《一头扎进Shiro》第05讲

素颜马尾好姑娘i 2022-06-02 03:18 177阅读 0赞

内容：  
shiro集成web  
（1）简单跳转的讨论  
（2）用户身份角色验证  
（3）用户身份权限验证

--------------------

步骤1 基础配置

pom.xml配置

<dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>2.5</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.servlet.jsp</groupId>
            <artifactId>jsp-api</artifactId>
            <version>2.2</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jstl</artifactId>
            <version>1.2</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.2</version>
        </dependency>   
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.4.0</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>1.7.25</version>
        </dependency>
    
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>1.4.0</version>
        </dependency>

web.xml配置

<listener>
            <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
        </listener>
        <filter>
            <filter-name>ShiroFilter</filter-name>
            <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
        </filter>
    
        <filter-mapping>
            <filter-name>ShiroFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    <servlet>
            <servlet-name>loginServlet</servlet-name>
            <servlet-class>com.java1234.login.LoginServlet</servlet-class>
        </servlet>
    
        <servlet-mapping>
            <servlet-name>loginServlet</servlet-name>
            <url-pattern>/login</url-pattern>
        </servlet-mapping>

shiro.ini配置文件

[main]
    authc.loginUrl=/login
    roles.unauthorizedUrl=/unauthorized.jsp
    perms.unauthorizedUrl=/unauthorized.jsp
    [users]
    java1234=123456,admin
    jack=123,teacher
    marry=234
    json=345
    [roles]
    admin=user:*
    teacher=student:*
    [urls]
    /login=anon
    /admin=authc
    /student=roles[teacher]
    /teacher=perms["user:create"]

LoginServlet .java

package com.java1234.login;
    
    import java.io.IOException;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.UnknownAccountException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    
    public class LoginServlet extends HttpServlet{
    
        //doGet 请求时展示登录页面
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            System.out.println("login doGet()方法执行了");
            req.getRequestDispatcher("login.jsp").forward(req, resp);
    
        }
        //doPost 时进行登录，登录时收集 username/password 参数，然后提交给 Subject 进行登录。
        //如果有错误再返回到登录页面；否则跳转到登录成功页面
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            System.out.println("login dopost");
            String userName=req.getParameter("username");
            String password=req.getParameter("password");
            Subject subject=SecurityUtils.getSubject();
            UsernamePasswordToken token=new UsernamePasswordToken(userName, password);
            try{
                subject.login(token); 
                resp.sendRedirect("success.jsp");
            }catch(Exception e){
                e.printStackTrace();
                req.setAttribute("errorInfo", "用户名或者密码错误");
                req.getRequestDispatcher("login.jsp").forward(req, resp);
            }
        }
    }

AdminServlet.java

package com.java1234.login;
    
    import java.io.IOException;
    
    import javax.servlet.ServletException;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    public class AdminServlet extends HttpServlet{ 
    
        //doGet 请求时展示登录页面
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            System.out.println("admin do get");
    
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            System.out.println("admin do post");
        }
    }

success.jsp

unauthorized.jsp

<body>
            身份验证未通过或者权限不足。
      </body>

--------------------

测试项目  
（1）测试链接跳转  
打开浏览器在地址栏里面输入：  
[http://127.0.0.1:8080/shiro06/admin][http_127.0.0.1_8080_shiro06_admin]，会自动跳转到登录界面  
![这里写图片描述][SouthEast]

authc.loginUrl=/login 默认是/login.jsp;  
anon拦截器表示匿名访问（即不需要登录即可访问）；  
authc 拦截器表示需要身份认证通过后才能访问；  
也就是说如果设置成authc 那么就要登录才能访问，否则直接跳转到默认页面（登录页面）。

--------------------

（2） 测试 角色和权限

首先用java1234=123456,admin登录  
然后打开浏览器在地址栏里面输入：  
[http://127.0.0.1:8080/shiro06/student][http_127.0.0.1_8080_shiro06_student]，会跳转到unauthorized.jsp界面 显示角色或者权限不足，

![这里写图片描述][SouthEast 1]

原因在于java1234用户的没有/student=roles\[teacher\] url所指定的角色，所以登陆之后想要跳转到/student链接，权限不足。  
然而Jack用户就可以跳转到该链接。

同理 拥有user的create权限的用户登陆以后就可以跳转到/teacher链接 比如admin。

[http_127.0.0.1_8080_shiro06_admin]: http://127.0.0.1:8080/shiro06/admin
[SouthEast]: /images/20220602/37c5e2dbff254534894015157d6148b8.png
[http_127.0.0.1_8080_shiro06_student]: http://127.0.0.1:8080/shiro06/student
[SouthEast 1]: /images/20220602/8f4dccebf3544d80aea0ed960b84289d.png