shiro与spring整合-蒲公英云

文章目录

- 首先需要一个简单的ssm项目:
- - pom配置
  - web.xml配置
  - spring.xml配置
  - 自定义realm
- 简单测试
- 通过java配置的方式整合spring

首先需要一个简单的ssm项目:

简单的ssm项目

pom配置

在项目pom.xml里面加入shiro依赖:

<properties>
        <shiro.version>1.4.2</shiro.version>
    </properties>
<dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-core</artifactId>
          <version>${ shiro.version}</version>
      </dependency>
      <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-web</artifactId>
          <version>${ shiro.version}</version>
      </dependency>
      <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-spring</artifactId>
          <version>${ shiro.version}</version>
      </dependency>

web.xml配置

web.xml加入shiro过滤器:

<!--shiro过滤器-->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern> </filter-mapping>

这里的filter-name的值shiroFilter需要跟spring里面配置的filter一样.

spring.xml配置

首先了解一下:

创建spring-shiro.xml配置:
首先肯定需要配置shiro的拦截过滤器bean,这个类org.apache.shiro.spring.web.ShiroFilterFactoryBean;
在这里插入图片描述
ShiroFilterFactoryBean里面的loginUrl,successUrl,unauthorizedUrl大致如下:

这个类的属性有SecurityManager,配置SecurityManager就使用默认的就好了,而默认的org.apache.shiro.web.mgt.DefaultWebSecurityManager有个传realm的构造方法.

配置文件需要在spring配置文件里面引入的:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <bean name="shiroFilterBean" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"></property>
        <property name="filterChainDefinitions">
            <value>
                /login = anon
                /logout = logout
                /** = authc </value> </property> <property name="loginUrl" value="/login" /> <property name="successUrl" value="/index" /> </bean> <bean name="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realms" ref="shiroRealm"></property> </bean> <bean name="shiroRealm" class="com.txn.config.ShiroRealm"> <!-- <property name="credentialsMatcher"> <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <property name="hashAlgorithmName" value="md5"></property> <property name="hashIterations" value="1"></property> </bean> </property>--> </property> </bean> </beans>

自定义realm

我们自己实现一个realm,上篇讲了,自己实现realm只需要继承AuthorizingRealm就可以了,看一下三篇讲的sampleRealm的rml图:装饰者应该
在这里插入图片描述

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import java.util.HashMap;
import java.util.Map;
public class ShiroRealm extends AuthorizingRealm { 
    /** * 认证 */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
        System.out.println("-权限校验-");
        if ("admin".equals(token.getPrincipal())) { 
            Map<String, Object> user = new HashMap<>();
            user.put("username", "admin");
            user.put("pass", "admin");
            user.put("user_id", 1);
            ByteSource salt = ByteSource.Util.bytes("abcd123");
            return new SimpleAuthenticationInfo(user, user.get("username"), salt, this.getName());
        }
        return null;
    }
    /** * 授权 */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("role_admin");
        info.addStringPermission("user:add");
        info.addStringPermission("user:list");
        return info;
    }
}

简单测试

随便写个controller:

import com.txn.common.ResponseObject;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;
/** * @author <a href="mailto:15268179013@139.com">yida</a> * @Version 2020-01-01 15:42 * @Version 1.0 * @Description IndexController */
@RestController
public class IndexController { 
    @RequestMapping(value = "/login", method = { RequestMethod.POST, RequestMethod.GET})
    public ResponseObject login(String username, String password) { 
        ResponseObject responseObject = new ResponseObject();
        if (StringUtils.isEmpty(username) || StringUtils.isEmpty(password)) { 
            responseObject.success("登录失败");
            return responseObject;
        }
        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
        SecurityUtils.getSubject().login(usernamePasswordToken);
        responseObject.success("ok");
        return responseObject;
    }
    @RequestMapping(value = "/getUser", method = RequestMethod.GET)
    public ResponseObject getUser() { 
        ResponseObject responseObject = new ResponseObject();
        responseObject.success(true);
        return responseObject;
    }
    @RequestMapping(value = "/user", method = RequestMethod.GET)
    public ResponseObject user() { 
        ResponseObject responseObject = new ResponseObject();
        Subject subject = SecurityUtils.getSubject();
        boolean permitted = subject.isPermitted("user:list");
        responseObject.success(permitted);
        return responseObject;
    }
}

就没写页面了,随便测试一下:
首先访问//localhost:8080/getUser,会跳转到登录页面,因为我们没有登录;
然后进行登录//localhost:8080/login?username=admin&password=admin
在这里插入图片描述
然后在访问http://localhost:8080/getUser但是并不会进入授权方法,就是doGetAuthorizationInfo方法,
然后访问http://localhost:8080/user然后在调用isPermitted方法的时候就进入到了doGetAuthorizationInfo方法证明了我们上篇介绍的.

通过java配置的方式整合spring

前面是通过xml的方式,改成通过配置类的方式:

import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
/** * @author <a href="mailto:15268179013@139.com">yida</a> * @Version 2020-01-01 15:05 * @Version 1.0 * @Description ShiroConfig */
@Configuration
public class ShiroConfig { 
    @Bean
    public DefaultWebSecurityManager securityManager() { 
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(realm());
        return defaultWebSecurityManager;
    }
    @Bean
    public Realm realm() { 
        ShiroRealm shiroRealm = new ShiroRealm();
        return shiroRealm;
    }
    @Bean
    public ShiroFilterFactoryBean shiroFilter() { 
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager());
        shiroFilterFactoryBean.setLoginUrl("/login");
        shiroFilterFactoryBean.setSuccessUrl("/index");
        shiroFilterFactoryBean.setFilterChainDefinitions(" /login = anon\n" +
                " /logout = logout\n" +
                " /** = authc");
        return shiroFilterFactoryBean;
    }
}