博文目录
- 权限的简单描述
- 实例表结构及内容及POJO
- Shiro-pom.xml
- Shiro-web.xml
- Shiro-MyShiro-权限认证,登录认证层
- Shiro-applicationContext-shiro.xml
- HomeController
- 三个JSP文件
什么是权限呢?举个简单的例子:
我有一个论坛,注册的用户分为normal用户,manager用户。
对论坛的帖子的操作有这些:
添加,删除,更新,查看,回复
我们规定:
normal用户只能:添加,查看,回复
manager用户可以:删除,更新
normal,manager对应的是角色(role)
添加,删除,更新等对应的是权限(permission)
我们采用下面的逻辑创建权限表结构(不是绝对的,根据需要修改)
一个用户可以有多种角色(normal,manager,admin等等)
一个角色可以有多个用户(user1,user2,user3等等)
一个角色可以有多个权限(save,update,delete,query等等)
一个权限只属于一个角色(delete只属于manager角色)
我们创建四张表:
t_user用户表:设置了3个用户
-------------------------------
id + username + password
---+----------------+----------
1 + tom + 000000
2 + jack + 000000
3 + rose + 000000
---------------------------------
t_role角色表:设置3个角色
--------------
id + rolename
---+----------
1 + admin
2 + manager
3 + normal
--------------
t_user_role用户角色表:tom是admin和normal角色,jack是manager和normal角色,rose是normal角色
---------------------
user_id + role_id
-----------+-----------
1 + 1
1 + 3
2 + 2
2 + 3
3 + 3
---------------------
t_permission权限表:admin角色可以删除,manager角色可以添加和更新,normal角色可以查看
-----------------------------------
id + permissionname + role_id
----+------------------------+-----------
1 + add + 2
2 + del + 1
3 + update + 2
4 + query + 3
-----------------------------------
建立对应的POJO:
- package com.cn.pojo;
- import java.util.HashSet;
- import java.util.List;
- import java.util.Set;
- import javax.persistence.Entity;
- import javax.persistence.GeneratedValue;
- import javax.persistence.GenerationType;
- import javax.persistence.Id;
- import javax.persistence.JoinColumn;
- import javax.persistence.JoinTable;
- import javax.persistence.ManyToMany;
- import javax.persistence.Table;
- import javax.persistence.Transient;
- import org.hibernate.validator.constraints.NotEmpty;
- @Entity
- @Table(name="t_user")
- public class User {
- private Integer id;
- @NotEmpty(message="用户名不能为空")
- private String username;
- @NotEmpty(message="密码不能为空")
- private String password;
- private List<Role> roleList;//一个用户具有多个角色
- @Id
- @GeneratedValue(strategy=GenerationType.IDENTITY)
- public Integer getId() {
- return id;
- }
- public void setId(Integer id) {
- this.id = id;
- }
- public String getUsername() {
- return username;
- }
- public void setUsername(String username) {
- this.username = username;
- }
- public String getPassword() {
- return password;
- }
- public void setPassword(String password) {
- this.password = password;
- }
- @ManyToMany
- @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="user_id")},inverseJoinColumns={@JoinColumn(name="role_id")})
- public List<Role> getRoleList() {
- return roleList;
- }
- public void setRoleList(List<Role> roleList) {
- this.roleList = roleList;
- }
- @Transient
- public Set<String> getRolesName(){
- List<Role> roles=getRoleList();
- Set<String> set=new HashSet<String>();
- for (Role role : roles) {
- set.add(role.getRolename());
- }
- return set;
- }
- }
- package com.cn.pojo;
- import java.util.ArrayList;
- import java.util.List;
- import javax.persistence.Entity;
- import javax.persistence.GeneratedValue;
- import javax.persistence.GenerationType;
- import javax.persistence.Id;
- import javax.persistence.JoinColumn;
- import javax.persistence.JoinTable;
- import javax.persistence.ManyToMany;
- import javax.persistence.OneToMany;
- import javax.persistence.Table;
- import javax.persistence.Transient;
- @Entity
- @Table(name="t_role")
- public class Role {
- private Integer id;
- private String rolename;
- private List<Permission> permissionList;//一个角色对应多个权限
- private List<User> userList;//一个角色对应多个用户
- @Id
- @GeneratedValue(strategy=GenerationType.IDENTITY)
- public Integer getId() {
- return id;
- }
- public void setId(Integer id) {
- this.id = id;
- }
- public String getRolename() {
- return rolename;
- }
- public void setRolename(String rolename) {
- this.rolename = rolename;
- }
