java安全框架-Shiro学习笔记（五）-Shiro集成Web

最新推荐文章于 2022-03-26 16:43:10 发布

进击的马小林

最新推荐文章于 2022-03-26 16:43:10 发布

阅读量416

点赞数

分类专栏： shiro

本文链接：https://blog.csdn.net/qq_26504875/article/details/51773801

版权

shiro 专栏收录该内容

8 篇文章 0 订阅

订阅专栏

首先，使用maven创建web项目，并引入依赖包，这里使用jetty启动应用程序。

pom.xml以及web.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
 <modelVersion>4.0.0</modelVersion>
 <groupId>com.feiyang.shiro</groupId>
 <artifactId>ShiroWeb</artifactId>
 <packaging>war</packaging>
 <version>0.0.1-SNAPSHOT</version>
 <name>ShiroWeb Maven Webapp</name>
 <url>http://maven.apache.org</url>
 <dependencies>
  <dependency>
   <groupId>junit</groupId>
   <artifactId>junit</artifactId>
   <version>3.8.1</version>
   <scope>test</scope>
  </dependency>
  <dependency>
   <groupId>javax.servlet</groupId>
   <artifactId>javax.servlet-api</artifactId>
   <version>3.1.0</version>
  </dependency>
  <dependency>
   <groupId>javax.servlet.jsp</groupId>
   <artifactId>javax.servlet.jsp-api</artifactId>
   <version>2.3.1</version>
  </dependency>
  <dependency>
   <groupId>log4j</groupId>
   <artifactId>log4j</artifactId>
   <version>1.2.17</version>
  </dependency>
  <dependency>
   <groupId>log4j</groupId>
   <artifactId>log4j</artifactId>
   <version>1.2.17</version>
  </dependency>
  <dependency>
   <groupId>commons-logging</groupId>
   <artifactId>commons-logging</artifactId>
   <version>1.2</version>
  </dependency>

<dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-core</artifactId>
   <version>1.2.5</version>
  </dependency>
  <dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-web</artifactId>
   <version>1.2.5</version>
  </dependency>
 <dependency>
   <groupId>org.slf4j</groupId>
   <artifactId>slf4j-api</artifactId>
   <version>1.7.12</version>
  </dependency>
 </dependencies>
 <build>
  <finalName>ShiroWeb</finalName>

  <plugins>
   <plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-jar-plugin</artifactId>
    <configuration>
     <encoding>UTF-8</encoding>
    </configuration>
    <executions>
     <execution>
      <phase>package</phase>
      <goals>
       <goal>jar</goal>
      </goals>
      <configuration>
       <classesDirectory>target/classes</classesDirectory>
       <finalName>ystone-cms-web</finalName>
       <outputDirectory>target/lib</outputDirectory>
       <excludes>
        <exclude>**.xml</exclude>
       </excludes>
      </configuration>
     </execution>
    </executions>
   </plugin>
   <plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-compiler-plugin</artifactId>
    <version>3.1</version>
    <configuration>
     <source>1.7</source>
     <target>1.7</target>
     <encoding>UTF-8</encoding>
    </configuration>
   </plugin>
   <plugin>
    <groupId>org.mortbay.jetty</groupId>
    <artifactId>jetty-maven-plugin</artifactId>
    <version>8.1.8.v20121106</version>
    <configuration>
     <contextXml>src/main/resources/jetty-contexts.xml</contextXml>
     <stopKey>stop</stopKey>
     <stopPort>6699</stopPort>
     <webAppConfig>
      <contextPath>/ShiroWeb</contextPath>
      <!-- <defaultsDescriptor>src/main/resources/webdefault.xml</defaultsDescriptor> -->
     </webAppConfig>
     <scanIntervalSeconds>5</scanIntervalSeconds>
     <connectors>
      <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
       <port>8080</port>
       <maxIdleTime>60000</maxIdleTime>
      </connector>
     </connectors>
    </configuration>

   </plugin>
  </plugins>
 </build>
</project>

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>ShrioWeb</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  
  <listener>
	    <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
  </listener>
   
