@Controller
@RequestMapping("/user")
public class UsersController {

    @Autowired
    private UserService userService;

    @RequestMapping("login")
    public ModelAndView login(User user, ServletRequest request) {
        ModelAndView view = new ModelAndView();
        //得到 Subject，并且通过用户名/密码创建 身份验证 Token（即用户身份/凭证）
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
        if (!subject.isAuthenticated()) {
            subject.login(token);
        }
        //获取上一次请求路径
        SavedRequest savedRequest = WebUtils.getSavedRequest(request);
        String url = "";
        if (savedRequest != null) {
            url = savedRequest.getRequestUrl();
        } else {
            url = "list";
        }
        view.setViewName("redirect:" + url);
        return view;
    }

    @RequestMapping("list")
    public ModelAndView list() {
        ModelAndView view = new ModelAndView();
        view.addObject("users", this.userService.getUsers());
        view.setViewName("/page/list.html");
        return view;
    }

    @RequestMapping("register")
    public ModelAndView register(User user) throws Exception{
        ModelAndView view = new ModelAndView();
        if (!StringUtils.isEmpty(user.getUsername()) && !StringUtils.isEmpty(user.getPassword())) {
            userService.createUser(user);
        }
        view.setViewName("redirect:/login.html");
        return view;
    }

    @RequestMapping("logout")
    @ResponseBody
    public String logout(User user) {
        Subject subject = SecurityUtils.getSubject();

        /*Session session = subject.getSession(false);
        if(session!=null){
            session.removeAttribute(WebUtils.SAVED_REQUEST_KEY);
        }*/
        subject.logout();

        return "已注销";
    }

    // 权限控制
    @RequiresPermissions("sys:user:add")
    @RequestMapping("add")
    public ModelAndView add(User user) throws Exception{
        ModelAndView view = new ModelAndView();
        if (!StringUtils.isEmpty(user.getUsername()) && !StringUtils.isEmpty(user.getPassword())) {
            userService.createUser(user);
            view.setViewName("redirect:list");
        } else {
            view.addObject("action","add");
            view.setViewName("/page/add.html");
        }
        return view;
    }

    //代表用户角色为admin才可以访问 相当于 subject.checkRole("admin")
    @RequiresRoles("admin")
    @RequestMapping("/update")
    public ModelAndView update(User user) {
        ModelAndView view = new ModelAndView();
        if (!StringUtils.isEmpty(user.getUsername()) && !StringUtils.isEmpty(user.getPassword())) {
            userService.changePassword(user.getUsername(), user.getPassword());
            view.setViewName("redirect:list");
        } else {
            view.addObject("action","update");
            view.addObject("user", this.userService.getUser(user.getId()));
            view.setViewName("/page/add.html");
        }
        return view;
    }

    //代表用户有新增的权限才可以访问
    // 相当于 subject.checkPermitted("system:user:delete")
    @RequiresPermissions("sys:user:delete")
    @RequestMapping("delete")
    public ModelAndView delete(User user) throws Exception {
        if (user.getId() != null) {
            this.userService.deleteUser(user.getId());
        }
        ModelAndView view = new ModelAndView();
        view.setViewName("redirect:list");
        return view;
    }
}

package com.hu.service.impl;

import com.hu.dao.PermissionDao;
import com.hu.dao.UserDao;
import com.hu.dao.UserRoleDao;
import com.hu.entity.User;
import com.hu.entity.UserRole;
import com.hu.service.UserService;
import com.hu.util.PasswordHelper;
import com.hu.util.Util;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.ArrayList;
import java.util.List;
import java.util.Set;

@Service
public class UserServiceImpl implements UserService {

    @Autowired
    private UserDao userDao;
    @Autowired
    private UserRoleDao userRoleDao;
    @Autowired
    private PermissionDao permissionDao;

    @Override
    @Transactional
    public User createUser(User user) throws Exception {
        if (this.userDao.findUserByUsername(user.getUsername()) != null) {
            throw new Exception("用户名已存在");
        }
        user.setUserId(Util.getUUID());
        PasswordHelper.encryptPassword(user);
        user.setStatus(0);
        return userDao.save(user);
    }

    @Override
    public int deleteUser(Integer id) throws Exception {
        return this.userDao.deleteUser(id);
    }

