shrio redis实现集群模式下的session共享

 

shrio redis实现集群模式下的session共享

 

 

 

 

shrio用redis实现sesion共享就是告诉redis用session对比cookie的时候不从本地内存拿，从redis拿，里面有session，sessionid等

直接用拿出的sessionid和cookie对比

 

思路：（对比前一篇的配置用途）

增加sessionmanager到securitymanager即可

 

 

 

<bean id="sessionManager"

  class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">

<property name="sessionValidationSchedulerEnabled" value="false" />

<property name="sessionDAO" ref="sessionDAO" />

<property name="sessionFactory" ref="sessionFactoryshr"/>

<property name="globalSessionTimeout" value="60000" />

<property name="sessionIdCookie">

<bean class="org.apache.shiro.web.servlet.SimpleCookie">

<constructor-arg name="name" value="SHRIOSESSIONID"/>

</bean>

</property>

<property name="sessionListeners">

<list>

<bean class="com.common.shrio.ShiroSessionListener"/>

</list>

</property>

</bean>

<bean id="sessionDAO" class="com.common.shrio.RedisSessionDao">

 

</bean>

<!--<bean name="sessionFactory" class="org.apache.shiro.session.mgt.SessionFactory"/>-->

<bean id="sessionFactoryshr" class="com.common.shrio.ShiroSessionFactory"/>

 

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="sessionManager" ref="sessionManager" />

<property name="realm" ref="shiroDbRealm" />

</bean>

 

 

RedisSessionDao：

redis操作类

 

 

ShiroSessionFactory：

session配套

 

 

ShiroSessionListener：

退出清理等

 

 

第二：

 

 

 

 

在做shrio，session共享的同时shrio中的用户信息等也许做redis的存储，这个就需要用客户端cookie的信息作为key，存，之后可以确保之后客户端也可用cookie中的

key从redis拿到用户信息，session信息,不可直接用shrio中拿用户信息

 

 

 

 

 

 

登录成功的时候就保存cookie到客户端：

 

 

private void saveCurUserCookie(HttpServletRequest request, HttpServletResponse response)

  {

    String username = (String)request.getSession().getAttribute(

      "ACEGI_SECURITY_LAST_USERNAME");

 

    String ccidExtno = (String)request.getSession().getAttribute("EXTNO");

 

    this.userDetailsSessionService.setExtNo(ccidExtno);

    String ccid = "";

    String extno = "";

    if (ccidExtno.indexOf("_") > 0)

    {

      ccid = ccidExtno.substring(0, ccidExtno.indexOf("_"));

 

      extno = ccidExtno.substring(ccidExtno.indexOf("_") + 1, ccidExtno

        .length());

    }

    else {

      extno = ccidExtno;

    }

 

    Cookie[] cookies = request.getCookies();

 

    if (!"".equals(ccid)) {

      String c_ccid = getCookieValue(cookies, "callcenterid");

      if ((c_ccid == null) || (!extno.equals(c_ccid))) {

        Cookie baseCookie = new Cookie("callcenterid", ccid);

        baseCookie.setMaxAge(5184000);

        response.addCookie(baseCookie);

      }

    }

 

    String c_extension = getCookieValue(cookies, "extension");

    if ((c_extension == null) || (!extno.equals(c_extension))) {

      Cookie baseCookie = new Cookie("extension", extno);

      baseCookie.setMaxAge(5184000);

      response.addCookie(baseCookie);

    }

 

    String c_username = getCookieValue(cookies, "username");

    if ((c_username == null) || (!username.equals(c_username))) {

      Cookie baseCookie = new Cookie("username", username);

      baseCookie.setMaxAge(5184000);

      response.addCookie(baseCookie);

    }

  }

 

//获取cookie

  private static String getCookieValue(Cookie[] cookies, String cookieName)

  {

    if (cookies == null) {

      return null;

    }

    for (int i = 0; i < cookies.length; i++) {

      Cookie cookie = cookies[i];

      if (cookieName.equals(cookie.getName())) {

        return cookie.getValue();

      }

    }

    return null;

  }

 

 

 

 

 

从request中拿到cookie，之后用这个作为key存取redis

 

HttpServletRequest request1 =(HttpServletRequest) ((WebSubject)SecurityUtils.getSubject()).getServletRequest();  //ServletActionContext.getRequest();

HttpServletResponse response1 =(HttpServletResponse) ((WebSubject)SecurityUtils.getSubject()).getServletResponse();  //ServletActionContext.getRequest();

//HttpServletRequest request2 =(HttpServletRequest) request1;

//HttpServletRequest request = ServletActionContext.getRequest();

//Map request3 = (Map)ActionContext.getContext().get("request");

Cookie[] cookies = request1.getCookies();

 

   String username=getCookieValue(cookies, "username");

WebSession webSession=WebSessionManager.getInstance().getSession(username);

if(webSession==null){

 

webSession=WebSessionManager.getInstance().createSession(username);

}

if(value instanceof UserDetails ){

UserDetailsBean shiroUser = (UserDetailsBean) value;

 

webSession.setAttribute(username, value);

 

webSession.getAttribute(username);

 

}

 

 

 HttpServletRequest request1 =(HttpServletRequest) ((WebSubject)SecurityUtils.getSubject()).getServletRequest();

    Cookie[] cookies = request1.getCookies();

    String username=getCookieValue(cookies, "username");

    WebSession webSession= WebSessionManager.getInstance().getSession(username);

    UserDetailsBean shiroUser = (UserDetailsBean) webSession.getAttribute(username);

 

 

  注意

MyAuthenticationFilter中onLoginSuccess中的session.stop();需要注掉，否则用框架的登陆走了onLoginSuccess然后又清了session会报错

参考：

 

http://sgq0085.iteye.com/blog/2170405