shiro+spring相关配置
首先pom中添加所需jar包：
<!-- shiro start --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.2.3</version> </dependency> <!-- shiro end -->
一、在web.xml配制shiroFilter
<!-- 配置Shiro过滤器,先让Shiro过滤系统接收到的请求 --> <!-- 这里filter-name必须对应applicationContext.xml中定义的<bean id="shiroFilter"/> --> <!-- 使用[/*]匹配所有请求,保证所有的可控请求都经过Shiro的过滤 --> <!-- 通常会将此filter-mapping放置到最前面(即其他filter-mapping前面),以保证它是过滤器链中第一个起作用的 --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <init-param> <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 --> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
二、java代码编写
1.User.java
package isa.blog.bin.model; import java.io.Serializable; import java.util.Date; import javax.persistence.Column; import javax.persistence.Entity; import javax.persistence.GeneratedValue; import javax.persistence.Id; import javax.persistence.JoinColumn; import javax.persistence.ManyToOne; import org.hibernate.annotations.GenericGenerator; @Entity public class User implements Serializable { private static final long serialVersionUID = -5312120825533005238L; @Id @GeneratedValue(generator="system-uuid") @GenericGenerator(name="system-uuid",strategy="uuid") private String id; @Column(unique = true) private String userName; private String password; private Date createTime; private String email; @ManyToOne @JoinColumn private Role role; public String getEmail() { return email; } public void setEmail(String email) { this.email = email; } public String getId() { return id; } public void setId(String id) { this.id = id; } public String getUserName() { return userName; } public void setUserName(String userName) { this.userName = userName; } public String getPassword() { return password; } public void setPassword(String password) { this.password = password; } public Date getCreateTime() { return createTime; } public void setCreateTime(Date createTime) { this.createTime = createTime; } public Role getRole() { return role; } public void setRole(Role role) { this.role = role; } }
2.Role.java
package isa.blog.bin.model; import java.io.Serializable; import javax.persistence.Entity; import javax.persistence.GeneratedValue; import javax.persistence.Id; import org.hibernate.annotations.GenericGenerator; @Entity public class Role implements Serializable { private static final long serialVersionUID = -3431097890965814550L; @Id @GeneratedValue(generator="system-uuid") @GenericGenerator(name="system-uuid",strategy="uuid") private String id; private String roleName; public String getId() { return id; } public void setId(String id) { this.id = id; } public String getRoleName() { return roleName; } public void setRoleName(String roleName) { this.roleName = roleName; } }
3.Permission.java
package isa.blog.bin.model; import java.io.Serializable; import javax.persistence.Entity; import javax.persistence.GeneratedValue; import javax.persistence.Id; import javax.persistence.JoinColumn; import javax.persistence.ManyToOne; import org.hibernate.annotations.GenericGenerator; @Entity public class Permission implements Serializable { private static final long serialVersionUID = 7808624074545962407L; @Id @GeneratedValue(generator="system-uuid") @GenericGenerator(name="system-uuid",strategy="uuid") private String id; private String permissionName; @ManyToOne @JoinColumn private Role role; public String getId() { return id; } public void setId(String id) { this.id = id; } public String getPermissionName() { return permissionName; } public void setPermissionName(String permissionName) { this.permissionName = permissionName; } public Role getRole() { return role; } public void setRole(Role role) { this.role = role; } }
4.UserDao.java
package isa.blog.bin.dao; import org.springframework.data.jpa.repository.JpaRepository; import isa.blog.bin.model.User; public interface UserDao extends JpaRepository<User, String> { User findByUserNameAndPassword(String userName, String password); User findOneByUserName(String userName); }
5.PermissionDao.java
package isa.blog.bin.dao; import java.util.Set; import org.springframework.data.jpa.repository.JpaRepository; import isa.blog.bin.model.Permission; import isa.blog.bin.model.Role; public interface PermissionDao extends JpaRepository<Permission, String> { Set<Permission> findByRole(Role role); }
6.MyRealm.java