    @Override
    public User getUser(Integer id) {
        return this.userDao.getOne(id);
    }

    @Override
    public int changePassword(String userId, String newPassword) {
        User user = this.userDao.findUserByUsername(userId);
        user.setPassword(newPassword);
        PasswordHelper.encryptPassword(user);
        return userDao.save(user) == null ? -1 : 1;
    }

    @Override
    public void addUserRoles(String userId, String... roleIds) {
        List<UserRole> roles = new ArrayList<>();
        for (String roleId : roleIds) {
            roles.add(new UserRole(userId, roleId));
        }
        this.userRoleDao.saveAll(roles);
    }

    @Override
    public void delUserRoles(String userId, String... roleIds) {
        for (String roleId : roleIds) {
            this.userRoleDao.delRole(userId, roleId);
        }
    }

    @Override
    public List<User> getUsers() {
        return this.userDao.findAll();
    }

    @Override
    public User findByUsername(String username) {
        return this.userDao.findUserByUsername(username);
    }

    @Override
    public Set<String> findRoles(String username) {
        return this.userDao.findRoles(username);
    }

    @Override
    public Set<String> findPermissions(String username) {
        return this.userDao.findPermissions(username);
    }
}

public class PasswordHelper {
    private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    //这些要与Realm中一致
    private static String algorithmName = "md5";
    private final static int hashIterations = 1;

    static public  void encryptPassword(User user) {
        //加盐
        user.setSalt(randomNumberGenerator.nextBytes().toHex());
        String newPassword = new SimpleHash(algorithmName, user.getPassword(), ByteSource.Util.bytes(user.getSalt()),hashIterations).toHex();
        user.setPassword(newPassword);
    }
}

@Component
public class UserRealm extends AuthorizingRealm implements Serializable {

    @Autowired
    private UserService userService;

    /**
     * 授权
     * @param principals
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = (String) principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        return authorizationInfo;
    }

    /**
     * 认证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) throws AuthenticationException {
        String username = (String) token.getPrincipal();
        User user = userService.findByUsername(username);
        if(user == null){
            throw new UnknownAccountException(); //没找到账号
        }

        if(user.getStatus()==1){
            throw new LockedAccountException(); //账号被锁定
        }

        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                user.getUsername(),
                user.getPassword(),
                ByteSource.Util.bytes(user.getSalt()),
                getName());
        return authenticationInfo;
    }


}

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //如果没有登录，返回的json
        /*shiroFilterFactoryBean.getFilters().put("authc", new UserFilter() {
            @Override
            protected void redirectToLogin(ServletRequest request, ServletResponse response) throws IOException {
                HttpServletResponse resp = (HttpServletResponse) response;
                HttpResponseUtils.renderJson(resp, com.hu.util.R.UNLOGIN());
            }
        });*/

        //拦截器.
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/500*", "anon");
        filterChainDefinitionMap.put("/reg.html", "anon");
        filterChainDefinitionMap.put("/user/login*", "anon");
        filterChainDefinitionMap.put("/user/register*", "anon");
        filterChainDefinitionMap.put("/user/**", "authc");
        filterChainDefinitionMap.put("/page/**", "authc");
        filterChainDefinitionMap.put("/**", "authc");
        //不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/login.html");
        //未授权跳转
        shiroFilterFactoryBean.setUnauthorizedUrl("/page/fail.html");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

    //凭证匹配器 密码校验交给Shiro的SimpleAuthenticationInfo进行处理
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher() {
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");//使用MD5算法;
        //hashedCredentialsMatcher.setHashIterations(2);//散列的次数
        return hashedCredentialsMatcher;
    }


    //自定义Realm
    @Bean
    public UserRealm myShiroRealm() {
        UserRealm myShiroRealm = new UserRealm();
        myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return myShiroRealm;
    }

    //获得SecurityManager 实例
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //指定 securityManager 的 realms 实现，可以设置多个
        //securityManager 会按照 realms 指定的顺序进行身份认证。此处我们使用显示指定顺序的方式指定了 Realm 的顺序，
        // 如果不设置，那么 securityManager 会按照 realm 声明的顺序进行使用（即无需设置 realms 属性，其会自动发现 ）。
        securityManager.setRealm(myShiroRealm());
        return securityManager;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
        return new LifecycleBeanPostProcessor();
    }
}