	<!-- 添加shiro支持 -->
	<filter>
	    <filter-name>ShiroFilter</filter-name>
	    <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
	</filter>
	
	<filter-mapping>
	    <filter-name>ShiroFilter</filter-name>
	    <url-pattern>/*</url-pattern>
	</filter-mapping>
	
	<servlet>
		<servlet-name>loginServlet</servlet-name>
		<servlet-class>com.java1234.servlet.LoginServlet</servlet-class>
	</servlet>
	
	<servlet-mapping>
		<servlet-name>loginServlet</servlet-name>
		<url-pattern>/login</url-pattern>
	</servlet-mapping>
	
	<servlet>
		<servlet-name>adminServlet</servlet-name>
		<servlet-class>com.java1234.servlet.AdminServlet</servlet-class>
	</servlet>
	
	<servlet-mapping>
		<servlet-name>adminServlet</servlet-name>
		<url-pattern>/admin</url-pattern>
	</servlet-mapping>
</web-app>

loginServlet.java

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;

public class LoginServlet extends HttpServlet{
	private static final long serialVersionUID = 1L;
	@Override
	protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
		// TODO Auto-generated method stub
		System.out.println("login doget");
		req.getRequestDispatcher("login.jsp").forward(req, resp);
	}
	@Override
	protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
		System.out.println("login dopost");
		String userName=req.getParameter("userName");
		String password=req.getParameter("password");
		Subject subject=SecurityUtils.getSubject();
		UsernamePasswordToken token=new UsernamePasswordToken(userName, password);
		try{
			subject.login(token);	
			resp.sendRedirect("success.jsp");
		}catch(Exception e){
			e.printStackTrace();
			req.setAttribute("errorInfo", "用户名或者密码错误");
			req.getRequestDispatcher("login.jsp").forward(req, resp);
		}
	}
}

adminServlet.java

import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
public class AdminServlet extends HttpServlet{
	private static final long serialVersionUID = 1L;

	@Override
	protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
		System.out.println("admin do get");
	}
	@Override
	protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
		System.out.println("admin do post");
	}

}

接下来配置文件，用来描述全局的跳转页面，用户信息，角色信息，权限信息等。

shiro.ini

[main]
authc.loginUrl=/login
roles.unauthorizedUrl=/unauthorized.jsp
perms.unauthorizedUrl=/unauthorized.jsp
[users]
java1234=123456,admin
jack=123,teacher
marry=234
json=345
[roles]
admin=user:*
teacher=student:*
[urls]
/login=anon
/admin=authc
/student=roles[teacher]
/teacher=perms["user:create"]

准备工作做完了，接下来进行测试。

启动项目以后，我们直接访问，http://127.0.0.1:8080/ShiroWeb/admin，在shiro.ini中，我们可以看到/admin=authc，表示需要身份验证，而/login=anon，表示不需要经过身份验证，即游客身份。而在[main]中配置的authc.loginUrl=/login中，是代表如果访问某个请求，没有通过身份认证，则访问/login，跳转到登录页面。

接下来使用jack,123登录，然后访问/student，可以看到/student需要teacher的角色，而jack有这个teacher的角色。出现404代表，认证通过，只是没有找到该路径的请求。

而用marry，234，登录的话，结果如下。由于marry没有teacher的角色，所以角色的访问控制会通过[main]roles.unauthorizedUrl=/unauthorized.jsp的全局配置，跳转到unauthorized.jsp页面上。

同理，perms.unauthorizedUrl=/unauthorized.jsp表示权限的访问控制，会把没有该权限的用户的请求，跳转到unauthorized.jsp页面，大家可以自己去尝试。

进击的马小林

关注

0
点赞
踩
1

收藏

觉得还不错? 一键收藏
0
评论
java安全框架-Shiro学习笔记（五）-Shiro集成Web

首先，使用maven创建web项目，并引入依赖包，这里使用jetty启动应用程序。pom.xml<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.or
复制链接

扫一扫

专栏目录