package isa.blog.bin.commons; import java.util.HashSet; import java.util.Set; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.SimpleAuthenticationInfo; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.transaction.annotation.Transactional; import isa.blog.bin.dao.PermissionDao; import isa.blog.bin.dao.UserDao; import isa.blog.bin.model.Permission; import isa.blog.bin.model.User; @Transactional public class MyRealm extends AuthorizingRealm{ @Autowired private UserDao userDao; @Autowired private PermissionDao permissionDao; /** * 为当前登录的用户授予角色和权限 */ @Override public AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { String userName = (String)principals.getPrimaryPrincipal(); SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(); try{ authorizationInfo.addRole(userDao.findOneByUserName(userName).getRole().getRoleName()); Set<Permission> permissions = permissionDao.findByRole(userDao.findOneByUserName(userName).getRole()); Set<String> strs = new HashSet<String>(); for (Permission permission : permissions) { strs.add(permission.getPermissionName()); } authorizationInfo.addStringPermissions(strs); }catch(Exception e){ e.printStackTrace(); } return authorizationInfo; } /** * 验证当前登录的用户 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { String userName = (String)token.getPrincipal(); User user = userDao.findOneByUserName(userName); if(user!=null){ AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(),"xx"); return authcInfo; }else{ return null; } } }
三、配置文件applicationContext-shiro.xml
注意web.xml引入形式为：
<context-param> <param-name>contextConfigLocation</param-name> <param-value>classpath*:/applicationContext*.xml</param-value> </context-param>
applicationContext-shiro.xml
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd"> <!-- 缓存管理器 --> <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/> <!-- 继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户登录的类为自定义的ShiroDbRealm.java --> <bean id="myRealm" class="isa.blog.bin.commons.MyRealm"/> <!-- 踢出用户 --> <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO" /> <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> <property name="sessionDAO" ref="sessionDAO" /> </bean> <!-- Shiro默认会使用Servlet容器的Session,可通过sessionMode属性来指定使用Shiro原生Session --> <!-- 即<property name="sessionMode" value="native"/>,详细说明见官方文档 --> <!-- 这里主要是设置自定义的单Realm应用,若有多个Realm,可使用'realms'属性代替 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="myRealm"/> <property name="sessionManager" ref="sessionManager" /> <!-- 使用下面配置的缓存管理器 --> <property name="cacheManager" ref="cacheManager"/> </bean> <!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 --> <!-- Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截,Shiro对基于Spring的Web应用提供了完美的支持 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <!-- Shiro的核心安全接口,这个属性是必须的 --> <property name="securityManager" ref="securityManager"/> <!-- 要求登录时的链接(可根据项目的URL进行替换),非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 --> <property name="loginUrl" value="/views/login.html"/> <!-- 登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) --> <!-- <property name="successUrl" value="/index.html"/> --> <!-- 用户访问未对其授权的资源时,所显示的连接 --> <!-- 若想更明显的测试此属性可以修改它的值,如unauthor.jsp,然后用[玄玉]登录后访问/admin/listUser.jsp就看见浏览器会显示unauthor.jsp --> <property name="unauthorizedUrl" value="/unauthorized.html"/> <!-- Shiro连接约束配置,即过滤链的定义 --> <!-- 此处可配合我的这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839 --> <!-- 下面value值的第一个'/'代表的路径是相对于HttpServletRequest.getContextPath()的值来的 --> <!-- anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 --> <!-- authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter --> <property name="filterChainDefinitions"> <value> /frame/user/login/** = anon /frame/user/register/** = anon /frame/kaptcha** = anon /css/** = anon /img/** = anon /js/** = anon /json/** = anon /Scripts/** = anon /views/login.html = anon /views/register.html = anon # /frame/essay = roles[member] # /views/addBlog.html = roles[admin] # /frame/deleteEssay/** = perms[删除博客] # /frame/deleteEssay/** = roles[admin] # 必须放在最后 /** = authc </value> </property> </bean> <!-- 保证实现了Shiro内部lifecycle函数的bean执行 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <!-- 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证 --> <!-- 配置以下两个bean即可实现此功能 --> <!-- Enable Shiro Annotations for Spring-configured beans. Only run after the lifecycleBeanProcessor has run --> <!-- 由于本例中并未使用Shiro注解,故注释掉这两个bean(个人觉得将权限通过注解的方式硬编码在程序中,查看起来不是很方便,没必要使用) --> <!-- <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager"/> </bean> --> </beans>
以下代码根据实际项目更改
UserController.java
