shiro安全框架的使用流程

最近学了shiro安全框架流程，在这里梳理一下shiro的工作流程和一些代码，方便以后使用的时候，能快速找到对应的代码。

要使用这个shiro框架，还要新建两张表 t_authority（权限表）和t_role_authority（角色权限表）

1.先在porm.xml中引入四个jar包，分别是shiro-core（shiro核心包）、shiro-web（shiro服务包）、shiro-spring（shiro和spring整合包）和shiro-ehcache（shiro缓存包）

<shiro.version>1.3.2</shiro.version

	 <dependency>
		    <groupId>org.apache.shiro</groupId>
		    <artifactId>shiro-core</artifactId>
		    <version>${shiro.version}</version>
		</dependency>
		<dependency>
		    <groupId>org.apache.shiro</groupId>
		    <artifactId>shiro-web</artifactId>
		    <version>${shiro.version}</version>
		</dependency>
		<dependency>
		    <groupId>org.apache.shiro</groupId>
		    <artifactId>shiro-spring</artifactId>
		    <version>${shiro.version}</version>
		</dependency>
		<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>${shiro.version}</version>
        </dependency>

2.在web.xml中配置filter（拦截器），拦截所有URL请求路径。

			<!-- shiro过滤器定义 -->
	<filter>
	    <filter-name>shiroFilter</filter-name>
	    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
	    <init-param>
	        <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->
	        <param-name>targetFilterLifecycle</param-name>
	        <param-value>true</param-value>
	    </init-param>
	</filter>
	<filter-mapping>
	    <filter-name>shiroFilter</filter-name>
	    <url-pattern>/*</url-pattern>
	</filter-mapping>

3.在application.xml（spring.xml）中配置Realm、安全管理器和shiro过滤器

        <!-- 配置自定义Realm -->
    <bean id="myRealm" class="com.oracle.shiro.UserRealm">
    	<property name="credentialsMatcher" >
    		<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    			<property name="hashAlgorithmName" value="MD5"></property>
    			<property name="hashIterations" value="1024"></property>
    		</bean>
    	</property>
    </bean>

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm"/>
    </bean>

  <!-- Shiro过滤器 核心-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- Shiro的核心安全接口,这个属性是必须的 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 身份认证失败，则跳转到登录页面的配置 -->
        <property name="loginUrl" value="/login.html"/>
        <property name="successUrl" value="/index.jsp"/>
        <!-- 权限认证失败，则跳转到指定页面 -->
        <property name="unauthorizedUrl" value="/login.htmls"/>
        <!-- Shiro连接约束配置,即过滤链的定义 -->
        <property name="filterChainDefinitions">
            <value>
            	<!-- /candidate/admin/**=authc -->
                <!--anon 表示匿名访问，不需要认证以及授权-->
				/login.htmls = anon
				/css/** = anon
				/dist/** = anon
				/js/** = anon
				/user/loginIn.dodo = anon
				/user/reg.dodo = anon
				/res/** = anon
				/logout = logout
                <!--authc表示需要认证 没有进行身份认证是不能进行访问的-->
                /**=authc
<!--            /student=roles[teacher]
                /teacher=perms["user:create"]
 -->            </value>
        </property>
    </bean>

4.新建一个UserRealm类，该类的路径对应（3）中的自定义的Realm配置的class路径。

package com.oracle.shiro;

import java.util.ArrayList;
import java.util.List;

import javax.annotation.Resource;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.ByteSource;
import org.springframework.util.StringUtils;

import com.oracle.model.User;
import com.oracle.service.RoleService;
import com.oracle.service.UserService;

public class UserRealm extends AuthorizingRealm {
　　 // 用户对应的角色信息与权限信息都保存在数据库中，通过UserService获取数据
　　 @Resource
     private UserService userService;

    /**
     * 提供用户信息返回权限信息
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    	String currentUsername = (String)super.getAvailablePrincipal(principals);
		List<String> roleList = null;  //用来存放角色码的集合
		List<String> permissionList = null;  //用来存放当前用户的权限码
		//从数据库中获取当前登录用户的详细信息
		User user = userService.findUserByUsername(currentUsername);
		if(null != user){
			permissionList = userService.getPermissions(user.getId());//根据当前登录用户的id，获取当前用户的权限码
			roleList = userService.findRolesByUserId(user.getId());//根据当前用户的id，获取当前用户的角色码
		}else{
			throw new AuthorizationException();
		}
		//为当前用户设置角色和权限
		SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();
		simpleAuthorInfo.addRoles(roleList);//把用户角色码交给shiro
		simpleAuthorInfo.addStringPermissions(permissionList);//把用户权限码交给shiro
		return simpleAuthorInfo;
    }

    /**
     * 提供账户信息返回认证信息
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
			String username = (String) token.getPrincipal();
			User user = userService.findUserByUsername(username);
			if (user == null) {
			    // 用户名不存在抛出异常
			    throw new UnknownAccountException();
			}else{
				ByteSource salt = ByteSource.Util.bytes(user.getSalt());//盐值
				SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user.getName(),
						user.getPassWord(),salt,getName());
				SecurityUtils.getSubject().getSession().setAttribute("CURRENT_USER", user);
				return authenticationInfo;
			}