- @OneToMany(mappedBy="role")
- public List<Permission> getPermissionList() {
- return permissionList;
- }
- public void setPermissionList(List<Permission> permissionList) {
- this.permissionList = permissionList;
- }
- @ManyToMany
- @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="role_id")},inverseJoinColumns={@JoinColumn(name="user_id")})
- public List<User> getUserList() {
- return userList;
- }
- public void setUserList(List<User> userList) {
- this.userList = userList;
- }
- @Transient
- public List<String> getPermissionsName(){
- List<String> list=new ArrayList<String>();
- List<Permission> perlist=getPermissionList();
- for (Permission per : perlist) {
- list.add(per.getPermissionname());
- }
- return list;
- }
- }
- package com.cn.pojo;
- import javax.persistence.Entity;
- import javax.persistence.GeneratedValue;
- import javax.persistence.GenerationType;
- import javax.persistence.Id;
- import javax.persistence.JoinColumn;
- import javax.persistence.ManyToOne;
- import javax.persistence.Table;
- @Entity
- @Table(name="t_permission")
- public class Permission {
- private Integer id;
- private String permissionname;
- private Role role;//一个权限对应一个角色
- @Id
- @GeneratedValue(strategy=GenerationType.IDENTITY)
- public Integer getId() {
- return id;
- }
- public void setId(Integer id) {
- this.id = id;
- }
- public String getPermissionname() {
- return permissionname;
- }
- public void setPermissionname(String permissionname) {
- this.permissionname = permissionname;
- }
- @ManyToOne
- @JoinColumn(name="role_id")
- public Role getRole() {
- return role;
- }
- public void setRole(Role role) {
- this.role = role;
- }
- }
使用SHIRO的步骤:
1,导入jar
2,配置web.xml
3,建立dbRelm
4,在Spring中配置
pom.xml中配置如下:
- <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
- <modelVersion>4.0.0</modelVersion>
- <groupId>com.hyx</groupId>
- <artifactId>springmvc</artifactId>
- <packaging>war</packaging>
- <version>0.0.1-SNAPSHOT</version>
- <name>springmvc Maven Webapp</name>
- <url>http://maven.apache.org</url>
- <dependencies>
- <dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
- <version>3.8.1</version>
- <scope>test</scope>
- </dependency>
- <!-- SpringMVC核心jar -->
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-webmvc</artifactId>
- <version>3.2.4.RELEASE</version>
- </dependency>
- <!-- springmvc连接数据库需要的jar -->
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-jdbc</artifactId>
- <version>3.2.4.RELEASE</version>
- </dependency>
- <dependency>
- <groupId>org.springframework</groupId>
- <artifactId>spring-orm</artifactId>
- <version>3.2.4.RELEASE</version>
- </dependency>
- <!-- ************************************ -->
- <!-- Hibernate相关jar -->
- <dependency>
- <groupId>org.hibernate</groupId>
- <artifactId>hibernate-core</artifactId>
- <version>4.2.5.Final</version>
- </dependency>
- <dependency>
- <groupId>org.hibernate</groupId>
- <artifactId>hibernate-ehcache</artifactId>
- <version>4.2.5.Final</version>
- </dependency>
- <dependency>
- <groupId>net.sf.ehcache</groupId>
- <artifactId>ehcache</artifactId>
- <version>2.7.2</version>
- </dependency>
- <dependency>
- <groupId>commons-dbcp</groupId>
- <artifactId>commons-dbcp</artifactId>
- <version>1.4</version>
- </dependency>
- <dependency>
- <groupId>mysql</groupId>
- <artifactId>mysql-connector-java</artifactId>
- <version>5.1.26</version>
- </dependency>
- <!-- javax提供的annotation -->
- <dependency>
- <groupId>javax.inject</groupId>
- <artifactId>javax.inject</artifactId>
- <version>1</version>
- </dependency>
- <!-- **************************** -->
- <!-- hibernate验证 -->
- <dependency>
- <groupId>org.hibernate</groupId>
- <artifactId>hibernate-validator</artifactId>
- <version>5.0.1.Final</version>
- </dependency>
- <!-- 用于对@ResponseBody注解的支持 -->
- <dependency>
- <groupId>org.codehaus.jackson</groupId>
- <artifactId>jackson-mapper-asl</artifactId>
