shiro和spring的集合

1.shiro

1概念
	Apache Shiro是一个强大且易用的Java安全框架,可以做身份验证、授权、密码学和会话管理
2优势
	shiro是一款简单易用轻量级的安全框架（做项目要和spring整合）
3登录认证流程

 //（1）得到SecurityManager对象
    Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
     SecurityManager securityManager = factory.getInstance();
     //(2)加入的shiro的环境里面
     SecurityUtils.setSecurityManager(securityManager);
     //(3)在环境里面拿到主体
     Subject subject = SecurityUtils.getSubject();
     //判断这个主体是否认证过
     if(!subject.isAuthenticated()){
         //没有登录过
         //得到用户名和密码的令牌
         UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken("root", "secret");
         try {
             subject.login(usernamePasswordToken);
             System.out.println("登录成功");
         } catch (UnknownAccountException uae) {
            System.out.println("这没有这个账号（用户名）");
         } catch (IncorrectCredentialsException ice) {
             System.out.println("这个密码是错误的");
         } catch (LockedAccountException lae) {
             System.out.println("这个账号已经被锁定");
         }catch (AuthenticationException ae) {
             System.out.println("其他错误");
         }
     }

4授权流程
	判断是否登录，登录之后才有授权流程		

 //授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //得到主体
        String username = (String)principalCollection.getPrimaryPrincipal();
        //通过用户名拿到角色 -- 角色是存入数据库，从数据库拿到角色
        Set<String> roles = findRoleByUsername(username);
        //通过用户名拿到权限 -- 从数据库拿到
        Set<String> permissions = findPermissionsByUsername(username);
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.setRoles(roles);
        authorizationInfo.setStringPermissions(permissions);
        return authorizationInfo;
    }


	//通过用户名拿到权限
    private Set<String> findPermissionsByUsername(String username) {
        Set<String> permissions = new HashSet<String>();
        if("mm".equals(username)) {
            permissions.add("employee:*");
            permissions.add("department:save");
        }
        return permissions;
    }

	//通过用户名拿到角色
    private Set<String> findRoleByUsername(String username) {
        Set<String> roles = new HashSet<String>();
        if("mm".equals(username)){
            roles.add("admin");
            roles.add("it");
        }
        return roles;
    }

5shiro和spring整合
	1）导包

<!-- shiro的支持包 -->
 <dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-all</artifactId>
    <version>1.4.0</version>
    <type>pom</type>
</dependency>
  <!-- shiro与Spring的集成包 -->
  <dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
  </dependency>

	2）配置shiroFilter到web.xml			

<!-- Spring与shiro集成:需要定义一个shiro过滤器(这是一个代理过滤器，它会到spring的配置中找一个名称相同的真实过滤器) -->
<filter>
  <filter-name>shiroFilter</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  <init-param>
    <param-name>targetFilterLifecycle</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>

<filter-mapping>
  <filter-name>shiroFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

	3）配置shiro Spring文件

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
         http://www.springframework.org/schema/beans
         http://www.springframework.org/schema/beans/spring-beans.xsd
">
    <!--配置安全管理器-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm"></property>
    </bean>
    <!--配置realm-->
    <bean id="myRealm" class="cn.itsource.aisell.shiro.MyRealm">
        <property name="credentialsMatcher" >
            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                <property name="hashAlgorithmName" value="MD5"></property>
                <property name="hashIterations" value="10"></property>
            </bean>
        </property>
    </bean>

    <!-- 3.lifecycleBeanPostProcessor：可以自动调用在Spring IoC窗口中 Shiro bean的生成周期方法 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    <!-- 4.启动ioc容器中使用 shiro的注解，但是必需配置在Spring Ioc容器中Shiro bean的生成周期方法 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

    <!-- 真实的过滤器处理 id这个名字 必须和web.xml里面配置的代理的过滤器的名称一样，才行-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"></property>
        <!-- 如果没有认证，会跳转该页面-->
        <property name="loginUrl" value="/s/login.jsp"></property>
        <!--认证成功，跳转的页面-->
        <property name="successUrl" value="/s/main.jsp"></property>
        <!--没有权限-->
        <property name="unauthorizedUrl" value="/s/unauthorized.jsp"></property>
        <!-- 拦截配置-->
        <!-- <property name="filterChainDefinitions">
             <value>
                 /s/login.jsp = anon
                 /login = anon
                 /s/permission.jsp=perms[user:*]
                 /** =  authc
             </value>
         </property>-->
        <property name="filterChainDefinitionMap" ref="filterChainDefinitionMap1"></property>

    </bean>
    <!-- 配置两个bean-->
    <bean id="filterChainDefinitionMap1" factory-bean="filterMapFactoyBean" factory-method="createFilterChainDefinitionMap">
    </bean>
    <bean id="filterMapFactoyBean" class="cn.itsource.aisell.shiro.AisellFilterChainDefinitionMap"></bean>
</beans>

	4）集成到Spring
		<import resource="applicationContext-shiro.xml"></import>