    }

}

　注：在（4）中从数据库中获取用户信息的方法，比较简单，就不粘贴出来了（service->dao层->mapper.xml）

5.在spring-mvc.xml中配置，开启shiro注解，shiro才能被正式使用。

 <!-- 开启Shiro注解 -->
	     <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
    <property name="exceptionMappings">
        <props>
            <prop key="org.apache.shiro.authz.UnauthorizedException">
                /unauthorized
            </prop>
        </props>
    </property>
    </bean>

登录、注册的controller中的代码：

package com.oracle.controller;

import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Random;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import org.apache.log4j.Logger;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

import com.oracle.model.User;
import com.oracle.service.UserService;

@Controller
@RequestMapping("/user")
public class UserController {
	private static Logger log = Logger.getLogger(UserController.class);
	@Autowired
	private UserService userServiceNew;

	@RequestMapping("/reg")
	@ResponseBody
	public Map reg(User user) {
		Map<String,Object> map = new HashMap<String,Object>();
//		user.setPassWord(JavaUtilMD5.MD5(user.getPassWord()));
		Random rd = new Random();
		int salt = rd.nextInt(100000);
		SimpleHash sh = new SimpleHash("MD5", user.getPassWord(),ByteSource.Util.bytes(salt+"") , 1024);
		user.setPassWord(sh.toString());
		user.setSalt(salt+"");
		int i = userServiceNew.save(user);
		if(i>0) {
			map.put("code", 200);
		}else {
			map.put("code", 500);
		}
		return map;
	}
	@RequestMapping("/loginIn")
	public String loginIn(User user,HttpSession session) {
		if(user == null) {//
			return "redirect:index.html?loginCode=500";
		}else {
			Subject subject = SecurityUtils.getSubject();
			// 判断当前用户是否登陆
			if (subject.isAuthenticated() == false) {
				UsernamePasswordToken token = new UsernamePasswordToken(user.getName(), user.getPassWord());
				try {
					subject.login(token);
//					Session session = subject.getSession();
				//	user = (SysUser) session.getAttribute(Constants.CURRENT_USER);
//					session.setAttribute("SESSION_USERNAME", user.getId() + "");
//					// 根据用户id查找用户角色
//					SysUser u = this.findUserByUserId(user.getId());
//					session.setAttribute("u", u);
					return "index";
				} catch (Exception e) {
					// 这里将异常打印关闭是因为如果登录失败的话会自动抛异常
					e.printStackTrace();
//					model.addAttribute("error", "用户名或密码错误");
					return "index";
				}
			} else {
//				Session session = getSession();
//				user = (SysUser) session.getAttribute(Constants.CURRENT_USER);
//				session.setAttribute("SESSION_USERNAME", user.getId() + "");
				return "index";
			}
		}

	}

	@Autowired
	HttpServletRequest request;
	@RequestMapping("/LoginInfo")
	@ResponseBody
	public Object Logininfo() {
		HttpSession httpSession=request.getSession();
		Object map=httpSession.getAttribute("CURR_USER");
		return map;
	}

	@RequestMapping("/findPageData")
	@ResponseBody
	public Object findPageData(Integer page,Integer rows) {
		Integer startIndex = (page-1)*rows;
		Map<String,Object> map = new HashMap<String,Object>();
		map.put("startIndex", startIndex);
		map.put("rows", rows);
		List<User> users = userServiceNew.findPageData(map);
		map.put("rows", users);
		map.put("total", userServiceNew.findTotleSize());
		return map;
	}
	@RequestMapping("/findAllUser")
	@ResponseBody
	public Object findAllUser() {
		return userServiceNew.findAllUser();
	}

	@RequestMapping("/user")
	public String user() {
		return "user";
	}

	@RequestMapping("/userSave")
	@ResponseBody
	public Map userSave(User user) {
		Map<String,Object> map = new HashMap<String,Object>();
		int i = userServiceNew.save(user);
		if(i>0) {
			map.put("code", 200);
		}else {
			map.put("code", 500);
		}
		return map;
	}

	@RequestMapping("/userUpdate")
	@ResponseBody
	public Map userUpdate(User user) {
		Map<String,Object> map = new HashMap<String,Object>();
		int i = userServiceNew.update(user);
		if(i>0) {
			map.put("code", 200);
		}else {
			map.put("code", 500);
		}
		return map;
	}

	@RequestMapping("/userDelete")
	@ResponseBody
	public Map userDelete(User user) {
		Map<String,Object> map = new HashMap<String,Object>();
		int i = userServiceNew.delete(user.getId());
		if(i>0) {
			map.put("code", 200);
		}else {
			map.put("code", 500);
		}
		return map;
	}

	@RequestMapping("/CurrUserMenu")
	@ResponseBody
	public Map<String,Object> findCurrUserMenu(){
		User user = (User)SecurityUtils.getSubject().getSession().getAttribute("CURRENT_USER");
		List<Map<String,Object>> menuList = userServiceNew.findCurrMenu(user.getId());
		Map<String,Object> map = new HashMap<String,Object>();
		map.put("code", 100);
		map.put("msg", "");
		Map<String,Object> m = new HashMap<String,Object>();
		m.put("children", menuList);
		map.put("extend", m);
		return map;
	}
}