一、前言在Shiro中加入缓存可以使权限相关操作尽可能快避免频繁访问数据库获取权限信息因为对于一个用户来说其权限在短时间内基本是不会变化的。Shiro提供了Cache的抽象其并没有直接提供相应的实现因为这已经超出了一个安全框架的范围。在Shiro中可以集成常用的缓存实现这里介绍基于Redis和Ehcache缓存的实现。在《Spring-Boot-shiro权限控制》中当用户访问”获取用户信息”、”新增用户”和”删除用户”的时候后台输出了三次打印信息如下所示用户wno704获取权限-----ShiroRealm.doGetAuthorizationInfo用户wno704获取权限-----ShiroRealm.doGetAuthorizationInfo用户wno704获取权限-----ShiroRealm.doGetAuthorizationInfo说明在这三次访问中Shiro都会从数据库中获取用户的权限信息通过Druid数据源SQL监控后台也可以证实这一点这对数据库来说是没必要的消耗。接下来使用缓存来解决这个问题。二、Redis缓存2.1 引入Redis依赖网络上已经有关于Shiro集成Redis的实现我们引入即可!-- https://mvnrepository.com/artifact/org.crazycake/shiro-redis --dependencygroupIdorg.crazycake/groupIdartifactIdshiro-redis/artifactIdversion3.3.1/version/dependency2.2 配置Redis我们在application.yml配置文件中加入Redis配置spring:redis:host:127.0.0.1port:10007password:jedis:pool:max-active:8max-wait:-1max-idle:8min-idle:0timeout:02.3 配置Redis接着在ShiroConfig中配置RedisValue(${spring.redis.host})privateStringredisHost;Value(${spring.redis.port})privateStringredisPost;Value(${spring.redis.timeout})privateintredisTimeout;Value(${spring.redis.password})privateStringredisPassword;publicRedisManagerredisManager(){RedisManagerredisManagernewRedisManager();redisManager.setHost(redisHost:redisPost);redisManager.setTimeout(redisTimeout);if(!(redisPasswordnull||redisPassword.equals())){redisManager.setPassword(redisPassword);}returnredisManager;}publicRedisCacheManagercacheManager(){RedisCacheManagerredisCacheManagernewRedisCacheManager();redisCacheManager.setRedisManager(redisManager());returnredisCacheManager;}2.4 注入RedisManager上面代码配置了RedisManager并将其注入到了RedisCacheManager中最后在SecurityManager中加入RedisCacheManagerBeanpublicSecurityManagersecurityManager(){DefaultWebSecurityManagersecurityManagernewDefaultWebSecurityManager();...securityManager.setCacheManager(cacheManager());returnsecurityManager;}2.5 测试配置完毕启动项目分别访问访问”获取用户信息”、”新增用户”和”删除用户”可发现后台只打印一次获取权限信息用户wno704获取权限-----ShiroRealm.doGetAuthorizationInfo查看Druid数据源SQL监控三、Ehcache3.1 Ehcache依赖!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-ehcache --dependencygroupIdorg.apache.shiro/groupIdartifactIdshiro-ehcache/artifactIdversion1.6.0/version/dependency3.2 Ehcache配置在src/main/resource/config路径下新增一个Ehcache配置——shiro-ehcache.xml?xml version1.0 encodingUTF-8?ehcachexmlns:xsihttp://www.w3.org/2001/XMLSchema-instancexsi:noNamespaceSchemaLocationhttp://ehcache.org/ehcache.xsdupdateCheckfalsediskStorepathjava.io.tmpdir/Tmp_EhCache/defaultCachemaxElementsInMemory10000eternalfalsetimeToIdleSeconds120timeToLiveSeconds120overflowToDiskfalsediskPersistentfalsediskExpiryThreadIntervalSeconds120/!-- 登录记录缓存锁定1小时 --cachenamepasswordRetryCachemaxEntriesLocalHeap2000eternalfalsetimeToIdleSeconds3600timeToLiveSeconds0overflowToDiskfalsestatisticstrue//ehcache3.3 ShiroConfig配置Ehcache接着在ShiroConfig中注入Ehcache缓存BeanpublicEhCacheManagergetEhCacheManager(){EhCacheManageremnewEhCacheManager();em.setCacheManagerConfigFile(classpath:config/shiro-ehcache.xml);returnem;}3.4 注入EhCacheManager将缓存对象注入到SecurityManager中BeanpublicSecurityManagersecurityManager(){DefaultWebSecurityManagersecurityManagernewDefaultWebSecurityManager();securityManager.setRealm(shiroRealm());securityManager.setRememberMeManager(rememberMeManager());securityManager.setCacheManager(getEhCacheManager());returnsecurityManager;}3.5 测试配置完毕启动项目分别访问访问”获取用户信息”、”新增用户”和”删除用户”可发现后台只打印一次获取权限信息用户wno704获取权限-----ShiroRealm.doGetAuthorizationInfo查看Druid数据源SQL监控SQL只执行了一次说明缓存成功。