@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    String username = (String) principals.getPrimaryPrincipal();
    SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
    //在数据库中查询用户拥有的角色/权限
    authorizationInfo.setRoles(userService.findRoles(username));
    authorizationInfo.setStringPermissions(userService.findPermissions(username));
    return authorizationInfo;
}

 // 授权使用注解  需要开启Spring AOP
 // 自动代理所有的advisor
 // DefaultAdvisorAutoProxyCreator创建代理更加通用强大
 // a.指定一个DefaultAdvisorAutoProxyCreator Bean的定义.
 // b.会自动代理Advisor的类
 @Bean
 @DependsOn({"lifecycleBeanPostProcessor"})
 public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
     DefaultAdvisorAutoProxyCreator proxyCreator = new DefaultAdvisorAutoProxyCreator();
     proxyCreator.setProxyTargetClass(true);
     return proxyCreator;
 }

 // 属于StaticMethodMatcherPointcutAdvisor
@Bean
 public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){
     AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
     advisor.setSecurityManager(securityManager());
     return advisor;
 }

@Configuration
public class MyException implements HandlerExceptionResolver {

    @Override
    public ModelAndView resolveException(HttpServletRequest request,
                                         HttpServletResponse response, Object handler, Exception ex) {

        ModelAndView modelAndView = new ModelAndView();
        Map<String, Object> attributes = new HashMap<>();
        if (ex instanceof UnauthorizedException) {
            attributes.put("msg", "用户无权限");
        } else if (ex instanceof UnknownAccountException) {
            attributes.put("msg", "用户名密码有误");
        } else if (ex instanceof IncorrectCredentialsException) {
            attributes.put("msg", "用户名密码有误");
        } else if (ex instanceof LockedAccountException) {
            attributes.put("msg", "账号已被锁定");
        } else {
            attributes.put("msg", ex.getMessage());
        }
        modelAndView.addAllObjects(attributes);
        modelAndView.setViewName("/500");
        return modelAndView;
    }
}

public class MySessionListener1 implements SessionListener {  
    @Override  
    public void onStart(Session session) {//会话创建时触发  
        System.out.println("会话创建：" + session.getId());  
    }  
    @Override  
    public void onExpiration(Session session) {//会话过期时触发  
        System.out.println("会话过期：" + session.getId());  
    }  
    @Override  
    public void onStop(Session session) {//退出/会话过期时触发  
        System.out.println("会话停止：" + session.getId());  
    }    
}

public class MySessionListener2 extends SessionListenerAdapter {  
    @Override  
    public void onStart(Session session) {  
        System.out.println("会话创建：" + session.getId());  
    }  
}

//如DefaultSessionManager在创建完session后会调用该方法；如保存到关系数据库/文件系统/NoSQL数据库；即可以实现会话的持久化；返回会话ID；主要此处返回的ID.equals(session.getId())；  
Serializable create(Session session);  
//根据会话ID获取会话  
Session readSession(Serializable sessionId) throws UnknownSessionException;  
//更新会话；如更新会话最后访问时间/停止会话/设置超时时间/设置移除属性等会调用  
void update(Session session) throws UnknownSessionException;  
//删除会话；当会话过期/会话停止（如用户退出时）会调用  
void delete(Session session);  
//获取当前所有活跃用户，如果用户量多此方法影响性能  
Collection<Session> getActiveSessions();

public class MySessionDAO extends CachingSessionDAO {
    private JdbcTemplate jdbcTemplate = JdbcTemplateUtils.jdbcTemplate();
     protected Serializable doCreate(Session session) {
        Serializable sessionId = generateSessionId(session);
        assignSessionId(session, sessionId);
        String sql = "insert into sessions(id, session) values(?,?)";
        jdbcTemplate.update(sql, sessionId, SerializableUtils.serialize(session));
        return session.getId();
    }
protected void doUpdate(Session session) {
    if(session instanceof ValidatingSession && !((ValidatingSession)session).isValid()) {
        return; //如果会话过期/停止 没必要再更新了
    }
        String sql = "update sessions set session=? where id=?";
        jdbcTemplate.update(sql, SerializableUtils.serialize(session), session.getId());
    }
    protected void doDelete(Session session) {
        String sql = "delete from sessions where id=?";
        jdbcTemplate.update(sql, session.getId());
    }
    protected Session doReadSession(Serializable sessionId) {
        String sql = "select session from sessions where id=?";
        List<String> sessionStrList = jdbcTemplate.queryForList(sql, String.class, sessionId);
        if(sessionStrList.size() == 0) return null;
        return SerializableUtils.deserialize(sessionStrList.get(0));
    }
}

