shiro的认证及授权

1.添加依赖(jar包)

<dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-core</artifactId>
   <version>1.2.2</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.2.2</version>
</dependency>
<!-- shiro缓存-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>1.2.2</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.2.2</version>
</dependency>
<!-- shiro-quartz-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-quartz</artifactId>
    <version>1.2.2</version>
</dependency>

2.用户登录

用户输入用户名和密码后,点击登录按钮后,会到Controller层执行

public interface LoginService {
    public void login(String username,String password) throws Exception;
}

@Autowired
private LoginService loginService;

@RequestMapping("doLogin")
@ResponseBody
public JsonResult doLogin(String username,String password) {
    System.out.println(username+","+password);
	try {
	    loginService.login(username, password);
	} catch (Exception e) {
	    e.printStackTrace();
	}
	return new JsonResult();
}

3.自定义Realm类

/**
 * 借助此对象访问用户身份信息,权限信息并对其进行封装,返回给调用者.
 * 思考?
 * 1)此对象由谁来调用?(认证管理器,授权管理器)
 */
public class ShiroUserRealm extends AuthorizingRealm {
	@Autowired
	private PressionSelectDao sysUserDao; //从数据库查询登录用户的信息
	/***
	 * 完成授权信息的获取以及封装.
	 * 此方法何时调用?(执行授权检测时调用)
	 */
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		//1.获取登陆用户身份信息
		String username = (String)principals.getPrimaryPrincipal();
		//2.查找用户的权限信息
		List<String> list = sysUserDao.findUserPermissions(username);
		Set<String> permissions = new HashSet<>();
		for (String permission : list) {
			if(!StringUtils.isEmpty(permission)){
				permissions.add(permission);
			}
		}
		System.out.println("这是授权标识: "+permissions);
		//3.对权限信息进行封装
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		info.setStringPermissions(permissions);
		return info;
	}
	/**
	 * 完成认证信息的获取以及封装
	 * 此方法何时调用?(执行登陆认证时调用)
	 * @param  
	 * 用于接收用户身份以及凭证信息的对象(用户输入的)
	 * 
	 * @return AuthenticationInfo  
	 * 封装了认证信息的对象(从数据库查询到的)
	 * 流程:
	 * client-->controller-->service-->realm
	 */
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		//1.获取用户身份信息
		UsernamePasswordToken uToken=(UsernamePasswordToken)token;
		String username=uToken.getUsername();
		//2.基于用户身份查询数据库信息
		SysUser sysUser = sysUserDao.findUserByUserName(username);
		//3.对查询结果进行封装.
		//3.1获取用户salt值,并将其转换为一个字节源对象
		ByteSource byteSource = ByteSource.Util.bytes(sysUser.getSalt());
		//3.2对用户信息进行封装返回.
		SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(
				sysUser.getUsername(), //主身份 
				sysUser.getPassword(), //经过加密的密码(MD5) 
				byteSource, //salt对应的字节源对象
				getName()); //realm的名字
		return info;
	}

4.配置web.xml

<!-- 配置Shiro安全过滤器 -->
<filter>
    <filter-name>DelegatingFilterProxy</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <!-- 初始化参数 -->
    <init-param>
       <param-name>targetBeanName</param-name>
       <param-value>shiroFilter</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>DelegatingFilterProxy</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

5.配置spring

<!-- 配置自己的realm -->
	<bean id="userRealm" class="com.jt.service.impl.ShiroUserRealm">
		<!-- 凭证匹配器(密码加密) -->
		<property name="credentialsMatcher">
			<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
				<property name="hashAlgorithmName" value="MD5"></property>
			</bean>
		</property>
	</bean>

	<!-- 配置securityManager对象(此对象时shiro框架核心) -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="userRealm" />
	</bean>


	<!-- 配置ShiroFilter(通过此filter的配置实现对请求资源的过滤,哪些请求要放行,哪些要认证) -->
	<!-- 配置 ShiroFilter bean: 该 bean 的 id 必须和 web.xml 文件中配置的 shiro filter 的 name 一致  -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<!-- shiro的核心安全接口 -->
		<property name="securityManager" ref="securityManager" />
		<!-- 要求登录时的连接 -->
		<property name="loginUrl" value="Login.do"></property>
		<!-- 登录成功后要跳转的连接(此处已经在登录中处理了) -->
		<!-- <property name="successUrl" value="/index.jsp"></property> -->
		<!-- 访问未对其授权的资源时,要跳转的连接 <property name="unauthorizedUrl" value="/default.html"></property> -->
		<!-- shiro连接约束配置 -->
		<property name="filterChainDefinitions">
			<value>
				<!-- 对静态资源设置允许匿名访问 -->
				/bower_components/** = anon
				/build/** = anon
				/css/** = anon
				/img/** = anon
				/dist/** = anon
				/plugins/** = anon
				/Login.do = anon
				/doLogin.do = anon
				<!-- 退出 -->
				/doLogout.do = logout  <!-- 会调用Subject的logout方法,此方法会将session清空 -->
				<!-- 剩余其他路径，必须认证通过才可以访问 -->
				/** = authc
			</value>
		</property>
	</bean>

	<!--Shiro生命周期处理器 -->
	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

	<!--启用shiro注解权限检查(@RequestPermissions) -->
	<bean
		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
		depends-on="lifecycleBeanPostProcessor" />
	<bean
		class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
		<property name="securityManager" ref="securityManager" />
	</bean>

遗忘了,重新捡起来就行.....

个人查询用

源码资源