shiro实现不同浏览器本修改密码时其余浏览器需要重新登录

/**
*
* 类说明: session序列化工具
* @author 作者 LzwGlory
* @version 创建时间：2015年3月11日 上午11:36:35
*
*/
public class SerializableUtils {

public static String serialize(Session session) {
try {
ByteArrayOutputStream bos = new ByteArrayOutputStream();
ObjectOutputStream oos = new ObjectOutputStream(bos);
oos.writeObject(session);
return Base64.encodeToString(bos.toByteArray());
} catch (Exception e) {
throw new RuntimeException("serialize session error", e);
}
}
public static Session deserialize(String sessionStr) {
try {
ByteArrayInputStream bis = new ByteArrayInputStream(Base64.decode(sessionStr));
ObjectInputStream ois = new ObjectInputStream(bis);
return (Session)ois.readObject();
} catch (Exception e) {
throw new RuntimeException("deserialize session error", e);
}
}
}

/**
* @author lzwglory
* @time 2015-3-11
*/
public class ShiroSecurityHelper {

private static SessionDAO sessionDAO;

/**
* 获得当前用户名
*
* @return
*/
public static String getCurrentUsername() {
Subject subject = getSubject();
PrincipalCollection collection = subject.getPrincipals();
if (null != collection && !collection.isEmpty()) {
return (String) collection.iterator().next();
}
return null;
}

/**
*
* @return
*/
public static Session getSession() {
return SecurityUtils.getSubject().getSession();
}

/**
*
* @return
*/
public static String getSessionId() {
Session session = getSession();
if (null == session) {
return null;
}
return getSession().getId().toString();
}

/**
* @param username
* @return
*/
public static Session getSessionByUsername(String username) {
Collection<Session> sessions = sessionDAO.getActiveSessions();
for (Session session : sessions) {
if (null != session
&& StringUtils
.equals(String
.valueOf(session
.getAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY)),
username)) {
return session;
}
}
return null;
}

/**
* 判断当前用户是否已通过认证
*
* @return
*/
public static boolean hasAuthenticated() {
return getSubject().isAuthenticated();
}

public static void layout() {
getSubject().logout();
}

private static Subject getSubject() {
return SecurityUtils.getSubject();
}

}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd ">
<description>Shiro 配置</description>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/login_txz.jsp" />
<property name="successUrl" value="/homePage.jsp" />
<property name="unauthorizedUrl" value="/error/noperms.jsp" />
<property name="filters">
<util:map>
<entry key="userSetting" value-ref="userSettingFilter" />
<entry key="myAdvice" value-ref="myAdviceFilter" />
</util:map>
</property>
<property name="filterChainDefinitions">
<value>
/ = anon
/*anon_* =anon
/**/*anon_* =anon
/**/*app_*.do* = anon
/owsSSO*.do* = anon
/login.jsp* = anon
/login*.do* = anon
/register.jsp* = anon
/homePage.jsp* = anon
/forgetpwd.jsp* = anon
/login.do* = anon
/register*.do* = anon
/cipher*.do = anon
/app/index.jsp*= anon

/error/noperms.jsp*= anon
/home.jsp= anon
/sub_order.jsp*= anon
/** = myAdvice
</value>
</property>
</bean>

<bean id="userSettingFilter" class="com.ultrapower.rw.web.ows.filter.UserSetting" />
<bean id="myAdviceFilter" class="com.ultrapower.rw.web.ows.filter.MyAdviceFilter" />

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--设置自定义realm -->
<property name="realm" ref="monitorRealm" />
<property name="sessionManager" ref="sessionManager"/>
<!-- <property name="sessionManager" ref="sessionManager"/> -->

</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

<!--自定义Realm 继承自AuthorizingRealm -->
<bean id="monitorRealm" class="com.ultrapower.rw.web.ows.service.MonitorRealm"></bean>
<!-- start sessiondao -->
<bean id="sessionManager"
class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="sessionDAO" ref="sessionDAO" />
<property name="sessionIdCookie.name" value="jsid"/>
</bean>
<bean id="sessionDAO"
class="com.ultrapower.rw.web.ows.shiro.session.MySessionDAO" />
<!-- end sessiondao -->
<!-- securityManager -->
<bean
class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod"
value="org.apache.shiro.SecurityUtils.setSecurityManager" />
<property name="arguments" ref="securityManager" />
</bean>

<!-- Enable Shiro Annotations for Spring-configured beans. Only run after -->
<!-- the lifecycleBeanProcessor has run: -->
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor" />
<bean
class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
</beans>

