Apache shiro 笔记整理之web整合一

桃扇骨 2022-08-20 10:29 210阅读 0赞

以下内容是在看了涛哥的《跟我一起学shiro》 和 视频《一头扎入进shiro》 后整理出来备忘和方便自己和其他人学习。

个人主页：[http://www.itit123.cn/][http_www.itit123.cn] 更多干货等你来拿

第一步：创建maven版web项目：[http://blog.csdn.net/qq\_19558705/article/details/49887717][http_blog.csdn.net_qq_19558705_article_details_49887717]

创建好后需要： 右击项目 ----> build path ----> config build path ----> add library ----> server runtime ----> 选择合适的即可 避免出现 “The superclass "javax.servlet.http.HttpServlet" was not found on the Java Build Path” 错误

第二步：导入相关的jar

<dependency>
    			<groupId>log4j</groupId>
    			<artifactId>log4j</artifactId>
    			<version>1.2.17</version>
    		</dependency>
    
    
    		<dependency>
    			<groupId>commons-logging</groupId>
    			<artifactId>commons-logging</artifactId>
    			<version>1.2</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-core</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-web</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.slf4j</groupId>
    			<artifactId>slf4j-api</artifactId>
    			<version>1.7.12</version>
    		</dependency>

第三步：配置web.xml文件（该配置方法是加载shiro.ini方法，实际开发中不是这样，可以看官网文档）

<listener>
    		<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
    	</listener>
    	
    	
    	<filter>
    		<filter-name>ShiroFilter</filter-name>
    		<filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
    	</filter>
    	<filter-mapping>
    		<filter-name>ShiroFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>

第四步：身份验证

shiro.ini文件：

[main]
    #用户登入路径
    authc.loginUrl=/login
    [users]
    ITDragon=123456,admin
    [urls]
    #该路径为匿名登入
    /login=anon
    #身份验证后才能登入
    /admin=authc

<%@ page language="java" contentType="text/html; charset=utf-8"
    	pageEncoding="utf-8"%>
    <!DOCTYPE html>
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
    <title>登录页面</title>
    </head>
    <body>
    	<form action="login" method="post">
    		userName:<input type="text" name="userName" /><br /> 
    		password:<input type="password" name="password" /><br /> 
    		<input type="submit" value="Submit" />
    	</form>
    </body>
    </html>

LoginServlet：

package com.shiro.servlet;
    import java.io.IOException;
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    
    @WebServlet("/login")
    public class LoginServlet extends HttpServlet {
    
    	private static final long serialVersionUID = 1L;
    
    	protected void doGet(HttpServletRequest request,
    			HttpServletResponse response) throws ServletException, IOException {
    		System.out.println("login doGet ... ");
    		request.getRequestDispatcher("login.jsp").forward(request, response);
    	}
    
    	protected void doPost(HttpServletRequest request,
    			HttpServletResponse response) throws ServletException, IOException {
    		System.out.println("login doPost ... ");
    		String userName = request.getParameter("userName");
    		String password = request.getParameter("password");
    		Subject subject = SecurityUtils.getSubject();
    		UsernamePasswordToken token = new UsernamePasswordToken(userName,password);
    		try {
    			subject.login(token);
    			response.sendRedirect("success.jsp");
    		} catch (Exception e) {
    			e.printStackTrace();
    			request.setAttribute("errorInfo", "用户名或者密码错误");
    			request.getRequestDispatcher("login.jsp").forward(request, response);
    		}
    	}
    
    }

通过浏览器访问发现：未登入的访问/admin会跳转到登入页面，若登入后在访问即可进入成功页面，说明身份验证成功。

第五步：权限认证

shiro文件：

[main]
    #用户登入路径
    authc.loginUrl=/login
    #角色验证
    roles.unauthorizedUrl=/unauthorized.jsp
    #权限验证
    perms.unauthorizedUrl=/unauthorized.jsp
    [users]
    ITDragon=123456,admin
    teacher1=123456,teacher
    student1=123456
    [roles]
    admin=user:*
    teacher=student:*
    [urls]
    #该路径为匿名登入
    /login=anon
    #身份验证后才能登入
    /admin=authc
    #该路径验证是否拥有teacher角色
    /student=roles[teacher]
    #该路径验证该角色是否拥有权限
    /teacher=perms["admin:delete"]

unauthorized.jsp：

在浏览器中访问/student，会先跳到登入页面进行身份验证，然后在判断该用户是否拥护teacher角色权限

在浏览器中访问/teacher，判断用户是否拥有该权限。因为没有准备对应的servlet，所以正确情况会显示404，若没有权限则会跳到 unauthorized.jsp 页面。

这样就完成了web中shiro的HelloWorld，之后会详细记录笔记。

源码下载路径：[http://download.csdn.net/detail/qq\_19558705/9449892][http_download.csdn.net_detail_qq_19558705_9449892]

[http_www.itit123.cn]: http://www.itit123.cn/
[http_blog.csdn.net_qq_19558705_article_details_49887717]: http://blog.csdn.net/qq_19558705/article/details/49887717
[http_download.csdn.net_detail_qq_19558705_9449892]: http://download.csdn.net/detail/qq_19558705/9449892