Shiro 权限及登录

谁借莪１个温暖的怀抱￠ 2022-05-15 09:43 240阅读 0赞

Shiro是一款非常强大的安全框架，他可以帮助我们做身份验证，授权，密码学以及会话管理，今天我们就聊聊shiro的授权。

首先我们得确定下授权方案，我们需要用到五张表：用户表、权限表、角色表、用户角色表、角色权限表。

接下来我们开始配置Shiro。

第一步：加入依赖。

第二步：更改web.xml配置。

第三步：添加shiro-shiro.xml配置。

第四步：在springMVC加入Shiro的配置。

第五步：可能会用到缓存，我们添加spring-cache.xml缓存配置。

第六步：添加ehcache.xml配置。

配置结束~

第一步：

<dependencies>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-core</artifactId>
                <version>1.2.2</version>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-simple</artifactId>
                <version>1.7.5</version>
            </dependency>
        </dependencies>

第二步：

<filter>
            <filter-name>shiroFilter</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
            <init-param>
                <param-name>targetFilterLifecycle</param-name>
                <param-value>true</param-value>
            </init-param>
        </filter>
        
        <filter-mapping>
            <filter-name>shiroFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

第三步：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="
           http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">
    
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            
            <property name="securityManager" ref="securityManager" />
            
            <property name="loginUrl" value="/login.jsp" />
            
            
            
            
    
            <property name="filterChainDefinitions">
                
                <value>
                    /admin/**=authc
                </value>
            </property>
    
        </bean>
    
    
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>
        
        <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.Md5CredentialsMatcher"></bean>
        
        <bean id="shiroCacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"></bean>
    
        
        <bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
            <property name="credentialsMatcher" ref="credentialsMatcher"></property>
            <property name="permissionsLookupEnabled" value="true"></property>
            <property name="dataSource" ref="dataSource"></property>
            <property name="authenticationQuery"
                value="SELECT password FROM sec_user WHERE user_name = ?"></property>
            <property name="userRolesQuery"
                value="SELECT role_name from sec_user_role left join sec_role using(role_id) left join sec_user using(user_id) WHERE user_name = ?"></property>
            <property name="permissionsQuery"
                value="SELECT permission_name FROM sec_role_permission left join sec_role using(role_id) left join sec_permission using(permission_id) WHERE role_name = ?"></property>
        </bean>
    
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            <property name="realm" ref="jdbcRealm"></property>
            <property name="cacheManager" ref="shiroCacheManager"></property>
        </bean>
    
        
    
    </beans>

第四步：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
        xmlns:context="http://www.springframework.org/schema/context"
        xmlns:mvc="http://www.springframework.org/schema/mvc"
        xsi:schemaLocation="
            http://www.springframework.org/schema/beans 
            http://www.springframework.org/schema/beans/spring-beans-3.1.xsd 
            http://www.springframework.org/schema/context 
            http://www.springframework.org/schema/context/spring-context-3.1.xsd 
            http://www.springframework.org/schema/mvc 
            http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd ">
    
        
        <import resource="classpath:spring/spring-shiro.xml" />
    
        
        <context:component-scan base-package="com.test.controller">
            <context:include-filter type="annotation"
                expression="org.springframework.stereotype.Controller" />
        </context:component-scan>
    
        
        <mvc:view-controller path="/" view-name="index" />
    
        
        <mvc:annotation-driven />
    
        
        <mvc:resources location="/assets/" mapping="/assets/**"></mvc:resources>
    
        
        <bean
            class="org.springframework.web.servlet.view.InternalResourceViewResolver">
            <property name="prefix" value="/WEB-INF/views/" />
            <property name="suffix" value=".jsp" />
        </bean>
    
        
        <bean
            class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
            depends-on="lifecycleBeanPostProcessor">
            <property name="proxyTargetClass" value="true" />
        </bean>
    
        <bean
            class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager" />
        </bean>
    
        
        <bean
            class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
            <property name="exceptionMappings">
                <props>
                    
                    <prop key="org.apache.shiro.authz.UnauthorizedException">
                        
                        /error/unauthorized
                    </prop>
                    
                    <prop key="org.apache.shiro.authz.UnauthenticatedException">
                        
                        /error/unauthorized
                    </prop>
                </props>
            </property>
        </bean>
    </beans>

第五步：

第六步：

<?xml version="1.0" encoding="UTF-8"?>
    <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:noNamespaceSchemaLocation="http://www.ehcache.org/ehcache.xsd">
    
        <diskStore path="java.io.tmpdir/ehcache" />
    
        
        <defaultCache 
            maxElementsInMemory="1000" 
            eternal="false"
            timeToIdleSeconds="120" 
            timeToLiveSeconds="120" 
            overflowToDisk="false" />
    
        
        
        <cache name="userIsExists" 
            maxElementsInMemory="1000" 
            eternal="false"
            timeToIdleSeconds="120" 
            timeToLiveSeconds="120" 
            overflowToDisk="false"
            memoryStoreEvictionPolicy="LRU" />
        
        <cache name="getUserById" 
            maxElementsInMemory="1000" 
            eternal="false"
            timeToIdleSeconds="120" 
            timeToLiveSeconds="120" 
            overflowToDisk="false"
            memoryStoreEvictionPolicy="LRU" />
    
    </ehcache>

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*测试\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

Controller/login:

UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
            token.setRememberMe(true);
            Subject subject = SecurityUtils.getSubject();
            try {
                subject.login(token);
                if (subject.isAuthenticated()) {
                    request.getSession().setAttribute("user",user);
                    SavedRequest savedRequest = WebUtils.getSavedRequest(request);
                    // 获取保存的URL
                    if (savedRequest == null || savedRequest.getRequestUrl() == null) {
                        return "admin/home";
                    } else {
                        return "forward:" + savedRequest.getRequestUrl();
                    }
                } else {
                    return "login";
                }
            } catch (IncorrectCredentialsException e) {
                msg = "登录密码错误. Password for account " + token.getPrincipal() + " was incorrect.";
                model.addAttribute("message", msg);
                System.out.println(msg);
            }

权限控制Controller：

// 只用同时具有user:view和user:create权限才能访问
        @RequiresPermissions(value = { "user:view", "user:create" }, logical = Logical.AND)
        @RequestMapping(value = "/admin/auth")
        public String adminWithAuth() {
            return "admin/withauth";
        }

本文参考[http://blog.csdn.net/frankcheng5143/article/details/50836619][http_blog.csdn.net_frankcheng5143_article_details_50836619]这篇文章。谢谢各位~

[http_blog.csdn.net_frankcheng5143_article_details_50836619]: http://blog.csdn.net/frankcheng5143/article/details/50836619