Shiro的INI配置

最新推荐文章于 2024-11-29 17:32:05 发布

兰星_

最新推荐文章于 2024-11-29 17:32:05 发布

阅读量196

点赞数

CC 4.0 BY-SA版权

本文链接：https://blog.youkuaiyun.com/bjwfm2011/article/details/79487427

之前章节我们已经接触过一些INI配置规则了，如果大家使用过如Spring之类的IoC/DI容器的话，Shiro提供的INI配置也是非常类似的，即可以理解为是一个IoC/DI容器，但是区别在于它从一个根对象securityManager开始。

4.1 根对象SecurityManager

从之前的Shiro架构图可以看出，Shiro是从根对象SecurityManager进行身份验证和授权的；也就是所有操作都是自它开始的，这个对象是线程安全且真个应用只需要一个即可，因此Shiro提供了SecurityUtils让我们绑定它为全局的，方便后续操作。

因为Shiro的类都是POJO的，因此都很容易放到任何IoC容器管理。但是和一般的IoC容器的区别在于，Shiro从根对象securityManager开始导航；Shiro支持的依赖注入：public空参构造器对象的创建、setter依赖注入。

1、纯Java代码写法

package test.shiro.three;

import java.util.Arrays;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy;
import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
import org.apache.shiro.authz.ModularRealmAuthorizer;
import org.apache.shiro.authz.permission.WildcardPermissionResolver;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.junit.Assert;
import org.junit.Test;

import com.alibaba.druid.pool.DruidDataSource;

public class ShiroConfig {
	
	@Test
	public void TestShiroConfig(){
		DefaultSecurityManager securityManager = new DefaultSecurityManager(); 
		//设置authenticator 
		ModularRealmAuthenticator authenticator =new ModularRealmAuthenticator();
		AtLeastOneSuccessfulStrategy authenticationStrategy=new AtLeastOneSuccessfulStrategy();
		authenticator.setAuthenticationStrategy(authenticationStrategy);
		securityManager.setAuthenticator(authenticator);
		
		//设置authorizer
		ModularRealmAuthorizer authorizer=new ModularRealmAuthorizer(); 
		WildcardPermissionResolver permissionResolver=new WildcardPermissionResolver();
		authorizer.setPermissionResolver(permissionResolver);
		securityManager.setAuthorizer(authorizer);
		
		
		//设置Realm  
		DruidDataSource ds = new DruidDataSource();  
		ds.setDriverClassName("com.mysql.jdbc.Driver");  
		ds.setUrl("jdbc:mysql://localhost:3306/shiro");  
		ds.setUsername("root");  
		ds.setPassword("123456");  
		  
		JdbcRealm jdbcRealm = new JdbcRealm();  
		jdbcRealm.setDataSource(ds);  
		jdbcRealm.setPermissionsLookupEnabled(true);  
		securityManager.setRealms(Arrays.asList((Realm) jdbcRealm));  
		  
		//将SecurityManager设置到SecurityUtils 方便全局使用  
		SecurityUtils.setSecurityManager(securityManager);  
		  
		Subject subject = SecurityUtils.getSubject();
		UsernamePasswordToken token = new UsernamePasswordToken("zhang", "123");  
		subject.login(token); 
		
		PrincipalCollection  principals = subject.getPrincipals();
        principals.asList();
        for (Object object : principals) {
        	System.out.println("###"+object.toString());
		}
        
		Assert.assertTrue(subject.isAuthenticated()); 
	}
}

2.1、等价的INI配置（shiro-config.ini）

[main]  
#authenticator  
authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator  
authenticationStrategy=org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy  
authenticator.authenticationStrategy=$authenticationStrategy  
securityManager.authenticator=$authenticator  
  
#authorizer  
authorizer=org.apache.shiro.authz.ModularRealmAuthorizer  
permissionResolver=org.apache.shiro.authz.permission.WildcardPermissionResolver  
authorizer.permissionResolver=$permissionResolver  
securityManager.authorizer=$authorizer  
  