- <version>1.9.13</version>
- </dependency>
- <!-- 提供对c标签的支持 -->
- <dependency>
- <groupId>javax.servlet</groupId>
- <artifactId>jstl</artifactId>
- <version>1.2</version>
- </dependency>
- <!-- servlet api -->
- <dependency>
- <groupId>javax.servlet</groupId>
- <artifactId>servlet-api</artifactId>
- <version>2.5</version>
- </dependency>
- <!--Apache Shiro所需的jar包-->
- <dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-core</artifactId>
- <version>1.2.2</version>
- </dependency>
- <dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-web</artifactId>
- <version>1.2.2</version>
- </dependency>
- <dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-spring</artifactId>
- <version>1.2.2</version>
- </dependency>
- </dependencies>
- <build>
- <finalName>springmvc</finalName>
- <!-- maven的jetty服务器插件 -->
- <plugins>
- <plugin>
- <groupId>org.mortbay.jetty</groupId>
- <artifactId>jetty-maven-plugin</artifactId>
- <configuration>
- <scanIntervalSeconds>10</scanIntervalSeconds>
- <webApp>
- <contextPath>/</contextPath>
- </webApp>
- <!-- 修改jetty的默认端口 -->
- <connectors>
- <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
- <port>80</port>
- <maxIdleTime>60000</maxIdleTime>
- </connector>
- </connectors>
- </configuration>
- </plugin>
- </plugins>
- </build>
- </project>
web.xml中的配置:
- <?xml version="1.0" encoding="UTF-8" ?>
- <web-app version="2.5"
- xmlns="http://java.sun.com/xml/ns/javaee"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
- http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
- <display-name>Archetype Created Web Application</display-name>
- <!-- spring-orm-hibernate4的OpenSessionInViewFilter -->
- <filter>
- <filter-name>opensessioninview</filter-name>
- <filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilter</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>opensessioninview</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- <!-- 配置springmvc servlet -->
- <servlet>
- <servlet-name>springmvc</servlet-name>
- <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
- <load-on-startup>1</load-on-startup>
- </servlet>
- <servlet-mapping>
- <servlet-name>springmvc</servlet-name>
- <!-- / 表示所有的请求都要经过此serlvet -->
- <url-pattern>/</url-pattern>
- </servlet-mapping>
- <!-- spring的监听器 -->
- <context-param>
- <param-name>contextConfigLocation</param-name>
- <param-value>classpath:applicationContext*.xml</param-value>
- </context-param>
- <listener>
- <listener-class>
- org.springframework.web.context.ContextLoaderListener
- </listener-class>
- </listener>
- <!-- Shiro配置 -->
- <filter>
- <filter-name>shiroFilter</filter-name>
- <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>shiroFilter</filter-name>
- <url-pattern>/*</url-pattern>
- </filter-mapping>
- </web-app>
- package com.cn.service;
- import java.util.List;
- import javax.inject.Inject;
- import org.apache.shiro.authc.AuthenticationException;
- import org.apache.shiro.authc.AuthenticationInfo;
- import org.apache.shiro.authc.AuthenticationToken;
- import org.apache.shiro.authc.SimpleAuthenticationInfo;
- import org.apache.shiro.authc.UsernamePasswordToken;
- import org.apache.shiro.authz.AuthorizationInfo;
- import org.apache.shiro.authz.SimpleAuthorizationInfo;
- import org.apache.shiro.realm.AuthorizingRealm;
- import org.apache.shiro.subject.PrincipalCollection;
- import org.springframework.stereotype.Service;
- import org.springframework.transaction.annotation.Transactional;
- import com.cn.pojo.Role;
- import com.cn.pojo.User;
- @Service
- @Transactional
- public class MyShiro extends AuthorizingRealm{
- @Inject
- private UserService userService;
- /**
- * 权限认证
- */
- @Override
- protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
- //获取登录时输入的用户名
- String loginName=(String) principalCollection.fromRealm(getName()).iterator().next();
- //到数据库查是否有此对象
- User user=userService.findByName(loginName);
