记一次springboot集成shiro报错org.apache.shiro.UnavailableSecurityManagerException的坑

最新推荐文章于 2024-08-08 11:11:31 发布

m0_54850825

最新推荐文章于 2024-08-08 11:11:31 发布

阅读量692

点赞数

分类专栏： java 文章标签： java 后端

本文链接：https://blog.csdn.net/m0_54850825/article/details/124490541

版权

java 专栏收录该内容

334 篇文章 12 订阅

订阅专栏

文章目录

背景

近期做了个小项目，在项目后台使用shiro来做身份验证、权限管理等。shiro这个框架写的真不错，接入简单，功能还算完善，扩展支持的也还行。但是在使用的过程中发现了一个问题，在ajax请求需要校验用户和权限时直接重定向的登录页或者无权限的页面，无法处理为json信息返回，导致页面不能给出正确的提示信息。在查看文档后考虑重写对应的filter来处理。

shiro处理ajax请求思路

于是重写了shiro默认UserFilter的onAccessDenied方法，代码很简单如下。

public class CustomShiroUserFilter extends UserFilter {

    /**
     * 认证失败回调
     *
     * @param request
     * @param response
     * @return
     * @throws Exception
     */
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        //查看是否是AjAX请求
        String accept = httpRequest.getHeader("accept");
        String requestedWith = httpRequest.getHeader("X-Requested-With");
        if ((accept != null && accept.contains("application/json")) || (requestedWith != null && "XMLHttpRequest".equalsIgnoreCase(requestedWith))) {
            httpResponse.setContentType("text/json; charset=UTF-8");
            // 构建返回值
            Result<Boolean> result = Result.<Boolean>builder().code(403).success(false).data(false).message("not login!").build();
            //带回AJAX请求,把数据作为流传回去这里需要传出标准的json数据格式
            httpResponse.getWriter().print(JSON.toJSONString(result));
            saveRequest(request);
        } else {
            saveRequestAndRedirectToLogin(request, response);
        }
        return false;
    }

}

我的项目是springboot搭建的，filter写完感觉问题不大，直接将其添加到shiroConfig中，代码如下：

    @Bean
    public CustomShiroUserFilter customShiroUserFilter(){
        return new CustomShiroUserFilter();
    }

    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        shiroFilterFactoryBean.setSecurityManager(securityManager);
        shiroFilterFactoryBean.setLoginUrl("/login");
        Map<String, Filter> filterMap = new LinkedHashMap<>();
        // 若CustomShiroUserFilter交由spring管理的话会导致filter在shiroFilter之外而且运行在shiroFilter之前了，导致无法bind securityManager
        filterMap.put("customShiroUserFilter", customShiroUserFilter());
        shiroFilterFactoryBean.setFilters(filterMap);

        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/manage/**", "user");
        filterChainDefinitionMap.put("/rest/manage/**", "customShiroUserFilter");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return shiroFilterFactoryBean;
    }

遇到的问题

启动项目，访问，结果出现了意料之外的问题，报错UnavailableSecurityManagerException

org.apache.shiro.UnavailableSecurityManagerException: No SecurityManager accessible to the calling code, either bound to the org.apache.shiro.util.ThreadContext or as a vm static singleton.  This is an invalid application configuration.
	at org.apache.shiro.SecurityUtils.getSecurityManager(SecurityUtils.java:123) ~[shiro-core-1.4.2.jar:1.4.2]
	at org.apache.shiro.subject.Subject$Builder.<init>(Subject.java:626) ~[shiro-core-1.4.2.jar:1.4.2]
	at org.apache.shiro.SecurityUtils.getSubject(SecurityUtils.java:56) ~[shiro-core-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.filter.AccessControlFilter.getSubject(AccessControlFilter.java:97) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.filter.authc.UserFilter.isAccessAllowed(UserFilter.java:53) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.filter.AccessControlFilter.onPreHandle(AccessControlFilter.java:162) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.filter.PathMatchingFilter.isFilterChainContinued(PathMatchingFilter.java:203) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.filter.PathMatchingFilter.preHandle(PathMatchingFilter.java:178) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.servlet.AdviceFilter.doFilterInternal(AdviceFilter.java:131) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.shiro.web.servlet.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:125) ~[shiro-web-1.4.2.jar:1.4.2]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at com.alibaba.druid.support.http.WebStatFilter.doFilter(WebStatFilter.java:123) ~[druid-1.1.9.jar:1.1.9]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:526) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:408) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:861) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1579) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_131]
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_131]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.27.jar:9.0.27]
	at java.lang.Thread.run(Thread.java:748) [na:1.8.0_131]

原因分析

很奇怪，使用spring是同样的操作，将自定义filter配置成spring bean，然后配置到shiro的filter中，没啥问题，而使用springboot就出现了这个报错，跟代码发现报错的位置在org.apache.shiro.SecurityUtils的getSecurityManager()方法，分析原因定位是securityManager没有获取到值，应该是ThreadContext.getSecurityManager()没有取到对应的信息，而这个set值是通过org.apache.shiro.web.servlet.AbstractShiroFilter的doFilterInternal()方法这里面做的也就是说代码没有执行到shiroFilter。

接下来就分析为什么ShiroFilter还未执行就执行到了自定义的filter，debug其执行过程发现我自定义的customShiroUserFilter被加入的了filter chain于shiroFilter同级，顺序还在shiroFilter前面，所以CustomShiroUserFilter执行时shiro还未执行上下文信息还未写入。
在这里插入图片描述

解决办法

查阅资料发现springboot会将@Bean标识的filter注册到filter chain中，所以就出现了上述问题。到此解决办法已经很清晰了，自定义的customShiroUserFilter应该是shiroFilter的子级，由ShiroFilterFactoryBean来注册管理，所以直接new一个CustomShiroUserFilter对象交给ShiroFilterFactoryBean，修改代码就一句filterMap.put("customShiroUserFilter", new CustomShiroUserFilter());问题就解决了，配置代码如下：

    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        shiroFilterFactoryBean.setSecurityManager(securityManager);
        shiroFilterFactoryBean.setLoginUrl("/login");
        Map<String, Filter> filterMap = new LinkedHashMap<>();
        // 若CustomShiroUserFilter交由spring管理的话会导致filter在shiroFilter之外而且运行在shiroFilter之前了，导致无法bind securityManager
        filterMap.put("customShiroUserFilter", new CustomShiroUserFilter());
        shiroFilterFactoryBean.setFilters(filterMap);

        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/userlogin", "anon");
        filterChainDefinitionMap.put("/manage/**", "user");
        filterChainDefinitionMap.put("/rest/manage/**", "customShiroUserFilter");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return shiroFilterFactoryBean;
    }

ps：如果自定义的filter需要依赖其他的spring bean，在springboot filter配置中可以设置不自动注册，具体的方法可自行查找。