【Shiro】第四章 Web项目集成Shiro

Myth丶恋晨 2024-03-16 21:54 69阅读 0赞

**目录**

1、Web集成原理分析

【1】web集成的配置

【1.1】新建项目

【1.2】pom.xml配置

【1.3】web.xml配置

【2】SecurityManager对象创建

2、Shiro默认过滤器

【1】认证相关

【2】授权相关

3、Web集成完整案例

【1】编写pom.xml

【2】编写shiro.ini文件

【3】编写LoginService

【4】编写SecurityServiceImpl

【5】添加web层内容

【5.1】LoginServlet

【5.2】HomeServlet

【5.3】OrderAddServlet

【5.4】OrderListServlet

【5.5】LogoutServlet

【7】测试

【7.1】启动

【7.3】角色过滤

【7.4】资源过滤

4、web项目授权

【1】基于代码

【1.1】登录相关

【1.2】角色相关

【1.3】资源相关

【1.4】案例

【1.4.1】创建项目

【1.4.2】修改shiro.ini

【1.4.3】登录相关

【1.4.4】角色相关

【1.4.5】资源相关

【2】基于Jsp标签

【2.1】使用方式

【2.2】相关标签

【2.3】案例

【2.3.1】新建项目

【2.3.2】修改home.jsp

#### 1、Web集成原理分析 ####

##### 【1】web集成的配置 #####

还记得吗，以前我们在没有与WEB环境进行集成的时候，为了生成SecurityManager对象，是通过手动读取配置文件生成工厂对象，再通过工厂对象获取到SecurityManager的。就像下面代码展示的那样

/**
       * @Description 登录方法
       */
    private Subject shiroLogin(String loginName,String password) {
        //导入权限ini文件构建权限工厂
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //工厂构建安全管理器
        SecurityManager securityManager = factory.getInstance();
        //使用SecurityUtils工具生效安全管理器
        SecurityUtils.setSecurityManager(securityManager);
        //使用SecurityUtils工具获得主体
        Subject subject = SecurityUtils.getSubject();
        //构建账号token
        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(loginName, password);
        //登录操作
        subject.login(usernamePasswordToken);
        return subject;
    }

不过，现在我们既然说要与WEB集成，那么首先要做的事情就是把我们的shiro.ini这个配置文件交付到WEB环境中，定义shiro.ini文件如下

#声明自定义的realm，且为安全管理器指定realms
    [main]
    definitionRealm=com.itheima.shiro.realm.DefinitionRealm
    securityManager.realms=$definitionRealm

###### 【1.1】新建项目 ######

新建web项目shiro-day01-07web,其中realm、service、resources内容从shiro-day01-06authentication-realm中拷贝即可

![137714b331274fb9912a39a59a5da734.png][]

###### 【1.2】pom.xml配置 ######

<?xml version="1.0" encoding="UTF-8"?>
    
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
      <modelVersion>4.0.0</modelVersion>
    
      <groupId>com.itheima.shiro</groupId>
      <artifactId>shiro-day01-07web</artifactId>
      <version>1.0-SNAPSHOT</version>
      <packaging>war</packaging>
    
      <name>shiro-day01-07web Maven Webapp</name>
      
      <url>http://www.example.com</url>
    
      <dependencies>
    
        <dependency>
          <groupId>commons-logging</groupId>
          <artifactId>commons-logging</artifactId>
          <version>1.1.3</version>
        </dependency>
    
        <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-core</artifactId>
          <version>1.3.2</version>
        </dependency>
    
        <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-web</artifactId>
          <version>1.3.2</version>
        </dependency>
    
        <dependency>
          <groupId>junit</groupId>
          <artifactId>junit</artifactId>
          <version>4.11</version>
        </dependency>
    
      </dependencies>
    
      <build>
        <plugins>
          
          <plugin>
            <groupId>org.apache.tomcat.maven</groupId>
            <artifactId>tomcat7-maven-plugin</artifactId>
            <version>2.2</version>
            <configuration>
              <uriEncoding>utf-8</uriEncoding>
              <port>8080</port>
              <path>/platform</path>
            </configuration>
          </plugin>
    
          
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.1</version>
            <configuration>
              <source>8</source>
              <target>8</target>
              <showWarnings>true</showWarnings>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </project>

###### 【1.3】web.xml配置 ######

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xmlns="http://java.sun.com/xml/ns/javaee"
             xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
             version="3.0">
      <display-name>shiro-day01-07web</display-name>
    
      
      <context-param>
        <param-name>shiroEnvironmentClass</param-name>
        <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value>
      </context-param>
    
