Shiro(2)--从零开始Spring整合Shiro

左手的ㄟ右手 2022-06-01 10:54 215阅读 0赞

强烈推荐一个大神的人工智能的教程：[http://www.captainbed.net/zhanghan][http_www.captainbed.net_zhanghan]

一、新建maven项目,坐标如下,打包方式为war

<groupId>zh.shiro.spring</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.0-SNAPSHOT</version>

依赖的parent工程为zh-root

<parent>
            <groupId>zh.root</groupId>
            <artifactId>zh-root</artifactId>
            <version>1.0-SNAPSHOT</version>
    </parent>

二、在pom.xml中添加依赖的jar包

该demo只是做一个简单的整合,不用去查数据库,所以就不依赖jdbc相关的jar包了,只需要添加日志相关的jar包,spring相关的jar包,和Shiro相关的jar包,版本都是最新的就可以,可以去[maven的中央仓库][maven]查看。

<dependencies>
            <dependency>
                <groupId>junit</groupId>
                <artifactId>junit</artifactId>
                <scope>test</scope>
            </dependency>
            
            <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-api</artifactId>
            </dependency>
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-log4j12</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-ehcache</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-core</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
            </dependency>
            
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-context-support</artifactId>
            </dependency>
    
            
            
            
            
    
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-webmvc</artifactId>
            </dependency>
        </dependencies>

三、在src/resources下添加配置文件

1.  Spring配置文件:applicationContext.xml
2.  Shiro缓存的配置文件:ehcache.xml
3.  日志的配置文件:log4j.properties
4.  servlet的配置文件:spring-servlet.xml

四、配置webapp/WEB-INF路径下的web.xml文件

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns="http://java.sun.com/xml/ns/javaee"
             xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
             http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
             version="3.0">
        
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:applicationContext.xml</param-value>
        </context-param>
        
        <listener>
            <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
        </listener>
    
        
        <servlet>
            <servlet-name>spring</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
            <init-param>
                <param-name>contextConfigLocation</param-name>
                <param-value>classpath:spring-servlet.xml</param-value>
            </init-param>
            <load-on-startup>1</load-on-startup>
        </servlet>
        <servlet-mapping>
            <servlet-name>spring</servlet-name>
            <url-pattern>/</url-pattern>
        </servlet-mapping>
        
        <filter>
            <filter-name>shiroFilter</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
            <init-param>
                <param-name>targetFilterLifecycle</param-name>
                <param-value>true</param-value>
            </init-param>
        </filter>
        <filter-mapping>
            <filter-name>shiroFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    </web-app>

*  context-param标签和servlet的区别

context-param标签对应的是全局的,servlet标签对应的是Controller级别的,例如spring的配置文件,定时器配置文件等等,我们都需要配置在context-param标签中,当程序启动后,程序从web.xml进入,加载context-param标签下的配置文件。配置文件的默认位置是webapp/WEB-INF目录,当我们想要更清晰的管理配置文件时可能需要将配置文件放到了resources目录下,这是就需要在web.xml中指定加载的位置。

上述配置文件中的配置块中是配置ContextLoaderListener会加载指定位置的配置文件,全局的配置文件的指定位置是contextConfigLocation指定的位置。

*  springMVC的配置

DispatcherServlet是前端控制器设计模式的实现,主要作用是职责调度,可以配置init-param指定加载控制层上下文的位置,指定的位置是contextConfigLocation对应的value。

*  配置Shiro的shiroFilter

DelegatingFilterProxy 是一个代理filter,它会将实际的工作交给spring配置文件中id="shiroFilter"的bean来处理

五、在src/main/java目录下新建com.zh.shiro包

六、完善spring-servlet.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:mvc="http://www.springframework.org/schema/mvc"
           xmlns:context="http://www.springframework.org/schema/context"
           xsi:schemaLocation="http://www.springframework.org/schema/beans 
           http://www.springframework.org/schema/beans/spring-beans.xsd 
           http://www.springframework.org/schema/mvc 
           http://www.springframework.org/schema/mvc/spring-mvc.xsd
           http://www.springframework.org/schema/context
           http://www.springframework.org/schema/context/spring-context.xsd">
        
        <context:component-scan base-package="com.zh.shiro"></context:component-scan>
    
        
        <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
            <property name="prefix" value="/"/>
            <property name="suffix" value=".jsp"/>
        </bean>
    