- if(user!=null){
- //权限信息对象info,用来存放查出的用户的所有的角色(role)及权限(permission)
- SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
- //用户的角色集合
- info.setRoles(user.getRolesName());
- //用户的角色对应的所有权限,如果只使用角色定义访问权限,下面的四行可以不要
- List<Role> roleList=user.getRoleList();
- for (Role role : roleList) {
- info.addStringPermissions(role.getPermissionsName());
- }
- return info;
- }
- return null;
- }
- /**
- * 登录认证;
- */
- @Override
- protected AuthenticationInfo doGetAuthenticationInfo(
- AuthenticationToken authenticationToken) throws AuthenticationException {
- //UsernamePasswordToken对象用来存放提交的登录信息
- UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
- //查出是否有此用户
- User user=userService.findByName(token.getUsername());
- if(user!=null){
- //若存在,将此用户存放到登录认证info中
- return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
- }
- return null;
- }
- }
在spring的配置文件中配置,为了区别spring原配置和shiro我们将shiro的配置独立出来。
applicationContext-shiro.xml
- <?xml version="1.0" encoding="UTF-8" ?>
- <beans xmlns="http://www.springframework.org/schema/beans"
- xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xmlns:aop="http://www.springframework.org/schema/aop"
- xmlns:tx="http://www.springframework.org/schema/tx"
- xmlns:context="http://www.springframework.org/schema/context"
- xsi:schemaLocation="
- http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
- http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
- http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
- http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
- <!-- 配置权限管理器 -->
- <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
- <!-- ref对应我们写的realm MyShiro -->
- <property name="realm" ref="myShiro"/>
- <!-- 使用下面配置的缓存管理器 -->
- <property name="cacheManager" ref="cacheManager"/>
- </bean>
- <!-- 配置shiro的过滤器工厂类,id- shiroFilter要和我们在web.xml中配置的过滤器一致 -->
- <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
- <!-- 调用我们配置的权限管理器 -->
- <property name="securityManager" ref="securityManager"/>
- <!-- 配置我们的登录请求地址 -->
- <property name="loginUrl" value="/login"/>
- <!-- 配置我们在登录页登录成功后的跳转地址,如果你访问的是非/login地址,则跳到您访问的地址 -->
- <property name="successUrl" value="/user"/>
- <!-- 如果您请求的资源不再您的权限范围,则跳转到/403请求地址 -->
- <property name="unauthorizedUrl" value="/403"/>
- <!-- 权限配置 -->
- <property name="filterChainDefinitions">
- <value>
- <!-- anon表示此地址不需要任何权限即可访问 -->
- /static/**=anon
- <!-- perms[user:query]表示访问此连接需要权限为user:query的用户 -->
- /user=perms[user:query]
- <!-- roles[manager]表示访问此连接需要用户的角色为manager -->
- /user/add=roles[manager]
- /user/del/**=roles[admin]
- /user/edit/**=roles[manager]
- <!--所有的请求(除去配置的静态资源请求或请求地址为anon的请求)都要通过登录验证,如果未登录则跳到/login-->
- /** = authc
- </value>
- </property>
- </bean>
- <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
- <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
- </beans>
用于登录,登出,权限跳转的控制:
- package com.cn.controller;
- import javax.validation.Valid;
- import org.apache.shiro.SecurityUtils;
- import org.apache.shiro.authc.AuthenticationException;
- import org.apache.shiro.authc.UsernamePasswordToken;
- import org.springframework.stereotype.Controller;
- import org.springframework.ui.Model;
- import org.springframework.validation.BindingResult;
- import org.springframework.web.bind.annotation.RequestMapping;
- import org.springframework.web.bind.annotation.RequestMethod;
- import org.springframework.web.servlet.mvc.support.RedirectAttributes;
- import com.cn.pojo.User;
- @Controller
- public class HomeController {
- @RequestMapping(value="/login",method=RequestMethod.GET)
- public String loginForm(Model model){
- model.addAttribute("user", new User());
- return "/login";
- }
- @RequestMapping(value="/login",method=RequestMethod.POST)
- public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
- try {
- if(bindingResult.hasErrors()){
- return "/login";
- }
- //使用权限工具进行用户登录,登录成功后跳到shiro配置的successUrl中,与下面的return没什么关系!
- SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
- return "redirect:/user";
- } catch (AuthenticationException e) {
- redirectAttributes.addFlashAttribute("message","用户名或密码错误");
- return "redirect:/login";
- }
- }
- @RequestMapping(value="/logout",method=RequestMethod.GET)
- public String logout(RedirectAttributes redirectAttributes ){
- //使用权限管理工具进行用户的退出,跳出登录,给出提示信息
- SecurityUtils.getSubject().logout();
- redirectAttributes.addFlashAttribute("message", "您已安全退出");
- return "redirect:/login";
- }
- @RequestMapping("/403")
- public String unauthorizedRole(){
- return "/403";
- }
- }
三个主要的JSP:
login.jsp:
- <%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
- <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
- <html>
- <head>
- <title>My JSP 'MyJsp.jsp' starting page</title>
- </head>
- <body>
- <h1>登录页面----${message }</h1>
- <img alt="" src="/static/img/1.jpg">
- <form:form action="/login" commandName="user" method="post">
- 用户名:<form:input path="username"/> <form:errors path="username" cssClass="error"/> <br/>
- 密 码:<form:password path="password"/> <form:errors path="password" cssClass="error" /> <br/>
- <form:button name="button">submit</form:button>
- </form:form>
- </body>
- </html>
user.jsp:
- <%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
- <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
- <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
- <html>
- <head>
- <title>用户列表</title>
- </head>
- <body>
- <h1>${message }</h1>
- <h1>用户列表--<a href="/user/add">添加用户</a>---<a href="/logout">退出登录</a> </h1>
- <h2>权限列表</h2>
- <shiro:authenticated>用户已经登录显示此内容</shiro:authenticated>
- <shiro:hasRole name="manager">manager角色登录显示此内容</shiro:hasRole>
- <shiro:hasRole name="admin">admin角色登录显示此内容</shiro:hasRole>
- <shiro:hasRole name="normal">normal角色登录显示此内容</shiro:hasRole>
- <shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**</shiro:hasAnyRoles>
- <shiro:principal/>-显示当前登录用户名
- <shiro:hasPermission name="add">add权限用户显示此内容</shiro:hasPermission>
- <shiro:hasPermission name="user:query">query权限用户显示此内容<shiro:principal/></shiro:hasPermission>
- <shiro:lacksPermission name="user:del"> 不具有user:del权限的用户显示此内容 </shiro:lacksPermission>
- <ul>
- <c:forEach items="${userList }" var="user">
- <li>用户名:${user.username }----密码:${user.password }----<a href="/user/edit/${user.id}">修改用户</a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户</a></li>
- </c:forEach>
- </ul>
- <img alt="" src="/static/img/1.jpg">
- <script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js"></script>
- <script>
- $(function(){
- $(".del").click(function(){
- var id=$(this).attr("ref");
- $.ajax({
- type:"delete",
- url:"/user/del/"+id,
- success:function(e){
- }
- });
- });
- });
- </script>
- </body>
- </html>
403.jsp:
- <%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
- <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
- <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
- <html>
- <head>
- <title>权限错误</title>
- </head>
- <body>
- <h1>对不起,您没有权限请求此连接!</h1>
- <img alt="" src="/static/img/1.jpg">
- </body>
- </html>
原博客地址:http://www.cnblogs.com/lonely-buffoon/p/5580935.html
spring mvc 集成shiro 做权限的简单使用
1.概述
现在的项目使用的权限控制系统是spring security 3.因为项目的框架使用spring,就顺便使用了。最近研究了一下spring side4,推荐使用shiro。照着示例做了一遍。在原有的spring web工程中。步骤如下。