      
      <context-param>
        <param-name>shiroConfigLocations</param-name>
        <param-value>classpath:shiro.ini</param-value>
      </context-param>
    
      
      <listener>
        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
      </listener>
    
      
      <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
      </filter>
      <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        
        <url-pattern>/*</url-pattern>
      </filter-mapping>
    
    </web-app>

##### 【2】SecurityManager对象创建 #####

上面我们集成shiro到web项目了，下面我们来追踪下源码，看下SecurityManager对象是如何创建的

（1）我启动了服务器，监听器捕获到了服务器启动事件。我现在所处的位置EnvironmentLoaderListener监听器的入口处

![1883268c625745e281d4f11990d39707.png][]

（2）进入方法内查看，它先根据我们的shiroEnvironmentClass变量的值org.apache.shiro.web.env.IniWebEnvironment，初始化一个shiro环境对象

![73071c80a5e3418882f814a85d97eb28.png][]

（3）最后在创建一个SecurityManager对象，再将其绑定到刚才通过字节码创建的Shiro环境对象中![db089c7ee7474d83add46477343f77df.png][]

![87d5a0f5926641f9b682225a8998a5f4.png][] ![a7f744f7294f47a484981df1c0a5abcd.png][]

到这来SecurityManager就完成了初始化

#### 2、Shiro默认过滤器 ####

Shiro内置了很多默认的过滤器，比如身份验证、授权等相关的。默认过滤器可以参考org.apache.shiro.web.filter.mgt.DefaultFilter中的枚举过滤器

![15056d054c944aa384e21f1932706d44.png][]

##### 【1】认证相关 #####

<table> 
 <thead> 
  <tr> 
   <th>过滤器</th> 
   <th>过滤器类</th> 
   <th>说明</th> 
   <th>默认</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>authc</td> 
   <td>FormAuthenticationFilter</td> 
   <td>基于表单的过滤器；如“/**=authc”，如果没有登录会跳到相应的登录页面登录</td> 
   <td>无</td> 
  </tr> 
  <tr> 
   <td>logout</td> 
   <td>LogoutFilter</td> 
   <td>退出过滤器，主要属性：redirectUrl：退出成功后重定向的地址，如“/logout=logout”</td> 
   <td>/</td> 
  </tr> 
  <tr> 
   <td>anon</td> 
   <td>AnonymousFilter</td> 
   <td>匿名过滤器，即不需要登录即可访问；一般用于静态资源过滤；示例“/static/**=anon”</td> 
   <td>无</td> 
  </tr> 
 </tbody> 
</table>

##### 【2】授权相关 #####

<table> 
 <thead> 
  <tr> 
   <th>过滤器</th> 
   <th>过滤器类</th> 
   <th>说明</th> 
   <th>默认</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>roles</td> 
   <td>RolesAuthorizationFilter</td> 
   <td>角色授权拦截器，验证用户是否拥有所有角色；主要属性： loginUrl：登录页面地址（/login.jsp）；unauthorizedUrl：未授权后重定向的地址；示例“/admin/**=roles[admin]”</td> 
   <td>无</td> 
  </tr> 
  <tr> 
   <td>perms</td> 
   <td>PermissionsAuthorizationFilter</td> 
   <td>权限授权拦截器，验证用户是否拥有所有权限；属性和roles一样；示例“/user/**=perms["user:create"]”</td> 
   <td>无</td> 
  </tr> 
  <tr> 
   <td>port</td> 
   <td>PortFilter</td> 
   <td>端口拦截器，主要属性：port（80）：可以通过的端口；示例“/test= port[80]”，如果用户访问该页面是非80，将自动将请求端口改为80并重定向到该80端口，其他路径/参数等都一样</td> 
   <td>无</td> 
  </tr> 
  <tr> 
   <td>rest</td> 
   <td>HttpMethodPermissionFilter</td> 
   <td>rest风格拦截器，自动根据请求方法构建权限字符串（GET=read, POST=create,PUT=update,DELETE=delete,HEAD=read,TRACE=read,OPTIONS=read, MKCOL=create）构建权限字符串；示例“/users=rest[user]”，会自动拼出“user:read,user:create,user:update,user:delete”权限字符串进行权限匹配（所有都得匹配，isPermittedAll）</td> 
   <td>无</td> 
  </tr> 
  <tr> 
   <td>ssl</td> 
   <td>SslFilter</td> 
   <td>SSL拦截器，只有请求协议是https才能通过；否则自动跳转会https端口（443）；其他和port拦截器一样；</td> 
   <td>无</td> 
  </tr> 
 </tbody> 
</table>

