以下应用由springmvc结合shiro 认证与授权配置
1\spring-shiro.xml
1 <?xml version="1.0" encoding="UTF-8"?> 2 <beans xmlns="http://www.springframework.org/schema/beans" 3 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop" 4 xmlns:tx="http://www.springframework.org/schema/tx" xmlns:util="http://www.springframework.org/schema/util" 5 xmlns:context="http://www.springframework.org/schema/context" 6 xsi:schemaLocation=" 7 http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd 8 http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd 9 http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd 10 http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd 11 http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd"> 12 <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> 13 <property name="securityManager" ref="securityManager"></property> 14 <!-- 身份认证失败，则跳转到登录页面的配置 --> 15 <property name="loginUrl" value="/login.do"></property> 16 <!-- 权限认证失败，则跳转到指定页面 --> 17 <property name="unauthorizedUrl" value="/refuse.jsp"></property> 18 <!-- 权限认证成功，则跳转到指定页面 --> 19 <property name="successUrl" value="/main.do" /> 20 <!-- 自定义filter配置 --> 21 <property name="filters"> 22 <map> 23 <!-- 将自定义 的FormAuthenticationFilter注入shiroFilter中--> 24 <entry key="authc" value-ref="formAuthenticationFilter" /> 25 </map> 26 </property> 27 <property name="filterChainDefinitions"> 28 <value> 29 /login.do = authc 30 /main.do = authc 31 /logout.do = logout 32 /refuse.jsp = anon 33 34 /** = anon 35 </value> 36 </property> 37 </bean> 38 <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> 39 <property name="realm" ref="customRealm"></property> 40 <!-- 注入缓存管理器 --> 41 <property name="cacheManager" ref="cacheManager"/> 42 <!-- 注入session管理器 --> 43 <property name="sessionManager" ref="sessionManager" /> 44 <!-- 记住我 --> 45 <property name="rememberMeManager" ref="rememberMeManager"/> 46 </bean> 47 48 <!-- realm --> 49 <bean id="customRealm" class="com.telecom.shiro.CustomRealm"> 50 <!-- 将凭证匹配器设置到realm中，realm按照凭证匹配器的要求进行散列 --> 51 <property name="credentialsMatcher" ref="credentialsMatcher"/> 52 </bean> 53 <!-- 凭证匹配器 --> 54 <bean id="credentialsMatcher" 55 class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> 56 <property name="hashAlgorithmName" value="md5" /> 57 <property name="hashIterations" value="1" /> 58 </bean> 59 60 <!-- 缓存管理器 --> 61 <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"> 62 <property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml"/> 63 </bean> 64 65 <!-- 会话管理器 --> 66 <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> 67 <!-- session的失效时长，单位毫秒 --> 68 <property name="globalSessionTimeout" value="600000"/> 69 <!-- 删除失效的session --> 70 <property name="deleteInvalidSessions" value="true"/> 71 72 </bean> 73 74 <!-- 自定义form认证过虑器 --> 75 <!-- 基于Form表单的身份验证过滤器，不配置将也会注册此过虑器，表单中的用户账号、密码及loginurl将采用默认值，建议配置 --> 76 <bean id="formAuthenticationFilter" 77 class="com.telecom.shiro.CustomFormAuthenticationFilter "> 78 <!-- 表单中账号的input名称 --> 79 <property name="usernameParam" value="username" /> 80 <!-- 表单中密码的input名称 --> 81 <property name="passwordParam" value="password" /> 82 <!-- 记住我input的名称 --> 83 <property name="rememberMeParam" value="rememberMe"/> 84 </bean> 85 86 <!-- rememberMeManager管理器，写cookie，取出cookie生成用户信息 --> 87 <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager"> 88 <property name="cookie" ref="rememberMeCookie" /> 89 </bean> 90 <!-- 记住我cookie --> 91 <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie"> 92 <!-- rememberMe是cookie的名字 --> 93 <constructor-arg value="rememberMe" /> 94 <!-- 记住我cookie生效时间30天 --> 95 <property name="maxAge" value="2592000" /> 96 </bean> 97 98 </beans>
2\shiro-ehcache.xml
1 <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 2 xsi:noNamespaceSchemaLocation="../config/ehcache.xsd"> 3 <!--diskStore：缓存数据持久化的目录 地址 --> 4 <diskStore path="/home/ljj/JAVA/cache" /> 5 <defaultCache 6 maxElementsInMemory="1000" 7 maxElementsOnDisk="10000000" 8 eternal="false" 9 overflowToDisk="false" 10 diskPersistent="false" 11 timeToIdleSeconds="120" 12 timeToLiveSeconds="120" 13 diskExpiryThreadIntervalSeconds="120" 14 memoryStoreEvictionPolicy="LRU"> 15 </defaultCache> 16 </ehcache>
3\web.xml