/**
* @author 作者 LzwGlory
* @version 创建时间：2015年3月12日 下午2:36:22
* 类说明
*/
public enum ShiroType {

flag();

private ShiroType(){

}
/**
* 更改密码标示
*/
public final String isModifyPwd = "isModifyPwd_";

/**
* 退出标示
*/
public final String isLayout = "isLayout_";
}

/**
* @author 作者 LzwGlory
* @version 创建时间：2015年3月4日 下午5:46:11 类说明 shiro session管理
*/
public class MySessionDAO extends CachingSessionDAO {

private static Logger log = Logger.getLogger(LoginController.class);
private static final Cache cache = CacheFactory
.getCache(OwsConstant.USERDTOCACHE);

private String keyPrefix = "shiro_session_";
Set<String> jsidSet;

public MySessionDAO() {
}

@Override
protected Serializable doCreate(Session session) {
Serializable sessionId = generateSessionId(session);
this.assignSessionId(session, sessionId);
addSession(sessionId, session);
return sessionId;
}

@Override
protected Session doReadSession(Serializable sessionId) {
try {
// 先取出对应的session
Object sessionObj = cache.get(sessionId.toString());
if (sessionObj == null) {// 取出当为空时直接返回空
return null;
}
// Session session = (Session) sessionObj;
Session session = SerializableUtils.deserialize(String
.valueOf(sessionObj));
// 用于存储用户id对应的sessionid
Object userIDObj = session.getAttribute("userId");

if (ShiroSecurityHelper.hasAuthenticated()) {
//				if (userIDObj != null&&!"yes".equals(cache.get(ShiroType.flag.isLayout + String.valueOf(userIDObj)))) {
// cache.get(session.getAttribute("userId").toString());
// cache.remove(session.getAttribute("userId").toString());
String userID = String.valueOf(userIDObj);
String keyUserID = this.keyPrefix + userID;

if ((Set<String>) cache.get(keyUserID) == null){
jsidSet = new HashSet<String>();
}else{
jsidSet = (Set<String>) cache.get(keyUserID);
}
log.info("----size:" + jsidSet.size() + "-------jsidSet:"
+ jsidSet);
jsidSet.add(sessionId.toString());
cache.set(keyUserID, jsidSet);
// 如果修改密码成功后则直接清除除了当前的sessionid
if (cache.get(ShiroType.flag.isModifyPwd + userID) != null) {
String curJsid = String.valueOf(cache.get("isModifyPwd_"
+ userID));
jsidSet = (Set<String>) cache.get(keyUserID);
for (String str : jsidSet) {
if (!str.equals(curJsid)) {
cache.remove(str);
}
}
cache.remove("isModifyPwd_" + userID);
// 当取出多余的session后重新取一下session
}
}
return session;
// String json = cache.get(MemcachedObjectType.SESSION.getPrefix() +
// sessionId.toString());
// return (Session) serializer.deserialize(Encodes.decodeHex(json));
} catch (Exception e) {
log.warn("## Not found session #{}" + sessionId);
return null;
}
}

@Override
protected void doDelete(Session session) {
// TODO Auto-generated method stub
if (session == null) {
throw new NullPointerException("session argument cannot be null.");
}
// 取出所有的当前账户对应的sessionid集合
Object userIDObj=session.getAttribute("userId");
if(userIDObj!=null){
String userID = String.valueOf(userIDObj);
String keyUserID = this.keyPrefix + userID;
cache.remove(keyUserID);
//			cache.remove(ShiroType.flag.isLayout+userID);
}

// 去除sessionid对应session,就会引发重定向后session丢失的现象
//		Serializable id = session.getId();
//		if (id != null) {
//			cache.remove(session.getId().toString());
//		}
}

@Override
protected void doUpdate(Session session) {
// TODO Auto-generated method stub
if (session instanceof ValidatingSession
&& !((ValidatingSession) session).isValid()) {
return; // 如果会话过期/停止 没必要再更新了
}
updateSession(session.getId(), session);
}

protected Session addSession(Serializable id, Session session) {
if (id == null) {
throw new NullPointerException("id argument cannot be null.");
}

// cache.add(session.getId().toString(), session,
// DateUtil.getIntervalTime(30));
cache.add(session.getId().toString(),
SerializableUtils.serialize(session),
DateUtil.getIntervalTime(30));
return session;
}

protected Session updateSession(Serializable id, Session session) {

if (id == null) {
throw new NullPointerException("id argument cannot be null.");
}
cache.set(session.getId().toString(),
SerializableUtils.serialize(session),
DateUtil.getIntervalTime(30));
// cache.set(session.getId().toString(), session,
// DateUtil.getIntervalTime(30));
return session;
}
}