#### 3、Web集成完整案例 ####

基于shiro-day01-07web继续集成

##### 【1】编写pom.xml #####

<?xml version="1.0" encoding="UTF-8"?>
    
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
      <modelVersion>4.0.0</modelVersion>
    
      <groupId>com.itheima.shiro</groupId>
      <artifactId>shiro-day01-07web</artifactId>
      <version>1.0-SNAPSHOT</version>
      <packaging>war</packaging>
    
      <name>shiro-day01-07web Maven Webapp</name>
      
      <url>http://www.example.com</url>
    
      <dependencies>
    
        <dependency>
          <groupId>commons-logging</groupId>
          <artifactId>commons-logging</artifactId>
          <version>1.1.3</version>
        </dependency>
    
        <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-core</artifactId>
          <version>1.3.2</version>
        </dependency>
    
        <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-web</artifactId>
          <version>1.3.2</version>
        </dependency>
    
        <dependency>
          <groupId>junit</groupId>
          <artifactId>junit</artifactId>
          <version>4.11</version>
        </dependency>
    
        <dependency>
          <groupId>javax.servlet</groupId>
          <artifactId>javax.servlet-api</artifactId>
          <version>3.0.1</version>
          <scope>provided</scope>
        </dependency>
        <dependency>
          <groupId>jstl</groupId>
          <artifactId>jstl</artifactId>
          <version>1.2</version>
        </dependency>
        <dependency>
          <groupId>taglibs</groupId>
          <artifactId>standard</artifactId>
          <version>1.1.2</version>
        </dependency>
    
      </dependencies>
    
      <build>
        <plugins>
          
          <plugin>
            <groupId>org.apache.tomcat.maven</groupId>
            <artifactId>tomcat7-maven-plugin</artifactId>
            <version>2.2</version>
            <configuration>
              <uriEncoding>utf-8</uriEncoding>
              <port>8080</port>
              <path>/platform</path>
            </configuration>
          </plugin>
    
          
          <plugin>
            <groupId>org.apache.maven.plugins</groupId>
            <artifactId>maven-compiler-plugin</artifactId>
            <version>3.1</version>
            <configuration>
              <source>8</source>
              <target>8</target>
              <showWarnings>true</showWarnings>
            </configuration>
          </plugin>
        </plugins>
      </build>
    </project>

##### 【2】编写shiro.ini文件 #####

#声明自定义的realm，且为安全管理器指定realms
    [main]
    definitionRealm=com.itheima.shiro.realm.DefinitionRealm
    securityManager.realms=$definitionRealm
    #用户退出后跳转指定JSP页面
    logout.redirectUrl=/login.jsp
    #若没有登录，则被authc过滤器重定向到login.jsp页面
    authc.loginUrl = /login.jsp
    [urls]
    /login=anon
    #发送/home请求需要先登录
    /home= authc
    #发送/order/list请求需要先登录
    /order-list = roles[admin]
    #提交代码需要order:add权限
    /order-add = perms["order:add"]
    #更新代码需要order:del权限
    /order-del = perms["order:del"]
    #发送退出请求则用退出过滤器
    /logout = logout

##### 【3】编写LoginService #####

package com.itheima.shiro.service;
    
    import org.apache.shiro.authc.UsernamePasswordToken;
    
    import java.lang.management.LockInfo;
    
    /**
     * @Description：登录服务
     */
    public interface LoginService {
    
        /**
         * @Description 登录方法
         * @param token 登录对象
         * @return
         */
        boolean login(UsernamePasswordToken token);
    
        /**
         * @Description 登出方法
         */
        void logout();
    }

package com.itheima.shiro.service.impl;
    
    import com.itheima.shiro.service.LoginService;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    
    
    /**
     * @Description：登录服务
     */
    public class LoginServiceImpl implements LoginService {
    
        @Override
        public boolean login(UsernamePasswordToken token) {
            Subject subject = SecurityUtils.getSubject();
            try {
                subject.login(token);
            }catch (Exception e){
                return false;
            }
            return subject.isAuthenticated();
        }
    
        @Override
        public void logout() {
            Subject subject = SecurityUtils.getSubject();
            subject.logout();
        }
    }

##### 【4】编写SecurityServiceImpl #####

package com.itheima.shiro.service.impl;
    
    import com.itheima.shiro.service.SecurityService;
    
    import java.util.ArrayList;
    import java.util.HashMap;
    import java.util.List;
    import java.util.Map;
    
