Java经典框架之Shiro_java shiro

<!DOCTYPE web-app PUBLIC
        "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
        "http://java.sun.com/dtd/web-app_2_3.dtd" >
 
<web-app  version="2.5"
          xmlns="http://java.sun.com/xml/ns/javaee"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
        http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
  <display-name>Archetype Created Web Application</display-name>
 
  <!-- 配置Spring -->
  <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:applicationContext-*.xml</param-value>
  </context-param>
  <listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
  </listener>
 
  <!-- 配置Servlet的前端控制器 -->
  <servlet>
    <servlet-name>springmvc</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <!-- 关联自定义的Spring MVC的配置文件 -->
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:spring-mvc.xml</param-value>
    </init-param>
  </servlet>
 
  <servlet-mapping>
    <servlet-name>springmvc</servlet-name>
    <!-- 支持Restful风格编程 -->
    <url-pattern>/</url-pattern>
  </servlet-mapping>
  <!-- 配置字符编码的过滤器 -->
  <!-- 配置设置编码的过滤器 -->
  <filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    <init-param>
      <param-name>encoding</param-name>
      <param-value>UTF-8</param-value>
    </init-param>
    <init-param>
      <param-name>forceRequestEncoding</param-name>
      <param-value>true</param-value>
    </init-param>
    <init-param>
      <param-name>forceResponseEncoding</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>encodingFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
  <!-- default 防止静态资源拦截 -->
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.html</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.css</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.js</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.jpg</url-pattern>
  </servlet-mapping>
  <servlet-mapping>
    <servlet-name>default</servlet-name>
    <url-pattern>*.png</url-pattern>
  </servlet-mapping>
  <!-- 注册一个Shiro的过滤器 -->
  <filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <!-- 设置Filter的声明周期和Servlet容器绑定 -->
    <init-param>
      <param-name>targetFilterLifecycle</param-name>
      <param-value>true</param-value>
    </init-param>
    <!-- 设置Spring容器Filter的bean  id -->
    <init-param>
      <param-name>targetBeanName</param-name>
      <param-value>shiro</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>
</web-app>

1.3 添加shiro配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns:context="http://www.springframework.org/schema/context"
 
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd">
 
    <!-- 定义凭证匹配器 -->
    <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher" id="credentialsMatcher">
        <!-- 配置加密算法 -->
        <property name="hashAlgorithmName" value="md5" />
        <!-- 配置迭代的次数-->
        <property name="hashIterations" value="1024" />
    </bean>
 
    <!-- 配置自定义Realm -->
    <bean class="com.bobo.realm.MyRealm" id="myRealm" >
        <!-- 配置Realm对应的凭证匹配器 -->
        <property name="credentialsMatcher" ref="credentialsMatcher" />
    </bean>
 
    <!-- 配置SecurityManager -->
    <bean class="org.apache.shiro.web.mgt.DefaultWebSecurityManager" id="securityManager" >
        <!-- 关联自定义Realm -->
        <property name="realm" ref="myRealm" />
    </bean>
 
    <!-- 注册一个ShiroFilterFactoryBean对象 注意id必须和web.xml文件中注册的targetBeanName要一致-->
    <bean class="org.apache.shiro.spring.web.ShiroFilterFactoryBean" id="shiro">
        <!-- 注册SecurityManager对象 -->
        <property name="securityManager" ref="securityManager" />
        <!-- 注册登录地址 -->
        <property name="loginUrl" value="/login.do" />
        <!-- 登录成功的跳转地址 -->
        <property name="successUrl" value="/success.jsp" />
        <!-- 设置过滤器链 -->
        <property name="filterChainDefinitions">
            <value>
                /login.do=authc
                /**=anon
            </value>
        </property>
    </bean>
</beans>

package com.bobo.realm;
 
import com.bobo.pojo.User;
import com.bobo.service.IUserService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.SimpleByteSource;
import org.springframework.beans.factory.annotation.Autowired;
 
public class MyRealm  extends AuthorizingRealm {
 
    @Autowired
    private IUserService userService;
 
 
    /***
     * 认证方法
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
 
        User user = userService.login(token.getUsername());
        if(user == null){
            return null;
        }
 
        return new SimpleAuthenticationInfo(user
                ,user.getPassword()
                ,new SimpleByteSource(user.getSalt())
                ,"myRealm"
        );
    }
 
