基于spring框架的apache shiro简单集成

2023-03-18 13:43:28

关于项目的安全保护，我一直想找一个简单配置就能达到目的的方法，自从接触了shiro，这个目标总算达成了，以下结合我使用shiro的经验，谈谈比较轻便地集成该功能。

首先我们先了解一下shiro是什么。

apache shiro 是一个功能强大和易于使用的Java安全框架，为开发人员提供一个直观而全面的的解决方案的认证，授权，加密，会话管理。

其实按照我个人的理解，就是个过滤器，按照配置（或者注解）的规则进行权限验证。

我的项目基于maven管理依赖jar包，首先把apache shiro相关需要用到的jar引入：

<!-- shiro -->

            <dependency>

                <groupId>org.apache.shiro</groupId>

                <artifactId>shiro-web</artifactId>

                <version>1.2.1</version>

            </dependency>

            <dependency>

                <groupId>org.apache.shiro</groupId>

                <artifactId>shiro-spring</artifactId>

                <version>1.2.1</version>

            </dependency>

            <dependency>

                <groupId>org.apache.shiro</groupId>

                <artifactId>shiro-ehcache</artifactId>

                <version>1.2.1</version>

            </dependency>

其中shiro-web和shiro-spring必须，如果要缓存权限的话，就引入shiro-ehcache，后边会详细说道shiro-ehcache的使用。

看一下login.action里是如何实现用户登录写入的，获取用户表单信息以及查询数据库验证就不说了，直接上关键代码：

            //验证用户信息后进行token写入，这里为了简单，我把用户的id和姓名作为token的username和password

            UsernamePasswordToken token = new UsernamePasswordToken(m.getId()

                    .toString(), m.getUsername());

            Subject subject1 = SecurityUtils.getSubject();

            subject1.login(token);

            subject1.getSession();

既然是个过滤器，那我们就看一下这个过滤器的写法：

package com.airfey.tech.nuo.action.shiro.filter;

import java.io.IOException;

import java.security.Principal;

import javax.annotation.Resource;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.Cookie;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.subject.Subject;

import com.airfey.tech.nuo.common.security.MD5;

import com.airfey.tech.nuo.core.domain.Manager;

import com.airfey.tech.nuo.core.service.ManagerService;

public class shiroFilter implements Filter {
    //管理员用户service

    @Resource

    private ManagerService managerService;

    @Override

    public void init(FilterConfig filterConfig) throws ServletException {

    }

    @Override

    public void doFilter(ServletRequest request, ServletResponse response,

            FilterChain chain) throws IOException, ServletException {

        Subject subjects = SecurityUtils.getSubject();

        HttpServletRequest requestHttp = (HttpServletRequest) request;

        HttpServletResponse responseHttp = (HttpServletResponse) response;

        Principal principal = requestHttp.getUserPrincipal();

        if (null != principal) {
            //principal.getName()里保存的是用户的id，就是上边登录处token里的信息

            System.out.println(principal.getName());

            Manager m = managerService.findOne(Long.parseLong(principal

                    .getName()));

            if (null != m && 1 == m.getAudit()) {

                UsernamePasswordToken token = new UsernamePasswordToken(

                        m.getId(), m.getId());//作为例子，这里我只是把用户id放进了token，你可以修改成其它复杂点的信息

                Subject subject1 = SecurityUtils.getSubject();

                subject1.login(token);

                subject1.getSession();

            } else {

                if (subjects != null) {

                    subjects.logout();

                }

            }

        }

        chain.doFilter(requestHttp, responseHttp);

    }

    @Override

    public void destroy() {

    }

}

至此，可以说登录和过滤器已经完成了。然后就进行web.xml和spring文件以及权限验证的实现。

1、在web.xml里加入shiro的过滤器配置：

<filter>

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

        <filter-name>shiroFilter</filter-name>

        <url-pattern>/*</url-pattern>

</filter-mapping>

此过滤器要位于所有过滤器的前面。

2、权限验证代码实现，我们写一个realm类集成shiro的AuthorizingRealm

package com.airfey.tech.nuo.action.shiro.realm;

import javax.annotation.Resource;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.authz.AuthorizationException;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.cache.Cache;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.apache.shiro.subject.SimplePrincipalCollection;

public class ShiroRealm extends AuthorizingRealm {

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(

            PrincipalCollection principals) {

        if (principals == null) {

            throw new AuthorizationException(

                    "PrincipalCollection method argument cannot be null.");

        }

        String username = (String) getAvailablePrincipal(principals);

