SpringMVC+Shiro权限管理

最新推荐文章于 2023-01-14 13:55:46 发布

菠萝y

最新推荐文章于 2023-01-14 13:55:46 发布

阅读量1.1k

点赞数 2

JAVA 同时被 2 个专栏收录

169 篇文章 4 订阅

订阅专栏

Spring MVC

17 篇文章 0 订阅

订阅专栏

博文目录

权限的简单描述
实例表结构及内容及POJO
Shiro-pom.xml
Shiro-web.xml
Shiro-MyShiro-权限认证,登录认证层
Shiro-applicationContext-shiro.xml
HomeController
三个JSP文件

什么是权限呢？举个简单的例子：
我有一个论坛，注册的用户分为normal用户，manager用户。
对论坛的帖子的操作有这些：
添加，删除，更新，查看，回复
我们规定：
normal用户只能：添加，查看，回复
manager用户可以：删除，更新

normal，manager对应的是角色（role）
添加，删除，更新等对应的是权限（permission）

我们采用下面的逻辑创建权限表结构（不是绝对的，根据需要修改）

一个用户可以有多种角色（normal,manager,admin等等）
一个角色可以有多个用户（user1,user2,user3等等）
一个角色可以有多个权限（save,update,delete,query等等）
一个权限只属于一个角色（delete只属于manager角色）

我们创建四张表：
t_user用户表:设置了3个用户
-------------------------------
id + username   + password
---+----------------+----------
1  +   tom +  000000
2  +   jack +  000000
3  +   rose +  000000
---------------------------------
t_role角色表：设置3个角色
--------------
id + rolename
---+----------
1  + admin
2  + manager
3  + normal
--------------
t_user_role用户角色表：tom是admin和normal角色，jack是manager和normal角色，rose是normal角色
---------------------
user_id  +  role_id
-----------+-----------
1 + 1
1 + 3
2 + 2
2 + 3
3 + 3
---------------------
t_permission权限表：admin角色可以删除，manager角色可以添加和更新，normal角色可以查看
-----------------------------------
id  +  permissionname  +  role_id
----+------------------------+-----------
1   +   add + 2
2   +   del + 1
3   +   update + 2
4   +   query + 3
-----------------------------------

建立对应的POJO：

package com.cn.pojo;
import java.util.HashSet;
import java.util.List;
import java.util.Set;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.Table;
import javax.persistence.Transient;
import org.hibernate.validator.constraints.NotEmpty;
@Entity
@Table(name="t_user")
public class User {
private Integer id;
@NotEmpty(message="用户名不能为空")
private String username;
@NotEmpty(message="密码不能为空")
private String password;
private List<Role> roleList;//一个用户具有多个角色
@Id
@GeneratedValue(strategy=GenerationType.IDENTITY)
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getUsername() {
return username;
}
public void setUsername(String username) {
this.username = username;
}
public String getPassword() {
return password;
}
public void setPassword(String password) {
this.password = password;
}
@ManyToMany
@JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="user_id")},inverseJoinColumns={@JoinColumn(name="role_id")})
public List<Role> getRoleList() {
return roleList;
}
public void setRoleList(List<Role> roleList) {
this.roleList = roleList;
}
@Transient
public Set<String> getRolesName(){
List<Role> roles=getRoleList();
Set<String> set=new HashSet<String>();
for (Role role : roles) {
set.add(role.getRolename());
}
return set;
}
}

package com.cn.pojo;
import java.util.ArrayList;
import java.util.List;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.OneToMany;
import javax.persistence.Table;
import javax.persistence.Transient;
@Entity
@Table(name="t_role")
public class Role {
private Integer id;
private String rolename;
private List<Permission> permissionList;//一个角色对应多个权限
private List<User> userList;//一个角色对应多个用户
@Id
@GeneratedValue(strategy=GenerationType.IDENTITY)
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getRolename() {
return rolename;
}
public void setRolename(String rolename) {
this.rolename = rolename;
}
@OneToMany(mappedBy="role")
public List<Permission> getPermissionList() {
return permissionList;
}
public void setPermissionList(List<Permission> permissionList) {
this.permissionList = permissionList;
}
@ManyToMany
@JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="role_id")},inverseJoinColumns={@JoinColumn(name="user_id")})
public List<User> getUserList() {
return userList;
}
public void setUserList(List<User> userList) {
this.userList = userList;
}
@Transient
public List<String> getPermissionsName(){
List<String> list=new ArrayList<String>();
List<Permission> perlist=getPermissionList();
for (Permission per : perlist) {
list.add(per.getPermissionname());
}
return list;
}
}

