前面的博客中,我们说道了Shiro的两个最大的特点,认证和授权,而单点登录也是属于认证的一部分,默认情况下,Shiro已经为我们实现了和Cas的集成,我们加入集成的一些配置就ok了。
1、加入shiro-cas包
org.apache.shiro shiro-cas 1.2.4package com.chhliu.springboot.shiro.config;
import java.util.LinkedHashMap;
import java.util.Map;
import javax.servlet.Filter;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.cas.CasFilter;
import org.apache.shiro.cas.CasSubjectFactory;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.web.filter.DelegatingFilterProxy;
/**
Shiro 配置
Apache Shiro 核心通过 Filter 来实现,就好像SpringMvc 通过DispachServlet 来主控制一样。 既然是使用
Filter 一般也就能猜到,是通过URL规则来进行过滤和权限校验,所以我们需要定义一系列关于URL的规则和访问权限。
@author chhliu
*/
@Configuration
public class ShiroConfiguration {
// cas server地址
public static final String casServerUrlPrefix = “http://127.0.0.1”;
// Cas登录页面地址
public static final String casLoginUrl = casServerUrlPrefix + “/login”;
// Cas登出页面地址
public static final String casLogoutUrl = casServerUrlPrefix + “/logout”;
// 当前工程对外提供的服务地址
public static final String shiroServerUrlPrefix = “http://127.0.1.28:8080”;
// casFilter UrlPattern
public static final String casFilterUrlPattern = “/index”;
// 登录地址
public static final String loginUrl = casLoginUrl + “service=” + shiroServerUrlPrefix + casFilterUrlPattern;
// 登出地址(casserver启用service跳转功能,需在webappscasWEB-INFcas.properties文件中启用cas.logout.followServiceRedirects=true)
public static final String logoutUrl = casLogoutUrl+“service=”+loginUrl;
// 登录成功地址
// public static final String loginSuccessUrl = “/index”;
// 权限认证失败跳转地址
public static final String unauthorizedUrl = “/error/403.html”;
/**
/**
/**
/**
/**
/**
/**
/**
/**
/**
/**
使用工厂模式,创建并初始化ShiroFilter
@param securityManager
@param casFilter
@return
/
@Bean(name = “shiroFilter”)
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager, CasFilter casFilter) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
// 必须设置 SecurityManager
shiroFilterFactoryBean.setSecurityManager(securityManager);
// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
shiroFilterFactoryBean.setLoginUrl(loginUrl);
/
// 设置无权限访问页面
shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
/*
// logout已经被单点登录的logout取代
// filters.put(“logout”,logoutFilter());
shiroFilterFactoryBean.setFilters(filters);
loadShiroFilterChain(shiroFilterFactoryBean);
return shiroFilterFactoryBean;
}
/**
加载shiroFilter权限控制规则(从数据库读取然后配置),角色/权限信息由MyShiroCasRealm对象提供doGetAuthorizationInfo实现获取来的
生产中会将这部分规则放到数据库中
@param shiroFilterFactoryBean
*/
private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean){
/// 下面这些规则配置最好配置到配置文件中,注意,此处加入的filter需要保证有序,所以用的LinkedHashMap ///
Map filterChainDefinitionMap = new LinkedHashMap();
filterChainDefinitionMap.put(casFilterUrlPattern, “casFilter”);
//2.不拦截的请求
filterChainDefinitionMap.put(“/css/**”,“anon”);
filterChainDefinitionMap.put(“/js/**”,“anon”);
filterChainDefinitionMap.put(“/login”, “anon”);
// 此处将logout页面设置为anon,而不是logout,因为logout被单点处理,而不需要再被shiro的logoutFilter进行拦截
filterChainDefinitionMap.put(“/logout”,“anon”);
filterChainDefinitionMap.put(“/error”,“anon”);
//3.拦截的请求(从本地数据库获取或者从casserver获取(webservice,http等远程方式),看你的角色权限配置在哪里)
filterChainDefinitionMap.put(“/user”, “authc”); //需要登录
//4.登录过的不拦截
filterChainDefinitionMap.put(“/**”, “authc”);
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
}
}