@Data
public class ShiroRedisSessionDao extends AbstractSessionDAO {

    private RedisTemplate<Serializable, Object> redisTemplate;

    @Override
    public Serializable create(final Session session) {
        Serializable id = super.create(session);
        redisTemplate.opsForValue().set(Contans.getKeys(id), session, 3600L, TimeUnit.MINUTES);
        return id;
    }

    @Override
    protected Serializable doCreate(Session session) {
        Serializable sessionId = super.generateSessionId(session);
        super.assignSessionId(session, sessionId);
        return sessionId;
    }

    //根据会话ID获取会话
    @Override
    public Session readSession(Serializable sessionId) throws UnknownSessionException {
        Session session = doReadSession(sessionId);
        if (session == null) {
            throw new UnknownSessionException("There is no session with id [" + sessionId + "]");
        }
        return session;
    }

    @Override
    protected Session doReadSession(final Serializable sessionId) {
        Session session = (SimpleSession) this.redisTemplate.opsForValue().get(Contans.getKeys(sessionId));
        if (session == null) {
            throw new UnknownSessionException("There is no session with id [" + sessionId + "]");
        } else {
            return session;
        }
    }

    @Override
    public void update(final Session session) throws UnknownSessionException {
        if (session instanceof SimpleSession) {
            final Serializable id = session.getId();
            redisTemplate.opsForValue().set(Contans.getKeys(id), session, 3600L, TimeUnit.MINUTES);
        }
    }

    @Override
    public void delete(Session session) {
        redisTemplate.delete(CollectionUtils.arrayToList(Contans.getKeys(session.getId())));
    }

    // 获取当前所有活跃用户，如果用户量多此方法影响性能
    @Override
    public Collection<Session> getActiveSessions() {
        return null;
    }
}

    /* @Bean
     public SimpleCookie rememberMeCookie(){
         //这个参数是cookie的名称，对应前端的checkbox的name = rememberMe
         SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
         //setcookie的httponly属性如果设为true的话，会增加对xss防护的安全系数。它有以下特点：
         //setcookie()的第七个参数
         //设为true后，只能通过http访问，javascript无法访问
         //防止xss读取cookie
         simpleCookie.setHttpOnly(true);
         simpleCookie.setPath("/");
         //记住我cookie生效时间30天 ,单位秒;
         simpleCookie.setMaxAge(2592000);
         return simpleCookie;
     }
     //cookie管理对象;记住我功能,rememberMe管理器
     @Bean
     public CookieRememberMeManager rememberMeManager(){
         CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
         cookieRememberMeManager.setCookie(rememberMeCookie());
         //rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度(128 256 512 位)
         cookieRememberMeManager.setCipherKey(Base64.decode("4AvVheFLUs0KTA3K23frgdg=="));
         return cookieRememberMeManager;
     }*/
    //自定义Realm
    @Bean
    public UserRealm myShiroRealm() {
        UserRealm myShiroRealm = new UserRealm();
        return myShiroRealm;
    }

    //配置核心安全事务管理器
    @Bean
    public SecurityManager securityManager(SessionDAO sessionDAO) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //指定 securityManager 的 realms 实现，可以设置多个
        //securityManager 会按照 realms 指定的顺序进行身份认证。此处我们使用显示指定顺序的方式指定了 Realm 的顺序，
        // 如果不设置，那么 securityManager 会按照 realm 声明的顺序进行使用（即无需设置 realms 属性，其会自动发现 ）。
        securityManager.setRealm(myShiroRealm());
        //配置自定义session管理，使用redis
        securityManager.setSessionManager(sessionManager(sessionDAO));
        //配置记住我
//        securityManager.setRememberMeManager(rememberMeManager());
        //配置redis缓存
//        securityManager.setCacheManager(cacheManager());
        return securityManager;
    }

