SpringMVC整合Shiro

 SpringMVC整合Shiro，Shiro是一个强大易用的Java安全框架,提供了认证、授权、加密和会话管理等功能。

第一步：配置web.xml

<!-- 配置Shiro过滤器,先让Shiro过滤系统接收到的请求 -->  
<!-- 这里filter-name必须对应applicationContext.xml中定义的<bean id="shiroFilter"/> -->  
<!-- 使用[/*]匹配所有请求,保证所有的可控请求都经过Shiro的过滤 -->  
<!-- 通常会将此filter-mapping放置到最前面(即其他filter-mapping前面),以保证它是过滤器链中第一个起作用的 -->  
<filter>  
    <filter-name>shiroFilter</filter-name>  
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
    <init-param>  
    <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->  
    <param-name>targetFilterLifecycle</param-name>  
    <param-value>true</param-value>  
    </init-param>  
</filter>  
<filter-mapping>  
        <filter-name>shiroFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
</filter-mapping>

或者

<!-- apache shiro权限 -->
<filter>  
        <filter-name>shiroFilter</filter-name>  
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
        <init-param>  
            <param-name>targetFilterLifecycle</param-name>  
            <param-value>true</param-value>  
        </init-param>  
    </filter>  
  
    <filter-mapping>  
        <filter-name>shiroFilter</filter-name>  
        <url-pattern>*.do</url-pattern>  
    </filter-mapping>  
    <filter-mapping>  
        <filter-name>shiroFilter</filter-name>  
        <url-pattern>*.jsp</url-pattern>  
    </filter-mapping> 

第二步：配置applicationContext-shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/beans 
http://www.springframework.org/schema/beans/spring-beans-3.0.xsd   
    http://www.springframework.org/schema/util 
    http://www.springframework.org/schema/util/spring-util-3.0.xsd">
    
<description>Shiro 配置</description>


<!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 -->  
<!-- Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截,Shiro对基于Spring的Web应用提供了完美的支持 --> 
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<!-- Shiro的核心安全接口,这个属性是必须的 -->  
<property name="securityManager" ref="securityManager" />
 <!-- 要求登录时的链接(可根据项目的URL进行替换),非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->  
<property name="loginUrl" value="/login.jsp" />

<!--  
<property name="successUrl" value="/login.jsp" />
-->

<!-- 登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) -->  
    <!-- <property name="successUrl" value="/system/main"/> -->  
    <!-- 用户访问未对其授权的资源时,所显示的连接 -->  
    <!-- 若想更明显的测试此属性可以修改它的值,如unauthor.jsp,然后用[玄玉]登录后访问/admin/listUser.jsp就看见浏览器会显示unauthor.jsp --> 
<property name="unauthorizedUrl" value="/error.jsp" />

<!-- Shiro连接约束配置,即过滤链的定义 -->  
    <!-- 此处可配合我的这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839 -->  
    <!-- 下面value值的第一个'/'代表的路径是相对于HttpServletRequest.getContextPath()的值来的 -->  
    <!-- anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 -->  
    <!-- authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter -->  
<property name="filterChainDefinitions">
<value>
/login.jsp* = anon
/login.do* = anon
/logout.do* = anon
/index.jsp*= anon
/image.jsp*= anon
/error.jsp*= anon
/*.jpg* = anon
/*.png* = anon
/*.css* = anon
/*.js* = anon
/*.jsp* = authc
/*.do* = authc
<!-- 
/user/*=authc,roles[1]
/department/*=authc,roles[1]
-->
</value>
</property>
</bean>


<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--设置自定义realm -->
<property name="realm" ref="monitorRealm" />
</bean>


<!-- Support Shiro 所谓的异常拦截 可有可无 Annotation -->
    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">  
        <property name="exceptionMappings">  
            <props>  
                <prop key="org.apache.shiro.authz.UnauthorizedException">/error</prop>
            </props>  
        </property>  
    </bean>
    
