shiro 与Spring 结合
-
数据库实现,参考RBAC角色权限控制的实现
-
maven 导入相关包
<dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.3.2</version> </dependency> <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-web</artifactId> <version>1.3.2</version> </dependency> <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.3.2</version> </dependency> <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-ehcache --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>1.3.2</version> </dependency>
-
web.xml 配置
shiroFilter org.springframework.web.filter.DelegatingFilterProxy shiroFilter /* -
spring_shiro.xml
<bean id="myRealm" class="com.nzs.listener.MyShiroRealm"/> <!-- 缓存管理 --> <bean id="mycacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/> <!-- 安全管理器 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="myRealm"/> <property name="cacheManager" ref="mycacheManager"></property> </bean> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <!-- Shiro过滤器 --> <!--<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">--> <bean id="shiroFilter" class="com.nzs.listener.ShiroPermissionFactory"> <property name="manageUserService" ref="manageUserService"/> <!-- Shiro的核心安全接口,这个属性是必须的 --> <property name="securityManager" ref="securityManager"/> <!-- 身份认证失败,则跳转到登录页面的配置 --> <property name="loginUrl" value="/login.jsp"/> <!-- 登录成功跳转页面的配置 --> <property name="successUrl" value="/index"/> <!-- 权限认证失败,则跳转到指定页面 --> <property name="unauthorizedUrl" value="/norole.jsp"/> <!-- Shiro连接约束配置,即过滤链的定义 --> <property name="filterChainDefinitions"> <value> /manageUser/login=anon <!--/** = authc--> </value> </property> </bean>
-
自定义的realm
public class MyShiroRealm extends AuthorizingRealm {
static IManageUserService manageUserService;
public static final String SESSION_USER_KEY = “temp”;/** * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用,负责在应用程序中决定用户的访问控制的方法 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { //可自定义实现内容 SecurityUtils.getSubject().getSession() .getAttribute(OneballShiroRealm.SESSION_USER_KEY); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); return info; } /** * 认证回调函数,登录信息和用户验证信息验证 */ @Override protected AuthenticationInfo doGetAuthenticationInfo( AuthenticationToken authcToken) throws AuthenticationException { //判断 manageUserService 是否为空 if (manageUserService == null) { manageUserService = (ManageUserService) ApplicationContextUtil.getBean("manageUserService"); } UsernamePasswordToken token = (UsernamePasswordToken) authcToken; String userName = token.getUsername(); String passWord = String.valueOf(token.getPassword()); ManageUser manageUser = manageUserService.login(userName, passWord); if (manageUser == null) { return null; // 异常处理,找不到数据 } Subject subject = SecurityUtils.getSubject(); //shiro session Session session = SecurityUtils.getSubject().getSession(); session.setTimeout(60 * 60 * 3 * 1000); session.setAttribute(OneballShiroRealm.SESSION_USER_KEY, manageUser); //当前 Realm 的 name String realmName = this.getName(); //登陆的主要信息: 可以是一个实体类的对象, 但该实体类的对象一定是根据 token 的 username 查询得到的. Object principal = authcToken.getPrincipal(); return new SimpleAuthenticationInfo(principal, passWord, realmName); } public IManageUserService getManageUserService() { return manageUserService; } public void setManageUserService(IManageUserService manageUserService) { this.manageUserService = manageUserService; }
}
-
继承ShiroFilterFactoryBean,实现从数据库动态加载权限信息
public class ShiroPermissionFactory extends ShiroFilterFactoryBean {
private ManageUserService manageUserService; /**记录配置中的过滤链*/ public static String definition=""; /** * 初始化设置过滤链 */ @Override public void setFilterChainDefinitions(String definitions) {
// String token = manageUserService.getAdminToken(0);
//可从数据库读取后,添加至过滤链,参考此处已注释的代码 definition = definitions;//记录配置的静态过滤链
// List permissions = permissService.findAll();
Map<String, String> otherChains = new HashMap<String,String>();
// permissions.forEach(permiss->{
// //perms.add(e)
otherChains.put(“/discover/newstag”, “authc,roles[user,admin]”);
// });
//加载配置默认的过滤链
Ini ini = new Ini();
ini.load(definitions);
Ini.Section section = ini.getSection(IniFilterChainResolverFactory.URLS);
if (CollectionUtils.isEmpty(section)) {
section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
}
//加上数据库中过滤链
section.putAll(otherChains);
setFilterChainDefinitionMap(section);} public ManageUserService getManageUserService() { return manageUserService; } public void setManageUserService(ManageUserService manageUserService) { this.manageUserService = manageUserService; }
}
-
FilterChainDefinitionsService实现,无需部署,重新加载权限
@Service
public class FilterChainDefinitionsService implements IFilterChainDefinitionsService {
@Autowired
private ShiroPermissionFactory permissFactory;@Override public void reloadFilterChains() { synchronized (permissFactory) { //强制同步,控制线程安全 AbstractShiroFilter shiroFilter = null; try { shiroFilter = (AbstractShiroFilter) permissFactory.getObject(); PathMatchingFilterChainResolver resolver = (PathMatchingFilterChainResolver) shiroFilter .getFilterChainResolver(); // 过滤管理器 DefaultFilterChainManager manager = (DefaultFilterChainManager) resolver.getFilterChainManager(); // 清除权限配置 manager.getFilterChains().clear(); permissFactory.getFilterChainDefinitionMap().clear(); // 重新设置权限 permissFactory.setFilterChainDefinitions(ShiroPermissionFactory.definition);//传入配置中的filterchains Map<String, String> chains = permissFactory.getFilterChainDefinitionMap(); //重新生成过滤链 if (!CollectionUtils.isEmpty(chains)) { chains.forEach((url, definitionChains) -> { manager.createChain(url, definitionChains.trim().replace(" ", "")); }); } // manager.addToChain("/discover/banner", "perms", "sssss"); } catch (Exception e) { e.printStackTrace(); } } }
}
-
登录验证的实现
//示例代码,未实现加密验证
private String loginUser(ManageUser user) {
// if (isRelogin(user)) {
// // 如果已经登陆,无需重新登录
// return “success”;
// }
return shiroLogin(user); // 调用shiro的登陆验证
}private String shiroLogin(ManageUser user) { UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword().toCharArray(), null);
// token.setRememberMe(true);
// shiro登陆验证
try {
// System.out.println(SecurityUtils.getSubject());
SecurityUtils.getSubject().login(token);
} catch (UnknownAccountException ex) {
return “用户不存在或者密码错误!”;
} catch (IncorrectCredentialsException ex) {
return “用户不存在或者密码错误!”;
}catch (ExcessiveAttemptsException ex) {
return “账号或密码错误次数过多,请稍后重试!”;
} catch (AuthenticationException ex) {
return ex.getMessage(); // 自定义报错信息
} catch (Exception ex) {
ex.printStackTrace();
return “内部错误,请重试!”;
}
return “success”;
}private boolean isRelogin(ManageUser user) { Subject us = SecurityUtils.getSubject(); if (us.isAuthenticated()) { return true; // 参数未改变,无需重新登录,默认为已经登录成功 } return false; // 需要重新登陆 }