【Shiro + Spring MVC整合】教程——权限控制

1、准备Shiro的架包和spring 的架包

2、项目的架构

3、配置web.xml

[java] view plain copy

1. <?xmlversion="1.0"encoding="UTF-8"?>
2. <web-appversion="2.5"xmlns="http://java.sun.com/xml/ns/javaee"
3. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4. xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
5. http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
7. <display-name>simpleSpringMCV</display-name>
9. <!--加载文件-->
10. <context-param>
11. <param-name>contextConfigLocation</param-name>
12. <param-value>
13. classpath:applicationContext-shiro.xml
14. </param-value>
15. </context-param>
17. <!--shiro-->
18. <filter>
19. <filter-name>shiroFilter</filter-name>
20. <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
21. <init-param>
22. <param-name>targetFilterLifecycle</param-name>
23. <param-value>true</param-value>
24. </init-param>
25. </filter>
26. <filter-mapping>
27. <filter-name>shiroFilter</filter-name>
28. <url-pattern>/*</url-pattern>
29. </filter-mapping>
32. <!--加载springmvc-->
33. <servlet>
34. <servlet-name>SpringMVC</servlet-name>
35. <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
36. <init-param>
37. <param-name>contextConfigLocation</param-name>
38. <param-value>classpath:mvc.xml</param-value>
39. </init-param>
40. <load-on-startup>1</load-on-startup>
41. </servlet>
43. <!--以.htm结尾的都被mvc拦截-->
44. <servlet-mapping>
45. <servlet-name>SpringMVC</servlet-name>
46. <url-pattern>*.htm</url-pattern>
47. </servlet-mapping>
48. <!--启动spring加载-->
50. <listener>
51. <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
52. </listener>
53. </web-app>

4、配置applicationContext-shiro.xml

[java] view plain copy

1. <?xmlversion="1.0"encoding="UTF-8"?>
2. <beansxmlns="http://www.springframework.org/schema/beans"
3. xmlns:aop="http://www.springframework.org/schema/aop"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4. xmlns:context="http://www.springframework.org/schema/context"xmlns:tx="http://www.springframework.org/schema/tx"
5. xsi:schemaLocation="http://www.springframework.org/schema/beanshttp://www.springframework.org/schema/beans/spring-beans.xsdhttp://www.springframework.org/schema/contexthttp://www.springframework.org/schema/context/spring-context.xsdhttp://www.springframework.org/schema/txhttp://www.springframework.org/schema/tx/spring-tx-2.5.xsdhttp://www.springframework.org/schema/data/jpahttp://www.springframework.org/schema/data/jpa/spring-jpa-1.0.xsd">
7. <beanid="shiroFilter"class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
8. <propertyname="securityManager"ref="securityManager"/>
9. <propertyname="successUrl"value="/member/index.htm"/>
10. <propertyname="loginUrl"value="/login.htm"/>
11. <propertyname="unauthorizedUrl"value="/error.htm"/>
12. <propertyname="filters">
13. <map>
14. <entrykey="authc"value-ref="shiro"></entry>
15. </map>
16. </property>
17. <propertyname="filterChainDefinitions">
18. <value>
19. /login.htm=anon
20. /submit.htm=anon
21. /error.htm=anon
22. /member/**=authc,roles["member"]
23. </value>
24. </property>
25. </bean>
26. <beanid="shiro"class="com.cat.shiro.ShiroFilter">
28. </bean>
29. <beanid="shiroRealm"class="com.cat.shiro.ShiroRealm"/>
31. <beanid="securityManager"class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
32. <propertyname="realm"ref="shiroRealm"/>
33. <!--需要使用cache的话加上这句
34. <propertyname="cacheManager"ref="shiroEhcacheManager"/>
35. -->
36. </bean>
38. <!--用户授权信息Cache,采用EhCache，需要的话就配置上此信息
39. <beanid="shiroEhcacheManager"class="org.apache.shiro.cache.ehcache.EhCacheManager">
40. <propertyname="cacheManagerConfigFile"value="classpath:ehcache-shiro.xml"/>
41. </bean>
42. -->
44. <beanid="lifecycleBeanPostProcessor"class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
45. <bean
46. class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
47. depends-on="lifecycleBeanPostProcessor">
48. <propertyname="proxyTargetClass"value="true"/>
49. </bean>
50. <bean
51. class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
52. <propertyname="securityManager"ref="securityManager"/>
53. </bean>
54. </beans>

