首先把Spring、springmvc环境搭建好(跑起来可以访问页面没报错.).....此处省略一万行代码
第一步、在web.xml中配置shiro filter
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
第二步、在spring的配置文件applicationContext.xml中配置
<!-- 1.配置securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- 缓存管理器 -->
<property name="cacheManager" ref="cacheManager"/>
<!-- property name="realm" ref="jdbcRealm"/ -->
<property name="authenticator" ref="authenticator"></property>
<property name="realms">
<list>
<ref bean="jdbcRealm"/>
<ref bean="secondRealm"/>
</list>
</property>
<!-- 还可以配置session,此次不使用 -->
</bean>
<!-- 2.配置cacheManager -->
<!-- 2.1 需要加入ehcache的jar包及配置文件(hibernate的开源代码里有)-->
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
</bean>
<!-- 3.配置Realm,需要创建一个类实现Realm接口--><!-- 3.1 直接配置实现了org.apache.shiro.realm.Realm 接口的bean-->
<bean id="jdbcRealm" class="com.shiro.realms.ShiroRealm">
<!-- 此处的作用:把前台传来的密码封装成的token加密成MD5 -->
<property name="credentialsMatcher">
<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
<!-- 使用MD5算法加密 -->
<property name="hashAlgorithmName" value="MD5"></property>
<!-- 加密1024次 -->
<property name="hashIterations" value="1024"></property>
</bean>
</property>
</bean>
<!-- 4. 配置lifecycleBeanPostProcessor 可以自动的来调用Spring IOC容器中的shiro bean的生命周期方法-->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
<!-- 5.要想在IOC容器中使用Shiro的注解 必须配置lifecycleBeanPostProcessor -->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
<!-- 6. 配置shiroFilter
6.1 id必须和web.xml文件中配置的DelegatingFilterProxy <filter-name>一致
6.2
-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login.jsp"/>
<property name="successUrl" value="/list.jsp"/>
<property name="unauthorizedUrl" value="/unauthorized.jsp"/>
<!--
配置哪些页面需要受保护,
以及访问这些页面需要的权限 (url=拦截器 的形式)
1) anon可以被匿名访问
2) authc必须认证即登录后才可以访问的页面
3) logout 登出
-->
<property name="filterChainDefinitions">
<value>
/login.jsp = anon
/shiro/login = anon
/shiro/logout = logout
# everything else requires authentication:
/** = authc
<!-- /list.jsp = anon 第一次匹配优先,此处无效。依然属于authc-->
</value>
</property>
</bean>
bean类:ShiroRealm
public class ShiroRealm extends AuthenticatingRealm{
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken token) throws AuthenticationException {
//1.AuthenticationToken转换成UsernamePasswordToken
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
//2.从UsernamePasswordToken中获取username
String username = upToken.getUsername();
//3.调用数据库的方法,从数据库中查询username对应的记录
//调用dao.....
//4.若用户不存在,则可以抛出UnknownAccountException异常
if("unknown".equals(username)){
throw new UnknownAccountException("用户不存在!");
}
//5.根据用户信息的情况决定是否需要抛出其他的异常
if("sb".equals(username)){
throw new LockedAccountException("用户被锁定!");
}
//6.根据用户的情况来构建AuthenticationInfo对象并返回
//以下信息是从数据中获取的
//1) principal:认证的实体信息,可以是username,也可以是对应的实体对象
Object principal = username;
//2) credentials:密码
Object credentials = null;
if("admin".equals(username)){
credentials="038bdaf98f2037b31f1e75b5b4c9b26e";
}else if("user".equals(username)){
credentials="098d2c478e9c11555ce2823231e02ec1";
}
//3) realmName:当前realm对象的name,调用父类的getName()方法即可
String realmName = getName();
//4) salt盐值:相同的密码,不同的盐值,加密后的字符串不同
ByteSource credentialsSalt = ByteSource.Util.bytes(username);//这里使用了用户名作为原始值
SimpleAuthenticationInfo info = null;//new SimpleAuthenticationInfo(principal, credentials, realmName);
info = new SimpleAuthenticationInfo(principal,credentials, credentialsSalt, realmName);
return info;
}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
String userName = (String) principals.getPrimaryPrincipal();
SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
try {
authorizationInfo.setRoles("admin");
authorizationInfo.setStringPermissions("delete");
} catch (Exception e) {
e.printStackTrace();
}
return authorizationInfo;
}
}
springmvc handler
@Controller
@RequestMapping("/shiro")
public class ShiroHandler {
@RequestMapping("/login")
public String login(@RequestParam("username") String username,
@RequestParam("password") String password){
Subject currentUser = SecurityUtils.getSubject();
if(!currentUser.isAuthenticated()){
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
token.setRememberMe(true);
try{
currentUser.login(token);//token传入到了realm里面
}
//所有认证异常的父类
catch(AuthenticationException e){
System.out.println("登录失败:"+e.getMessage());
}
}
return "redirect:/list.jsp";
}
}
整个过程,其实就是 用户从页面传来token,然后handler执行subject.login(token),token被传到reaml
里面,执行doGetAuthenticationInfo身份认证方法和doGetAuthorizationInfo查询角色权限方法。
Shiro与Spring整合
最新推荐文章于 2024-08-22 10:14:23 发布