    /**
     * @Description：权限服务层
     */
    public class SecurityServiceImpl implements SecurityService {
    
        @Override
        public Map<String,String> findPasswordByLoginName(String loginName) {
            return DigestsUtil.entryptPassword("123");
            return map;
        }
    
        @Override
        public List<String> findRoleByloginName(String loginName) {
            List<String> list = new ArrayList<>();
            if ("admin".equals(loginName)){
                list.add("admin");
            }
            list.add("dev");
            return list;
        }
    
        @Override
        public List<String>  findPermissionByloginName(String loginName) {
            List<String> list = new ArrayList<>();
            if ("jay".equals(loginName)){
                list.add("order:list");
                list.add("order:add");
                list.add("order:del");
            }
            return list;
        }
    }

##### 【5】添加web层内容 #####

###### 【5.1】LoginServlet ######

package com.itheima.shiro.web;
    
    import com.itheima.shiro.service.LoginService;
    import com.itheima.shiro.service.impl.LoginServiceImpl;
    import org.apache.shiro.authc.UsernamePasswordToken;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * @Description：登录方法
     */
    @WebServlet(urlPatterns = "/login")
    public class LoginServlet extends HttpServlet {
    
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            doPost(req, resp);
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            //获取输入的帐号密码
            String username = req.getParameter("loginName");
            String password = req.getParameter("password");
            //封装用户数据，成为Shiro能认识的token标识
            UsernamePasswordToken token = new UsernamePasswordToken(username, password);
            LoginService loginService = new LoginServiceImpl();
            //将封装用户信息的token进行验证
            boolean isLoginSuccess = loginService.login(token);
            if (!isLoginSuccess) {
                //重定向到未登录成功页面
                resp.sendRedirect("login.jsp");
                return;
            }
            req.getRequestDispatcher("/home").forward(req, resp);
        }
    
    }

###### 【5.2】HomeServlet ######

package com.itheima.shiro.web;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * @Description：系统home页面
     */
    @WebServlet(urlPatterns = "/home")
    public class HomeServlet extends HttpServlet {
    
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            doPost(req, resp);
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            req.getRequestDispatcher("home.jsp").forward(req, resp);
        }
    }

###### 【5.3】OrderAddServlet ######

###### 【5.4】OrderListServlet ######

###### 【5.5】LogoutServlet ######

【6】添加JSP

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>Title</title>
    </head>
    <body>
    <form method="post" action="${pageContext.request.contextPath}/login">
        <table>
            <tr>
                <th>登陆名称</th>
                <td><input type="text"  name="loginName"></td>
            </tr>
            <tr>
                <th>密码</th>
                <td><input type="password" name="password"></td>
            </tr>
            <tr>
                <td colspan="2">
                    <input type="submit" value="提交"/>
                </td>
            </tr>
        </table>
    
    </form>
    </body>
    </html>

home.jsp系统页

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
    <%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <title></title>
    </head>
    <body>
    <h6>
        <a href="${pageContext.request.contextPath}/logout">退出</a>
        <a href="${pageContext.request.contextPath}/order-list">列表</a>
        <a href="${pageContext.request.contextPath}/order-add">添加</a>
    </h6>
    </body>
    </html>

order-add.jsp订单添加（伪代码）

order-list.jsp订单列表

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <%--导入jstl标签库--%>
    <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
    <html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>用户列表jsp页面</title>
        <style>
            table {border:1px solid #000000}
            table th{border:1px solid #000000}
            table td{border:1px solid #000000}
        </style>
    
    </head>
    <body>
    <table cellpadding="0" cellspacing="0" width="80%">
        <tr>
            <th>编号</th>
            <th>公司名称</th>
            <th>信息来源</th>
            <th>所属行业</th>
            <th>级别</th>
            <th>联系地址</th>
            <th>联系电话</th>
        </tr>
        <tr>
            <td>1</td>
            <td>传智播客</td>
            <td>网络营销</td>
            <td>互联网</td>
            <td>普通客户</td>
            <td>津安创意园</td>
            <td>0208888887</td>
        </tr>
        <tr>
            <td>2</td>
            <td>黑马程序员</td>
            <td>j2ee</td>
            <td>互联网</td>
            <td>VIP客户</td>
            <td>津安创意园</td>
            <td>0208888887</td>
        </tr>
        <tr>
            <td>3</td>
            <td>黑马程序员</td>
            <td>大数据</td>
            <td>互联网</td>
            <td>VIP客户</td>
            <td>津安创意园</td>
            <td>0208888887</td>
        </tr>
    </table>
    </body>
    
