Shiro安全框架整理

 1 <!-- Shiro filter-->
 2 <!--这里filter-name必须对应applicationContext.xml中定义的<beanid="shiroFilter"/> -->
 3 <filter>
 4     <filter-name>shiroFilter</filter-name>
 5     <filter-class>
 6         org.springframework.web.filter.DelegatingFilterProxy
 7     </filter-class>
 8     <init-param>
 9         <!--该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理-->
10         <param-name>targetFilterLifecycle</param-name>
11         <param-value>true</param-value>
12     </init-param>
13 </filter>
14 
15 <filter-mapping>
16     <filter-name>shiroFilter</filter-name>
17     <url-pattern>/*</url-pattern>
18 </filter-mapping>

 1 <!--shiro securityManager -->
 2 <!--Shiro默认会使用Servlet容器的Session,可通过sessionMode属性来指定使用Shiro原生Session -->
 3 <!-- 即<propertyname="sessionMode" value="native"/>,详细说明见官方文档-->
 4 <!--这里主要是设置自定义的单Realm应用,若有多个Realm,可使用‘realms‘属性代替 -->
 5 <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
 6     <property name="realm" ref="shiroDbRealm"/>
 7     <!--<property name="cacheManager"ref="myShiroEhcacheManager" /> -->
 8     <!-- <property name="sessionMode" value="native"/>
 9      <property name="sessionManager" ref="sessionManager"/>
10     -->
11 </bean>
12 
13 <!-- 用户授权信息Cache,采用EhCache -->
14 <bean id="myShiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
15     <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
16 </bean>
17 
18 <!--继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户的认证和授权 -->
19 <bean id="shiroDbRealm" class="org.shiro.demo.service.realm.ShiroDbRealm" depends-on="baseService">
20     <property name="userService" ref="userService"/>
21 </bean>

 1 <!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行-->
 2 <!-- Shiro Filter -->
 3 <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 4     <!-- Shiro的核心安全接口,这个属性是必须的 -->
 5     <property name="securityManager" ref="securityManager" />
 6     <!-- 要求登录时的链接,非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面-->
 7     <property name="loginUrl" value="/" />
 8     <!--登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) -->
 9     <property name="successUrl" value="/system/main" />
10     <!-- 用户访问未对其授权的资源时,所显示的连接 -->
11     <property name="unauthorizedUrl" value="/system/error" />
12     <!-- Shiro 过滤链的定义-->
13     <!--此处可配合这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839-->
14     <!--下面value值的第一个‘/‘代表的路径是相对于HttpServletRequest.getContextPath()的值来的 -->
15     <!--anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 -->
16     <!--authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter-->
17     <property name="filterChainDefinitions">
18         <value>
19             /login = anon
20             /validateCode = anon
21             /** = authc
22         </value>
23     </property>
24 </bean>

 1 <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
 2 <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
 3 
 4 <!--开启Shiro的注解，实现对Controller的方法级权限检查(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证-->
 5 <!--配置以下两个bean即可实现此功能 -->
 6 <!--Enable Shiro Annotations for Spring-configured beans. Only run after thelifecycleBeanProcessor has run -->
 7 <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" >
 8     <property name="proxyTargetClass" value="true" />
 9 </bean>
10 
11 <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
12     <property name="securityManager" ref="securityManager" />
13 </bean> 