package isa.blog.bin.controller; import java.awt.image.BufferedImage; import java.io.UnsupportedEncodingException; import java.net.URLDecoder; import java.util.HashMap; import java.util.Map; import javax.imageio.ImageIO; import javax.servlet.ServletOutputStream; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.web.bind.annotation.PathVariable; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RestController; import com.google.code.kaptcha.Constants; import com.google.code.kaptcha.Producer; import isa.blog.bin.commons.JsonUtil; import isa.blog.bin.commons.Result; import isa.blog.bin.dto.UserDto; import isa.blog.bin.service.UserService; @RestController @RequestMapping(value="/frame") public class UserController { @Autowired private UserService userService; @Autowired private Producer producer; private Map<String, String> map; @RequestMapping(value="/user/register/{kaptchaCode}", method=RequestMethod.POST, produces=JsonUtil.JSON) public Result register(@RequestBody UserDto userDto, @PathVariable String kaptchaCode) { return userService.register(userDto, map, kaptchaCode); } @RequestMapping(value="/user/oneUser/{userId}", method=RequestMethod.GET, produces=JsonUtil.JSON) public Result getOneUser(@PathVariable String userId) { return userService.getOneUser(userId); } @RequestMapping(value="/user/login/{userName}/{password}/{kaptchaCode}", method=RequestMethod.GET, produces=JsonUtil.JSON) public Result login(@PathVariable String userName, @PathVariable String password, @PathVariable String kaptchaCode) throws UnsupportedEncodingException { return userService.login(URLDecoder.decode(userName, "UTF-8"), password, map, kaptchaCode); } @RequestMapping(value="/user/logout", method=RequestMethod.GET, produces=JsonUtil.JSON) public void logout() { userService.logout(); } @RequestMapping(value="/user/userDetails_userName", method=RequestMethod.GET, produces=JsonUtil.JSON) public Result getOneUserName() { return userService.getOneUserName(); } @RequestMapping(value="/user/userDetails", method=RequestMethod.GET, produces=JsonUtil.JSON) public Result getOneUserDetails() { String userId = userService.currentUserId(); return userService.getOneUser(userId); } @RequestMapping(value="/user/updateUserDetails", method=RequestMethod.POST, produces=JsonUtil.JSON) public Result updateUserDetails(@RequestBody UserDto userDto) { String userId = userService.currentUserId(); return userService.updateUserDetails(userId, userDto); } @RequestMapping("/kaptcha") public void initCaptcha(HttpServletRequest request, HttpServletResponse response) throws Exception { HttpSession session = request.getSession(); response.setDateHeader("Expires", 0); response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate"); response.addHeader("Cache-Control", "post-check=0, pre-check=0"); response.setHeader("Pragma", "no-cache"); response.setContentType("image/jpeg"); String capText = producer.createText(); session.setAttribute(Constants.KAPTCHA_SESSION_KEY, capText); BufferedImage bi = producer.createImage(capText); ServletOutputStream out = response.getOutputStream(); ImageIO.write(bi, "jpg", out); try { out.flush(); } finally { String kaptchaCode = (String)session.getAttribute(Constants.KAPTCHA_SESSION_KEY); map = new HashMap<String, String>(); map.put("kaptchaCode", kaptchaCode); out.close(); } } }
UserService.java
package isa.blog.bin.service; import java.util.ArrayList; import java.util.Collection; import java.util.Date; import java.util.List; import java.util.Map; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.session.Session; import org.apache.shiro.session.mgt.eis.SessionDAO; import org.apache.shiro.subject.PrincipalCollection; import org.apache.shiro.subject.Subject; import org.apache.shiro.subject.support.DefaultSubjectContext; import org.modelmapper.ModelMapper; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import org.springframework.transaction.annotation.Transactional; import isa.blog.bin.commons.MD5Util; import isa.blog.bin.commons.Result; import isa.blog.bin.dao.UserDao; import isa.blog.bin.dto.UserDto; import isa.blog.bin.model.User; @Service @Transactional public class UserService { ModelMapper modelMapper = new ModelMapper(); @Autowired private UserDao userDao; @Autowired private SessionDAO sessionDAO; /** * 注册 * @param userDto * @param map * @param kaptchaCode * @return */ public Result register(UserDto userDto, Map<String, String> map, String kaptchaCode) { Result result = new Result(); if (!map.get("kaptchaCode").equals(kaptchaCode)) { result.setSuccess(false); result.setMessage("验证码错误"); return result; } User user = userDao.findOneByUserName(userDto.getUserName()); if (user != null) { result.setSuccess(false); result.setMessage("用户名已存在"); return result; } user = modelMapper.map(userDto, User.class); user.setPassword(MD5Util.MD5(userDto.getPassword())); user.setCreateTime(new