权限管理是一个系统不可缺少的一部分，也是比较复杂的一部分。
目前有二个主流权限管理的框架：shiro 和spring security ，以下讲解spring如何集成apache shiro
第一步：导入shiro的jar包
shiro-aspectj-1.2.2.jar
shiro-cas-1.2.2.jar
shiro-core-1.2.2.jar
shiro-ehcache-1.2.2.jar
shiro-guice-1.2.2.jar
shiro-quartz-1.2.2.jar
shiro-spring-1.2.2.jar
shiro-tools-hasher-1.2.2-cli.jar
shiro-web-1.2.2.jar
第二步：编写自己的Realm实现类：
package com.bs.common.shiro.realm;
import java.io.Serializable;
import java.util.HashSet;
import java.util.Set;
import javax.annotation.Resource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import com.bs.exception.BsException;
import com.bs.exception.BsExceptionCode;
import com.bs.system.po.BookUserInfo;
import com.bs.system.service.IBookUserService;
public class MyRealm extends AuthorizingRealm {
@Resource(name="bookUserService")
private IBookUserService bookUserService;
/**
* 授权
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
//arg0.getPrimaryPrincipal(): 实际上是在认证时返回的 SimpleAuthenticationInfo 的第一个参数!
// Object principal = arg0.getPrimaryPrincipal();
// ShiroUser user = (ShiroUser) principal;
ShiroUser user = (ShiroUser) SecurityUtils.getSubject().getSession().getAttribute("userObj");
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
info.setRoles(user.getRoles());
info.setStringPermissions(user.getPermissions());
return info;
}
/**
* 认证
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken arg0) throws AuthenticationException {
//强转为UsernamePasswordToken类型
UsernamePasswordToken token=(UsernamePasswordToken)arg0;
//获取用户名和密码(密码要转为字符串类型)
String username = token.getUsername();
String password = new String(token.getPassword());
//测试一下，看是否得到了用户名和密码
System.out.println("username: " + username + ", password: " + password);
BookUserInfo bookUserInfo = null;
try {
bookUserInfo = bookUserService.loginService(username, password);
if(bookUserInfo==null){
throw new IncorrectCredentialsException("密码错误");
}
} catch(BsException bs){
if(BsExceptionCode.ERROR_CODE_NO_DATA==bs.getErrorCode()){
throw new UnknownAccountException("账户不存在，请联系管理员!");
}
}
//利用新建的类来创建对象
ShiroUser user=new ShiroUser();
user.setUsername(username); //将页面中的username值设置进去
//模拟设置权限部分
//实际项目中：从数据库根据用户名去查询其角色和权限
if("admin".equals(username)){
//如果用户名为：admin，则为其增加2个角色 admin和user
//这里是模拟设置角色
user.getRoles().add("admin");
user.getRoles().add("user");
Set<String> permissions = new HashSet<String>();
//这里是模拟设置权限
permissions.add("book:add");
permissions.add("book:create");
user.setPermissions(permissions);
}else {
//如果用户名不为admin,则为其增加user角色
user.getRoles().add("user");
}
SecurityUtils.getSubject().getSession().setAttribute("userObj", user);
return new SimpleAuthenticationInfo(username, password,getName());
}
@Override
public String getName() {
return "myRealm";
}
//新建一个类定义用户角色和权限
class ShiroUser implements Serializable{
private static final long serialVersionUID = 1L;
private String username;
private Set<String> roles= new HashSet<String>();
private Set<String> permissions = new HashSet<String>();
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public Set<String> getRoles() {
return roles;
}
public void setRoles(Set<String> roles) {
this.roles = roles;
}
public Set<String> getPermissions() {
return permissions;
}
public void setPermissions(Set<String> permissions) {
this.permissions = permissions;
}
}
}
第三步：在src目录下新建applicationContext-shiro.xml配置文件内容如下：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:util="http://www.springframework.org/schema/util"
xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd">
<!--2.配置CacheManager实例：管理Shiro相关缓存操作 -->
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"></property>
</bean>
<!--3.配置realm实例，实际的认证和授权都是由Realm实例来完成的！ -->
<bean id="myRealm" class="com.bs.common.shiro.realm.MyRealm"></bean>
<!-- 4.配置 SecurityManager 实例. SecurityManager 是 Shiro 最核心的组件 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="cacheManager" ref="cacheManager"/>
<property name="realm" ref="myRealm"/>
</bean>
<!--5.配置bean的后置处理器来自动调用Shiro中的bean的init和destroy方法。 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>
<!--6.配置使shiro注解起作用的bean，需要放在 lifecycleBeanPostProcessor后面 -->
<aop:config proxy-target-class="true"></aop:config>
<!-- <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"></bean> -->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"></property>
</bean>
<!--
7.配置哪些页面需要被拦截，以及访问这些页面所需的权限 。
该bean中的id 属性值必须和 web.xml 文件中配置的 filter 的 filter-name 值一致
-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"></property>
<!--①配置登陆页面 -->
<property name="loginUrl" value="/index.jsp"></property>
<property name="successUrl" value="/admin.jsp"></property>
<property name="unauthorizedUrl" value="/index.jsp"></property>
<!-- <property name="filters">
<util:map>
<entry key="authc">
<bean class="org.apache.shiro.web.filter.authc.PassThruAuthenticationFilter"/>
</entry>
</util:map>
</property> -->
<!--②配置需要被拦截的资源 以及访问权限 -->
<property name="filterChainDefinitions">