#realm  
dataSource=com.alibaba.druid.pool.DruidDataSource  
dataSource.driverClassName=com.mysql.jdbc.Driver  
dataSource.url=jdbc:mysql://localhost:3306/shiro  
dataSource.username=root  
dataSource.password=123456  
jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm  
jdbcRealm.dataSource=$dataSource  
jdbcRealm.permissionsLookupEnabled=true  
securityManager.realms=$jdbcRealm

即使没接触过IoC容器的知识，如上配置也是很容易理解的：

1、对象名=全限定类名相对于调用public无参构造器创建对象

2、对象名.属性名=值相当于调用setter方法设置常量值

3、对象名.属性名=$对象引用相当于调用setter方法设置对象引用

基于ININ配置的测试类

package test.shiro.three;

import java.util.Arrays;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy;
import org.apache.shiro.authc.pam.ModularRealmAuthenticator;
import org.apache.shiro.authz.ModularRealmAuthorizer;
import org.apache.shiro.authz.permission.WildcardPermissionResolver;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.junit.Assert;
import org.junit.Test;

public class TestShiroByINI {
	@Test
	public void TestShiroConfig(){
		//1、获取SecurityManager工厂，此处使用Ini配置文件初始化SecurityManager  
	    Factory<org.apache.shiro.mgt.SecurityManager> factory =  
	    		new IniSecurityManagerFactory("classpath:shiro-jdbc-authorizer.ini");  
	    //2、得到SecurityManager实例 并绑定给SecurityUtils  
	    SecurityManager securityManager = factory.getInstance();  
	    SecurityUtils.setSecurityManager(securityManager);  
	    //3、得到Subject及创建用户名/密码身份验证Token（即用户身份/凭证）  
	    Subject subject = SecurityUtils.getSubject();  
	    UsernamePasswordToken token = new UsernamePasswordToken("zhang", "123");  
	  
	    try {  
	        //4、登录，即身份验证  
	        subject.login(token);
	        PrincipalCollection  principals = subject.getPrincipals();
	        principals.asList();
	        for (Object object : principals) {
	        	System.out.println("###"+object.toString());
			}
	        //判断拥有角色：role1  
	        System.out.println(subject.hasRole("role1"));  
	        //判断拥有角色：role1 and role2  
	        System.out.println(subject.hasAllRoles(Arrays.asList("role1", "role2"))); 
	        //判断拥有角色：role1 and role2  and role3
	        System.out.println(subject.hasAllRoles(Arrays.asList("role1", "role2", "role3"))); 
	        
	        try {
	        	//判断拥有角色：role1 
		        subject.checkRole("role1"); 
		        //判断拥有角色：role1 and role2  
		        subject.checkRoles(Arrays.asList("role1", "role2")); 
		        //判断拥有角色：role1 and role2  and role3
		        subject.checkRoles(Arrays.asList("role1", "role2", "role3"));
			} catch (Exception e){
				System.out.println("exception:"+e.getMessage());
			}
	        
	        
	    } catch (AuthenticationException e) {  
	        //5、身份验证失败  
	    	System.out.println("登录失败！");
	    }  
	    Assert.assertEquals(true, subject.isAuthenticated()); //断言用户已经登录  
	  
	    //6、退出  
	    subject.logout();  
	}  
}

如上代码是从Shiro INI配置中获取相应的securityManager实例：

1、默认情况先创建一个名字为securityManager，类型为org.apache.shiro.mgt.DefaultSecurityManager的默认的SecurityManager，如果想自定义，只需要在ini配置文件中指定“securityManager=SecurityManager实现类”即可，名字必须为securityManager，它是起始的根；

2、IniSecurityManagerFactory是创建securityManager的工厂，其需要一个ini配置文件路径，其支持“classpath:”（类路径）、“file:”（文件系统）、“url:”（网络）三种路径格式，默认是文件系统；

3、接着获取SecuriyManager实例，后续步骤和之前的一样。

从如上可以看出Shiro INI配置方式本身提供了一个简单的IoC/DI机制方便在配置文件配置，但是是从securityManager这个根对象开始导航。