    </html>

##### 【7】测试 #####

###### 【7.1】启动 ######

![f469037df8244993a460496fe3270ec9.png][]

![ead3cbefed1542c2a057e938ebfa5c61.png][]

![ee1d2f9b558a4adba346f0392016f640.png][] 点击apply然后点击OK

![4c572c354fe54963b7c7910e07ff8e53.png][]

【7.2】登录过滤

访问[http://localhost:8080/platform/home][http_localhost_8080_platform_home]的时候，会被

![3f8ed2b3694646faa40521928fc93d4c.png][]

![71456bec469c49c8af45a5ea13bfd430.png][]

###### 【7.3】角色过滤 ######

使用“admin”用户登录，密码：123

![613071e0575248f1bfdf8024f03503b9.png][]

根据SecurityServiceImpl我们可以知道使用admin账号

![130a336991174bb6b1bb1f8f10923844.png][]

登录成功之后：

![4d4c0a41248942cbb6e7247141e02e94.png][]

此时点击“列表”，因为当前admin用户是有admin角色

![5fd5ceca67fb4300b7de087f1c49662c.png][]

所有可以正常访问

![a2baaa38f2f74490888eb8c314b1f7ef.png][]

点击“添加”，因为当前admin用户是没有order:add的资源

![8dfd2f03b9c648d0b57182bc9c380ba9.png][]

所以回401

![216e87f4732942278dc7d38aa9a1c003.png][]

###### 【7.4】资源过滤 ######

点击“退出”

![97c8283d36fc47319e067670fbb3e923.png][]

使用“jay”用户登录，密码为123

![9d74dea3828d473881d818ed6424a501.png][]

点击“添加”

![97865d90ab3f4a4798312eca0935b244.png][]

因为SecurityServiceImpl中为jay用户添加如下的资源

![1e3a075c248748ddb98a0bd60858db77.png][]

点击“添加”之后正常访问

![ee47e16fc9fb4b6095e8af1596678a85.png][]

点击“列表”之后，因为“jay”用户满意“admin”角色，所以访问受限

![b5f5b976319c4f788f487071209417a0.png][]

#### 4、web项目授权 ####

前面我们学习了基于ini文件配置方式来完成授权，下面我们来看下其他2种方式的授权

##### 【1】基于代码 #####

###### 【1.1】登录相关 ######

<table> 
 <thead> 
  <tr> 
   <th>Subject 登录相关方法</th> 
   <th>描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>isAuthenticated()</td> 
   <td>返回true 表示已经登录，否则返回false。</td> 
  </tr> 
 </tbody> 
</table>

###### 【1.2】角色相关 ######

<table> 
 <thead> 
  <tr> 
   <th>Subject 角色相关方法</th> 
   <th>描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>hasRole(String roleName)</td> 
   <td>返回true 如果Subject 被分配了指定的角色，否则返回false。</td> 
  </tr> 
  <tr> 
   <td>hasRoles(List&lt;String&gt; roleNames)</td> 
   <td>返回true 如果Subject 被分配了所有指定的角色，否则返回false。</td> 
  </tr> 
  <tr> 
   <td>hasAllRoles(Collection&lt;String&gt;roleNames)</td> 
   <td>返回一个与方法参数中目录一致的hasRole 结果的集合。有性能的提高如果许多角色需要执行检查（例如，当自定义一个复杂的视图）。</td> 
  </tr> 
  <tr> 
   <td>checkRole(String roleName)</td> 
   <td>安静地返回，如果Subject 被分配了指定的角色，不然的话就抛出AuthorizationException。</td> 
  </tr> 
  <tr> 
   <td>checkRoles(Collection&lt;String&gt;roleNames)</td> 
   <td>安静地返回，如果Subject 被分配了所有的指定的角色，不然的话就抛出AuthorizationException。</td> 
  </tr> 
  <tr> 
   <td>checkRoles(String… roleNames)</td> 
   <td>与上面的checkRoles 方法的效果相同，但允许Java5 的var-args 类型的参数</td> 
  </tr> 
 </tbody> 
</table>

