Shiro简单使用

╰+哭是因爲堅強的太久メ 2022-09-24 10:23 142阅读 0赞

## Shiro使用 ##

### 添加JAR包 ###

<dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-core</artifactId>
                <version>${shiro.version}</version>
            </dependency>
    
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-web</artifactId>
                <version>${shiro.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>${shiro.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-aspectj</artifactId>
                <version>${shiro.version}</version>
            </dependency>

### application-shiro.xml ###

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:jdbc="http://www.springframework.org/schema/jdbc" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd" default-autowire="byName">
        <description>此文件用于shiro的整体配置</description>
    
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            <property name="realms">
                <list>
                    <bean id="geekRealm" class="com.geeku.common.shiro.GeekRealm" />
                </list>
            </property>
              
            <property name="cacheManager" ref="cacheManager"/> 
        </bean>
    
        
        <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
    
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager" />
            <property name="loginUrl" value="/index" />
            
            <property name="unauthorizedUrl" value="/code_403.jsp" />
            
            <property name="filterChainDefinitions">
                <value>
                    
                    
                    
                    
                    
                    
                    
                    
    
                    
                    /admin/** =roles[admin]
    
                    
                    /training/teach/** =roles[teacher]
                    /weike/teach/** =roles[teacher]
                    /exhibition/teachEx/** =roles[teacher]
    
                    
                    /training/student/** =roles[student]
                    /weike/student/** =roles[student]
                    /exhibition/studentEx/** =roles[student]
    
                    
                    /index=anon
                    /user/**=anon
                    /admin/**=authc
                    /training/**=authc
                    /weike/**=authc
                    /exhibition/**=authc            
                </value>
            </property>
        </bean>
    
        
        <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
            <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />
            <property name="arguments" ref="securityManager" />
        </bean>
    
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
        
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
        </bean>
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager" />
        </bean>
    </beans>

在Spring核心的application里面引入该配置文件或者web.xml配置classpath:application\*.xml引入进去

### 核心认证 ###

package com.geeku.common.shiro;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.beans.factory.annotation.Qualifier;
    
    import com.geeku.model.User;
    import com.geeku.service.common.UserService;
    
    /** * 身份认证服务类 * 此类是权限域的基本实现,继承自shiro安全框架的AuthorizingRealm. 它是整个权限控制的生命周期. 执行动作如下： * 1.获取当前用户的名称或状态()-subject. * 2.通过用户名称与状态拿取角色相关的权限集. * 3.根据用户相关权限对用户的身份验证、授权、会话、访问控制进行管理. * 4.整个域的生命周期最后交付给SecurityManager来管理(SecurityManager 相当于 SpringMVC中的DispqtcherServlet.) * */
    public class GeekRealm extends AuthorizingRealm {
        private static final Logger logger = LoggerFactory.getLogger(GeekRealm.class);
    
        @Autowired(required = true)
        @Qualifier("userService")
        private UserService userService;
    
        //授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(
                PrincipalCollection principalCollection) {
            String account = (String) principalCollection.fromRealm(getName()).iterator().next(); //获取登录时输入的用户名 
            User user = userService.findUserByAccount(account);
            if(user != null){
                SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); //权限信息对象,用来存放用户的所有"角色"及"权限"
                String category = user.getCategory();//用户类别，0-管理员;1-学生；2-老师
                if(category != null){
                    if("0".equals(category.trim())){
                        info.addRole("admin");//角色信息 
                    }else if("1".equals(category.trim())){
                        info.addRole("student");
                    }else if("2".equals(category.trim())){
                        info.addRole("teacher");
                    }
                }
                //info.addStringPermission(role.getPermissions()); //基于Permission的权限信息 
                return info;
            }
    
            return null;
        }
    
        //认证回调函数,登录时调用.
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(
                AuthenticationToken token) throws AuthenticationException {
            SimpleAuthenticationInfo authenticationInfo = null;
    
            UsernamePasswordToken upToken = (UsernamePasswordToken) token;
            String userName = upToken.getUsername();
            String userPwd = new String(upToken.getPassword());
            User user = userService.findLoginUser(userName, userPwd);
            if(user != null){
                authenticationInfo = new SimpleAuthenticationInfo(user.getAccount(),user.getPassword(),getName());
            }else{
                logger.error(userName + "……登录认证失败……！");
            }
    
            return authenticationInfo;
        }
    
    }