SSM整合Shiro，實現系統的認證管理和許可權管理？
阿新 • • 發佈：2018-11-25
資料：
一、首先匯入依賴：
<!--spring的版本號--> <spring-version>4.3.13.RELEASE</spring-version> <!--mybatis的版本號--> <mybatis-version>3.4.5</mybatis-version> <!--servlet的版本號--> <servlet-version>4.0.0</servlet-version> <!--mysql的版本號--> <mysql-version>5.1.46</mysql-version> <!--dbcp的版本號--> <dbcp-version>1.4</dbcp-version> <!--jackson的版本號--> <jackson-version>2.9.2</jackson-version> <!--shiro的版本號--> <shiro-version>1.4.0</shiro-version>
<dependency> <groupId>junit</groupId> <artifactId>junit</artifactId> <version>4.12</version> <scope>test</scope> </dependency> <!-- spring核心包 --> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-core</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-web</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-oxm</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-tx</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-jdbc</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-webmvc</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-aop</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-context-support</artifactId> <version>${spring-version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-test</artifactId> <version>${spring-version}</version> </dependency> <!-- mybatis核心包 --> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis</artifactId> <version>${mybatis-version}</version> </dependency> <!-- mybatis/spring包 --> <dependency> <groupId>org.mybatis</groupId> <artifactId>mybatis-spring</artifactId> <version>1.3.1</version> </dependency> <!--加入servlet依賴--> <dependency> <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> <version>${servlet-version}</version> </dependency> <!-- 匯入Mysql資料庫連結jar包 --> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>${mysql-version}</version> </dependency> <!-- 匯入dbcp的jar包，用來在applicationContext.xml中配置資料庫 --> <dependency> <groupId>commons-dbcp</groupId> <artifactId>commons-dbcp</artifactId> <version>${dbcp-version}</version> </dependency> <!-- 日誌檔案管理包 --> <!-- log start --> <dependency> <groupId>log4j</groupId> <artifactId>log4j</artifactId> <version>1.2.12</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-api</artifactId> <version>1.5.6</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>1.7.7</version> <scope>test</scope> </dependency> <!--加入jackson包--> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>${jackson-version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-core</artifactId> <version>${jackson-version}</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-annotations</artifactId> <version>${jackson-version}</version> </dependency> <!-- 匯入shiro的依賴--> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>${shiro-version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-web</artifactId> <version>${shiro-version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>${shiro-version}</version> </dependency> <dependency> <groupId>commons-logging</groupId> <artifactId>commons-logging</artifactId> <version>1.2</version> </dependency> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>1.5.8</version> </dependency> <dependency> <groupId>log4j</groupId> <artifactId>log4j</artifactId> <version>1.2.12</version> </dependency>
在build標籤里加上（不加會找不到檔案路徑）：
<resources> <resource> <directory>src/main/java</directory> <includes> <include>**/*.xml</include> </includes> </resource> </resources>
二、編寫java程式碼：
1、pojo包的實體類 User.java：
/**
* 測試類的實體類
*/
public class User implements Serializable {
/**
* 編號
*/
private String user_id;
/**
* 使用者名稱
*/
private String user_name;
/**
* 密碼
*/
private String user_pwd;
/**
* 型別
*/
private int user_type;
public User() {
}
public User(String user_id, String user_name, String user_pwd, int user_type) {
this.user_id = user_id;
this.user_name = user_name;
this.user_pwd = user_pwd;
this.user_type = user_type;
}