package com.cn.pojo;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.ManyToOne;
import javax.persistence.Table;
@Entity
@Table(name="t_permission")
public class Permission {
private Integer id;
private String permissionname;
private Role role;//一个权限对应一个角色
@Id
@GeneratedValue(strategy=GenerationType.IDENTITY)
public Integer getId() {
return id;
}
public void setId(Integer id) {
this.id = id;
}
public String getPermissionname() {
return permissionname;
}
public void setPermissionname(String permissionname) {
this.permissionname = permissionname;
}
@ManyToOne
@JoinColumn(name="role_id")
public Role getRole() {
return role;
}
public void setRole(Role role) {
this.role = role;
}
}

使用SHIRO的步骤：
1，导入jar
2，配置web.xml
3，建立dbRelm
4，在Spring中配置

pom.xml中配置如下：

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.hyx</groupId>
<artifactId>springmvc</artifactId>
<packaging>war</packaging>
<version>0.0.1-SNAPSHOT</version>
<name>springmvc Maven Webapp</name>
<url>http://maven.apache.org</url>
<dependencies>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>3.8.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>3.2.4.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jdbc</artifactId>
<version>3.2.4.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-orm</artifactId>
<version>3.2.4.RELEASE</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-core</artifactId>
<version>4.2.5.Final</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-ehcache</artifactId>
<version>4.2.5.Final</version>
</dependency>
<dependency>
<groupId>net.sf.ehcache</groupId>
<artifactId>ehcache</artifactId>
<version>2.7.2</version>
</dependency>
<dependency>
<groupId>commons-dbcp</groupId>
<artifactId>commons-dbcp</artifactId>
<version>1.4</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>5.1.26</version>
</dependency>
<dependency>
<groupId>javax.inject</groupId>
<artifactId>javax.inject</artifactId>
<version>1</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-validator</artifactId>
<version>5.0.1.Final</version>
</dependency>
<dependency>
<groupId>org.codehaus.jackson</groupId>
<artifactId>jackson-mapper-asl</artifactId>
<version>1.9.13</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>jstl</artifactId>
<version>1.2</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
<version>2.5</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.2.2</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.2.2</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.2.2</version>
</dependency>
</dependencies>
<build>
<finalName>springmvc</finalName>
<plugins>
<plugin>
<groupId>org.mortbay.jetty</groupId>
<artifactId>jetty-maven-plugin</artifactId>
<configuration>
<scanIntervalSeconds>10</scanIntervalSeconds>
<webApp>
<contextPath>/</contextPath>
</webApp>
<connectors>
<connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
<port>80</port>
<maxIdleTime>60000</maxIdleTime>
</connector>
</connectors>
</configuration>
</plugin>
</plugins>
</build>
</project>

web.xml中的配置：

<?xml version="1.0" encoding="UTF-8" ?>
<web-app version="2.5"
xmlns="http://java.sun.com/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
<display-name>Archetype Created Web Application</display-name>
<filter>
<filter-name>opensessioninview</filter-name>
<filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>opensessioninview</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<servlet>
<servlet-name>springmvc</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>springmvc</servlet-name>
<url-pattern>/</url-pattern>
</servlet-mapping>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:applicationContext*.xml</param-value>
</context-param>
<listener>
<listener-class>
org.springframework.web.context.ContextLoaderListener
</listener-class>
</listener>
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>

package com.cn.service;
import java.util.List;
import javax.inject.Inject;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;
import com.cn.pojo.Role;
import com.cn.pojo.User;
@Service
@Transactional
public class MyShiro extends AuthorizingRealm{
@Inject
private UserService userService;
/**
* 权限认证
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
//获取登录时输入的用户名
String loginName=(String) principalCollection.fromRealm(getName()).iterator().next();
//到数据库查是否有此对象
User user=userService.findByName(loginName);
if(user!=null){
//权限信息对象info,用来存放查出的用户的所有的角色（role）及权限（permission）
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
//用户的角色集合
info.setRoles(user.getRolesName());
//用户的角色对应的所有权限，如果只使用角色定义访问权限，下面的四行可以不要
List<Role> roleList=user.getRoleList();
for (Role role : roleList) {
info.addStringPermissions(role.getPermissionsName());
}
return info;
}
return null;
}
/**
* 登录认证;
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken authenticationToken) throws AuthenticationException {
//UsernamePasswordToken对象用来存放提交的登录信息
UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
//查出是否有此用户
User user=userService.findByName(token.getUsername());
if(user!=null){
//若存在，将此用户存放到登录认证info中
return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
}
return null;
}
}