###### 【1.3】资源相关 ######

<table> 
 <thead> 
  <tr> 
   <th>Subject 资源相关方法</th> 
   <th>描述</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>isPermitted(Permission p)</td> 
   <td>返回true 如果该Subject 被允许执行某动作或访问被权限实例指定的资源，否则返回false</td> 
  </tr> 
  <tr> 
   <td>isPermitted(List&lt;Permission&gt; perms)</td> 
   <td>返回一个与方法参数中目录一致的isPermitted 结果的集合。</td> 
  </tr> 
  <tr> 
   <td>isPermittedAll(Collection&lt;Permission&gt;perms)</td> 
   <td>返回true 如果该Subject 被允许所有指定的权限，否则返回false有性能的提高如果需要执行许多检查（例如，当自定义一个复杂的视图）</td> 
  </tr> 
  <tr> 
   <td>isPermitted(String perm)</td> 
   <td>返回true 如果该Subject 被允许执行某动作或访问被字符串权限指定的资源，否则返回false。</td> 
  </tr> 
  <tr> 
   <td>isPermitted(String…perms)</td> 
   <td>返回一个与方法参数中目录一致的isPermitted 结果的数组。有性能的提高如果许多字符串权限检查需要被执行（例如，当自定义一个复杂的视图）。</td> 
  </tr> 
  <tr> 
   <td>isPermittedAll(String…perms)</td> 
   <td>返回true 如果该Subject 被允许所有指定的字符串权限，否则返回false。</td> 
  </tr> 
  <tr> 
   <td>checkPermission(Permission p)</td> 
   <td>安静地返回，如果Subject 被允许执行某动作或访问被特定的权限实例指定的资源，不然的话就抛出AuthorizationException 异常。</td> 
  </tr> 
  <tr> 
   <td>checkPermission(String perm)</td> 
   <td>安静地返回，如果Subject 被允许执行某动作或访问被特定的字符串权限指定的资源，不然的话就抛出AuthorizationException 异常。</td> 
  </tr> 
  <tr> 
   <td>checkPermissions(Collection&lt;Permission&gt; perms)</td> 
   <td>安静地返回，如果Subject 被允许所有的权限，不然的话就抛出AuthorizationException 异常。有性能的提高如果需要执行许多检查（例如，当自定义一个复杂的视图）</td> 
  </tr> 
  <tr> 
   <td>checkPermissions(String… perms)</td> 
   <td>和上面的checkPermissions 方法效果相同，但是使用的是基于字符串的权限。</td> 
  </tr> 
 </tbody> 
</table>

###### 【1.4】案例 ######

###### 【1.4.1】创建项目 ######

拷贝shiro-day01-07web新建shiro-day01-08web-java

![4c763b20488b4164b657eaba92e328b9.png][]

###### 【1.4.2】修改shiro.ini ######

#声明自定义的realm，且为安全管理器指定realms
    [main]
    definitionRealm=com.itheima.shiro.realm.DefinitionRealm
    securityManager.realms=$definitionRealm
    #用户退出后跳转指定JSP页面
    logout.redirectUrl=/login.jsp
    #若没有登录，则被authc过滤器重定向到login.jsp页面
    authc.loginUrl = /login.jsp
    [urls]
    /login=anon
    #发送/home请求需要先登录
    #/home= authc
    #发送/order/list请求需要先登录
    #/order-list = roles[admin]
    #提交代码需要order:add权限
    #/order-add = perms["order:add"]
    #更新代码需要order:del权限
    #/order-del = perms["order:del"]
    #发送退出请求则用退出过滤器
    /logout = logout

###### 【1.4.3】登录相关 ######

修改HomeServlet的doPost方法

package com.itheima.shiro.web;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.subject.Subject;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * @Description：系统home页面
     */
    @WebServlet(urlPatterns = "/home")
    public class HomeServlet extends HttpServlet {
    
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            doPost(req, resp);
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            //通过subjectd对象去判断是否登录
            Subject subject = SecurityUtils.getSubject();
            boolean flag  = subject.isAuthenticated();
            if (flag){
                resp.sendRedirect("home.jsp");
            }else {
                req.getRequestDispatcher("/login").forward(req, resp);
            }
        }
    }

访问[http://localhost:8080/platform/home][http_localhost_8080_platform_home] 进行debug

![eced905128104be092c6a6fb73aeae76.png][]

此时我们通过subject.isAuthenticated()判断是否登录，如果登录则重定向到home.jsp,如果没有登录则转发到/login对应的servlet

###### 【1.4.4】角色相关 ######

修改OrderListServlet的doPost方法，判断是否有admin角色，如果有则转发order-list.jsp,没有则转发/login

package com.itheima.shiro.web;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.subject.Subject;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * @Description：订单列表
     */
    @WebServlet(urlPatterns = "/order-list")
    public class OrderListServlet extends HttpServlet {
    