2.引进包,maven设置
- <dependency>
- <groupId>org.apache.shiro</groupId>
- <artifactId>shiro-all</artifactId>
- <version>1.2.1</version>
- <type>jar</type>
- <scope>compile</scope>
- </dependency>
3.实现Controller层
主要是登陆url和几个掩饰url
- @Controller
- public class AdminController {
- @RequestMapping(value = "/admin/index", method = RequestMethod.GET)
- public String index(Model model) {
- return "admin/index";
- }
- @RequestMapping(value = "/admin/login", method = RequestMethod.GET)
- public String login(Model model) {
- logger.info("login get");
- return "admin/login";
- }
- @RequestMapping(value = "/admin/login", method = RequestMethod.POST)
- public String doLogin(Model model) {
- logger.info("login post");
- return "admin/login";
- }
- @RequiresRoles("user")
- @RequestMapping(value = "/admin/user", method = RequestMethod.GET)
- public String shiroUser(Model model) {
- return "admin/index";
- }
- @RequiresRoles("admin")
- @RequestMapping(value = "/admin/admin", method = RequestMethod.GET)
- public String shiroAdmin(Model model) {
- return "admin/index";
- }
- Logger logger = LoggerFactory.getLogger(AdminController.class);
- }
4.实现权限验证
继承shiro的AuthorizingRealm
- public class ShiroDbRealm extends AuthorizingRealm {
- protected AccountService accountService;
- @Autowired
- public void setAccountService(AccountService accountService) {
- this.accountService = accountService;
- }
- /**
- * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
- */
- @SuppressWarnings("unused")
- @Override
- protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection p) {
- logger.info("授权认证:" + p.getRealmNames());
- ShiroUser shiroUser = (ShiroUser) p.getPrimaryPrincipal();
- User user = accountService.findUserByLoginName(shiroUser.loginName);
- SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
- for (Role role : user.getRoleList()) {
- //基于Role的权限信息
- info.addRole(role.getName());
- //基于Permission的权限信息
- info.addStringPermission(role.getPermissions());
- }
- return info;
- }
- /**
- * 认证回调函数,登录时调用.
- */
- @Override
- protected AuthenticationInfo doGetAuthenticationInfo(
- AuthenticationToken authcToken) throws AuthenticationException {
- logger.info("authc pass:");
- UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
- logger.info("authc name:" + token.getUsername());
- User user = accountService.findUserByLoginName(token.getUsername());
- if (user != null) {
- if (user.getStatus().equals("disabled")) {
- throw new DisabledAccountException();
- }
- logger.info("authc name:" + token.getUsername() + " user:"
- + user.getLoginName() + " pwd:" + user.getPassword()
- + "getname:" + getName());
- // byte[] salt = Encodes.decodeHex(user.getSalt());
- return new SimpleAuthenticationInfo(new ShiroUser(user.getLoginName(), user.getName()),
- user.getPassword(), getName());
- }
- return null;
- }
- /**
- * 自定义Authentication对象,使得Subject除了携带用户的登录名外还可以携带更多信息.
- */
- public static class ShiroUser implements Serializable {
- private static final long serialVersionUID = -1373760761780840081L;
- public String loginName;
- public String name;
- public ShiroUser(String loginName, String name) {
- this.loginName = loginName;
- this.name = name;
- }
- public String getName() {
- return loginName;
- }
- /**
- * 本函数输出将作为默认的<shiro:principal/>输出.