在spring的配置文件中配置，为了区别spring原配置和shiro我们将shiro的配置独立出来。

applicationContext-shiro.xml

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:tx="http://www.springframework.org/schema/tx"
xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="myShiro"/>
<property name="cacheManager" ref="cacheManager"/>
</bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login"/>
<property name="successUrl" value="/user"/>
<property name="unauthorizedUrl" value="/403"/>
<property name="filterChainDefinitions">
<value>
/static/**=anon
/user=perms[user:query]
/user/add=roles[manager]
/user/del/**=roles[admin]
/user/edit/**=roles[manager]
/** = authc
</value>
</property>
</bean>
<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
</beans>

用于登录，登出，权限跳转的控制：

package com.cn.controller;
import javax.validation.Valid;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.mvc.support.RedirectAttributes;
import com.cn.pojo.User;
@Controller
public class HomeController {
@RequestMapping(value="/login",method=RequestMethod.GET)
public String loginForm(Model model){
model.addAttribute("user", new User());
return "/login";
}
@RequestMapping(value="/login",method=RequestMethod.POST)
public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
try {
if(bindingResult.hasErrors()){
return "/login";
}
//使用权限工具进行用户登录，登录成功后跳到shiro配置的successUrl中，与下面的return没什么关系！
SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
return "redirect:/user";
} catch (AuthenticationException e) {
redirectAttributes.addFlashAttribute("message","用户名或密码错误");
return "redirect:/login";
}
}
@RequestMapping(value="/logout",method=RequestMethod.GET)
public String logout(RedirectAttributes redirectAttributes ){
//使用权限管理工具进行用户的退出，跳出登录，给出提示信息
SecurityUtils.getSubject().logout();
redirectAttributes.addFlashAttribute("message", "您已安全退出");
return "redirect:/login";
}
@RequestMapping("/403")
public String unauthorizedRole(){
return "/403";
}
}

三个主要的JSP：
login.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>My JSP 'MyJsp.jsp' starting page</title>
</head>
<body>
<h1>登录页面----${message }</h1>
<img alt="" src="/static/img/1.jpg">
<form:form action="/login" commandName="user" method="post">
用户名：<form:input path="username"/> <form:errors path="username" cssClass="error"/> <br/>
密   码：<form:password path="password"/> <form:errors path="password" cssClass="error" /> <br/>
<form:button name="button">submit</form:button>
</form:form>
</body>
</html>

user.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>用户列表</title>
</head>
<body>
<h1>${message }</h1>
<h1>用户列表--<a href="/user/add">添加用户</a>---<a href="/logout">退出登录</a> </h1>
<h2>权限列表</h2>
<shiro:authenticated>用户已经登录显示此内容</shiro:authenticated>
<shiro:hasRole name="manager">manager角色登录显示此内容</shiro:hasRole>
<shiro:hasRole name="admin">admin角色登录显示此内容</shiro:hasRole>
<shiro:hasRole name="normal">normal角色登录显示此内容</shiro:hasRole>
<shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**</shiro:hasAnyRoles>
<shiro:principal/>-显示当前登录用户名
<shiro:hasPermission name="add">add权限用户显示此内容</shiro:hasPermission>
<shiro:hasPermission name="user:query">query权限用户显示此内容<shiro:principal/></shiro:hasPermission>
<shiro:lacksPermission name="user:del"> 不具有user:del权限的用户显示此内容 </shiro:lacksPermission>
<ul>
<c:forEach items="${userList }" var="user">
<li>用户名：${user.username }----密码：${user.password }----<a href="/user/edit/${user.id}">修改用户</a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户</a></li>
</c:forEach>
</ul>
<img alt="" src="/static/img/1.jpg">
<script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js"></script>
<script>
$(function(){
$(".del").click(function(){
var id=$(this).attr("ref");
$.ajax({
type:"delete",
url:"/user/del/"+id,
success:function(e){
}
});
});
});
</script>
</body>
</html>

