Shiro-官方文档及使用

普通web应用官方文档：

shiro.ini

Once you choose at least one user store to connect to for Shiro’s needs, we’ll need to configure a Realm that represents that data store and then tell the ShiroSecurityManager about it.
If you’ve checked out the step2 branch, you’ll notice the src/main/webapp/WEB-INF/shiro.ini file’s [main] section now has the following additions:
中文翻译：一旦您为Shiro的需要选择了至少一个要连接到的用户商店，我们将需要配置一个Realm，它表示数据存储，然后告诉ShiroSecurityManager关于这件事。
如果您已经检查了step2布兰奇，你会注意到src/main/webapp/WEB-INF/shiro.ini档案[main]一节现在增加了以下内容

# Configure a Realm to connect to a user datastore.  In this simple tutorial, 
# we'll just point to Stormpath since it
# takes 5 minutes to set up:
stormpathClient = com.stormpath.shiro.client.ClientFactory
stormpathClient.cacheManager = $cacheManager

# (Optional) If you put your apiKey.properties in the non-default location, you set the location here
#stormpathClient.apiKeyFileLocation = $HOME/.stormpath/apiKey.properties

stormpathRealm = com.stormpath.shiro.realm.ApplicationRealm
stormpathRealm.client = $stormpathClient

# Find this URL in your Stormpath console for an application you create:
# Applications -> (choose application name) --> Details --> REST URL
# (Optional) If you only have one Application
# stormpathRealm.applicationRestUrl = https://api.stormpath.com/v1/applications/$STORMPATH_APPLICATION_ID

stormpathRealm.groupRoleResolver.modeNames = name
securityManager.realm = $stormpathRealm
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

web.xml

这个声明定义了ServletContextListener启动Shiro环境(包括Shiro环境)。SecurityManager在web应用程序启动时。默认情况下，此侦听器自动知道如何查找WEB-INF/shiro.ini用于Shiro配置的文件。
这个声明定义了主ShiroFilter。这个过滤器需要过滤。全请求进入Web应用程序，这样Shiro可以在允许请求到达应用程序之前执行必要的标识和访问控制操作。
这个声明确保全请求类型由ShiroFilter。经常filter-mapping声明没有指定元素，但是Shiro需要定义它们，这样它就可以过滤可能为Web应用程序执行的所有不同的请求类型。

    org.apache.shiro.web.env.EnvironmentLoaderListener



    ShiroFilter
    org.apache.shiro.web.servlet.ShiroFilter



    ShiroFilter
    /*
    REQUEST
    FORWARD
    INCLUDE
    ERROR

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

spring整合shiro官方文档

web.xml：

    shiroFilter
    org.springframework.web.filter.DelegatingFilterProxy
    
        targetFilterLifecycle
        true
    






    shiroFilter
    /*

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

applicationContext.xml

bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    
    
    
    
    
    
    
     -->
    
    
    
    
    
    
        
            # some example chain definitions:
            /admin/** = authc, roles[admin]
            /docs/** = authc, perms[document:read]
            /** = authc
            # more URL-to-FilterChain definitions here
        
    







 ... 
...


    
    
    
    








    ...

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

启用Shiro注释

    
    

1
2
3
4
5
6

在spring整合shiro过程中，不需要添加EnvironmentLoaderListener这个监听器，是因为spring的ContentLoadListener 已经代替EnvironmentLoaderListener初始化容器并加载配置shiro的配置文件，所以spring整合shiro以后不需要配置EnvironmentLoaderListener。

使用

依赖：

    org.apache.shiro
    shiro-spring
    1.3.2



    org.apache.shiro
    shiro-core
    1.3.2

1
2
3
4
5
6
7
8
9
10
11

web.xml：

   shiroFilter
   org.springframework.web.filter.DelegatingFilterProxy
   
      targetFilterLifecycle
      true
   


   shiroFilter
   /*

1
2
3
4
5
6
7
8
9
10
11
12
13

自定义realm类

package com.zhijin.web.shiro;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

/**
 * 自定义reamlm
 */
public class AuthRealm extends AuthorizingRealm {

   //登陆认证
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    //强转为用户名密码token
    UsernamePasswordToken upToken = (UsernamePasswordToken)token;
    //得页面传的登录名
    String email = upToken.getUsername();
    //从数据库中查询登录名
    User user = userService.findUserByEmail(email);
    if (user != null){
        //封装到认证对象中
        //第一个参数：安全数据（user对象）
        //第二个参数：密码（数据库密码）
        //第三个参数：当前调用realm域的名称（类名即可）
        return new SimpleAuthenticationInfo(user,user.getPassword(),this.getName());
    }
    return null;
   }

   // 授权访问校验
   protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
   User user = (User) principals.getPrimaryPrincipal();
   if (user !=null) {
       //根据用户的ID从数据库中查询出权限模块
        List moduleList = moduleService.findModuleByUserId(user.getId());
        Set permissions = new HashSet<>();
        for (Module module : moduleList) {
            //将查询出的模块名称添加到set集合中
            permissions.add(module.getName());
        }
        SimpleAuthorizationInfo sia = new SimpleAuthorizationInfo();
        //将带有模块名称的set结合添加到SimpleAuthorizationInfo(封装授权对象) 
        sia.addStringPermissions(permissions);
        return sia;
    }
    return null;
   }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

配置applicationContext-shiro

    
    
        
        
        
        
        
        
        
        
            
                
                /index.jsp* = anon
                /login.jsp* = anon
                /login* = anon
                /logout* = anon
                /css/** = anon
                /img/** = anon
                /plugins/** = anon
                /make/** = anon
                /** = authc
            
        
    
    
    
        
    
    
    
        
    
    
    
        
    

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

自定义凭证匹配器

package com.zhijin.web.shiro;

import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.crypto.hash.Md5Hash;

public class CustomCredentialsMatcher extends HashedCredentialsMatcher {

    @Override
    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
        //获取用户输入的登录名
        String username = (String) token.getPrincipal();
        //获取用户输入的登录密码
        String password = new String((char[])token.getCredentials());
        //获取数据库查出来的密码
        String md5Password = new Md5Hash(password,username).toString();
        String dbPassword = (String) info.getCredentials();
        return md5Password.equals(dbPassword);
    }
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

登录

        //1.获取subject
        Subject subject = SecurityUtils.getSubject();
        //2.构造用户名和密码
        UsernamePasswordToken upToken = new UsernamePasswordToken(email, password);
        //3.借助subject完成用户登录
        subject.login(upToken);
1
2
3
4
5
6