public String getUser_id() {
return user_id;
}
public void setUser_id(String user_id) {
this.user_id = user_id;
}
public String getUser_name() {
return user_name;
}
public void setUser_name(String user_name) {
this.user_name = user_name;
}
public String getUser_pwd() {
return user_pwd;
}
public void setUser_pwd(String user_pwd) {
this.user_pwd = user_pwd;
}
public int getUser_type() {
return user_type;
}
public void setUser_type(int user_type) {
this.user_type = user_type;
}
@Override
public String toString() {
return "User{" +
"user_id='" + user_id + '\'' +
", user_name='" + user_name + '\'' +
", user_pwd='" + user_pwd + '\'' +
", user_type=" + user_type +
'}';
}
}2、mapper包的介面 IUsersMapper.java：
/**
* 測試類mapper包的介面
*/
@Repository
public interface IUsersMapper {
/**
* 使用者登入的方法
* @param user_name
* @return
*/
public String UserLogin(String user_name);
}3、mapper包的myBatis的配置檔案 IUsersMapper.xml：
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.zking.mapper.IUsersMapper">
<!--使用者登入的sql語句-->
<select id="UserLogin" resultType="java.lang.String" parameterType="java.lang.String">
SELECT user_pwd FROM USER WHERE user_name=#{user_name}
</select>
</mapper>4、service包的介面 IUsersService.java：
/**
* 測試類service包的介面
*/
public interface IUsersService {
/**
* 使用者登入的方法
* @param user_name
* @return
*/
public String UserLogin(String user_name);
}5、service.impl包的實現類 UsersServiceImpl.java：
/**
* 測試類service包的實現類
*/
@Service("IUsersService")
public class UsersServiceImpl implements IUsersService {
@Resource(name = "IUsersMapper")
private IUsersMapper ium;
@Override
public String UserLogin(String user_name) {
return ium.UserLogin(user_name);
}
}6、realm包的自定義realm的類 CustomRealm.java：
/**
* 自定義realm的類
*/
public class CustomRealm extends AuthorizingRealm {
@Resource(name = "IUsersService")
private IUsersService ius;
/**
* 用於許可權管理
*
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
//得到使用者名稱
String user_name = (String) principalCollection.getPrimaryPrincipal();
//建立返回資料的授權物件
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
//連線資料庫，獲取當前使用者的角色
Set<String> roleSet = new HashSet<>();
roleSet.add("admin");
//連線資料庫，獲取當前使用者的許可權（傳遞到頁面，判斷哪些內容顯示）
Set<String> permissionSet = new HashSet<>();
permissionSet.add("Useradd");
permissionSet.add("Userremove");
permissionSet.add("Useredit");
//授權角色
simpleAuthorizationInfo.addRoles(roleSet);
//授權許可權
simpleAuthorizationInfo.addStringPermissions(permissionSet);
return simpleAuthorizationInfo;
}
/**
* 用於認證管理
*
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//獲取傳遞過來的資料
UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
//獲取使用者名稱和密碼
String user_name = usernamePasswordToken.getUsername();
String user_pwd = ius.UserLogin(user_name);
//建立返回資料的認證物件：使用者名稱，密碼，當前使用者名稱
SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user_name, user_pwd, this.getName());
//認證物件
return simpleAuthenticationInfo;
}
}7、controller包的資料互動類 UsersController.java：
@Controller//定義為是一個控制器類
@RequestMapping("user")//提供初步的請求對映資訊，相對於 WEB 應用的根目錄
public class UsersController {
@Resource(name = "IUsersService")
private IUsersService ius;
//註解式授權判斷
//@RequiresRoles("admin") //只有角色為admin才能進入這個方法
//@RequiresPermissions("add") //只顯示新增的方法
@RequestMapping(value = "userLogin")
public String userLogin(User user) {
//得到Subject物件
Subject subject = SecurityUtils.getSubject();
//例項化令牌
UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(user.getUser_name(), user.getUser_pwd());
//驗證
subject.login(usernamePasswordToken);
//認證是否通過
//System.out.println(subject.isAuthenticated());
return "index";
}
}三、配置資訊：
1、spring-mvc.xml檔案資訊：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd">
<!--1) 排除掃描@Component、@Repository、@Service 註解-->
<context:component-scan base-package="com.zking.controller"></context:component-scan>
<!--2) 此標籤預設註冊DefaultAnnotationHandlerMapping和AnnotationMethodHandlerAdapter -->