403.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>权限错误</title>
</head>
<body>
<h1>对不起，您没有权限请求此连接！</h1>
<img alt="" src="/static/img/1.jpg">
</body>
</html>

原博客地址：http://www.cnblogs.com/lonely-buffoon/p/5580935.html

spring mvc 集成shiro 做权限的简单使用

1.概述

现在的项目使用的权限控制系统是spring security 3.因为项目的框架使用spring，就顺便使用了。最近研究了一下spring side4，推荐使用shiro。照着示例做了一遍。在原有的spring web工程中。步骤如下。

2.引进包,maven设置

[html] view plain copy

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-all</artifactId>
<version>1.2.1</version>
<type>jar</type>
<scope>compile</scope>
</dependency>

3.实现Controller层

主要是登陆url和几个掩饰url

[java] view plain copy

@Controller
public class AdminController {
@RequestMapping(value = "/admin/index", method = RequestMethod.GET)
public String index(Model model) {
return "admin/index";
}
@RequestMapping(value = "/admin/login", method = RequestMethod.GET)
public String login(Model model) {
logger.info("login get");
return "admin/login";
}
@RequestMapping(value = "/admin/login", method = RequestMethod.POST)
public String doLogin(Model model) {
logger.info("login post");
return "admin/login";
}
@RequiresRoles("user")
@RequestMapping(value = "/admin/user", method = RequestMethod.GET)
public String shiroUser(Model model) {
return "admin/index";
}
@RequiresRoles("admin")
@RequestMapping(value = "/admin/admin", method = RequestMethod.GET)
public String shiroAdmin(Model model) {
return "admin/index";
}
Logger logger = LoggerFactory.getLogger(AdminController.class);
}

4.实现权限验证

继承shiro的AuthorizingRealm

[java] view plain copy

public class ShiroDbRealm extends AuthorizingRealm {
protected AccountService accountService;
@Autowired
public void setAccountService(AccountService accountService) {
this.accountService = accountService;
}
/**
* 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
*/
@SuppressWarnings("unused")
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection p) {
logger.info("授权认证：" + p.getRealmNames());
ShiroUser shiroUser = (ShiroUser) p.getPrimaryPrincipal();
User user = accountService.findUserByLoginName(shiroUser.loginName);
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
for (Role role : user.getRoleList()) {
//基于Role的权限信息
info.addRole(role.getName());
//基于Permission的权限信息
info.addStringPermission(role.getPermissions());
}
return info;
}
/**
* 认证回调函数,登录时调用.
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken authcToken) throws AuthenticationException {
logger.info("authc pass:");
UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
logger.info("authc name:" + token.getUsername());
User user = accountService.findUserByLoginName(token.getUsername());
if (user != null) {
if (user.getStatus().equals("disabled")) {
throw new DisabledAccountException();
}
logger.info("authc name:" + token.getUsername() + " user:"
+ user.getLoginName() + " pwd:" + user.getPassword()
+ "getname:" + getName());
// byte[] salt = Encodes.decodeHex(user.getSalt());
return new SimpleAuthenticationInfo(new ShiroUser(user.getLoginName(), user.getName()),
user.getPassword(), getName());
}
return null;
}
/**
* 自定义Authentication对象，使得Subject除了携带用户的登录名外还可以携带更多信息.
*/
public static class ShiroUser implements Serializable {
private static final long serialVersionUID = -1373760761780840081L;
public String loginName;
public String name;
public ShiroUser(String loginName, String name) {
this.loginName = loginName;
this.name = name;
}
public String getName() {
return loginName;
}
/**
* 本函数输出将作为默认的<shiro:principal/>输出.
*/
@Override
public String toString() {
return loginName;
}
/**
* 重载hashCode,只计算loginName;
*/
@Override
public int hashCode() {
return Objects.hashCode(loginName);
}
/**
* 重载equals,只计算loginName;
*/
@Override
public boolean equals(Object obj) {
if (this == obj)
return true;
if (obj == null)
return false;
if (getClass() != obj.getClass())
return false;
ShiroUser other = (ShiroUser) obj;
if (loginName == null) {
if (other.loginName != null)
return false;
} else if (!loginName.equals(other.loginName))
return false;
return true;
}
}
Logger logger = LoggerFactory.getLogger(ShiroDbRealm.class);
}

