小白用shiro（1）

本文来自网易云社区

作者：王飞

首先引入一段关于shiro的介绍：

开发系统中，少不了权限，目前java里的权限框架有SpringSecurity和Shiro(以前叫做jsecurity)，对于SpringSecurity：功能太过强大以至于功能比较分散，使用起来也比较复杂，跟Spring结合的比较好。对于初学Spring Security者来说，曲线还是较大，需要深入学习其源码和框架，配置起来也需要费比较大的力气，扩展性也不是特别强。

对于新秀Shiro来说，好评还是比较多的，使用起来比较简单，功能也足够强大，扩展性也较好。听说连Spring的官方都不用Spring Security，用的是Shiro，足见Shiro的优秀。网上找到两篇介绍：http://www.infoq.com/cn/articles/apache-shiro http://www.ibm.com/developerworks/cn/opensource/os-cn-shiro/，http://itindex.net/detail/50410-apache-shiro-%E4%BD%BF%E7%94%A8%E6%89%8B%E5%86%8C，官网http://shiro.apache.org/ ，使用和配置起来还是比较简单。

下面只是简单介绍下我们是如何配置和使用Shiro的。

pom.xml引入相关jar包

1             <!-- spring结合 -->
 2             <dependency>
 3                 <groupId>org.apache.shiro</groupId>
 4                 <artifactId>shiro-spring</artifactId>
 5                 <version>1.4.0</version>
 6             </dependency>
 7             <!--缓存包-->
 8             <dependency>
 9                 <groupId>org.apache.shiro</groupId>
10                 <artifactId>shiro-ehcache</artifactId>
11                 <version>1.4.0</version>
12             </dependency>
13             <!--核心包-->
14             <dependency>
15                 <groupId>org.apache.shiro</groupId>
16                 <artifactId>shiro-core</artifactId>
17                 <version>1.4.0</version>
18             </dependency>

web.xml增加过滤

 1     <!-- shiro 权限控制的过滤器 -->
 2     <filter>
 3         <filter-name>shiroFilter</filter-name>
 4         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 5     </filter>
 6 
 7     <filter-mapping>
 8         <filter-name>shiroFilter</filter-name>
 9         <url-pattern>/*</url-pattern>
10     </filter-mapping>

增加一个shiro.xml的配置文件

  1 <?xml version="1.0" encoding="UTF-8"?>
 2 <beans xmlns="http://www.springframework.org/schema/beans" 3     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jee="http://www.springframework.org/schema/jee" 4     xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" 5     xmlns:util="http://www.springframework.org/schema/util" 6     xsi:schemaLocation=" 7     http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd 
 8     http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.0.xsd 
 9     http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-3.0.xsd 
10     http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.0.xsd11     http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"12     default-lazy-init="false">
13 
14     <!-- 缓存管理器 使用memory实现 -->
15 
16 
17     <!--rememberMe 30天 -->
18     <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
19         <constructor-arg value="COOKIE_NAME" />
20         <property name="httpOnly" value="true" />
21         <property name="maxAge" value="2592000" />
22 
23     </bean>
24 
25     <!-- rememberMe管理器 -->
26     <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
27         <property name="cipherKey" value="#{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}" />
28         <property name="cookie" ref="rememberMeCookie" />
29     </bean>
30 
31     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
32         <!-- 继承AuthorizingRealm的类-->
33         <property name="realm" ref="userRealm" />
34         <property name="rememberMeManager" ref="rememberMeManager" />
35     </bean>
36 
37     <!-- Shiro Filter -->
38     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
39         <property name="securityManager" ref="securityManager" />
40         <property name="loginUrl" value="/openid" />
41         <property name="successUrl" value="/manage" />
42         <property name="unauthorizedUrl" value="/openid" />
43         <property name="filterChainDefinitions">
44             <value>
45                 /api/**=anon46                 /res/**=anon47                 /src/**=anon48                 /health/**=anon49                 /logout=authc50                 /openid=anon51                 /callback=anon52                 /=authc53                 /**=anon54             </value>
55         </property>
56     </bean>
57 
58 
59     <!-- Shiro生命周期处理器 -->
60     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
61 
62 </beans>

对bean的扫描配置

1     <!-- shiro相关的配置文件和路径扫描的配置必须要放在项目的mvc的配置文件(即xxx-servlet.xml)里 -->
2     <aop:config proxy-target-class="true" />
3 
4     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
5         <property name="securityManager" ref="securityManager" />
6     </bean>

UserRealm

  1 @Component
 2 public class UserRealm extends AuthorizingRealm {
 3 
 4     private Logger logger = org.slf4j.LoggerFactory.getLogger(UserRealm.class);
 5 
 6     public final static String CREDENTIALS = "openid";
 7 
 8     @Autowired
 9     private SessionService sessionService;
10     @Autowired
11     private PermissionService permissionService;
12 
13     // 记录是否已经设置过PemissionResover
14     private boolean hasSetPemissionResover = false;
15 
16     @Override
17     public PermissionResolver getPermissionResolver() {
18         if (!hasSetPemissionResover) {
19             setPermissionResolver(new WildcardExtPermissionResolver());
20             hasSetPemissionResover = true;
21         }
22         return super.getPermissionResolver();
23     }
24 
25     /**
26      * 获取授权信息
27      *
28      * @param principals
29      * @return
30      */
31     @Override
32     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
33         try {
34             Iterator<String> iter = principals.fromRealm(getName()).iterator();
35             if (!iter.hasNext()) {
36                 logger.info("shiro 验证 无权限");
37                 return null;
38             }
39             String email = iter.next();
40             if (!Strings.isNullOrEmpty(email)) {
41                 // set session
42                 SessionObject so = sessionService.getSession(email);
43                 if (so == null) {
44                     logger.info("so 缓存为空");
45                     return null;
46                 }
47                 SessionUtils.setSo(so);
48 
49                 // set auth
50                 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
51                 info.addStringPermissions(permissionService.getPermsForUser(so.getRoleId()));
52                 return info;
53             }
54             logger.info("邮箱为空");
55             return null;
56         } catch (Exception e) {
57             logger.error("shiro 权限获取异常:", e);
58             return null;
59         }
60     }
61 
62     /**
63      * 获取身份验证相关信息：
64      *
65      * @param authcToken
66      * @return
67      * @throws AuthenticationException
68      */
69     @Override
70     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
71         try {
72             UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
73             String email = token.getUsername();
74             String password = new String(token.getPassword());
75             if (!StringUtils.isEmpty(email) && CREDENTIALS.equals(password)) {
76                 SessionObject so = SessionUtils.getSo();
77                 sessionService.addOrUpdateSession(so);
78                 return new SimpleAuthenticationInfo(email, CREDENTIALS, getName());
79             }
80             logger.info("登录验证失败，shiro 不添加权限信息");
81             return null;
82         } catch (Exception e) {
83             logger.error("shiro 身份验证异常:", e);
84             return null;
85         }
86     }
87 
88 
89 }

登录调用

              UsernamePasswordToken token = new UsernamePasswordToken(
                     "username", "password", true);
 
             SecurityUtils.getSubject().login(token);

退出调用

1 SecurityUtils.getSubject().logout();

权限注解

@RequiresPermissions(value = {"ROLE_KEY"})

网易云免费体验馆，0成本体验20+款云产品！

更多网易研发、产品、运营经验分享请访问网易云社区。

相关文章：
【推荐】 如何看待P2P领域的羊毛党？
【推荐】 类似gitlab代码提交的热力图怎么做？