        
        <mvc:annotation-driven></mvc:annotation-driven>
        <mvc:default-servlet-handler/>
    </beans>

*  视图解析器

SpringMVC在处理器方法中通常返回的是逻辑视图,如何定位到真正的页面上呢,就是需要通过视图解析器,如上配置,当处理器返回的是index时,InternalResourceViewResolver解析器会自动的添加前缀和后缀即/index.jsp(前缀为prefix对应的value,后缀为suffix对应的value),程序就可以在webapp目录下找到index.jsp

七、完善log4j.properties

#root
    log4j.rootLogger=INFO,CONSOLE,file
    log4j.additivity.org.apache=true
    # CONSOLE
    log4j.appender.CONSOLE=org.apache.log4j.ConsoleAppender
    log4j.appender.CONSOLE.Threshold=ERROR
    log4j.appender.CONSOLE.Target=System.out
    log4j.appender.CONSOLE.layout=org.apache.log4j.PatternLayout
    log4j.appender.CONSOLE.layout.ConversionPattern=%d %-5p %l %t |- %m%n
    #file
    log4j.appender.file=org.apache.log4j.DailyRollingFileAppender
    log4j.appender.file.DatePattern=yyyyMMdd
    log4j.appender.file.File=../logs/shiro-zh.log
    log4j.appender.file.layout=org.apache.log4j.PatternLayout
    log4j.appender.file.layout.ConversionPattern=%d %-5p %l %t |- %m%n

八、完善ehcache.xml

九、完善applicationContext.xml配置文件

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans.xsd">
    
        
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            
            <property name="cacheManager" ref="cacheManager"/>
            
            <property name="authenticator" ref="authenticator"/>
            <property name="realms">
                <list>
                    <ref bean="shiroRealm"/>
                    <ref bean="secondRealm"/>
                </list>
            </property>
            
        </bean>
    
        
        <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
            <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
        </bean>
    
        
        <bean id="authenticator" class="org.apache.shiro.authc.pam.ModularRealmAuthenticator">
            
            <property name="authenticationStrategy">
                <bean class="org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy"></bean>
            </property>
        </bean>
    
        
        
        <bean id="shiroRealm" class="com.zh.shiro.realms.ShiroRealm">
            <property name="credentialsMatcher">
                <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                    <property name="hashAlgorithmName" value="MD5"></property>
                    <property name="hashIterations" value="1024"></property>
                </bean>
            </property>
        </bean>
    
        <bean id="secondRealm" class="com.zh.shiro.realms.SecondRealm">
            <property name="credentialsMatcher">
                <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                    <property name="hashAlgorithmName" value="SHA1"></property>
                    <property name="hashIterations" value="1024"></property>
                </bean>
            </property>
        </bean>
    
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
        
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager"/>
        </bean>
    
        
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager"/>
            <property name="loginUrl" value="/login.jsp"/>
            <property name="successUrl" value="/list.jsp"/>
            <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    
            <property name="filterChainDefinitionMap" ref="filterChainDefinitionMap"></property>
            
            
            
            
            
            
                
                    
                    
                    
    
                    
                    
    
                    
                
            
        </bean>
        
        <bean id="filterChainDefinitionMap" factory-bean="filterChainDefinitionMapBuilder" factory-method="buildFilterChainDefinitionMap"></bean>
        <bean id="filterChainDefinitionMapBuilder" class="com.zh.shiro.factory.FilterChainDefinitionMapBuilder"></bean>
    
        <bean id="shiroService" class="com.zh.shiro.services.ShiroService"></bean>
    </beans>

十、新建上述配置文件中涉及到的类

1.在src/main/java/com/zh/shiro包下新建factory包,factory包下新建名为FilterChainDefinitionMapBuilder的类,配置哪些页面需要受保护

package com.zh.shiro.factory;
    
    import java.util.LinkedHashMap;
    
    /**
     *配置哪些页面需要受保护,以及访问这些页面需要的权限
     * @author huan
     * @date 2018/1/23
     */
    public class FilterChainDefinitionMapBuilder {
        public LinkedHashMap<String,String> buildFilterChainDefinitionMap(){
            LinkedHashMap<String,String> map = new LinkedHashMap<>();
            map.put("/login.jsp","anon");
            map.put("/shiro/login","anon");
            map.put("/user.jsp","authc,roles[user]");
            map.put("/admin.jsp","authc,roles[admin]");
            map.put("/list.jsp","user");
            map.put("/**","authc");
            return map;
        }
    }

*  为什么使用LinkedHashMap?

