本文将进行cas与shiro的整合使用
1.搭建简单的ssm+shiro
对shiro的详细搭建解释请看我的另一篇详述;
下面贴出简易代码:
pom:
<dependencies>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>5.1.1.RELEASE</version>
</dependency>
<!-- https://mvnrepository.com/artifact/javax.servlet/javax.servlet-api -->
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
<scope>provided</scope>
</dependency>
<!--shiro的jar包-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web -->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.0</version>
</dependency>
<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<!--开启spring+shiro的注解包-->
<dependency>
<groupId>org.aspectj</groupId>
<artifactId>aspectjweaver</artifactId>
<version>1.8.0</version>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<scope>test</scope>
</dependency>
</dependencies>
web.xml
<!DOCTYPE web-app PUBLIC
"-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd" >
<web-app>
<display-name>Archetype Created Web Application</display-name>
<!-- 设置contextConfigLocation的参数,指明路径 -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring*.xml</param-value>
</context-param>
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<servlet>
<servlet-name>DispatcherServlet</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-mvc.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>DispatcherServlet</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>
realm:只做简单的认证登录,不连接数据库
package com;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
/**
* @author lhl
* @version 1.0
* @date 2019/12/17 9:50
* @description TODO
*/
public class Realm extends AuthorizingRealm {
/**
* 授权
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
return null;
}
/**
* 登录
* @param token
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
String username = (String) token.getPrincipal();//获取身份信息
User one =new User();
one.setUsername("小一");
one.setPassword("1234");
if (one!=null){
SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(one,one.getPassword(), null, getName());
return info;
}
return null;
}
}
spring+shiro
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
<!-- 会话Cookie模板 -->
<bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
<constructor-arg value="sid"/>
<property name="httpOnly" value="true"/>
<property name="maxAge" value="180000"/>
</bean>
<!-- 会话ID生成器 -->
<bean id="sessionIdGenerator"
class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>
<!-- 会话DAO -->
<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
<!--直接采用session的生成-->
<property name="activeSessionsCacheName" value="shiro-activeSessionCache"/>
<property name="sessionIdGenerator" ref="sessionIdGenerator"/>
</bean>
<!-- 会话管理器 -->
<bean id="sessionManager"
class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="globalSessionTimeout" value="1800000"/>
<property name="deleteInvalidSessions" value="true"/>
<property name="sessionValidationSchedulerEnabled" value="true"/>
<property name="sessionDAO" ref="sessionDAO"/>
<property name="sessionIdCookieEnabled" value="true"/>
<property name="sessionIdCookie" ref="sessionIdCookie"/>
</bean>
<bean id="myRealm" class="com.Realm"/>
<!-- 安全管理器 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--<property name="com.realm" ref="myRealm"/>-->
<!-- 多个验证策略 realmes -->
<property name="realms">
<list> <!-- 这个认证,有一个先后的顺序 -->
<ref bean="myRealm"/>
</list>
</property>
<property name="sessionManager" ref="sessionManager"/>
<!--<property name="cacheManager" ref="cacheManager"/>-->
</bean>
<!-- Shiro的Web过滤器 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<!--身份认证失败,跳转到登录路径-->
<property name="loginUrl" value="/test/toLogin"/>
<!--针对后台,成功页面的路径-->
<property name="successUrl" value="/admin/adminUser/toLayuiHome" />
<property name="unauthorizedUrl" value="/unauthorized.jsp"/>
<property name="filterChainDefinitions">
<value>
<!--/**=anno-->
/test/*=anon <!--没有参数,表示可以匿名使用。-->
/index/*=authc <!--身份认证成功-->
/aa=authc
<!--/company/*=authc<!–下面的路径必须需要登陆才可以去访问–>-->
<!--/content=authc<!–必须登陆才可以访问这个路径–>-->
<!--/index=authc<!–表示需要认证(登录)才能使用,没有参数–>-->
<!--/role=authc,roles[admin]-->
<!--/menu/**==authc,roles[admin],perms[menu:*]-->
<!--表示访问该地址的用户是身份验证通过或RememberMe登录的都可以。-->
</value>
</property>
</bean>
</beans>
spingMvc.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xmlns:task="http://www.springframework.org/schema/task"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task.xsd">
<!-- 启用spring mvc 注解 -->
<context:component-scan base-package="com"/>
<mvc:annotation-driven/>
<mvc:default-servlet-handler/> <!--静态资源的访问设置-->
<!-- 开启shiro的注解支持 -->
<bean id="defaultAdvisorAutoProxyCreator" class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator">
<!-- 必须改为true,即使用cglib方式为Action创建代理对象。默认值为false,使用JDK创建代理对象,会造成问题 -->
<property name="proxyTargetClass" value="true"></property>
</bean>
<!-- 使用shiro框架提供的切面类,用于创建代理对象 -->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"></bean>
<!--开启shiro的注解支持-->
</beans>
测试的controller,特别书名user类仅有两个字段username,和password
登录成功的页面
/**
* @author lhl
* @version 1.0
* @date 2019/12/17 9:54
* @description TODO
*/
@RequestMapping(value = "/index")
@Controller
public class IndexController {
/**
* 到达
* @return
*/
@RequestMapping(value = "/index")
@ResponseBody
public String index(){
return "welcome to index";
}
}
登录和登录失败
package com;
import com.sun.org.apache.regexp.internal.RE;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
/**
* @author lhl
* @version 1.0
* @date 2019/12/17 9:44
* @description TODO
*/
@RequestMapping(value = "/test")
@Controller
public class TestController {
/**
* 登录
* @return
*/
@RequestMapping(value = "/login")
@ResponseBody
public String login(){
User user=new User();
user.setUsername("小一");
user.setPassword("1234");
UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
Subject subject = SecurityUtils.getSubject();
subject.login(token);//shiro进行验证用户登陆合法性, 如果合法,则更新session表userid
Session session = subject.getSession();//
User o = (User) subject.getPrincipal();
System.out.println("--------------------------------------");
System.out.println("登录成功"+user);
return "login success";
}
/**
* 登录失败
* @return
*/
@RequestMapping(value = "/toLogin")
@ResponseBody
public String toLogin(){
return "please login first";
}
}
亲测正确;未登录直接访问/test/toLogin 登录成功方正确访问了/index/*里的路径
至此:一个简单的ssm+shiro整合成功了。