1 <?xml version="1.0" encoding="UTF-8"?> 2 <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1"> 3 <display-name>telecom</display-name> 4 <context-param> 5 <param-name>contextConfigLocation</param-name> 6 <param-value>classpath:applicationContext.xml,classpath:spring-mybatis.xml,classpath:spring-shiro.xml</param-value> 7 </context-param> 8 <listener> 9 <description>spring监听器</description> 10 <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> 11 </listener> 12 13 14 <servlet> 15 <description>spring mvc servlet</description> 16 <servlet-name>springMvc</servlet-name> 17 <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> 18 <init-param> 19 <description>spring mvc 配置文件</description> 20 <param-name>contextConfigLocation</param-name> 21 <param-value>classpath:spring-mvc.xml</param-value> 22 </init-param> 23 <init-param> 24 <param-name>activeReverseAjaxEnabled</param-name> 25 <param-value>true</param-value> 26 </init-param> 27 <load-on-startup>1</load-on-startup> 28 </servlet> 29 <servlet-mapping> 30 <servlet-name>springMvc</servlet-name> 31 <url-pattern>*.do</url-pattern> 32 </servlet-mapping> 33 34 35 <!--配置 shiro filter --> 36 <!-- shiro过滤器 ,DelegatingFilterProxy通过代理模式将spring容器的bean和filter关联 --> 37 <filter> 38 <filter-name>shiroFilter</filter-name> 39 <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> 40 <init-param> 41 <param-name>targetFilterLifecycle</param-name> 42 <param-value>true</param-value> 43 </init-param> 44 <init-param> 45 <param-name>targetBeanName</param-name> 46 <param-value>shiroFilter</param-value> 47 </init-param> 48 </filter> 49 <filter-mapping> 50 <filter-name>shiroFilter</filter-name> 51 <url-pattern>/*</url-pattern> 52 </filter-mapping> 53 54 <filter> 55 <filter-name>characterEncodingFilter</filter-name> 56 <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class> 57 <init-param> 58 <param-name>encoding</param-name> 59 <param-value>UTF-8</param-value> 60 </init-param> 61 <init-param> 62 <param-name>forceEncoding</param-name> 63 <param-value>true</param-value> 64 </init-param> 65 </filter> 66 67 <filter-mapping> 68 <filter-name>characterEncodingFilter</filter-name> 69 <url-pattern>/*</url-pattern> 70 </filter-mapping> 71 72 <listener> 73 <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class> 74 </listener> 75 <welcome-file-list> 76 <welcome-file>index.jsp</welcome-file> 77 </welcome-file-list> 78 </web-app>
4\CustomRealm.java(自定义域)
1 package com.telecom.shiro; 2 3 import javax.servlet.ServletRequest; 4 import javax.servlet.ServletResponse; 5 import javax.servlet.http.HttpServletRequest; 6 import javax.servlet.http.HttpSession; 7 8 import org.apache.shiro.web.filter.authc.FormAuthenticationFilter; 9 10 public class CustomFormAuthenticationFilter extends FormAuthenticationFilter { 11 @Override 12 protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { 13 // TODO Auto-generated method stub 14 HttpServletRequest httpServletRequest = (HttpServletRequest)request; 15 HttpSession httpSession = httpServletRequest.getSession(); 16 //session中验证码 17 String validateCode = (String) httpSession.getAttribute("validateCode"); 18 19 //界面中验证码 20 String randomcode = httpServletRequest.getParameter("randomcode"); 21 22 System.out.println("验证:::::"+validateCode+"输入的验证:::::"+randomcode); 23 if(validateCode != null && randomcode != null && !validateCode.equals(randomcode)){ 24 //如果校验失败，将验证码错误失败信息，通过shiroLoginFailure设置到request中 25 httpServletRequest.setAttribute("shiroLoginFailure", "randomCodeError"); 26 27 //拒绝访问，不再校验账号和密码 28 return true; 29 } 30 return super.onAccessDenied(request, response); 31 } 32 }
5\自定义表单CustomFormAuthenticationFilter.java
1 package com.telecom.shiro; 2 3 import javax.servlet.ServletRequest; 4 import javax.servlet.ServletResponse; 5 import javax.servlet.http.HttpServletRequest; 6 import javax.servlet.http.HttpSession; 7 8 import org.apache.shiro.web.filter.authc.FormAuthenticationFilter; 9 10 public class CustomFormAuthenticationFilter extends FormAuthenticationFilter { 11 @Override 12 protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { 13 // TODO Auto-generated method stub 14 HttpServletRequest httpServletRequest = (HttpServletRequest)request; 15 HttpSession httpSession = httpServletRequest.getSession(); 16 //session中验证码 17 String validateCode = (String) httpSession.getAttribute("validateCode"); 18 19 //界面中验证码 20 String randomcode = httpServletRequest.getParameter("randomcode"); 21 22 System.out.println("验证:::::"+validateCode+"输入的验证:::::"+randomcode); 23 if(validateCode != null && randomcode != null && !validateCode.equals(randomcode)){ 24 //如果校验失败，将验证码错误失败信息，通过shiroLoginFailure设置到request中 25 httpServletRequest.setAttribute("shiroLoginFailure", "randomCodeError"); 26 27 //拒绝访问，不再校验账号和密码 28 return true; 29 } 30 return super.onAccessDenied(request, response); 31 } 32 }
6\Controller
@RequestMapping("login")
public String login(){
System.out.println("进行登录");
String exceptionClassName = (String) request.getAttribute("shiroLoginFailure");
if(exceptionClassName != null){
if(UnknownAccountException.class.getName().equals(exceptionClassName)){
System.out.println("账号不存在!");
request.setAttribute("message", "账号不存在!");
}else if(IncorrectCredentialsException.class.getName().equals(exceptionClassName)){
request.setAttribute("message", "密码错误!");
System.out.println("账号/密码错误!");
}else if("randomCodeError".equals(exceptionClassName)){
request.setAttribute("message", "验证码错误!");
System.out.println("验证码错误!");
}else {
request.setAttribute("message", "未知错误!");
System.out.println("未知错误!");
}
}
return "/main/login";
}
501
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