5、配置mvc.xml

[java] view plain copy

1. <?xmlversion="1.0"encoding="UTF-8"?>
2. <beansxmlns="http://www.springframework.org/schema/beans"
3. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:p="http://www.springframework.org/schema/p"
4. xmlns:context="http://www.springframework.org/schema/context"
5. xmlns:mvc="http://www.springframework.org/schema/mvc"
6. xsi:schemaLocation="http://www.springframework.org/schema/beans
7. http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
8. http://www.springframework.org/schema/context
9. http://www.springframework.org/schema/context/spring-context-3.0.xsd
10. http://www.springframework.org/schema/mvc
11. http://www.springframework.org/schema/mvc/spring-mvc-3.0.xsd">
12. <mvc:annotation-driven/>
13. <!--自动扫描包-->
14. <context:component-scanbase-package="com.cat.spring.controller"/>
16. <!--mvc返回页面的配置-->
17. <beanid="viewResolver"
18. class="org.springframework.web.servlet.view.InternalResourceViewResolver">
19. <!--模板路径为WEB-INF/pages/-->
20. <propertyname="prefix">
21. <value>/WEB-INF/pages/</value>
22. </property>
23. <!--视图模板后缀为.JSP-->
24. <propertyname="suffix">
25. <value>.jsp</value>
26. </property>
27. </bean>
29. </beans>

6、创建ShiroFilter和ShiroRealm

ShiroFilter.java

[java] view plain copy

1. /**
2. *
3. */
4. packagecom.cat.shiro;
6. importjava.io.IOException;
7. importjava.security.Principal;
9. importjavax.servlet.Filter;
10. importjavax.servlet.FilterChain;
11. importjavax.servlet.FilterConfig;
12. importjavax.servlet.ServletException;
13. importjavax.servlet.ServletRequest;
14. importjavax.servlet.ServletResponse;
15. importjavax.servlet.http.HttpServletRequest;
16. importjavax.servlet.http.HttpServletResponse;
18. importorg.apache.shiro.SecurityUtils;
19. importorg.apache.shiro.authc.UsernamePasswordToken;
20. importorg.apache.shiro.subject.Subject;
22. importcom.cat.spring.entity.Role;
23. importcom.cat.spring.entity.User;
25. /**
26. *@authorchenlf
27. *
28. *2014-3-24
29. */
30. publicclassShiroFilterimplementsFilter{
32. /*
33. *(non-Javadoc)
34. *
35. *@seejavax.servlet.Filter#destroy()
36. */
37. @Override
38. publicvoiddestroy(){
39. //TODOAuto-generatedmethodstub
41. }
43. /*
44. *(non-Javadoc)
45. *
46. *@seejavax.servlet.Filter#doFilter(javax.servlet.ServletRequest,javax.servlet.ServletResponse,javax.servlet.FilterChain)
47. */
48. @Override
49. publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,FilterChainchain)
50. throwsIOException,ServletException{
54. HttpServletRequesthttpRequest=(HttpServletRequest)request;
55. HttpServletResponsehttpResponse=(HttpServletResponse)response;
56. Principalprincipal=httpRequest.getUserPrincipal();
58. if(principal!=null){
59. Subjectsubjects=SecurityUtils.getSubject();
60. //为了简单，这里初始化一个用户。实际项目项目中应该去数据库里通过名字取用户：
61. //例如：Useruser=userService.getByAccount(principal.getName());
62. Useruser=newUser();
63. user.setName("shiro");
64. user.setPassword("123456");
65. user.setRole(newRole("member"));
66. if(user.getName().equals(principal.getName())){
67. UsernamePasswordTokentoken=newUsernamePasswordToken(user.getName(),user
68. .getPassword());
69. subjects=SecurityUtils.getSubject();
70. subjects.login(token);
71. subjects.getSession();
72. }else{
73. //如果用户为空，则subjects信息登出
74. if(subjects!=null){
75. subjects.logout();
76. }
77. }
78. }
79. chain.doFilter(httpRequest,httpResponse);
81. }
83. /*
84. *(non-Javadoc)
85. *
86. *@seejavax.servlet.Filter#init(javax.servlet.FilterConfig)
87. */
88. @Override
89. publicvoidinit(FilterConfigarg0)throwsServletException{
90. //TODOAuto-generatedmethodstub
92. }
94. }

