- </pre> shiro 很强大,但往往项目不可能大改造,往往只需要部分功能,比如用到验证码,加密,还有就是同一个账户在两个地方登录,剔除第一个登录者,本文只提供思路和部 分代码,<p></p><p></p><p>自定义实现ream,< /p><p></p><pre name="code" class="java">package com.shiro.shiro.realm;
-
- import java.util.HashSet;
- import java.util.Set;
-
- import org.apache.shiro.authc.*;
- import org.apache.shiro.authz.AuthorizationInfo;
- import org.apache.shiro.authz.SimpleAuthorizationInfo;
- import org.apache.shiro.realm.AuthorizingRealm;
- import org.apache.shiro.subject.PrincipalCollection;
- import org.apache.shiro.util.ByteSource;
- import org.springframework.beans.factory.annotation.Autowired;
-
- import com.shiro.model.User;
- import com.shiro.service.UserService;
-
-
- public class UserRealm extends AuthorizingRealm {
-
- @Autowired
- private UserService userService;
-
- @Override
- protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
- SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
- <span style="font-size:18px;"> <span style="color:#ff0000;"><strong>Set<String> set =new HashSet<String>();
- set.add("*:*:*");</strong></span>
- <span style="color:#ff0000;"><strong>authorizationInfo.setRoles(set);
- authorizationInfo.setStringPermissions(set);
- return authorizationInfo;</strong></span></span>
- }
-
- @Override
- protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
-
- String username = (String)token.getPrincipal();
-
- User user = userService.findByUsername(username);
-
- if(user == null) {
- throw new UnknownAccountException();
- }
-
- if(Boolean.TRUE.equals(user.getLocked())) {
- throw new LockedAccountException();
- }
-
-
- SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
- user.getUsername(),
- user.getPassword(),
- ByteSource.Util.bytes(user.getCredentialsSalt()),
- getName()
- );
- return authenticationInfo;
- }
-
- @Override
- public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
- super.clearCachedAuthorizationInfo(principals);
- }
-
- @Override
- public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
- super.clearCachedAuthenticationInfo(principals);
- }
-
- @Override
- public void clearCache(PrincipalCollection principals) {
- super.clearCache(principals);
- }
-
- public void clearAllCachedAuthorizationInfo() {
- getAuthorizationCache().clear();
- }
-
- public void clearAllCachedAuthenticationInfo() {
- getAuthenticationCache().clear();
- }
-
- public void clearAllCache() {
- clearAllCachedAuthenticationInfo();
- clearAllCachedAuthorizationInfo();
- }
-
- }
- 只要在<pre name="code" class="java">doGetAuthorizationInfo方法体里授权所有资源所有角色就好了
- </pre><pre name="code" class="java">
此处用到了缓存,当然可以自己实现,把session存到数据库中然后判断操作
- </pre><pre name="code" class="java">再看下部分配置文件
- </pre><pre name="code" class="java">
- </pre><pre name="code" class="java">自定义的
- </pre><pre name="code" class="java"><pre name="code" class="java">package com.shiro.shiro.filter;
-
- import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
-
- import javax.servlet.ServletRequest;
- import javax.servlet.ServletResponse;
-
- public class MyFormAuthenticationFilter extends FormAuthenticationFilter {
-
- @Override
- protected boolean onAccessDenied(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
- if(request.getAttribute(getFailureKeyAttribute()) != null) {
- return true;
- }
- return super.onAccessDenied(request, response, mappedValue);
- }
- }
- <pre name="code" class="java">package com.shiro.shiro.filter;
-
- import org.apache.shiro.web.filter.AccessControlFilter;
- import org.apache.shiro.web.util.WebUtils;
- import org.springframework.beans.factory.annotation.Autowired;
-
- import com.shiro.service.UserService;
-
- import javax.servlet.ServletRequest;
- import javax.servlet.ServletResponse;
- import javax.servlet.http.HttpServletRequest;
-
- public class ValidateFilter extends AccessControlFilter {
-
- @SuppressWarnings("unused")
- @Autowired
- private UserService userService;
-
- private boolean verificationAbled = true;
-
- @SuppressWarnings("unused")
- private String verificationParam = "verificationParam";
-
- private String failureKeyAttribute = "shiroLoginFailure";
-
-
- public void setVerificationAbled(boolean verificationAbled) {
- this.verificationAbled = verificationAbled;
- }
-
- public void setVerificationParam(String verificationParam) {
- this.verificationParam = verificationParam;
- }
-
- public void setFailureKeyAttribute(String failureKeyAttribute) {
- this.failureKeyAttribute = failureKeyAttribute;
- }
-
- @Override
- protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
-
- request.setAttribute("verificationAbled", verificationAbled);
-
- HttpServletRequest httpServletRequest = WebUtils.toHttp(request);
-
- if (verificationAbled == false || !"post".equalsIgnoreCase(httpServletRequest.getMethod())) {
- return true;
- }
- <span style="color:#ff0000;"><strong>
-
-
- return true;</strong></span>
- }
- @Override
- protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
-
-
- request.setAttribute(failureKeyAttribute, "<span style="color:#ff0000;">verification.error</span>");
- return true;
- }
- }
处理器
- </pre><pre name="code" class="java"><pre name="code" class="java">package com.shiro.controller;
-
- import org.apache.shiro.authc.IncorrectCredentialsException;
- import org.apache.shiro.authc.UnknownAccountException;
- import org.springframework.stereotype.Controller;
- import org.springframework.ui.Model;
- import org.springframework.web.bind.annotation.RequestMapping;
-
- import javax.servlet.http.HttpServletRequest;
- @Controller
- public class LoginController {
-
- @RequestMapping(value = "/login" )
- public String showLoginForm(HttpServletRequest req, Model model) {
- String exceptionClassName = (String)req.getAttribute("shiroLoginFailure");
- String error = null;
- if(UnknownAccountException.class.getName().equals(exceptionClassName)) {
- error = "用户名/密码错误";
- } else if(IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {
- error = "用户名/密码错误";
- }else if("<span style="color:#ff0000;">verification.error</span>".equals(exceptionClassName)) {
- error = "验证码错误";
- } else if(exceptionClassName != null) {
- error = "其他错误:" + exceptionClassName;
- }
- model.addAttribute("error", error);
- return "login";
- }
-
-
- }
参考 :http://jinnianshilongnian.iteye.com/blog/2049092
- </pre><pre name="code" class="java">
- </pre><pre name="code" class="java">
- </pre><pre name="code" class="java">
- </pre><pre name="code" class="java">