因为URL权限采取第一次匹配优先的方式,即从头开始使用第一个匹配的url模式对应的拦截器链。

十一、在src/main/java/com/zh/shiro包下新建handlers包,handlers包下新建名为ShiroHandler的类

package com.zh.shiro.handlers;
    
    import com.zh.shiro.services.ShiroService;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestParam;
    
    
    /**
     *
     * @author huan
     * @date 2018/1/22
     */
    @Controller
    @RequestMapping("/shiro")
    public class ShiroHandler {
        @Autowired
        private ShiroService shiroService;
    
        @RequestMapping("/testShiroAnnotation")
        public String testShiroAnnotation(){
            shiroService.testMethod();
            return "redirect:/list.jsp";
        }
    
        @RequestMapping("/login")
        public String login(@RequestParam("username")String username,@RequestParam("password")String password){
            Subject currentUser = SecurityUtils.getSubject();
            if(!currentUser.isAuthenticated()){
                //把用户名和密码封装为UsernamePasswordToken对象
                UsernamePasswordToken token = new UsernamePasswordToken(username,password);
                token.setRememberMe(true);
                try {
                    //执行登录
                    currentUser.login(token);
                }catch (AuthenticationException ae){
                    System.out.println("登录失败" + ae.getMessage());
                }
            }
            return "redirect:/list.jsp";
        }
    }

十二、在src/main/java/com/zh/shiro包下新建包realms,在realms包下新建ShiroRealm,SecondRealm

ShiroRealm

package com.zh.shiro.realms;
    
    import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.crypto.hash.SimpleHash;
    import org.apache.shiro.realm.AuthenticatingRealm;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.realm.Realm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.apache.shiro.util.ByteSource;
    
    import java.util.HashSet;
    import java.util.Set;
    
    /**
     *验证
     * @author huan
     * @date 2018/1/22
     */
    public class ShiroRealm extends AuthorizingRealm {
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
            System.out.println("FirstReaml");
            System.out.println("doGetAuthenticationInfo:" + authenticationToken);
            //1.  把AuthenticationToken 转换为 UsernamePasswordToken
            UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
            //2.  从UsernamePasswordToken 中来获取username
    
            String username = usernamePasswordToken.getUsername();
            //3.  调用数据库的方法,从数据库中查询username 对应的用户记录
            System.out.println("从数据库中获取username:" + username + "所对应的用户信息");
    
            //4.  若用户不存在.则可以抛出UnknownAccountException异常
            if ("unknown".equals(username)) {
                throw new UnknownAccountException("用户不存在!");
            }
            //5.  根据用户信息的情况,决定是否需要抛出其他的AuthenticationException异常
            if ("monster".equals(username)) {
                throw new LockedAccountException("用户被锁定");
            }
            //6.  根据用户的情况,来构建AuthenticationToken对象并返回
    //        1):principal 认证的实体信息,可以是username,也可以是数据表对应的用户的实体类对象
            Object principal = username;
    //        2)credentials 密码
            Object credentials = null;
            if("admin".equals(username)){
                credentials="038bdaf98f2037b31f1e75b5b4c9b26e";
            }else if("user".equals(username)){
                credentials="098d2c478e9c11555ce2823231e02ec1";
            }
    //        3) realmName 当前realm对象的name,调用父类的getName()方法即可
            String realmName = getName();
            //        4) 盐值
            ByteSource credentialsSalt = ByteSource.Util.bytes(username);
            SimpleAuthenticationInfo info =null;    // new SimpleAuthenticationInfo(principal,credentials,realmName);
            info = new SimpleAuthenticationInfo(principal,credentials,credentialsSalt,realmName);
            return info;
        }
    
        public static void main(String[] args) {
            String hashAlgorithmName = "MD5";
            Object credentials = "123456";
            Object salt =ByteSource.Util.bytes("user");
            int hashIterations = 1024;
            Object result = new SimpleHash(hashAlgorithmName,credentials,salt,hashIterations);
            System.out.println(result);
        }
    