<!--兩個bean，這兩個bean是spring MVC為@Controllers分發請求所必須的。並提供了資料繫結支援，-->
<[email protected]支援，@DateTimeFormat支援，@Valid支援，讀寫XML的支援（JAXB），讀寫JSON的支援（Jackson）-->
<mvc:annotation-driven></mvc:annotation-driven>
<!--但是，從spring3.1開始DefaultAnnotationHandlerMapping和AnnotationMethodHandlerAdapter的使用已經過時-->
<!--spring3.1開始我們應該用RequestMappingHandlerMapping 來替換DefaultAnnotationHandlerMapping，-->
<!--spring3.1開始我們應該用用RequestMappingHandlerAdapter 來替換AnnotationMethodHandlerAdapter-->
<bean class="org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter">
<property name="messageConverters">
<list>
<ref bean="mappingJackson2HttpMessageConverter"/>
</list>
</property>
</bean>
<bean id="mappingJackson2HttpMessageConverter"
class="org.springframework.http.converter.json.MappingJackson2HttpMessageConverter">
<!--處理中文亂碼以及避免IE執行AJAX時，返回JSON出現下載檔案-->
<property name="supportedMediaTypes">
<list>
<value>text/html;charset=UTF-8</value>
<value>text/json;charset=UTF-8</value>
<value>application/json;charset=UTF-8</value>
</list>
</property>
</bean>
<!--3) ViewResolver -->
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/"/>
<property name="suffix" value=".jsp"/>
</bean>
<!--4) 單獨處理圖片、樣式、js等資源 -->
<!--<mvc:resources location="/css/" mapping="/css/**"/>-->
<!--<mvc:resources location="/images/" mapping="/images/**"/>-->
<!--<mvc:resources location="/js/" mapping="/js/**"/>-->
<!-- <mvc:resources location="/jquery-easyui/" mapping="/jquery-easyui/**"/>-->
<!-- ********************* 國際化配置開始***************** -->
<!--修改springmvc-servlet.xml-->
<!--1) 配置國際化資原始檔 -->
<!--<bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource">-->
<!--<property name="basenames">-->
<!--<list>-->
<!--<value>i18n</value>-->
<!--</list>-->
<!--</property>-->
<!--</bean>-->
<!--<!–2) 指定語言區域解析器，由它來確定使用哪個語言 –>-->
<!--<bean id="localeResolver" class="org.springframework.web.servlet.i18n.SessionLocaleResolver">-->
<!--</bean>-->
<!--<!–3) 配置國際化操作攔截器–>-->
<!--<mvc:interceptors>-->
<!--<bean class="org.springframework.web.servlet.i18n.LocaleChangeInterceptor"/>-->
<!--</mvc:interceptors>-->
<!-- ********************* 檔案上傳配置開始***************** -->
<!--<bean id="multipartResolver"-->
<!--class="org.springframework.web.multipart.commons.CommonsMultipartResolver">-->
<!--<!– 必須和使用者JSP 的pageEncoding屬性一致，以便正確解析表單的內容 –>-->
<!--<property name="defaultEncoding" value="UTF-8"></property>-->
<!--<!– 檔案最大大小(位元組) 1024*1024*100=50M–>-->
<!--<property name="maxUploadSize" value="52428800"></property>-->
<!--<!–resolveLazily屬性啟用是為了推遲檔案解析，以便捕獲檔案大小異常–>-->
<!--<property name="resolveLazily" value="true"/>-->
<!--</bean>-->
</beans>2、spring-mybatis.xml檔案資訊：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:context="http://www.springframework.org/schema/context" xmlns:tx="http://www.springframework.org/schema/tx"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.3.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd">
<!--配置註解掃描-->
<context:component-scan base-package="com.zking"/>
<!--配置dbcp的資料庫連線池-->
<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
<!--連線物件-->
<property name="driverClassName" value="com.mysql.jdbc.Driver"/>
<!--連線地址-->
<property name="url" value="jdbc:mysql://localhost:3306/chencao"/>
<!--使用者名稱-->
<property name="username" value="root"/>
<property name="password" value="sasa"/>
<!-- 初始化連線大小 -->
<property name="initialSize" value="20"></property>
<!-- 連線池最大數量 -->
<property name="maxActive" value="100"></property>
<!-- 連線池最大空閒 -->
<property name="maxIdle" value="20"></property>
<!-- 連線池最小空閒 -->
<property name="minIdle" value="1"></property>
<!-- 獲取連線最大等待時間 -->
<property name="maxWait" value="6000"></property>
</bean>
<!--建立sessionFactory工廠-->
<bean id="sessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
<property name="dataSource" ref="dataSource"></property>
<property name="typeAliasesPackage" value="com.zking.pojo"></property>
