common.MyRealm"/>-->

    <!-- Shiro安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!--多REALMS配置-->
        <property name="realms">
            <list>
                <ref bean="jdbcRealm" />
                <!--<ref bean="myRealm" />-->
            </list>
        </property>
        <!--<property name="realm" ref="jdbcRealm"></property>-->
        <property name="cacheManager" ref="shiroEhcacheManager"></property>
    </bean>

    <!--登出过滤 -->
    <bean id="logout" class="org.apache.shiro.web.filter.authc.LogoutFilter">
        <property name="redirectUrl" value="/index" />
    </bean>
    <!--
       Shiro主过滤器本身功能十分强大，其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行
       Web应用中，Shiro可控制的Web请求必须经过Shiro主过滤器的拦截，Shiro对基于Spring的Web应用提供了完美的支持
    -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- Shiro的核心安全接口，这个属性是必须的 -->
        <property name="securityManager" ref="securityManager"></property>
        <!-- 要求登录时的链接(登录页面地址)，非必须的属性，默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->
        <property name="loginUrl" value="/index"></property>
        <!-- 登录成功后要跳转的连接(本例中此属性用不到，因为登录成功后的处理逻辑在LoginController里硬编码) -->
        <!-- <property name="successUrl" value="/" ></property> -->
        <!-- 用户访问未对其授权的资源时，所显示的连接 -->
        <property name="unauthorizedUrl" value="/"></property>
        <property name="filterChainDefinitions">
            <value>
                /security/*=anon
                /login=anon
                <!--指向登出过滤-->
                /logout=logout
                /login.jsp=anon
                /user/*=authc,roles[admin]
            </value>
        </property>
    </bean>

    <!-- 自定义session会话管理配置 -->
    <bean id="sessionManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="jdbcRealm"/>
        <property name="sessionManager" ref="securityManager" />
        <property name="cacheManager" ref="shiroEhcacheManager" />
    </bean>






    <!--
       开启Shiro的注解(如@RequiresRoles，@RequiresPermissions)，需借助SpringAOP扫描使用Shiro注解的类，
       并在必要时进行安全逻辑验证
    -->

    <bean
        class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"></bean>
    <bean
        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"></property>
    </bean>

</beans>