这是我的shiro.xml 《@中国人叔叔-lt》
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
<bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
<property name="permissionsLookupEnabled" value="true"></property>
<property name="dataSource" ref="dataSource"/>
<property name="authenticationQuery"
value="SELECT password FROM USER_INFO WHERE username = ?"></property>
<property name="userRolesQuery"
value="select r.roleurl from role_user_info ru left join role_info r on ru.role_id = r.id ,user_info u where u.id =ru.user_id and u.username=?"></property>
<property name="permissionsQuery"
value="select t.right_url from role_rights_info lt left join rights_info t on lt.right_id = t.id ,role_info r where r.id =lt.role_id and r.roleurl=?"></property>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- 基于ehCache来缓存用户认证信息和授权信息的实现 -->
<property name="cacheManager" ref="cacheManager"/>
<!-- sessionMode参数设置为native时,那么shrio就将用户的基本认证信息保存到缺省名称为shiro-activeSessionCache 的Cache中 -->
<property name="sessionMode" value="native" />
<!--设置自定义realm -->
<property name="realms" >
<list>
<ref bean="jdbcRealm"></ref>
</list>
</property>
</bean>
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManager" ref="ehCacheManager"/>
<property name="cacheManagerConfigFile" value="classpath:shiro_ehcache.xml"/>
</bean>
<bean id="ehCacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"/>
<!--
Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行
Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截,Shiro对基于Spring的Web应用提供了完美的支持
-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<!-- Shiro的核心安全接口,这个属性是必须的 -->
<property name="securityManager" ref="securityManager"></property>
<!-- 要求登录时的链接(登录页面地址),非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->
<property name="loginUrl" value="/admin/login/login.html"></property>
<!-- 登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码) -->
<property name="successUrl" value="/" ></property>
<!-- 用户访问未对其授权的资源时,所显示的连接 -->
<property name="unauthorizedUrl" value="/admin/norights.html"></property>
<property name="filters">
<map>
<entry key="commonauth" value-ref="commonauth"/>
</map>
</property>
<property name="filterChainDefinitions">
<value>
/admin/norights.html=anon
/admin/login/**=anon
/admin/login/loginout.html=anon
/**=authc,commonauth
</value>
</property>
</bean>
<bean id="commonauth" class="common.shiro.CommonAuthFilter" />
</beans>
其中<bean id="commonauth" class="common.shiro.CommonAuthFilter" />
为自定义的过滤器
以下是CommonAuthFilter的源码:
package common.shiro;
import java.io.IOException;
import java.util.Set;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.CollectionUtils;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;
import org.apache.shiro.web.util.WebUtils;
/**
* Created by lt on 2016/8/3.
* 权限过虑
*/
public class CommonAuthFilter extends AuthorizationFilter {
public CommonAuthFilter(){
}
protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
String requestURI = WebUtils.getPathWithinApplication(WebUtils.toHttp(servletRequest));
Subject subject = this.getSubject(servletRequest, servletResponse);
//超级管理员无阻
if(subject.hasRole("adminrole")) return true;
//通过subject判断用户有没有些url权限
return subject.isPermitted(requestURI);
}
}
其中String requestURI = WebUtils.getPathWithinApplication(WebUtils.toHttp(servletRequest));
为取到当前访问的URL地址,在我的权限资源表中,我存的是每一个controller配制的@RequestMapping(value=”/main.html”) ,如果用户能访问此权限,自动通过。
当然一些别的权限也可以是虚拟的URL或者NAME,看自己怎么定义。