SpringMVC整合Shiro

 SPRingMVC整合Shiro，Shiro是一个强大易用的java安全框架,提供了认证、授权、加密和会话管理等功能。

第一步：配置web.xml

<!-- 配置Shiro过滤器,先让Shiro过滤系统接收到的请求 -->  <!-- 这里filter-name必须对应applicationContext.xml中定义的<bean id="shiroFilter"/> -->  <!-- 使用[/*]匹配所有请求,保证所有的可控请求都经过Shiro的过滤 -->  <!-- 通常会将此filter-mapping放置到最前面(即其他filter-mapping前面),以保证它是过滤器链中第一个起作用的 -->  <filter>      <filter-name>shiroFilter</filter-name>      <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>      <init-param>      <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->      <param-name>targetFilterLifecycle</param-name>      <param-value>true</param-value>      </init-param>  </filter>  <filter-mapping>          <filter-name>shiroFilter</filter-name>          <url-pattern>/*</url-pattern>  </filter-mapping>

或者

<!-- apache shiro权限 --><filter>          <filter-name>shiroFilter</filter-name>          <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>          <init-param>              <param-name>targetFilterLifecycle</param-name>              <param-value>true</param-value>          </init-param>      </filter>        <filter-mapping>          <filter-name>shiroFilter</filter-name>          <url-pattern>*.do</url-pattern>      </filter-mapping>      <filter-mapping>          <filter-name>shiroFilter</filter-name>          <url-pattern>*.jsp</url-pattern>      </filter-mapping> 

第二步：配置applicationContext-shiro.xml

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd       http://www.springframework.org/schema/util     http://www.springframework.org/schema/util/spring-util-3.0.xsd">    <description>Shiro 配置</description><!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 -->  <!-- Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截,Shiro对基于Spring的Web应用提供了完美的支持 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><!-- Shiro的核心安全接口,这个属性是必须的 -->  <property name="securityManager" ref="securityManager" /> <!-- 要求登录时的链接(可根据项目的URL进行替换),非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->  <property name="loginUrl" value="/login.jsp" /><!--  <property name="successUrl" value="/login.jsp" />--><!-- 登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) -->      <!-- <property name="successUrl" value="/system/main"/> -->      <!-- 用户访问未对其授权的资源时,所显示的连接 -->      <!-- 若想更明显的测试此属性可以修改它的值,如unauthor.jsp,然后用[玄玉]登录后访问/admin/listUser.jsp就看见浏览器会显示unauthor.jsp --> <property name="unauthorizedUrl" value="/error.jsp" /><!-- Shiro连接约束配置,即过滤链的定义 -->      <!-- 此处可配合我的这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839 -->      <!-- 下面value值的第一个'/'代表的路径是相对于HttpServletRequest.getContextPath()的值来的 -->      <!-- anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 -->      <!-- authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter -->  <property name="filterChainDefinitions"><value>/login.jsp* = anon/login.do* = anon/logout.do* = anon/index.jsp*= anon/image.jsp*= anon/error.jsp*= anon/*.jpg* = anon/*.png* = anon/*.CSS* = anon/*.js* = anon/*.jsp* = authc/*.do* = authc<!-- /user/*=authc,roles[1]/department/*=authc,roles[1]--></value></property></bean><bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"><!--设置自定义realm --><property name="realm" ref="monitorRealm" /></bean><!-- Support Shiro 所谓的异常拦截 可有可无 Annotation -->    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">          <property name="exceptionMappings">              <props>                  <prop key="org.apache.shiro.authz.UnauthorizedException">/error</prop>            </props>          </property>      </bean>    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /><!--自定义Realm 继承自AuthorizingRealm --><!-- 继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户登录的类为自定义的ShiroDbRealm.java -->  <bean id="monitorRealm" class="com.dt.service.MonitorRealm">   <!-- 关闭授权缓存域，把authorizationCachingEnabled设置为false   否则会提示No cache or cacheManager properties have been set.  Authorization cache cannot be obtained.    -->   <property name="authorizationCachingEnabled" value="false"/> </bean><!-- securityManager --><beanclass="org.springframework.beans.factory.config.MethodInvokingFactoryBean"><property name="staticMethod"value="org.apache.shiro.SecurityUtils.setSecurityManager" /><property name="arguments" ref="securityManager" /></bean><!-- Enable Shiro Annotations for Spring-configured beans. Only run after --><!-- the lifecycleBeanProcessor has run: --><beanclass="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"depends-on="lifecycleBeanPostProcessor" /><bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"><property name="securityManager" ref="securityManager" /></bean></beans>

第三步：自定义的Realm类

@Service("monitorRealm")public class MonitorRealm extends AuthorizingRealm {@Resourceprivate UserService userService;public MonitorRealm() {super();}//Authorization：授权，即权限验证，验证某个已认证的用户是否拥有某个权限；即判断用户是否能做事情，常见的如：验证某个用户是否拥有某个角色。或者细粒度的验证某个用户对某个资源是否具有某个权限；@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {/* 这里编写授权代码 */HttpServletRequest request = ((ServletRequestAttributes)RequestContextHolder.getRequestAttributes()).getRequest();  User user2  = (User)request.getsession().getAttribute("currentUser");/* 角色  */Set<String> roleNames = new HashSet<String>();   roleNames.add(String.valueOf(user2.getRoleId()));   /* 权限  */   Set<String> permissions = new HashSet<String>();    permissions.addAll(PrivilegeReader.getModulUrlsById(user2.getRoleId()));      SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();    info.setRoles(roleNames);//添加角色(Set集合<字符串>)info.setStringPermissions(permissions);return info;}// Authentication 身份认证/登录，验证用户是不是拥有相应的身份；@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {/* 这里编写认证代码 */UsernamePassWordToken token = (UsernamePasswordToken) authcToken;//User user = securityApplication.findby(upToken.getUsername());//User user = new User();//user.setUserName(token.getUsername());User user = userService.loadById(token.getUsername());if (user != null) {this.setSession("currentUser", user);  return new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(), user.getTrueName());}else{throw new AuthenticationException();}}//清空缓存public void clearCachedAuthorizationInfo(String principal) {SimplePrincipalCollection principals = new SimplePrincipalCollection(principal, getName());clearCachedAuthorizationInfo(principals);} /**      * 将一些数据放到ShiroSession中,以便于其它地方使用      * @see  比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到      */      private void setSession(Object key, Object value){          Subject currentUser = SecurityUtils.getSubject();          if(null != currentUser){              Session session = currentUser.getSession();              if(null != session){                  session.setAttribute(key, value);              }          }      }  }

第四步：SpringMvc

<!-- 使用注解的包，包括子集 --><context:component-scan base-package="com.dt.controller" /><!-- shiro 使用注解必须 --><context:annotation-config/><!-- Required for security annotations to work in this servlet -->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"/>    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"/>    <!-- Enable annotation-based controllers using @Controller annotations -->    <bean id="annotationUrlMapping"  class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping"></bean>    <bean id="annotationMethodHandlerAdapter" class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter"/> <!-- 视图解析器 --><bean id="viewResolver"class="org.springframework.web.servlet.view.InternalResourceViewResolver"><property name="prefix" value="/" /><property name="suffix" value=".jsp"></property></bean> <!-- 文件上传 --><bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver"> <property name="defaultEncoding" value="utf-8" />     <property name="maxUploadSize" value="10485760000" />     <property name="maxInMemorySize" value="40960" /></bean>