- */
- @Override
- public String toString() {
- return loginName;
- }
- /**
- * 重载hashCode,只计算loginName;
- */
- @Override
- public int hashCode() {
- return Objects.hashCode(loginName);
- }
- /**
- * 重载equals,只计算loginName;
- */
- @Override
- public boolean equals(Object obj) {
- if (this == obj)
- return true;
- if (obj == null)
- return false;
- if (getClass() != obj.getClass())
- return false;
- ShiroUser other = (ShiroUser) obj;
- if (loginName == null) {
- if (other.loginName != null)
- return false;
- } else if (!loginName.equals(other.loginName))
- return false;
- return true;
- }
- }
- Logger logger = LoggerFactory.getLogger(ShiroDbRealm.class);
- }
自定义的类ShiroUser是为了,可以多传输一些内容,供后面验证时使用,例子中只用了一个loginName,一般可以用String 传输就够了。
登陆时用doGetAuthenticationInfo()函数获得相关信息。
登陆后访问url 使用doGetAuthorizationInfo()获得用户的权限。
5.配置文件shiro部分
将controller的url纳入权限验证范围。
- <?xml version="1.0" encoding="UTF-8"?>
- <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
- xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd"
- default-lazy-init="true">
- <description>Shiro安全配置</description>
- <!-- 項目自定义的Realm -->
- <bean id="shiroDbRealm" class="com.blueinfo.jee.shiro.ShiroDbRealm" depends-on="userDao,roleDao">
- <property name="accountService" ref="accountService"/>
- </bean>
- <!-- Shiro Filter -->
- <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
- <property name="securityManager" ref="securityManager" />
- <property name="loginUrl" value="/admin/login" />
- <property name="successUrl" value="/admin/index" />
- <property name="unauthorizedUrl" value="/admin/logout" />
- <property name="filterChainDefinitions">
- <value>
- /admin/login = authc
- /admin/logout = logout
- /static/** = anon
- /admin/** = authc
- </value>
- </property>
- </bean>
- <!-- 用户授权信息Cache, 采用EhCache -->
- <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
- <property name="cacheManagerConfigFile" value="classpath:security/ehcache-shiro.xml"/>
- </bean>
- <!-- Shiro's main business-tier object for web-enabled applications -->
- <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
- <property name="realm" ref="shiroDbRealm" />
- <property name="cacheManager" ref="shiroEhcacheManager" />
- </bean>
- <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
- <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
- <!-- AOP式方法级权限检查 -->
- <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
- <property name="proxyTargetClass" value="true" />
- </bean>
- <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
- <property name="securityManager" ref="securityManager"/>
- </bean>
- </beans>
主要内容是shiroFilter的定义。
loginUrl:登陆页面,用户登陆不成功,自动返回此页面。
successUrl:登陆成功后跳转此页面
unauthorizedUrl:用户访问无权限的链接时跳转此页面
filterChainDefinitions:设置url的访问权限。anon表示不用验证,都可以访问。anthc:authc filter 监听,不登陆不能访问。logout:logout filter监听。没有列出的常用配置:perms["remote:invoke"] :需要角色romote 和权限invoke才能访问。roles["admin"]需要角色admin才能访问。设置可用“,”隔开,如:
/admin/test = authc,roles[admin]
关于filter的列表:
Filter Name | Class |
anon | org.apache.shiro.web.filter.authc.AnonymousFilter |
authc | org.apache.shiro.web.filter.authc.FormAuthenticationFilter |
authcBasic | org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter |
perms | org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter |
port | org.apache.shiro.web.filter.authz.PortFilter |
rest | org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter |
roles | org.apache.shiro.web.filter.authz.RolesAuthorizationFilter |
ssl | org.apache.shiro.web.filter.authz.SslFilter |
user | org.apache.shiro.web.filter.authc.UserFilter |
6.配置文件,启用shiroFilter
上面的配置和源码定义了shiroFilter,在web.xml中启用它
- <!-- Shiro Security filter -->
- <filter>
- <filter-name>shiroFilter</filter-name>
- <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
- </filter>
- <filter-mapping>
- <filter-name>shiroFilter</filter-name>
- <url-pattern>/*</url-pattern>
- <dispatcher>REQUEST</dispatcher>
- <dispatcher>FORWARD</dispatcher>
- </filter-mapping>
7.使用annotation控制权限
在2中controller使用@RequiresRoles 注解控制权限,还可以是@RequirePermissions,要在方法上使用注解需要做如下配置:
1.在spring-mvc.xml中加入
- <!-- 支持 Shiro对Controller的方法级AOP安全控制-->
- <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
- <property name="proxyTargetClass" value="true" />
- </bean>
- <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
- <property name="securityManager" ref="securityManager"/>
- </bean>
2.出错控制,在spring-mvc.xml中加入
- <!-- 将Controller抛出的异常转到特定View -->
- <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
- <property name="exceptionMappings">
- <props>
- <prop key="org.apache.shiro.authz.UnauthorizedException">error/403</prop>
- <prop key="java.lang.Throwable">error/500</prop>
- </props>
- </property>
- </bean>
8.参考
1,文中的内容大部分来源于开源工程,spring-side,真心感谢其作者江南白衣
2.apache-shiro官网:http://shiro.apache.org/
原博客地址:http://blog.csdn.net/hsienhua/article/details/9768477