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            doPost(req, resp);
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            Subject subject = SecurityUtils.getSubject();
            //判断当前角色
            boolean flag = subject.hasRole("admin");
            if (flag){
                req.getRequestDispatcher("order-list.jsp").forward(req, resp);
            }else {
                req.getRequestDispatcher("/login").forward(req, resp);
            }
        }
    }

访问[http://localhost:8080/platform/order-list][http_localhost_8080_platform_order-list]

![9f6ef69e0ed74949b1dcfeb2247470e6.png][]

因为此时我未登录，也就是说当前没有admin角色，这是通过subject.hasRole("admin")返回未false

###### 【1.4.5】资源相关 ######

修改OrderAddServlet

package com.itheima.shiro.web;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.subject.Subject;
    
    import javax.servlet.ServletException;
    import javax.servlet.annotation.WebServlet;
    import javax.servlet.http.HttpServlet;
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.io.IOException;
    
    /**
     * @Description：添加页码
     */
    @WebServlet(urlPatterns = "/order-add")
    public class OrderAddServlet extends HttpServlet {
    
        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            doPost(req, resp);
        }
    
        @Override
        protected void doPost(HttpServletRequest req, HttpServletResponse resp)
                throws ServletException, IOException {
            Subject subject = SecurityUtils.getSubject();
            //判断是否有对应资源
            boolean flag = subject.isPermitted("order:add");
            if (flag){
                req.getRequestDispatcher("order-add.jsp").forward(req, resp);
            }else {
                req.getRequestDispatcher("/login").forward(req, resp);
            }
        }
    
    }

访问[http://localhost:8080/platform/order-add][http_localhost_8080_platform_order-add]

![8f01c9b840bd4c37adb3dfda7bd1bf93.png][]

因为此时我未登录，也就是说当前没有order:add资源，通过 subject.isPermitted("order:add")返回未false

##### 【2】基于Jsp标签 #####

###### 【2.1】使用方式 ######

Shiro提供了一套JSP标签库来实现页面级的授权控制， 在使用Shiro标签库前，首先需要在JSP引入shiro标签：

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>

###### 【2.2】相关标签 ######

<table> 
 <thead> 
  <tr> 
   <th>标签</th> 
   <th>说明</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>&lt; shiro:guest &gt;</td> 
   <td>验证当前用户是否为“访客”，即未认证（包含未记住）的用户</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:user &gt;</td> 
   <td>认证通过或已记住的用户</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:authenticated &gt;</td> 
   <td>已认证通过的用户。不包含已记住的用户，这是与user标签的区别所在</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:notAuthenticated &gt;</td> 
   <td>未认证通过用户。与guest标签的区别是，该标签包含已记住用户</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:principal /&gt;</td> 
   <td>输出当前用户信息，通常为登录帐号信息</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:hasRole name="角色"&gt;</td> 
   <td>验证当前用户是否属于该角色</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:lacksRole name="角色"&gt;</td> 
   <td>与hasRole标签逻辑相反，当用户不属于该角色时验证通过</td> 
  </tr> 
  <tr> 
   <td>&lt; shiro:hasAnyRoles name="a,b"&gt;</td> 
   <td>验证当前用户是否属于以下任意一个角色</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:hasPermission name=“资源”&gt;</td> 
   <td>验证当前用户是否拥有制定权限</td> 
  </tr> 
  <tr> 
   <td>&lt;shiro:lacksPermission name="资源"&gt;</td> 
   <td>与permission标签逻辑相反，当前用户没有制定权限时，验证通过</td> 
  </tr> 
 </tbody> 
</table>

###### 【2.3】案例 ######

###### 【2.3.1】新建项目 ######

拷贝shiro-day01-08web-java新建shiro-day01-09web-jsp-taglib项目

![81570a930338458e86bd4762c1bb9b4f.png][]

###### 【2.3.2】修改home.jsp ######

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
    <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
    <%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <title></title>
    </head>
    <body>
    <h6>
        <a href="${pageContext.request.contextPath}/logout">退出</a>
        <shiro:hasRole name="admin">
        <a href="${pageContext.request.contextPath}/order-list">列表</a>
        </shiro:hasRole>
        <shiro:hasPermission name="order:add">
        <a href="${pageContext.request.contextPath}/order-add">添加</a>
        </shiro:hasPermission>
    </h6>
    </body>
    </html>

【2.3.3】测试

访问[http://localhost:8080/platform/login][http_localhost_8080_platform_login]

使用admin/123登录

![a89f8e0a015f447ebe9ed1909858d791.png][]

这个时候我们只能看见“列表”，看不见“添加”，点击“退出”

使用jay/123登录

![4a47d86ef85b41aab97bf8ee393ccc1d.png][]