    /**
     * 解决无权限页面不跳转 shiroFilterFactoryBean.setUnauthorizedUrl("/page/fail.html") 无效
     *
     * shiro的源代码ShiroFilterFactoryBean.Java定义的filter必须满足filter instanceof AuthorizationFilter，
     * 只有perms，roles，ssl，rest，port才是属于AuthorizationFilter，而anon，authcBasic，auchc，user是AuthenticationFilter，
     * 所以unauthorizedUrl设置后页面不跳转 Shiro注解模式下，登录失败与没有权限都是通过抛出异常。
     * 并且默认并没有去处理或者捕获这些异常。在SpringMVC下需要配置捕获相应异常来通知用户信息
     * @return
     */
    @Bean
    public SimpleMappingExceptionResolver simpleMappingExceptionResolver() {
        SimpleMappingExceptionResolver simpleMappingExceptionResolver=new SimpleMappingExceptionResolver();
        Properties properties=new Properties();
        //这里的 /unauthorized 是页面，不是访问的路径
        properties.setProperty("org.apache.shiro.authz.UnauthorizedException","/page/fail.html");
        properties.setProperty("org.apache.shiro.authz.UnauthenticatedException","/page/fail.html");
        simpleMappingExceptionResolver.setExceptionMappings(properties);
        return simpleMappingExceptionResolver;
    }

    @Bean
    public SessionDAO sessionDAO(RedisTemplate redisTemplate) {
        ShiroRedisSessionDao sessionDao = new ShiroRedisSessionDao();
        sessionDao.setRedisTemplate(redisTemplate);
        return sessionDao;
    }
    //配置会话管理器
    //SessionManager是session的真正管理者，负责shiro的session管理；
    @Bean("sessionManager")
    public SessionManager sessionManager(SessionDAO sessionDAO) {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        sessionManager.setSessionDAO(sessionDAO);
        sessionManager.setSessionIdCookie(simpleCookie());
        List<SessionListener> arrayList = new ArrayList<>();
        arrayList.add(sessionListener());
        sessionManager.setSessionListeners(arrayList);
        return sessionManager;
    }

    @Bean("sessionListener")
    public SessionListener sessionListener() {
        return new ShiroRedisSessionListener();
    }

    //配置保存sessionId的cookie
    //这里的cookie 不是上面的记住我 cookie
    @Bean
    public SimpleCookie simpleCookie() {
        //这个参数是cookie的名称
        SimpleCookie simpleCookie = new SimpleCookie("sid");
        //setcookie的httponly属性如果设为true的话，会增加对xss防护的安全系数。它有以下特点：
        //setcookie()的第七个参数
        //设为true后，只能通过http访问，javascript无法访问
        //防止xss读取cookie
        simpleCookie.setHttpOnly(true);
        simpleCookie.setPath("/");
        //maxAge=-1表示浏览器关闭时失效此Cookie
        simpleCookie.setMaxAge(-1);
        return simpleCookie;
    }

@Override
 public Collection<Session> getActiveSessions() {
     return null;
 }

public class OnlineSession extends SimpleSession {
    public static enum OnlineStatus {
        on_line("在线"), hidden("隐身"), force_logout("强制退出");
        private final String info;
        private OnlineStatus(String info) {
            this.info = info;
        }
        public String getInfo() {
            return info;
        }
    }
    private String userAgent; //用户浏览器类型
    private OnlineStatus status = OnlineStatus.on_line; //在线状态
    private String systemHost; //用户登录时系统IP
    //省略其他
}

public class OnlineSessionFactory implements SessionFactory {
    @Override
    public Session createSession(SessionContext initData) {
        OnlineSession session = new OnlineSession();
        if (initData != null && initData instanceof WebSessionContext) {
            WebSessionContext sessionContext = (WebSessionContext) initData;
            HttpServletRequest request = (HttpServletRequest) sessionContext.getServletRequest();
            if (request != null) {
                session.setHost(IpUtils.getIpAddr(request));
                session.setUserAgent(request.getHeader("User-Agent"));
                session.setSystemHost(request.getLocalAddr() + ":" + request.getLocalPort());
            }
        }
        return session;
    }
}

protected void applyCacheManagerToRealms() {
    CacheManager cacheManager = getCacheManager();
    Collection<Realm> realms = getRealms();
    if (cacheManager != null && realms != null && !realms.isEmpty()) {
        for (Realm realm : realms) {
            if (realm instanceof CacheManagerAware) {
                ((CacheManagerAware) realm).setCacheManager(cacheManager);
            }
        }
    }
}