        //授权
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
            System.out.println("doGetAuthorizationInfo.......");
            //1. 从PrincipalCollection中来获取登录用户的信息
            Object principal = principalCollection.getPrimaryPrincipal();
    
            //2. 利用登录的用户的信息来用户当前用户的角色或权限
            Set<String> roles = new HashSet<>();
            roles.add("user");
            if("admin".equals(principal)){
                roles.add("admin");
            }
    
            //3. 创建SimpleAuthorizationInfo 并设置其reles属性
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roles);
    
            //4. 返回SimpleAuthorizationInfo对象
    
            return info;
        }
    }

SecondRealm

package com.zh.shiro.realms;
    
    import org.apache.shiro.authc.*;
    import org.apache.shiro.crypto.hash.SimpleHash;
    import org.apache.shiro.realm.AuthenticatingRealm;
    import org.apache.shiro.util.ByteSource;
    
    /**
     *第二个验证
     * @author huan
     * @date 2018/1/22
     */
    public class SecondRealm extends AuthenticatingRealm {
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
            System.out.println("SecondReaml");
            System.out.println("doGetAuthenticationInfo:" + authenticationToken);
            //1.  把AuthenticationToken 转换为 UsernamePasswordToken
            UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
            //2.  从UsernamePasswordToken 中来获取username
    
            String username = usernamePasswordToken.getUsername();
            //3.  调用数据库的方法,从数据库中查询username 对应的用户记录
            System.out.println("从数据库中获取username:" + username + "所对应的用户信息");
    
            //4.  若用户不存在.则可以抛出UnknownAccountException异常
            if ("unknown".equals(username)) {
                throw new UnknownAccountException("用户不存在!");
            }
            //5.  根据用户信息的情况,决定是否需要抛出其他的AuthenticationException异常
            if ("monster".equals(username)) {
                throw new LockedAccountException("用户被锁定");
            }
            //6.  根据用户的情况,来构建AuthenticationToken对象并返回
    //        1):principal 认证的实体信息,可以是username,也可以是数据表对应的用户的实体类对象
            Object principal = username;
    //        2)credentials 密码
            Object credentials = null;
            if("admin".equals(username)){
                credentials="ce2f6417c7e1d32c1d81a797ee0b499f87c5de06";
            }else if("user".equals(username)){
                credentials="073d4c3ae812935f23cb3f2a71943f49e082a718";
            }
    //        3) realmName 当前realm对象的name,调用父类的getName()方法即可
            String realmName = getName();
            //        4) 盐值
            ByteSource credentialsSalt = ByteSource.Util.bytes(username);
            SimpleAuthenticationInfo info =null;    // new SimpleAuthenticationInfo(principal,credentials,realmName);
            info = new SimpleAuthenticationInfo("secondRealmName",credentials,credentialsSalt,realmName);
            return info;
        }
    
        public static void main(String[] args) {
            String hashAlgorithmName = "SHA1";
            Object credentials = "123456";
            Object salt =ByteSource.Util.bytes("admin");
            int hashIterations = 1024;
            Object result = new SimpleHash(hashAlgorithmName,credentials,salt,hashIterations);
            System.out.println(result);
        }
    }

十三、整个权限管理的流程

上篇博客介绍了Shiro的架构,从应用程序来看,程序运行事,先会拿到认证策略,所有与应用交互的都称为Subject,Subject只是一个门面,我们能够拿到主体的信息(如用户名,密码等),Subject的后续操作会交给SecurityManager去进行.SecurityManager会根据配置的realms执行认证,拿到安全数据realm,然后会执行assertCredentialsMatch方法比对用户是否认证通过,认证通过后可执行登录,登录进去之后访问有资源权限认证的资源时要去授权,有权限的才可以访问,否则无权访问。  
![SouthEast][]

十四、jsp

该程序还有几个jsp页面,我会将这个简单的demo上传到码云上,读者若有需要可以自行下载。

十五、总结

Shiro非常方便的为我们实现了权限的认证和授权,所谓实践出真知,多调试一下代码就明白了他的流程逻辑。码云地址:https://gitee.com/ZhangHuan8/ShiroRenZhengJiShouQuandemo

[http_www.captainbed.net_zhanghan]: http://www.captainbed.net/zhanghan
[maven]: https://mvnrepository.com/
[SouthEast]: /images/20220601/5cf0c3439f6c40258518512cc09fb2ff.png