<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"  xmlns:security="http://www.springframework.org/schema/security"  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation="
		http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
		http://www.springframework.org/schema/context  http://www.springframework.org/schema/context/spring-context-3.2.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-4.2.xsd"
	default-lazy-init="true">
 <description>apache shiro配置</description>
<!--<context:property-placeholder ignore-unresolvable="true" location="classpath*:/application-test.properties" />-->

    <!-- 引入配置文件 -->
    <!--<bean id="convertPwdPropertyConfigurer" class="com.cftech.core.util.ConvertPwdPropertyConfigurer">-->
        <!--<property name="locations">-->
            <!--<list>-->
                <!--<value>classpath*:application-test.properties</value>-->
            <!--</list>-->
        <!--</property>-->
    <!--</bean>-->

    <!-- 加载配置属性文件 -->
	<!--<bean class="com.cftech.core.util.SpringContextHolder" />-->

 	<!--<bean id="springContextHolder" class="com.cftech.core.util.SpringContextHolder" />-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/page/login"/>
        <property name="successUrl" value="/a/index"/>
       <property name="unauthorizedUrl" value="/page/401"/>
        <property name="filterChainDefinitions">
            <value>
                /app/** = anon
                /swagger-ui.html = anon
                /assets/** = anon<!-- 后台静态资源允许访问 -->
                /mobile/** = anon<!-- 手机端接口 -->
                /api/** = anon<!-- 开放对外接口 -->
                /static/** = anon <!-- 前端静态资源 -->
                /mp/**=anon<!--服务号页面-->
                /ws/** = anon   <!-- WebService -->
                /test/** = anon
                <!-- 登录页允许访问 -->
                /page/** = anon
                /a/logout = logout
                <!-- 其他资源需要认证 -->
                /a/** = authc
                /** = authc
            </value>
        </property>
    </bean>

    <!-- 缓存管理器 使用Ehcache实现 -->
    <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
    </bean>

    <!-- 会话DAO -->
    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO"/>

    <!-- 会话管理器 -->
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="sessionDAO" ref="sessionDAO"/>
    </bean>




    <!-- remember me cookies配置 -->
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe"/>
        <property name="secure" value="true"/>
        <!--<property name="maxAge" value="0"/>-->
        <!-- 30天 -->
    </bean>

    <!-- rememberMe管理器 -->
    <bean id="rememberMeManager"
          class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cookie" ref="rememberMeCookie"/>
    </bean>


    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!--单个realm使用realm,如果有多个realm，使用realms属性代替-->
		<property name="realm" ref="securityRealm" />
        <!-- <property name="realms">
            <list>
                <ref bean="securityRealm"/>
            </list>
        </property> -->
        <!-- 定义RememberMe的管理器 -->
        <property name="rememberMeManager" ref="rememberMeManager"/>

        <!-- cacheManager,集合spring缓存工厂 -->
       <property name="cacheManager" ref="shiroEhcacheManager" /> 
      <!--    <property name="sessionManager" ref="sessionManager" />  -->
    </bean>
	
    <!-- Shiro生命周期处理器 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
	<bean id="securityRealm" class="com.cftech.sys.security.SecurityRealm"></bean>


    <bean id="manageSecurityFilter" class="com.cftech.sys.filter.ManageSecurityFilter">
        <property name="excludePathRegex">
            <set>
                <value>/console/compass/manage.*</value>
            </set>
        </property>
    </bean>

    <bean id="jwtSecurityFilter" class="com.cftech.sys.filter.JwtSecurityFilter">
        <property name="excludePathRegex">
            <set>
                <value>/a/.*</value>
            </set>
        </property>
    </bean>


    <bean id="csrfSecurityRequestMatcher" class="com.cftech.sys.filter.CsrfSecurityRequestMatcher"></bean>
    <bean id="mcCsrfTokenRepository" class="com.cftech.sys.filter.McCsrfTokenRepository"></bean>

    <bean id="httpFirewall"
            class="org.springframework.security.web.firewall.StrictHttpFirewall" >
        <property name="allowSemicolon">
            <value>true</value>
        </property>
    </bean>
    <security:http-firewall ref="httpFirewall"></security:http-firewall>

    <security:http auto-config="true" use-expressions="true">

        <security:headers>
            <security:frame-options policy="SAMEORIGIN" />
            <security:referrer-policy policy="same-origin"/>
            <security:xss-protection enabled="true"></security:xss-protection>
        </security:headers>
        <security:csrf request-matcher-ref="csrfSecurityRequestMatcher" />
        <security:csrf token-repository-ref="mcCsrfTokenRepository" />
    </security:http>



    <security:authentication-manager>
        <!-- 直接将用户名密码卸载配置文件中     -->
        <security:authentication-provider>
            <security:user-service>
                <security:user name="user" password="user" authorities="ROLE_USER" />
                <security:user name="admin" password="admin" authorities="ROLE_USER, ROLE_ADMIN" />
            </security:user-service>
        </security:authentication-provider>


    </security:authentication-manager>

</beans>