 1 package org.shiro.demo.service.realm;
 2 
 3 import ...
 4 
 5 /**
 6  * 自定义的指定Shiro验证用户登录的类
 7  * @author TCH
 8  *
 9  */
10 public class ShiroDbRealm extends AuthorizingRealm{
11 
12     // @Resource(name="userService")
13     private IUserService userService;
14 
15     public void setUserService(IUserService userService) {
16         this.userService = userService;
17     }
18     
19     /** 
20      * 为当前登录的Subject授予角色和权限 
21      * @see 经测试:本例中该方法的调用时机为需授权资源被访问时 
22      * @see 经测试:并且每次访问需授权资源时都会执行该方法中的逻辑,这表明本例未启用AuthorizationCache 
23      * @see web层可以有shiro的缓存，dao层可以配有hibernate的缓存（后面介绍）
24      */ 
25     protected AuthorizationInfo doGetAuthorizationInfo(
26             PrincipalCollection principals) {
27         
28         //获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()  
29         String account = (String) super.getAvailablePrincipal(principals);
30         
31         List<String> roles = new ArrayList<String>();  
32         List<String> permissions = new ArrayList<String>();
33         
34         //从数据库中获取当前登录用户的详细信息  
35         User user = userService.getByAccount(account);
36         
37         if(user != null){
38             //实体类User中包含有用户角色的实体类信息  
39             if (user.getRoles() != null && user.getRoles().size() > 0) {
40                 //获取当前登录用户的角色 
41                 for (Role role : user.getRoles()) {
42                     roles.add(role.getName());
43                      //实体类Role中包含有角色权限的实体类信息  
44                     if (role.getPmss() != null && role.getPmss().size() > 0) {
45                          //获取权限  
46                         for (Permission pmss : role.getPmss()) {
47                             if(!StringUtils.isEmpty(pmss.getPermission())){
48                                 permissions.add(pmss.getPermission());
49                             }
50                         }
51                     }
52                 }
53             }
54         }else{
55             throw new AuthorizationException();
56         }
57         
58         //为当前用户设置角色和权限
59         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
60         info.addRoles(roles);
61         info.addStringPermissions(permissions); 
62         
63         return info;
64         
65     }
66 
67     /** 
68      * 验证当前登录的Subject 
69      * @see 经测试:本例中该方法的调用时机为LoginController.login()方法中执行Subject.login()时 
70      */  
71     protected AuthenticationInfo doGetAuthenticationInfo(
72             AuthenticationToken authcToken) throws AuthenticationException {
73         //获取基于用户名和密码的令牌  
74         //实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的  
75         UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
76         
77         //从数据库中查询用户用信息
78         User user = userService.getByAccount(token.getUsername());
79         if (user != null) {
80              //此处无需比对,比对的逻辑Shiro会做,我们只需返回一个和令牌相关的正确的验证信息  
81             return new SimpleAuthenticationInfo(user.getAccount(), user
82                     .getPassword(), getName());
83         } else {
84              //没有返回登录用户名对应的SimpleAuthenticationInfo对象时,就会在LoginController中抛出UnknownAccountException异常  
85             return null;
86         }
87     }
88 }

1 Subject currentUser = SecurityUtils.getSubject();
2 //使用冒号分隔的权限表达式是org.apache.shiro.authz.permission.WildcardPermission默认支持的实现方式。 
3 //这里分别代表了 资源类型：操作：资源ID
4 if(currentUser.isPermitted("printer:print:laserjet4400n")){
5         //show the Print button
6         }else{
7         //don‘t show the button?  Grey it out?
8         }

@RequiresAuthentication
public void updateAccount(Account userAccount) {
        //this method will only be invoked by a
        //Subject that is guaranteed authenticated
        ...
        }

@RequiresPermissions("account:create")
public void createAccount(Account account) {
        //this method will only be invoked by a Subject  
        //that is permitted to create an account  
        ...
        } 

1 <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
2 
3 <shiro:hasRole name="administrator">
4     <a href="admin.jsp">Administer the system</a>
5 </shiro:hasRole>
6 
7 <shiro:hasPermission name="user:create">
8     <a href="createUser.jsp">Create a new User</a>
9 </shiro:hasPermission>  

 1     @RequestMapping(value = "/login")
 2     public String login(User user,HttpSession session, HttpServletRequest request){
 3         // 判断验证码
 4         String code = (String) session.getAttribute("validateCode");
 5         String submitCode = WebUtils.getCleanParam(request, "validateCode");
 6         
 7         if (StringUtils.isEmpty(submitCode) || !StringUtils.equals(code,submitCode.toLowerCase())) {
 8             return "redirect:/";
 9         }
10         
11         //获取当前的Subject  
12         Subject curUser = SecurityUtils.getSubject();
13         UsernamePasswordToken token = new UsernamePasswordToken(user.getAccount(),user.getPassword());
14         token.setRememberMe(true);
15         try {
16              //在调用了login方法后,SecurityManager会收到AuthenticationToken,并将其发送给已配置的Realm执行必须的认证检查  
17             //每个Realm都能在必要时对提交的AuthenticationTokens作出反应  
18             //所以这一步在调用login(token)方法时,它会走到ShiroDbRealm.doGetAuthenticationInfo()方法中
19             curUser.login(token);
20             
21             return "/system/main";
22         }catch (AuthenticationException e) {
23             //通过处理Shiro的运行时AuthenticationException就可以控制用户登录失败或密码错误时的情景
24             token.clear();
25             return "redirect:/";
26         }
27     }