Date()); userDao.save(user); result.setId(user.getId()); result.setSuccess(true); result.setMessage("注册成功"); return result; } /** * 获取一个用户详情 * @param userId * @return */ public Result getOneUser(String userId) { Result result = new Result(); User user = userDao.findOne(userId); UserDto userDto = modelMapper.map(user, UserDto.class); List<UserDto> datas = new ArrayList<UserDto>(); datas.add(userDto); result.setSuccess(true); result.setDatas(datas); return result; } /** * 登录 * @param userName * @param password * @param map * @param kaptchaCode * @return */ public Result login(String userName, String password, Map<String, String> map, String kaptchaCode) { Result result = new Result(); if (!map.get("kaptchaCode").equals(kaptchaCode)) { result.setSuccess(false); result.setMessage("验证码错误"); return result; } Subject subject = SecurityUtils.getSubject(); UsernamePasswordToken token = new UsernamePasswordToken(userName, MD5Util.MD5(password)); //踢除用户 this.kickOutUser(token); try{ subject.login(token); Session session = subject.getSession(); System.out.println("sessionId:"+session.getId()); System.out.println("sessionHost:"+session.getHost()); System.out.println("sessionTimeout:"+session.getTimeout()); result.setMessage("登录成功"); System.out.println(userName+"登录成功"); List<UserDto> userDtos = new ArrayList<UserDto>(); User user = this.userDao.findOneByUserName(userName); userDtos.add(modelMapper.map(user, UserDto.class)); result.setDatas(userDtos); result.setSuccess(true); return result; }catch(Exception e){ e.printStackTrace(); result.setSuccess(false); result.setMessage("用户名或密码错误！"); System.out.println("用户名或密码错误！"); return result; } } /** * 获得当前用户id * @return */ public String currentUserId() { Subject subject = SecurityUtils.getSubject(); PrincipalCollection collection = subject.getPrincipals(); if (null != collection && !collection.isEmpty()) { String userName = (String) collection.iterator().next(); return userDao.findOneByUserName(userName).getId(); } return null; } /** * 踢除用户 * http://www.ithao123.cn/content-7174367.html */ public void kickOutUser(UsernamePasswordToken token){ String loginName = token.getUsername(); Collection<Session> sessions = sessionDAO.getActiveSessions(); for(Session session:sessions){ if(loginName.equals(String.valueOf(session.getAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY)))) { //设置session立即失效，即将其踢出系统 session.setTimeout(0); } } } /** * 退出登录 */ public void logout() { Subject subject = SecurityUtils.getSubject(); if (subject.isAuthenticated()) { // session 会销毁，在SessionListener监听session销毁，清理权限缓存 subject.logout(); } } /** * 获取当前用户名 * @return */ public Result getOneUserName() { Subject subject = SecurityUtils.getSubject(); PrincipalCollection collection = subject.getPrincipals(); Result result = new Result(); if (null != collection && !collection.isEmpty()) { String userName = (String) collection.iterator().next(); result.setSuccess(true); List<String> datas = new ArrayList<String>(); datas.add(userName); result.setDatas(datas); return result; } result.setSuccess(false); return result; } /** * 修改用户信息 * @param userId * @param userDto * @return */ public Result updateUserDetails(String userId, UserDto userDto) { Result result = new Result(); User user = modelMapper.map(userDto, User.class); user.setId(userId); user.setPassword(userDao.findOne(userId).getPassword()); user.setCreateTime(userDao.findOne(userId).getCreateTime()); user.setRole(userDao.findOne(userId).getRole()); if (!userDto.getUserName().equals(userDao.findOne(userId).getUserName())) { result.setMessage("修改成功，立即重新登录！"); } else { result.setMessage("修改成功!"); } userDao.save(user); result.setId(userId); result.setSuccess(true); return result; } }
需要注意，前端需要编写全局ajax以便对用户友好提示权限相关信息，
统一处理页面登录超时和无权限情况（一般在每一个页面都会调用的js文件中编写以便覆盖完整）
//统一处理页面登录超时和无权限情况 jQuery(function($){ // 备份jquery的ajax方法 var _ajax = $.ajax; // 重写ajax方法 $.ajax=function(opt){ var _error = opt && opt.error || function(a, b){}; var _opt = $.extend(opt, { error:function(data, textStatus){ // 如果后台将请求重定向到了登录页，则data里面存放的就是登录页的源码，这里需要找到data是登录页的证据(标记) if(data.responseText.indexOf("无此权限") > 0) { alert("无此权限"); return; } else if (data.responseText.indexOf("请输入用户名") > 0) { alert("登录超时，请重新登录！"); window.location.href = '/views/login.html'; return; } else { alert("error"); return; } _error(data, textStatus); } }); _ajax(_opt); }; });
data.responseText获取得到的是applicationContext-shiro.xml里的配置
登录超时：
<property name="loginUrl" value="/views/login.html"/>
无权限：
<property name="unauthorizedUrl" value="/unauthorized.html"/>
对应页面的html的代码