        System.out.println("-------------------" + username);//输出的其实是用户id

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

        // 增加默认角色

        info.addRole("ROLE_USER");
        /*以下可以从数据库获取用户的角色以及权限信息，获取到的信息添加入info即可，具体获取数据库的代码我就省略了*/

        // // 增加自定义角色

        // if (null != userInfo.getRoleList()) {

        // for (RoleInfo roleInfo : userInfo.getRoleList()) {

        // if (null != roleInfo.getName()

        // && !"".equals(roleInfo.getName())) {

        // info.addRole(roleInfo.getName());

        // }

        // }

        // }

        // if (null != userInfo.getModuleInfo()) {

        // for (ModuleInfo moduleInfo : userInfo.getModuleInfo()) {

        // if (null != moduleInfo.getGuid()

        // && !"".equals(moduleInfo.getGuid())) {

        // info.addStringPermission(moduleInfo.getGuid());

        // }

        // }

        // }

        return info;

    }

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(

            AuthenticationToken authcToken) throws AuthenticationException {

        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;

        String userName = token.getUsername();

        if (userName != null && !"".equals(userName)) {

            return new SimpleAuthenticationInfo(token.getPrincipal(),

                    token.getPassword(), token.getUsername());

        }

        return null;

    }

    /**

     * 清空用户关联权限认证，待下次使用时重新加载。

     *

     * @param principal

     */

    public void clearCachedAuthorizationInfo(String principal) {

        SimplePrincipalCollection principals = new SimplePrincipalCollection(

                principal, getName());

        clearCachedAuthorizationInfo(principals);

    }

    /**

     * 清空所有关联认证

     */

    public void clearAllCachedAuthorizationInfo() {

        Cache<Object, AuthorizationInfo> cache = getAuthorizationCache();

        if (cache != null) {

            for (Object key : cache.keys()) {

                cache.remove(key);

            }

        }

    }

}

3、applicationContext.xml的配置 (这里只保留了shiro相关的信息)

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xmlns:context="http://www.springframework.org/schema/context" xmlns:tx="http://www.springframework.org/schema/tx"

    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.5.xsd http://www.springframework.org/schema/data/jpa http://www.springframework.org/schema/data/jpa/spring-jpa-1.0.xsd">

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager" />

        <property name="successUrl" value="/manage/index.do" />

        <property name="loginUrl" value="/manage/login.do" />

        <property name="unauthorizedUrl" value="/manage/401.html" />

        <property name="filters">

            <map>

                <entry key="authc" value-ref="shiro"></entry>

            </map>

        </property>

        <property name="filterChainDefinitions">

            <value>

                /manage/admin.html = authc,perms[shiro_admin:view]

                /manage/user.html=authc,perms[shiro_user:view]

                /manage/login.do=anon

                /manage/401.html=anon
                /manage/js/**=anon 
                /manage/img/**=anon
                /manage/kindeditor/**=anon

                /manage/**=authc,roles["ROLE_USER"]

                /**=anon

            </value>

        </property>

    </bean>

    <bean id="shiro" class="com.airfey.tech.nuo.action.shiro.filter.shiroFilter">

    </bean>

    <bean id="shiroRealm" class="com.airfey.tech.nuo.action.shiro.realm.ShiroRealm" />

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="shiroRealm" />

        <property name="cacheManager" ref="shiroEhcacheManager" />

    </bean>

    <!-- 用户授权信息Cache, 采用EhCache，需要的话就配置上此信息 -->

    <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">

        <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml" />

    </bean>

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

    <bean

        class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"

        depends-on="lifecycleBeanPostProcessor">

        <property name="proxyTargetClass" value="true" />

    </bean>

    <bean

        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">

        <property name="securityManager" ref="securityManager" />

    </bean>

</beans>

验证规则里如下让静态文件比如js img 目录配置上anon

/manage/admin.html = authc,perms[shiro_admin:view]

/manage/user.html=authc,perms[shiro_user:view]

/manage/login.do=anon

/manage/401.html=anon

/manage/js/**=anon

/manage/img/**=anon

/manage/kindeditor/**=anon

/manage/**=authc,roles["ROLE_USER"]

/**=anon

结束，收工。好久不写这么长的博文了，敲起来真费劲。原创文章，文中难免有遗漏或者错误之处，请指正。

作者：碧血黄沙
出处：http://www.cnblogs.com/airfey/
本文版权归作者和博客园共有，欢迎转载，但未经作者同意必须保留此段声明，且在文章页面明显位置给出原文连接，否则保留追究法律责任的权利.
上一篇：第七章 与Web集成——《跟我学Shiro》


下一篇：spring-boot+mybatisPlus+shiro的集成demo 我用了5天