<value>
<!-- anon: 表示匿名的, 即任何人都可以访问 -->
/add.jsp=anon
/images/**=anon
/js/**=anon
/skin/**=anon
/upload/**=anon
/index.jsp=anon
/login.jsp=anon
/user/**=anon
/system/**=anon
/book/**=anon
/login=anon
/logout=logout
<!--③设置访问具体资源的权限 -->
/admin.jsp=roles[admin]
/user.jsp=roles[user]
<!-- authc 表示必须经过认证之后才可以访问的页面 -->
/**=authc
</value>
</property>
</bean>
</beans>
<ehcache>
<diskStore path="java.io.tmpdir/shiro-spring-sample"/>
<defaultCache
maxElementsInMemory="10000"
eternal="false"
timeToIdleSeconds="120"
timeToLiveSeconds="120"
overflowToDisk="false"
diskPersistent="false"
diskExpiryThreadIntervalSeconds="120"
/>
<cache name="shiro-activeSessionCache"
maxElementsInMemory="10000"
eternal="true"
overflowToDisk="true"
diskPersistent="true"
diskExpiryThreadIntervalSeconds="600"/>
<cache name="org.apache.shiro.realm.SimpleAccountRealm.authorization"
maxElementsInMemory="100"
eternal="false"
timeToLiveSeconds="600"
overflowToDisk="false"/>
</ehcache>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:applicationContext.xml,classpath:applicationContext-shiro.xml</param-value>
</context-param> <!--配置shiro过滤器 -->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping> 至此，spring集成shiro配置完毕。
编写登陆的处理方法：
public String login(){
//数据验证
if(ObjectFormatUtil.isNotNull(username) && ObjectFormatUtil.isNotNull(password)){
try {
//1.获取当前的用户
Subject currentUser = SecurityUtils.getSubject();
//2.把登录信息封装为一个 UsernamePasswordToken 对象
UsernamePasswordToken token=new UsernamePasswordToken(this.username,this.password);
currentUser.login(token);
} catch (UnknownAccountException uae) {
System.out.println("用户名不存在: " + uae);
return "input";
} catch (IncorrectCredentialsException ice) {
System.out.println("用户名存在,但密码和用户名不匹配: " + ice);
return "input";
} catch (LockedAccountException lae) {
System.out.println("用户被锁定: " + lae);
return "input";
} catch (AuthenticationException ae) {
System.out.println("其他异常: " + ae);
return "input";
}
}else{
message = "用户名或密码不能为空";
}
return "main";
}编程退出登录方法：
public String loginout(){
//移除session
Subject currentUser = SecurityUtils.getSubject();
currentUser.logout();
return "loginPage";
}shiro标签的使用:
以下配置表示：拥有admin角色的用户可以显示图书管理和系统管理菜单
<%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro" %>
<shiro:hasRole name="admin">
<dd><div class='item' id='item8' onMouseMove="mv(this,'m',8);" onMouseOut="mv(this,'o',8);"><a href="${ctx}/jsp/main/user/bookmenu.jsp" οnclick="changeSel(8)" target="menu">图书管理</a></div></dd>
<dd><div class='item' id='item4' onMouseMove="mv(this,'m',4);" onMouseOut="mv(this,'o',4);"><a href="${ctx}/jsp/main/user/usermenu.jsp" οnclick="changeSel(4)" target="menu">系统管理</a></div></dd>
</shiro:hasRole>使用注解配置action类中方法访问的权限：
以下注解表示拥有admin角色的用户可以访问该方法：
/**
* 添加分馆
* @return
*/
@RequiresRoles({"admin"})
public String doAdd(){
try {
if(!ObjectFormatUtil.isNotNull(bookLib.getLibname())){
message = "输入的信息有误";
return MESSAGE;
}
if(null==bookLibService.save(bookLib)){
message = "保存信息失败";
return MESSAGE;
}
return list();
} catch (Exception e) {
e.printStackTrace();
}
return "message";
}当没有权限访问以下action类的方法时，会抛出org.apache.shiro.authz.UnauthorizedException异常，我们需要在struts2中进行该异常处理：
<global-results>
<result name="permissionmessage">/jsp/common/permissionmessage.jsp</result>
</global-results>
<global-exception-mappings>
<exception-mapping result="permissionmessage" exception="org.apache.shiro.authz.UnauthorizedException">
</exception-mapping>
</global-exception-mappings>如果使用ajax异步访问我们action类中方法时，如果没有权限，我们该怎样处理了？
如：
<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib uri="http://java.sun.com/jstl/core_rt" prefix="c"%>
<c:set var="ctx" value="${pageContext.request.contextPath}"></c:set>
<%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<base href="<%=basePath%>">
<title>add page</title>
<script type="text/javascript" src="${ctx}/js/jquery-2.1.1.min.js"></script>
<script type="text/javascript">
function add(){
$.ajax({
url:"${ctx}/system/testBookLib.action",
type:"post",
data:{"bookLib.libname":$("#libname").val()},
dataType:"json",
success:function(data){
if(data.result){
alert("添加成功");
}else{
alert(data.message);
}
}
});
}
</script>
</head>
<body>
图书馆名称：<input type="text" name="libname" id="libname"/> <br>
<input type="button" value="添加" id="btn_add" οnclick="add()"/>
</body>
</html>1、我们可以使用以下方式：
public void test1(){
boolean result = false;
Subject subject = SecurityUtils.getSubject();
if(subject.hasRole("admin")){
//1验证数据
if(!ObjectFormatUtil.isNotNull(bookLib.getLibname())){
message = "输入的信息有误";
}
//2验证图书名称是否已存在 如果已存在 则添加失败 给出提示 反正添加成功
if(bookLibService.isExistBooklibName(bookLib.getLibname())){
if(null==bookLibService.save(bookLib)){
message = "保存信息失败";
}else{
result = true;
}
}else{
message = "图书名称已存在";
}
}else{
message ="无权访问";
}
outJsonString(response, "{\"result\":"+result+",\"message\":\""+message+"\"}");
}
扫一扫
156
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