@Data
public class ShiroRedisCache<K, V> implements Cache<K, V> {
    private RedisTemplate<K, V> redisTemplate;
    private K keyPrefix;
    private RedisSerializer<Object> keySerializer=new JdkSerializationRedisSerializer();
    private RedisSerializer<Object> valueSerializer=new JdkSerializationRedisSerializer();

    public ShiroRedisCache(K keyPrefix, RedisTemplate<K, V> redisTemplate) {
        this.keyPrefix = keyPrefix;
        this.redisTemplate = redisTemplate;
    }

    @Override
    public void clear() throws CacheException {

    }

    @SuppressWarnings("unchecked")
    @Override
    public V get(K k) throws CacheException {
        final byte[] keyByte = getKey(k);
        byte[] result = this.redisTemplate.execute(new RedisCallback<byte[]>() {
            @Override
            public byte[] doInRedis(RedisConnection connection) throws DataAccessException {
                return connection.get(keyByte);
            }
        });
        return (V) this.valueSerializer.deserialize(result);
    }

    public byte[] getKey(K k) {
        if (k instanceof String) {
            return (this.keyPrefix+(String) k).getBytes();
        }
        return this.keySerializer.serialize(k);
    }

    @Override
    public Set<K> keys() {
        final byte[] pattern=(this.keyPrefix+"*").getBytes();
        return this.redisTemplate.execute(new RedisCallback<Set<K>>(){
            @SuppressWarnings("unchecked")
            @Override
            public Set<K> doInRedis(RedisConnection connection) throws DataAccessException {
                Set<byte[]> keys=connection.keys(pattern);
                if(CollectionUtils.isEmpty(keys)){
                    return Collections.emptySet();
                }
                Set<K> newKeys = new HashSet<K>();
                for(byte[] key:keys){
                    newKeys.add((K)key);
                }
                return newKeys;
            }

        });
    }

    @Override
    public V put(K k, final V v) throws CacheException {
        final byte[] key = getKey(k);
        final V perV=get(k);
        final byte[] values = this.valueSerializer.serialize(v);
        return this.redisTemplate.execute(new RedisCallback<V>() {
            @Override
            public V doInRedis(RedisConnection connection) throws DataAccessException {
                connection.set(key, values);
                return perV;
            }
        });
    }

    @Override
    public V remove(K k) throws CacheException {
        final byte[] key = getKey(k);
        final V perV=get(k);
        return this.redisTemplate.execute(new RedisCallback<V>() {
            @Override
            public V doInRedis(RedisConnection connection) throws DataAccessException {
                connection.del(key);
                return perV;
            }
        });
    }

    @Override
    public int size() {
        return this.redisTemplate.execute(new RedisCallback<Long>() {
            @Override
            public Long doInRedis(RedisConnection connection) throws DataAccessException {
                return connection.dbSize();
            }
        }).intValue();
    }

    @Override
    public Collection<V> values() {
        Set<K> keys = keys();
        if (!CollectionUtils.isEmpty(keys)) {
            List<V> values = new ArrayList<V>(keys.size());
            for (K key : keys) {
                V value = get(key);
                if (value != null) {
                    values.add(value);
                }
            }
            return Collections.unmodifiableList(values);
        } else {
            return Collections.emptyList();
        }
    }
    public static void main(String[] args){
        System.out.println("Cd".matches("^[A-Z]+$"));
    }
}

@Data
public class ShiroRedisCacheManager implements CacheManager {

    private final ConcurrentHashMap<String, ShiroRedisCache> caches = new ConcurrentHashMap<String, ShiroRedisCache>();

    private RedisTemplate redisTemplate;

    private String keyPrefix;

    @SuppressWarnings("unchecked")
    @Override
    public <K, V> Cache<K, V> getCache(String name) throws CacheException {
        ShiroRedisCache<K, V> cache = (ShiroRedisCache<K, V>) caches.get(name);
        if (cache == null) {
            cache = new ShiroRedisCache<>(keyPrefix, this.redisTemplate);
            caches.put(name, cache);
        }
        return cache;
    }
}

public class Contans {
    public static String keyPrefix = "shiro-session:";
    public static String keyPrefixCache = "shiro-cache:";
    public static String getKeys(Serializable id) {
        return Contans.keyPrefix + id.toString();
    }
}