 
    /**
     * 授权方法
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        User user = (User) principalCollection.getPrimaryPrincipal();
        System.out.println("--->" + user.getUsername());
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("admin");
        info.addRole("root");
        return info;
    }
}

package com.bobo.controller;
 
import com.bobo.pojo.User;
import com.bobo.service.IUserService;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
 
import javax.servlet.http.HttpServletRequest;
import java.util.List;
 
@Controller
public class UserController {
 
    @Autowired
    private IUserService service;
 
    @GetMapping("/user/query")
    @ResponseBody
    public String query(){
        return service.query(new User()).toString();
    }
 
    /**
     * 本方法是Realm认证失败后会进入的方法
     * @param model
     * @param request
     * @return
     */
    @RequestMapping("/login.do")
    public String login(Model model, HttpServletRequest request){
        // 当认证失败的时候会将失败信息保存的request对应的属性中
        Object obj = request.getAttribute(FormAuthenticationFilter.DEFAULT_ERROR_KEY_ATTRIBUTE_NAME);
        System.out.println("错误信息:" + obj);
        return "/login.jsp";
    }
 
}

<%--
  Created by IntelliJ IDEA.
  User: dpb
  Date: 2021/2/19
  Time: 20:31
  To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
 
    <form action="login.do" method="post">
        账号:<input type="text" name="username" ><br/>
        密码:<input type="password" name="password"><br/>
        <input type="submit" value="提交">
    </form>
 
</body>
</html>

@RequestMapping("/logout.do")
public void logout(){
    SecurityUtils.getSubject().logout();
}

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-aspects</artifactId>
    <version>${spring.version}</version>
</dependency>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd
       http://www.springframework.org/schema/mvc
       http://www.springframework.org/schema/mvc/spring-mvc.xsd
       http://www.springframework.org/schema/aop
       http://www.springframework.org/schema/aop/spring-aop.xsd
">
    <!-- 配置扫描路径 -->
    <context:component-scan base-package="com.bobo.controller" use-default-filters="false" >
        <context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
    </context:component-scan>
    <!-- 开启注解 -->
    <mvc:annotation-driven ></mvc:annotation-driven>
    <!-- 开启Shiro的注解 -->
    <aop:config proxy-target-class="true" />
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor" >
        <property name="securityManager" ref="securityManager" />
    </bean>
</beans>

    /**
     * 授权方法
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        User user = (User) principalCollection.getPrimaryPrincipal();
        System.out.println("--->" + user.getUsername());
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("admin");
        info.addRole("root");
        return info;
    }

package com.bobo.controller;
 
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
 
@RestController
@RequestMapping("/order")
public class OrderController {
 
    @RequiresRoles(value = {"admin"},logical = Logical.AND)
    @GetMapping("/query")
    public String query(){
        return "query ... ";
    }
 
    @RequiresRoles(value = {"root","root1"},logical = Logical.AND)
    @GetMapping("/add")
    public String add(){
        return "add ... ";
    }
    @RequiresRoles(value = {"root","root1"},logical = Logical.OR)
    @GetMapping("/update")
    public String update(){
        return "update ... ";
    }
 
    @GetMapping("/delete")
    public String delete(){
        return "delete ... ";
    }
}

<%--
  Created by IntelliJ IDEA.
  User: dpb
  Date: 2021/2/21
  Time: 14:06
  To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h3>您没有访问当前请求的权限！请联系系统管理员：xxxxxxxxx</h3>
</body>q
</html>

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd
       http://www.springframework.org/schema/mvc
       http://www.springframework.org/schema/mvc/spring-mvc.xsd
       http://www.springframework.org/schema/aop
       http://www.springframework.org/schema/aop/spring-aop.xsd
">
    <!-- 配置扫描路径 -->
    <context:component-scan base-package="com.bobo.controller" use-default-filters="false" >
        <context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
    </context:component-scan>
    <!-- 开启注解 -->
    <mvc:annotation-driven ></mvc:annotation-driven>
    <!-- 开启Shiro的注解 -->
    <aop:config proxy-target-class="true" />
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor" >
        <property name="securityManager" ref="securityManager" />
    </bean>
    
    <!-- 配置SpringMVC的全局异常处理器 -->
    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="exceptionMappings">
            <props>
                <prop key="org.apache.shiro.authz.UnauthorizedException">redirect:/unauthorized.jsp</prop>
            </props>
        </property>
    </bean>
</beans>