Shiro是一個強大易用的Java安全框架,提供了認證、授權、加密和會話管理等功能。本文將簡單介紹springmvc中如何配置shiro。

1.首先是maven中配置shiro所需要的jar包

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.2.3</version>
</dependency>

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.2.3</version>
</dependency>

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-ehcache</artifactId>
<version>1.2.3</version>
</dependency>

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.2.3</version>
</dependency>

2.往web.xml中配置shiro過濾器

<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>

3.在web.xml中配置shiro所要攔截的請求或資源

<!--攔截所有.do請求-->

<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>*.do</url-pattern>
</filter-mapping>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>

4.在spring的配置檔案中配置shiro

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<!-- Shiro的核心安全介面,這個屬性是必須的 --> 

<property name="securityManager" ref="securityManager" />

<!-- 登入的頁面，當shiro驗證不同過的時候，會進入該頁面，請根據自己專案的實際需求配置 -->

<property name="loginUrl" value="/views/common/login.jsp" />

<!-- 登入成功之後跳轉的頁面 -->
<property name="successUrl" value="/views/login.jsp" />

<!-- 定義shiro過濾規則 -->
<property name="filterChainDefinitions">

<value>

<!-- 這裡面配置響應的請求一及所需的許可權 -->

<!-- authc表示僅需對 /information/deal_change.do進行登入驗證，即必須登入之後才可以正常傳送改請求，如果沒有登入，即會跳轉到上邊配置好的loginUrl對應的頁面-->

/information/deal_change.do = authc

<!-- 此處表示既要登入，而且只允許角色是[]裡面定義好的角色才可以訪問-->

/demand/getDemand.do = authc,perms[designer]

</value>

在spring配置檔案中再新增如下配置其他配置

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--設定自定義realm -->
<property name="realm" ref="monitorRealm" />
</bean>


<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />


<!--自定義Realm 繼承自AuthorizingRealm -->
<bean id="monitorRealm" class="com.gdqy.FCS.common.api.MonitorRealm"></bean>
<!-- securityManager -->
<bean
class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod"
value="org.apache.shiro.SecurityUtils.setSecurityManager" />
<property name="arguments" ref="securityManager" />
</bean>
<bean
class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
配置到此就已經完成

接下來就是編寫自定義的realm

package com.gdqy.FCS.common.api;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.SimplePrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import com.gdqy.FCS.entity.User;
import com.gdqy.FCS.service.UserService;


//自定義的類必須繼承<span style="font-family: Arial, Helvetica, sans-serif;">AuthorizingRealm ，並重寫其方法</span>

public class MonitorRealm extends AuthorizingRealm {


	public MonitorRealm() {
		super();

	}

	//注入角色對應的service
	@Autowired
	private UserService userService;
	

<span style="white-space:pre">	</span><span style="font-family:Consolas, Bitstream Vera Sans Mono, Courier New, Courier, monospace;color:#808080;"><span style="font-size: 12.5px; line-height: 13.75px;">
</span></span>
	public void clearCachedAuthorizationInfo(String principal) {
		SimplePrincipalCollection principals = new SimplePrincipalCollection(
				principal, getName());
		
		clearCachedAuthorizationInfo(principals);
	}
<span style="white-space:pre">	</span><pre name="code" class="html"><span style="font-family:Consolas, Bitstream Vera Sans Mono, Courier New, Courier, monospace;color:#808080;"><span style="font-size: 12.5px; line-height: 13.75px;"><span style="white-space:pre">	</span>//</span></span><span style="font-size: 12.5px; line-height: 13.75px; color: rgb(128, 128, 128); font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace;">該方法的呼叫時機為需授權資源被訪問時執行 </span><span style="font-size: 12.5px; line-height: 13.75px; color: rgb(128, 128, 128); font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace;"> </span>

<span style="white-space:pre">		</span>//獲取使用者名稱，在登入的Controller中加入SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));//就可以在此處使用<span style="font-family: Arial, Helvetica, sans-serif;">String currentUsername = (String)super.getAvailablePrincipal(principals);去獲取角色的使用者名稱</span>

		String currentUsername = (String)super.getAvailablePrincipal(principals);

<span style="white-space:pre">		</span>//訪問資料庫，查詢對應的角色
		 User user = userService.selectByName(currentUsername);
		 if(user !=null) {

<span style="white-space:pre">			</span> //分配許可權
			  SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();
			  simpleAuthorInfo.addRole(user.getRole());
			  simpleAuthorInfo.addStringPermission(user.getRole()); 
			  return simpleAuthorInfo;
		 }
		return null;
	}
<span style="white-space:pre">	</span>//<span style="color: rgb(128, 128, 128); font-family: Consolas, 'Bitstream Vera Sans Mono', 'Courier New', Courier, monospace; font-size: 12.5px; line-height: 13.75px; white-space: pre;">LoginController.login()方法中執行Subject.login()時呼叫此方法</span>
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
		 UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
		return new SimpleAuthenticationInfo(token.getUsername(),
				token.getPassword(),getName());
	}

}

到這裡。shiro的配置就算完成了