Shiro安全框架配置之身份验证

来源：互联网发布：软件测试考题编辑：程序博客网时间：2024/05/16 05:55

shiro的配置

1、在pom.xml中引入shiro的包

<dependency>
           <groupId>org.apache.shiro</groupId>
           <artifactId>shiro-all</artifactId>
           <version>1.2.3</version>
       </dependency>

2、在web.xml中进行如下配置

<filter>
       <filter-name>shiroFilter</filter-name>
       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
       <init-param>
           
           <param-name>targetFilterLifecycle</param-name>
           <param-value>true</param-value>
       </init-param>
   </filter>

<filter-mapping>
       <filter-name>shiroFilter</filter-name>
       <url-pattern>/*</url-pattern>
   </filter-mapping>

3、将shiro交个Spring进行管理，在Spring中进行如下配置

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xmlns:context="http://www.springframework.org/schema/context"
   xmlns:aop="http://www.springframework.org/schema/aop"
   xmlns:tx="http://www.springframework.org/schema/tx"
   xsi:schemaLocation="http://www.springframework.org/schema/beans
                         http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
                         http://www.springframework.org/schema/context
                         http://www.springframework.org/schema/context/spring-context-3.0.xsd
                         http://www.springframework.org/schema/tx
                         http://www.springframework.org/schema/tx/spring-tx-3.0.xsd
                         http://www.springframework.org/schema/aop
                         http://www.springframework.org/schema/aop/spring-aop-3.0.xsd">

   
   <bean id="lifeCycleBeanProcessor"
   class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

   
   <bean
   class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
   depends-on="lifeCycleBeanProcessor">
      
      <property name="proxyTargetClass" value="true"></property>
   </bean>

   
   <aop:aspectj-autoproxy proxy-target-class="true"></aop:aspectj-autoproxy>

   
   <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
       
      <property name="realm" ref="AuthRealm"></property>
   </bean>
   <bean id="AuthRealm" class="cn.tarena.ht.shiro.AuthRealm">
      
      <property name="credentialsMatcher" ref="authEnctype"></property>//如果没有给密码加密不需要写
   </bean>

   
   <bean id="authEnctype" class="cn.tarena.ht.shiro.AuthCredential"></bean>//如果没有给密码加密不需要写,当使用到才写


   <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
      <property name="securityManager" ref="securityManager"></property>
   </bean>


   <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
      <property name="securityManager" ref="securityManager"></property>

      <property name="loginUrl" value="/login.jsp"></property>
      
      <property name="filterChainDefinitions">
      <value>
          
          /validate/doLogin=anon
          /staticfile/**=anon
          /**=authc
      </value>
      </property>

   </bean>
</beans>

4、写具体处理的类

package cn.tarena.ht.shiro;

import java.util.ArrayList;
import java.util.Collection;
import java.util.List;

import javax.annotation.Resource;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;

import cn.tarena.ht.pojo.Module;
import cn.tarena.ht.pojo.User;
import cn.tarena.ht.service.LoginService;
import cn.tarena.ht.service.UserService;

public class AuthRealm extends AuthorizingRealm{

   @Resource
   public LoginService loginService;

   @Resource
   public UserService userService;

   //授权管理    实现不同用户展现不同界面
   protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {

   }

   //认证管理登录认证
   protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
       //传入的是一个关于username和password的令牌通过令牌获取其中的用户名和密码
       UsernamePasswordToken loginToken=(UsernamePasswordToken) token;
       //获取其中的用户名   根据用户名去找数据库中的用户来判断密码是否相等
       String username = loginToken.getUsername();

       User user = loginService.findUserByUserName(username);

       //为shiro内的比较器准备数据    根据传回来的用户名查询其正确的密码   准备去比较
       AuthenticationInfo info=new SimpleAuthenticationInfo(user, user.getPassword(), this.getName());
       //数据库中的信息准备好
       return info;
   }

}

5、在登录时写如下代码来进入shiro

//获取用户名和密码组成通关令牌
       UsernamePasswordToken token=new UsernamePasswordToken(username,password);
       //获取当前页面对象
       Subject subject = SecurityUtils.getSubject();

       try {
           subject.login(token);
           //用来进行权限管理用
           subject.getSession().setAttribute("username", username);
           return "redirect:/index.jsp"；//登录成功进行页面跳转
       } catch (AuthenticationException e) {
           session.setAttribute("loginFailed", 1);
           return "redirect:/login.jsp";//登录失败，在页面提示返回页面
       }

0 0