一 配置shiro的filter实现URL级别权限控制
登录流程:应用程序-->Subject(就是shiro管理的用户)-->securityManger(安全管理器,shiro权限控制的核心)--Realm(应用程序和安全数据之间连接器)--安全数据---->SecurityManager(底层判断)---->Suject--->application code
在编写程序是操作Subject方法,调用底层的SucurityManger安全管理器进行管理,并通过Realm这个应用程序和安全数据之间的连接器的对象,来完成权限控制读取安全数据.
- 配置web.xml文件
<?xml version="1.0" encoding="UTF-8"?> <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5"> <!-- spring配置文件位置 --> <context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath:applicationContext.xml</param-value> </context-param> <!-- spring核心监听器 --> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> <!-- shiro的filter --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- struts2 过滤器 --> <filter> <filter-name>struts2</filter-name> <filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class> </filter> <filter-mapping> <filter-name>struts2</filter-name> <url-pattern>*.action</url-pattern> </filter-mapping> </web-app>
2. 配置application.xml
anon 未认证可以访问 authc 认证后可以访问 perms 需要特定权限才能访问 roles 需要特定角色才能访问
user 需要特定用户才能访问 port 需要特定端口才能访问 reset 根据指定 HTTP 请求访问才能访问<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns:jdbc="http://www.springframework.org/schema/jdbc" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:jpa="http://www.springframework.org/schema/data/jpa" xmlns:task="http://www.springframework.org/schema/task" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/data/jpa http://www.springframework.org/schema/data/jpa/spring-jpa.xsd"> <!-- 配置shiro的核心Filter --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <!-- 配置安全管理器 --> <property name="securityManager" ref="securityManager"/> <!-- 未认证,跳转到哪个页面 --> <property name="loginUrl" value="/login.html"/> <!-- 登录页面页面 --> <property name="successUrl" value="/index.html"/> <!-- 认证后,没有权限跳转页面 --> <property name="unauthorizedUrl" value="/unauthorized.html" /> <!-- shiro URL控制过滤器规则 --> <property name="filterChainDefinitions"> <value> /login.html* =anon /user_login.action=anon <!-- 登录时在认证前访问 --> /validatecode.jsp*=anon <!-- anon 未认证可访问.authc认证后可访问--> /css/**=anon /js/**=anon /images/**=anon /services/**=anon /**=authc </value> </property> </bean> <!-- 安全管理器 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="bosRealm"></property> </bean> <!-- shiro的后处理器 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"> </bean> </beans>
3.在登录界面,form表单补全,并提交.
<form class="form-horizontal" id="loginform" name="loginform" method="post" action="user_login.action"> <a href="javascript:$('#loginform').submit();" id="loginform" name="loginform" >立即登录</a>
4. 在UserAction编写login方法
package cn.itcast.bos.web.action.system; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.subject.Subject; import org.apache.struts2.convention.annotation.Action; import org.apache.struts2.convention.annotation.Namespace; import org.apache.struts2.convention.annotation.ParentPackage; import org.apache.struts2.convention.annotation.Result; import org.springframework.context.annotation.Scope; import org.springframework.stereotype.Controller; import cn.itcast.bos.domain.system.User; import cn.itcast.bos.web.action.common.BaseAction; @Namespace("/") @Controller @ParentPackage("json-default") @Scope("prototype") public class UserAction extends BaseAction<User>{ @Action(value="user_login",results={@Result(type="redirect",name="success",location="index.html") ,@Result(name="login",type="redirect",location="login.html")}) public String login(){ //用户名和密码都保存在model中 //基于shiro实现登录 Subject subject = SecurityUtils.getSubject(); //用户名和密码保存到token中 AuthenticationToken token= new UsernamePasswordToken(model.getUsername(),model.getPassword()); try { //如果正常登录,表示没有异常.登陆成功 subject.login(token); return SUCCESS; } catch (Exception e) { //如果异常,表示登录失败,重新跳转到登录页面 e.printStackTrace(); return LOGIN; } } }
5. 定义Realm,实现认证方法.
package cn.itcast.bos.realm; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.SimpleAuthenticationInfo; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.springframework.stereotype.Component; import cn.itcast.bos.domain.system.User; import cn.itcast.bos.service.system.UserService; //加入Spring管理的注解,bean管理. @Component("bosRealm") public class BosRealm extends AuthorizingRealm{ private UserService userService ; @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection pc) { System.out.println("授权..."); return null; } @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { System.out.println("认证..."); //转换token UsernamePasswordToken UsernamePasswordToken=(UsernamePasswordToken) token; //根据用户名查询用户信息 User user = userService.findByUsername(UsernamePasswordToken.getUsername()); if(user==null){ //用户名不存在 //参数一:期望登陆后保存在subject中的信息 //参数二:密码 //参数三:realm的名称 //return new SimpleAuthenticationInfo(user,null,getName()); return null; }else{ //用户名存在 //当返回密码时,securityManager安全管理器会自动比较与用户传过来的密码 //如果一致,登陆成功,如果不一致,报密码错误异常 return new SimpleAuthenticationInfo(user,user.getPassword(),getName()); } } }