    //配置核心安全事务管理器
    @Bean
    public SecurityManager securityManager(SessionDAO sessionDAO,CacheManager cacheManager) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //指定 securityManager 的 realms 实现，可以设置多个
        //securityManager 会按照 realms 指定的顺序进行身份认证。此处我们使用显示指定顺序的方式指定了 Realm 的顺序，
        // 如果不设置，那么 securityManager 会按照 realm 声明的顺序进行使用（即无需设置 realms 属性，其会自动发现 ）。
        securityManager.setRealm(myShiroRealm());
        //配置自定义session管理，使用redis
        securityManager.setSessionManager(sessionManager(sessionDAO));
        //配置记住我
//        securityManager.setRememberMeManager(rememberMeManager());
        //配置redis缓存
        securityManager.setCacheManager(cacheManager);
        return securityManager;
    }

    @Bean
    public CacheManager cacheManager(RedisTemplate redisTemplate){
        ShiroRedisCacheManager shiroRedisCacheManager = new ShiroRedisCacheManager();
        shiroRedisCacheManager.setKeyPrefix(Contans.keyPrefixCache);
        shiroRedisCacheManager.setRedisTemplate(redisTemplate);
        return shiroRedisCacheManager;
    }

public interface FactoryBean<T> {
	//返回由 FactoryBean 创建的 Bean 实例，如果 isSingleton() 返回 true ，则该实例会放到 Spring 容器中单实例缓存池中
	@Nullable
	T getObject() throws Exception;
	
	//返回 FactoryBean 创建的 Bean 类型。
	@Nullable
	Class<?> getObjectType();
	
	//返回由 FactoryBean 创建的 Bean 实例的作用域是 singleton 还是 prototype
	default boolean isSingleton() {
		return true;
	}

}

public class User {
	public void print(){
		System.out.println("User");
	}
}

@Component("mybean")
public class MyBean implements FactoryBean<User> {
	@Override
	public User getObject() throws Exception {
		return new User();
	}

	@Override
	public Class<?> getObjectType() {
		return User.class;
	}

	@Override
	public boolean isSingleton() {
		return true;
	}

	public void print(){
		System.out.println("MyBean");
	}
}

@Configuration
@ComponentScan("org.hu.factorybean")
public class AppConfig {

}

public class Test {
	public static void main(String[] args) {
		AnnotationConfigApplicationContext applicationContext = new AnnotationConfigApplicationContext(AppConfig.class);
		//就是getObject()返回的对象
		User user = (User)applicationContext.getBean("mybean");
		user.print();//输出User
		//当前实现FactoryBean的对象要加个符号才能获取到
		MyBean myBean = (MyBean) applicationContext.getBean("&mybean");
		myBean.print();//输出MyBean
	}
}

@Target(ElementType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface Import {

	/**
	 * {@link Configuration}, {@link ImportSelector}, {@link ImportBeanDefinitionRegistrar}
	 * or regular component classes to imports.
	 */
	Class<?>[] value();

}

@Configuration
@Import(value={BookServiceImpl.class})
public class Config {
 
}

public interface ImportBeanDefinitionRegistrar {
	/**
	 * @param importingClassMetadata annotation metadata of the importing class 通过这个参数可以拿到类的元数据信息
	 * @param registry current bean definition registry 通过这个参数可以操作IOC容器
	 */
	public void registerBeanDefinitions(AnnotationMetadata importingClassMetadata, BeanDefinitionRegistry registry);
}

public class BookServiceBeanDefinitionRegistrar implements ImportBeanDefinitionRegistrar {
 
    public void registerBeanDefinitions(AnnotationMetadata importingClassMetadata,BeanDefinitionRegistry registry) {
        BeanDefinitionBuilder bookService = BeanDefinitionBuilder.rootBeanDefinition(BookServiceImpl.class);
        registry.registerBeanDefinition("bookService", bookService.getBeanDefinition());
    }
 
}

@Configuration
@Import(value={BookServiceBeanDefinitionRegistrar.class})
public class Config {
 
}

public interface ImportSelector {
	String[] selectImports(AnnotationMetadata importingClassMetadata);
}