自定义的类ShiroUser是为了，可以多传输一些内容，供后面验证时使用，例子中只用了一个loginName，一般可以用String 传输就够了。

登陆时用doGetAuthenticationInfo（）函数获得相关信息。

登陆后访问url 使用doGetAuthorizationInfo()获得用户的权限。

5.配置文件shiro部分

将controller的url纳入权限验证范围。

[html] view plain copy

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd"
default-lazy-init="true">
<description>Shiro安全配置</description>
<bean id="shiroDbRealm" class="com.blueinfo.jee.shiro.ShiroDbRealm" depends-on="userDao,roleDao">
<property name="accountService" ref="accountService"/>
</bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/admin/login" />
<property name="successUrl" value="/admin/index" />
<property name="unauthorizedUrl" value="/admin/logout" />
<property name="filterChainDefinitions">
<value>
/admin/login = authc
/admin/logout = logout
/static/** = anon
/admin/** = authc
</value>
</property>
</bean>
<bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManagerConfigFile" value="classpath:security/ehcache-shiro.xml"/>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="shiroDbRealm" />
<property name="cacheManager" ref="shiroEhcacheManager" />
</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
<property name="proxyTargetClass" value="true" />
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
</beans>

主要内容是shiroFilter的定义。

loginUrl：登陆页面，用户登陆不成功，自动返回此页面。

successUrl：登陆成功后跳转此页面

unauthorizedUrl：用户访问无权限的链接时跳转此页面

filterChainDefinitions：设置url的访问权限。anon表示不用验证，都可以访问。anthc：authc filter 监听，不登陆不能访问。logout：logout filter监听。没有列出的常用配置：perms["remote:invoke"] ：需要角色romote 和权限invoke才能访问。roles["admin"]需要角色admin才能访问。设置可用“,”隔开，如：

/admin/test = authc,roles[admin]

关于filter的列表：

Filter Name	Class
anon	org.apache.shiro.web.filter.authc.AnonymousFilter
authc	org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authcBasic	org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
perms	org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
port	org.apache.shiro.web.filter.authz.PortFilter
rest	org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
roles	org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
ssl	org.apache.shiro.web.filter.authz.SslFilter
user	org.apache.shiro.web.filter.authc.UserFilter

6.配置文件，启用shiroFilter

上面的配置和源码定义了shiroFilter，在web.xml中启用它

[html] view plain copy

<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
<dispatcher>REQUEST</dispatcher>
<dispatcher>FORWARD</dispatcher>
</filter-mapping>

7.使用annotation控制权限

在2中controller使用@RequiresRoles 注解控制权限，还可以是@RequirePermissions，要在方法上使用注解需要做如下配置：

1.在spring-mvc.xml中加入

[html] view plain copy

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
<property name="proxyTargetClass" value="true" />
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>

2.出错控制,在spring-mvc.xml中加入

[html] view plain copy

<bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
<property name="exceptionMappings">
<props>
<prop key="org.apache.shiro.authz.UnauthorizedException">error/403</prop>
<prop key="java.lang.Throwable">error/500</prop>
</props>
</property>
</bean>

将UnauthorizedException异常转到403页面,也可以使用其它页面.

8.参考

1,文中的内容大部分来源于开源工程,spring-side，真心感谢其作者江南白衣

2.apache-shiro官网:http://shiro.apache.org/

原博客地址：http://blog.csdn.net/hsienhua/article/details/9768477

菠萝y

关注

2
点赞
踩
2

收藏

觉得还不错? 一键收藏
0
评论
SpringMVC+Shiro权限管理

博文目录权限的简单描述实例表结构及内容及POJOShiro-pom.xmlShiro-web.xmlShiro-MyShiro-权限认证,登录认证层Shiro-applicationContext-shiro.xmlHomeController三个JSP文件什么是权限呢？举个简单的例子：我有一个论坛，注册的用户分为normal用户，manager用户。对论坛的帖子的操作有
复制链接

扫一扫

专栏目录