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />


<!--自定义Realm 继承自AuthorizingRealm -->
<!-- 继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户登录的类为自定义的ShiroDbRealm.java -->  
<bean id="monitorRealm" class="com.dt.service.MonitorRealm">
   <!-- 关闭授权缓存域，把authorizationCachingEnabled设置为false
   否则会提示No cache or cacheManager properties have been set.  Authorization cache cannot be obtained.
    -->
   <property name="authorizationCachingEnabled" value="false"/> 
</bean>
<!-- securityManager -->
<bean
class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod"
value="org.apache.shiro.SecurityUtils.setSecurityManager" />
<property name="arguments" ref="securityManager" />
</bean>


<!-- Enable Shiro Annotations for Spring-configured beans. Only run after -->
<!-- the lifecycleBeanProcessor has run: -->
<bean
class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor" />
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />


</bean>


</beans>

第三步：自定义的Realm类

@Service("monitorRealm")
public class MonitorRealm extends AuthorizingRealm {

@Resource
private UserService userService;


public MonitorRealm() {
super();


}


//Authorization：授权，即权限验证，验证某个已认证的用户是否拥有某个权限；即判断用户是否能做事情，常见的如：验证某个用户是否拥有某个角色。或者细粒度的验证某个用户对某个资源是否具有某个权限；
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
/* 这里编写授权代码 */
HttpServletRequest request = ((ServletRequestAttributes)RequestContextHolder.getRequestAttributes()).getRequest();  
User user2  = (User)request.getSession().getAttribute("currentUser");
/* 角色  */
Set<String> roleNames = new HashSet<String>();
   roleNames.add(String.valueOf(user2.getRoleId()));

   
/* 权限  */
   Set<String> permissions = new HashSet<String>();
    permissions.addAll(PrivilegeReader.getModulUrlsById(user2.getRoleId()));
   
   SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); 

   info.setRoles(roleNames);//添加角色(Set集合<字符串>)
info.setStringPermissions(permissions);
return info;


}

// Authentication 身份认证/登录，验证用户是不是拥有相应的身份；
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
/* 这里编写认证代码 */
UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
//User user = securityApplication.findby(upToken.getUsername());
//User user = new User();
//user.setUserName(token.getUsername());


User user = userService.loadById(token.getUsername());


if (user != null) {
this.setSession("currentUser", user);  
return new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(), user.getTrueName());

}else{
throw new AuthenticationException();
}






}


//清空缓存
public void clearCachedAuthorizationInfo(String principal) {
SimplePrincipalCollection principals = new SimplePrincipalCollection(
principal, getName());
clearCachedAuthorizationInfo(principals);
}



 /** 
     * 将一些数据放到ShiroSession中,以便于其它地方使用 
     * @see  比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到 
     */  
    private void setSession(Object key, Object value){  
        Subject currentUser = SecurityUtils.getSubject();  
        if(null != currentUser){  
            Session session = currentUser.getSession();  
            if(null != session){  
                session.setAttribute(key, value);  
            }  
        }  
    }  

}

第四步：SpringMvc

<!-- 使用注解的包，包括子集 -->
<context:component-scan base-package="com.dt.controller" />


<!-- shiro 使用注解必须 -->
<context:annotation-config/>
<!-- Required for security annotations to work in this servlet -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"/>
    <!-- Enable annotation-based controllers using @Controller annotations -->
    <bean id="annotationUrlMapping"  class="org.springframework.web.servlet.mvc.annotation.DefaultAnnotationHandlerMapping"></bean>
    <bean id="annotationMethodHandlerAdapter" class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter"/> 


<!-- 视图解析器 -->
<bean id="viewResolver"
class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="prefix" value="/" />
<property name="suffix" value=".jsp"></property>
</bean>

 <!-- 文件上传 -->
<bean id="multipartResolver" class="org.springframework.web.multipart.commons.CommonsMultipartResolver">
 <property name="defaultEncoding" value="utf-8" />
     <property name="maxUploadSize" value="10485760000" />
     <property name="maxInMemorySize" value="40960" />
</bean>