shiro 1.2.2和1.2.3
為shiro設(shè)置了緩存,但是當(dāng)服務(wù)器運(yùn)行幾個(gè)小時(shí)后,頁(yè)面判斷
<shiro:hasPermission name="admin">
<li class="mail">有權(quán)限
</li>
</shiro:hasPermission>
一直未顯示。重新登陸也無(wú)效。判斷問(wèn)題應(yīng)該是,實(shí)際緩存失效了,但是框架仍然認(rèn)為有效。
嘗試無(wú)效辦法
(1)
倘若把shiro對(duì)應(yīng)的ehcache配置文章,該掉設(shè)置,
timeToIdleSeconds="10"
timeToLiveSeconds="10"
該問(wèn)題依舊出現(xiàn)。但出問(wèn)題頻次減少
(2)在application-shiro里面添加
<bean id="sessionManager"
class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<!-- 超時(shí)時(shí)間 -->
<property name="globalSessionTimeout" value="3600" />
<property name="sessionDAO" ref="sessionDAO" />
<!-- 定時(shí)檢查失效的session -->
<property name="sessionValidationSchedulerEnabled" value="true" />
</bean>
<bean id="sessionDAO"
class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
<property name="activeSessionsCacheName" value="shiro-activeSessionCache" />
</bean>
依舊沒(méi)用
google到 http://stackoverflow.com/questions/17657283/cache-invalidate-not-working-in-shiro
(3)驗(yàn)證權(quán)限的時(shí)候,主動(dòng)清除緩存。
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { ... SimplePrincipalCollection principals = new SimplePrincipalCollection(username, "jndiJdbcRealm"); super.doClearCache(principals); ...}
最后,在日志里面發(fā)現(xiàn)
15:31:24.379 [main] DEBUG o.a.shiro.realm.AuthorizingRealm - No authorizationCache instance set. Checking for a cacheManager...
15:31:24.379 [main] INFO o.a.shiro.realm.AuthorizingRealm - No cache or cacheManager properties have been set. Authorization cache cannot be obtained.
15:31:24.405 [main] DEBUG o.a.s.s.LifecycleBeanPostProcessor - Initializing bean [shiroEhcacheManager]...
在shiroDbRealm里面添加這一句
<property name="cacheManager" ref="shiroEhcacheManager" />
問(wèn)題依舊無(wú)解
終極解決
1、
log配置文件里面添加
<logger name="org.apache.shiro" level="trace" >
<appender-ref ref="STDOUT" />
</logger>
之后得到日志信息
22:48:20.765 [http-80-3] DEBUG o.a.shiro.realm.AuthenticatingRealm - AuthenticationInfo caching is disabled for info [null].
加上以下內(nèi)容以后,依舊無(wú)效。
<property name="authenticationCachingEnabled" value="true" />
<property name="authorizationCachingEnabled" value="true" />
根源在ShiroUser對(duì)象的tostring方法,用的是loginName,但由于業(yè)務(wù)不需要,loginName根本就沒(méi)有賦值。所以字符串“NULL”是緩存的key。
故當(dāng)所有人登錄以后,保存的cache key是“null”,一直會(huì)互相覆蓋。
改寫ShiroUser的Tostring()方法,用系統(tǒng)唯一值登錄名賦值。問(wèn)題解決
聯(lián)系客服