Shiro 一 简介
Shrio 二 ssm+shiro整合

摘要：

这篇文章主要用Navicate Premium 自带的shiro 数据库 来测试 认证和授权的流程。

一 认证

1、配置

  <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <!-- 过虑器链定义，从上向下顺序执行，一般将/**放在最下边 -->
      <property name="loginUrl" value="/login"></property>
       <property name="filterChainDefinitions">
            <value>
                /logout=logout
                <!--认证的过滤器-->
                /refuse=anon
                /images/**=anon
                /js/**=anon
                /styles/**=anon
        <!--  所有url 必须通过认证才能访问-->
                /**=authc
            </value>
        </property>
    </bean>
  <!-- securityManager安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="customRealm"/>
    </bean>
 <!-- realm -->
    <bean id="customRealm" class="com.zl.shiro.DemoShiro">
        <property name="credentialsMatcher" ref="credentialsMatcher"/>
    </bean>

    <!-- 凭证匹配器 -->
    <bean id="credentialsMatcher"
          class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="md5"/>
        <property name="hashIterations" value="1"/>
    </bean>

2、DemoShiro (包含授权)

public class DemoShiro extends AuthorizingRealm {
    @Autowired
    UsersMapper usersMapper;
    @Autowired
    SysPermissionMapper sysPermissionMapper;

    @Override
    public String getName() {
        return "DemoShiro";
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("从数据库查询用户,进行认证");
        String principal = (String) authenticationToken.getPrincipal();
        Users users = usersMapper.selectByPrimaryKey(principal);
        if (users == null) {
            return null;
        }
        String password = users.getPassword();
        String salt = users.getSalt();
        return new SimpleAuthenticationInfo(users, password, ByteSource.Util.bytes(salt), getName());
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("从数据库查询权限进行授权");
        Users users = (Users) principalCollection.getPrimaryPrincipal();
        String id = users.getId();
        List<String> strings = sysPermissionMapper.listPercode(id);
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.addStringPermissions(strings);
        return authorizationInfo;
    }

}

3、login 接口

  // 用户登陆提交
   @RequestMapping("/login")
   public String loginsubmit(Model model, HttpServletRequest request)
           throws Exception {

       // shiro在认证过程中出现错误后将异常类路径通过request返回
       String exceptionClassName = (String) request
               .getAttribute("shiroLoginFailure");
       if (exceptionClassName != null) {
           if (UnknownAccountException.class.getName().equals(exceptionClassName)) {
               throw new CustomException("账号不存在");
           } else if (IncorrectCredentialsException.class.getName().equals(
                   exceptionClassName)) {
               throw new CustomException("用户名/密码错误");
           } else if ("randomCodeError".equals(exceptionClassName)) {
               throw new CustomException("验证码错误");
           } else {
               //最终在异常处理器生成未知错误
               throw new Exception();
           }
       }
       return "login";

   }

4、表单提交

<form action="/login" method="post">
    用户名： <input type="text" name="username">
    密码： <input type="password" name="password"><br><br><br>
    <input type="submit" value="提交">
</form>

认证成功自动返回上一路径

二 授权

1、开启aop 注解支持(加在spring-mvc 配置文件中)

 <mvc:annotation-driven/>
    <!-- 开启aop，对类代理 -->
    <aop:config proxy-target-class="true"></aop:config>
    <!-- 开启shiro注解支持 -->
    <bean
            class="
org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    </bean>

2、注解授权

  @RequestMapping("/permission")
    @RequiresPermissions("item:create")
    @ExceptionHandler(UnauthorizedException.class)
    public String permission() {
        return "authorationzation";
    }

3、jsp 页面中 授权

<%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>认证成功</title>
</head>
<body>
<h3>认证成功</h3>
<shiro:hasPermission name="item:query">
    <a href="/permission">有查询权限：查询用户信息</a>
</shiro:hasPermission>
</body>
</html>

友情提示

授权 当没有权限时，会抛出无权访问 异常
处理异常：

@Component
public class CustomExceptionResolver implements HandlerExceptionResolver {
 @Override
    public ModelAndView resolveException(HttpServletRequest request,
      HttpServletResponse response, Object handler, Exception ex) {
        //输出异常
        ex.printStackTrace();

        if (ex instanceof UnauthorizedException) {
                // 跳转到拒绝页面
             ModelAndView mv = new ModelAndView("refuse");
            return mv;
        }
    }
}