spring整合shiro配置学习总结

shiro依赖

<!-- shiro -->
<properties>
	<shiro.ver>1.2.3</shiro.ver>
</properties>
<dependencies>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-core</artifactId>
		<version>${shiro.ver}</version>
	</dependency>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-web</artifactId>
		<version>${shiro.ver}</version>
	</dependency>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-spring</artifactId>
		<version>${shiro.ver}</version>
	</dependency>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-aspectj</artifactId>
		<version>${shiro.ver}</version>
	</dependency>
</dependencies>

spring配置

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
						http://www.springframework.org/schema/beans/spring-beans.xsd">  
	<!-- shiro的过滤器工厂，加载默认的9个过滤器 -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<!-- 安全管理器， shiro核心组件 Facade模式 -->
		<property name="securityManager" ref="securityManager"></property>
		<!-- 自定义权限过滤器 -->
		<property name="filters">
			<map>
				<!-- 替换默认的perms -->
				<entry key="perms" value-ref="erpAuthorizationFilter"></entry>
			</map>
		</property>
		<!-- 用户没有登录，自动跳转到login.html页面 -->
		<property name="loginUrl" value="/login.html"></property>
		<!-- 用户访问没有权限的页面/操作时，自动跳转到error.html页面 -->
		<property name="unauthorizedUrl" value="/error.html"></property>
		<!-- 过滤链定义：定义url访问对应的认证或授权的过滤器 -->
		<property name="filterChainDefinitions">
			<value>
				<!-- 
					1. 匿名
					2. 授权
					3. 认证
				 -->
				/error.html = anon
				/login_*.action=anon
				<!-- perms[]：匿名外均可访问 -->
				/emp_updatePwd.action=perms[]
				/*_get.action=perms[]
				/*_list.action=perms[]
				/*_listByPage.action=perms[]
				/pwd.html=perms["重置密码"]	
				/emp_updatePwd_reset.action=perms["重置密码"]
				<!--["采购申请","采购订单查询","采购审核","采购确认","采购订单入库","销售订单录入","销售订单查询","销售订单出库"]: 需要同时满足权限 -->	
				/orders.html=perms["采购申请","采购订单查询","采购审核","采购确认","采购订单入库","销售订单录入","销售订单查询","销售订单出库"]	
				/orders_add.action=perms["采购申请","销售订单录入"]					
				/orders_doCheck.action=perms["采购审核"]
				/orders_doStart.action=perms["采购确认"]	
				/store_mylist.action=perms["采购订单入库","销售订单出库"]
				/orderdetail_doInStore.action=perms["采购订单入库"]
				/orderdetail_doOutStore.action=perms["销售订单出库"]
				/*.html = authc					
				/*.action = authc					
				/* = authc		
			</value>
		</property>
	</bean>
	
	<!-- 安全管理器 -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="erpRealm"></property>
	</bean>
	<!-- 自定义realm -->
	<bean id="erpRealm" class="pdsu.xps.erp.realm.ErpRealm">
		<property name="empBiz" ref="empBiz"></property>
	</bean>
	<!-- 自定义权限过滤器 -->
	<bean id="erpAuthorizationFilter" class="pdsu.xps.erp.filter.ErpAuthorizationFilter"></bean>
	
		<!-- 启动shiro注解 -->
	<bean
		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
			depends-on="lifecycleBeanPostProcessor" >
		<!-- 默认使用JDK代理 ，如被代理类没有实现接口，必须使用下列配置开启 cglib代理  -->
		<property name="proxyTargetClass" value="true" />
	</bean>	
	<bean
		class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
		<property name="securityManager" ref="securityManager" />
	</bean>
	
	<!-- 对安全管理器 增强代码 ， spring 后处理器 -->
	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> 
</beans>

web.xml配置

ssh整合中放在struts2前面

<!-- shiro 过滤器 -->
<filter>
	<filter-name>shiroFilter</filter-name>
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

<filter-mapping>
	<!-- 代理过滤器, 转发给spring容器中一个id=shiroFilter的Bean处理	-->
	<filter-name>shiroFilter</filter-name>
	<url-pattern>*.action</url-pattern>
	<url-pattern>*.html</url-pattern>
	<url-pattern>*</url-pattern>
</filter-mapping>

在action中的代码

// 登录
UsernamePasswordToken upt = new UsernamePasswordToken(username, pwd); 
Subject subject = SecurityUtils.getSubject();
subject.login(upt);
// 登出
SecurityUtils.getSubject().logout();
// 获取session中已登录的用户
(对象类型)SecurityUtils.getSubject().getPrincipal()；

自定义realm

public class ErpRealm extends AuthorizingRealm {
	private IEmpBiz empBiz;
	public void setEmpBiz(IEmpBiz empBiz) {
		this.empBiz = empBiz;
	}

	/**
	 * 	授权
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		// 获取当前用户
		Emp emp = (Emp) principals.getPrimaryPrincipal();
		// 获取该用户的菜单列表
		List<Menu> menuList = empBiz.getMenusByEmpuuid(emp.getUuid());
		for (Menu menu : menuList) {
			// 添加名为菜单名称的权限,与spring整合shiro中配置的perms[权限名]中的权限名保持一致
			info.addStringPermission(menu.getMenuname());
		}
		return info;
	}

	/**
	 * 	认证
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		// 获取登录的用户名、密码
		UsernamePasswordToken upt = (UsernamePasswordToken) token;
		// 将byte[]类型的密码转换为string类型
		String pwd = new String(upt.getPassword());
		// 根据用户输入的用户名和密码查询
		Emp emp = empBiz.findByUsernameAndPassword(upt.getUsername(), pwd);
		if(null != emp) {
			// 参数1: 主角，登录的用户
			// 参数2: 认证主角，可以是任何, 此为密码
			// 参数3: 当前realm的名字
			return  new SimpleAuthenticationInfo(emp, pwd, getName());  
		}
		return null;
	}
}

自定义权限过滤器

public class ErpAuthorizationFilter extends AuthorizationFilter {
	@Override
	protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue)
			throws Exception {
		Subject subject = getSubject(request, response);
        String[] perms = (String[]) mappedValue;

        boolean isPermitted = true;
        if(perms == null || perms.length == 0) {
        	return isPermitted;
        }
        if (perms != null && perms.length > 0) {
        // 原代码
//            if (perms.length == 1) {
//                if (!subject.isPermitted(perms[0])) {
//                    isPermitted = false;
//                }
//            } else {
//                if (!subject.isPermittedAll(perms)) {
//                    isPermitted = false;
//                }
//            }
        	for (String perm : perms) {
				if(subject.isPermitted(perm)) {
					isPermitted = true;
				} else {
					isPermitted = false;
				}
			}
        }
		return isPermitted;
	}

}

shiro细颗粒控制

方法级别

在方法上加入权限注解

// 采购订单入库：自定义权限名，和配置文件中保持一致
@RequiresPermissions("采购订单入库")
public void doInStore(Long uuid, Long storeuuid, Long empuuid) {}

代码级别

在方法中添加代码控制

// 获取主题
Subject subject = SecurityUtils.getSubject();
if(Orders.TYPE_IN.equals(orders.getType())) {
	// 添加权限
	subject.isPermitted("采购申请");
}
if(Orders.TYPE_OUT.equals(orders.getType())) {
	subject.isPermitted("销售订单录入");
}