<property name="mapperLocations" value="classpath*:com/zking/mapper/*.xml"></property>
</bean>
<!--自動掃描 將Mapper介面生成代理注入到Spring-->
<bean id="mapperScannerConfigurer" class="org.mybatis.spring.mapper.MapperScannerConfigurer">
<property name="basePackage" value="com.zking.mapper"></property>
<property name="sqlSessionFactoryBeanName" value="sessionFactory"></property>
</bean>
<!--建立驅動-->
<bean id="dataSourceTransactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
<property name="dataSource" ref="dataSource"></property>
</bean>
<!--驅動管理-->
<tx:annotation-driven transaction-manager="dataSourceTransactionManager"/>
<!--巢狀配置檔案spring-shiro.xml-->
<import resource="spring-shiro.xml"></import>
</beans>3、shiro-realm.ini檔案：
#自定義名=自定義類許可權定名
myRealm=com.zking.realm.CustomRealm
#securityManager.realms=自定義名
securityManager.realms=$myRealm4、spring-shiro.xml檔案：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:context="http://www.springframework.org/schema/context" xmlns:tx="http://www.springframework.org/schema/tx"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.3.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd">
<!--配置shiroFilter（shiroFilterBean）-->
<!--配置自定義realm-->
<bean id="customRealm" class="com.zking.realm.CustomRealm"></bean>
<!--引用安全管理器securityManager-->
<bean id="defaultWebSecurityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="customRealm"></property>
</bean>
<!--配置shiroFilter-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<!--引入securityManager-->
<property name="securityManager" ref="defaultWebSecurityManager">
</property>
<!--配置登入頁面-->
<property name="loginUrl" value="/login.jsp"></property>
<!--成功頁面-->
<property name="successUrl" value="/index.jsp"></property>
<!--登入後，沒有訪問許可權將跳轉的地址-->
<property name="unauthorizedUrl" value="/logout.jsp"></property>
<property name="filterChainDefinitions">
<value>
/login.jsp*=anon<!--代表匿名使用者可以訪問-->
/index.jsp*=authc<!--設定授權後才可以訪問-->
<!--/**=authc--><!--所有頁面都需要驗證-->
/jsp/*=roles[admin]<!--設定授權後並且只有admin角色才可以訪問-->
</value>
</property>
</bean>
<!--shiro生命週期處理器-->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor">
</bean>
</beans>5、在web.xml配置：
<!--載入spring配置檔案-->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath*:spring-mybatis.xml
</param-value>
</context-param>
<!--shiro的過濾器-->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<!-- 在Spring框架中是如何解決從頁面傳來的字串的編碼問題的呢？
下面我們來看看Spring框架給我們提供過濾器CharacterEncodingFilter
這個過濾器就是針對於每次瀏覽器請求進行過濾的，然後再其之上添加了父類沒有的功能即處理字元編碼。
其中encoding用來設定編碼格式，forceEncoding用來設定是否理會 request.getCharacterEncoding()方法，設定為true則強制覆蓋之前的編碼格式。-->
<filter>
<filter-name>characterEncodingFilter</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
<init-param>
<param-name>forceEncoding</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>characterEncodingFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!--springMvc的攔截器-->
<servlet>
<servlet-name>springmvc</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-mvc.xml</param-value>
</init-param>
</servlet>
<servlet-mapping>
<servlet-name>springmvc</servlet-name>
<url-pattern>*.action</url-pattern>
</servlet-mapping>四、頁面測試：
1、login.jsp：
<form action="/user/userLogin.action" method="post">
使用者名稱：<input type="text" name="user_name"><br/>
密碼：<input type="password" name="user_pwd"><br/>
<input type="submit" value="提交">
</form>2、index.jsp：
<!--只有角色為users才顯示-->
<shiro:hasRole name="users">
<a href="/jsp/index.jsp">跳轉到jsp資料夾下的index頁面</a>
</shiro:hasRole>
<!--只有角色為admin才顯示-->
<shiro:hasRole name="admin">
<a href="/permission.jsp">跳轉到許可權判斷頁面</a>
</shiro:hasRole>3、permission.jsp：
<!--顯示哪些內容：name值為後臺許可權判斷傳遞過來的值-->
<shiro:hasPermission name="Useradd">
新增
</shiro:hasPermission>
<shiro:hasPermission name="Userremove">
刪除
</shiro:hasPermission>
<shiro:hasPermission name="Useredit">
編輯
</shiro:hasPermission>
<shiro:hasPermission name="find">
查詢
</shiro:hasPermission>