这个时候我们只能看见“添加”，看不见“列表”，点击“退出”

需要注意的是，这里只是页面是否显示内容，不能防止盗链的发生

[137714b331274fb9912a39a59a5da734.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/46d2f6d16f5f4369b714a1d5204966df.png
[1883268c625745e281d4f11990d39707.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/607dc17c822c4b57b6b9cbd55f889c70.png
[73071c80a5e3418882f814a85d97eb28.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/afb57e4250b14705b766c982898b56dd.png
[db089c7ee7474d83add46477343f77df.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/87927f5e0569497d89e973d868a689a8.png
[87d5a0f5926641f9b682225a8998a5f4.png]: https://img-blog.csdnimg.cn/87d5a0f5926641f9b682225a8998a5f4.png
[a7f744f7294f47a484981df1c0a5abcd.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/7eeb997bb2784c8b870a0df603309ceb.png
[15056d054c944aa384e21f1932706d44.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/64c2c0c028d649a0b5a5251c12500537.png
[f469037df8244993a460496fe3270ec9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/82d93ed21f4a4b0aa59c1d2b5dbc7144.png
[ead3cbefed1542c2a057e938ebfa5c61.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/2f74bbd2d5c845a1b65602b01ab36e4b.png
[ee1d2f9b558a4adba346f0392016f640.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/223752f607ac48a5917d2d3b72686140.png
[4c572c354fe54963b7c7910e07ff8e53.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/7fa318c9f54e49beb76640bd52cb206f.png
[http_localhost_8080_platform_home]: http://localhost:8080/platform/home
[3f8ed2b3694646faa40521928fc93d4c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/f26e473b91be425d975bf488c0469a77.png
[71456bec469c49c8af45a5ea13bfd430.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/8a4b413fd496424b85a20a2a3e41d3c1.png
[613071e0575248f1bfdf8024f03503b9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/d44997fdd5ad4922b13d4bd332689e1a.png
[130a336991174bb6b1bb1f8f10923844.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/074ce87031e94ab394051635c9d45506.png
[4d4c0a41248942cbb6e7247141e02e94.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/5689be1d693346e996bd2a542c0a8625.png
[5fd5ceca67fb4300b7de087f1c49662c.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/1ce0a9f5a50a4468ac1205d4f0d0163a.png
[a2baaa38f2f74490888eb8c314b1f7ef.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/f20e1bcce10445c79f54d5fe3f52c8af.png
[8dfd2f03b9c648d0b57182bc9c380ba9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/0bd8642a41aa429aad0a4aa188637783.png
[216e87f4732942278dc7d38aa9a1c003.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/44ea250b661f47dd904537ad5413b1de.png
[97c8283d36fc47319e067670fbb3e923.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/4c09099fe253441ca8bb9114ab59f60a.png
[9d74dea3828d473881d818ed6424a501.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/eacd72d4135d4cee82a5c240bf243d3f.png
[97865d90ab3f4a4798312eca0935b244.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/340dda8b7ad14b39bec88e4e9b16aad5.png
[1e3a075c248748ddb98a0bd60858db77.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/a6b954623f1446318cd7e6326e83fde0.png
[ee47e16fc9fb4b6095e8af1596678a85.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/7be20c8f515343fca5d504ea7290e7e1.png
[b5f5b976319c4f788f487071209417a0.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/057e5375eee6478294bd4d33771af9bc.png
[4c763b20488b4164b657eaba92e328b9.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/cda1e797e9634dd1a36a045b7a81e8a5.png
[eced905128104be092c6a6fb73aeae76.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/6bf0ef8ec9c042e083e94268526a4542.png
[http_localhost_8080_platform_order-list]: http://localhost:8080/platform/order-list
[9f6ef69e0ed74949b1dcfeb2247470e6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/6050245e027b4c2a814b8b08cca44e14.png
[http_localhost_8080_platform_order-add]: http://localhost:8080/platform/order-add
[8f01c9b840bd4c37adb3dfda7bd1bf93.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/7f55f8cdb3744c92a33c1e650c0a65cd.png
[81570a930338458e86bd4762c1bb9b4f.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/baad2dfe06a8405fa1622f3671592b50.png
[http_localhost_8080_platform_login]: http://localhost:8080/platform/login
[a89f8e0a015f447ebe9ed1909858d791.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/29d5ddd9d76c48a5bdaadae12ed6f5ee.png
[4a47d86ef85b41aab97bf8ee393ccc1d.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/00aa0f674f49401aa530ef9ec758e47f.png