ShiroRealm.java

[java] view plain copy

1. /**
2. *
3. */
4. packagecom.cat.shiro;
6. importjava.util.ArrayList;
7. importjava.util.List;
9. importorg.apache.shiro.authc.AuthenticationException;
10. importorg.apache.shiro.authc.AuthenticationInfo;
11. importorg.apache.shiro.authc.AuthenticationToken;
12. importorg.apache.shiro.authc.SimpleAuthenticationInfo;
13. importorg.apache.shiro.authc.UsernamePasswordToken;
14. importorg.apache.shiro.authz.AuthorizationException;
15. importorg.apache.shiro.authz.AuthorizationInfo;
16. importorg.apache.shiro.authz.SimpleAuthorizationInfo;
17. importorg.apache.shiro.realm.AuthorizingRealm;
18. importorg.apache.shiro.subject.PrincipalCollection;
20. importcom.cat.spring.entity.Role;
21. importcom.cat.spring.entity.User;
23. /**
24. *@authorchenlf
25. *
26. *2014-3-24
27. */
28. publicclassShiroRealmextendsAuthorizingRealm{
30. /*
31. *(non-Javadoc)
32. *
33. *@seeorg.apache.shiro.realm.AuthorizingRealm#doGetAuthorizationInfo(org.apache.shiro.subject.PrincipalCollection)
34. */
35. @Override
36. protectedAuthorizationInfodoGetAuthorizationInfo(PrincipalCollectionprincipals){
37. //根据用户配置用户与权限
38. if(principals==null){
39. thrownewAuthorizationException("PrincipalCollectionmethodargumentcannotbenull.");
40. }
41. Stringname=(String)getAvailablePrincipal(principals);
42. List<String>roles=newArrayList<String>();
43. //简单默认一个用户与角色，实际项目应Useruser=userService.getByAccount(name);
44. Useruser=newUser("shiro","123456");
45. Rolerole=newRole("member");
46. user.setRole(role);
47. if(user.getName().equals(name)){
48. if(user.getRole()!=null){
49. roles.add(user.getRole().getName());
50. }
51. }else{
52. thrownewAuthorizationException();
53. }
54. SimpleAuthorizationInfoinfo=newSimpleAuthorizationInfo();
55. //增加角色
56. info.addRoles(roles);
57. returninfo;
58. }
60. /*
61. *(non-Javadoc)
62. *
63. *@seeorg.apache.shiro.realm.AuthenticatingRealm#doGetAuthenticationInfo(org.apache.shiro.authc.AuthenticationToken)
64. */
65. @Override
66. protectedAuthenticationInfodoGetAuthenticationInfo(AuthenticationTokenauthcToken)
67. throwsAuthenticationException{
68. UsernamePasswordTokentoken=(UsernamePasswordToken)authcToken;
69. //简单默认一个用户,实际项目应Useruser=userService.getByAccount(token.getUsername());
70. Useruser=newUser("shiro","123456");
71. if(user==null){
72. thrownewAuthorizationException();
73. }
74. SimpleAuthenticationInfoinfo=null;
75. if(user.getName().equals(token.getUsername())){
76. info=newSimpleAuthenticationInfo(user.getName(),user.getPassword(),getName());
77. }
78. returninfo;
79. }
80. }

7、配置对应的Controller文件

LoginController.java

[java] view plain copy

1. /**
2. *
3. */
4. packagecom.cat.spring.controller;
6. importorg.apache.shiro.SecurityUtils;
7. importorg.apache.shiro.authc.UsernamePasswordToken;
8. importorg.apache.shiro.subject.Subject;
9. importorg.springframework.stereotype.Controller;
10. importorg.springframework.web.bind.annotation.RequestMapping;
11. importorg.springframework.web.bind.annotation.RequestMethod;
12. importorg.springframework.web.servlet.ModelAndView;
14. importcom.cat.spring.entity.Role;
15. importcom.cat.spring.entity.User;
17. /**
18. *@authorchenlf
19. *
20. *2014-3-24
21. */
22. @Controller
23. publicclassLoginController{
24. @RequestMapping(value="/login",method=RequestMethod.GET)
25. publicModelAndViewlogin(){
26. returnnewModelAndView("/login");
27. }
29. @RequestMapping(value="/submit",method=RequestMethod.POST)
30. publicModelAndViewsubmit(Stringusername,Stringpassword){
31. Useruser=newUser("shiro","123456");
32. user.setRole(newRole("member"));
33. try{
34. //如果登陆成功
35. if(user.getName().equals(username)&&user.getPassword().equals(password)){
36. UsernamePasswordTokentoken=newUsernamePasswordToken(user.getName(),user
37. .getPassword().toString());
38. Subjectsubject=SecurityUtils.getSubject();
39. subject.login(token);
40. }
41. }catch(Exceptione){
42. e.printStackTrace();
43. }
45. returnnewModelAndView("redirect:/member/index.htm");
46. }
47. }

IndexController.java

[java] view plain copy

1. /**
2. *
3. */
4. packagecom.cat.spring.controller.member;
6. importorg.springframework.stereotype.Controller;
7. importorg.springframework.web.bind.annotation.RequestMapping;
8. importorg.springframework.web.bind.annotation.RequestMethod;
9. importorg.springframework.web.servlet.ModelAndView;
11. /**
12. *@authorchenlf
13. *
14. *2014-3-24
15. */
16. @Controller
17. @RequestMapping(value="/member")
18. //会员中心要被拦截
19. publicclassIndexController{
20. //拦截/index.htm方法为GET的请求
21. @RequestMapping(value="/index",method=RequestMethod.GET)
22. publicModelAndViewindex(){
23. ModelAndViewview=newModelAndView();
24. view.setViewName("/member/index");
25. returnview;
26. }
28. }

8、对应的jsp 就不写了

9、来看看效果图吧

没有登陆状态的访问/member/**被shiro拦截到登入界面

当用户（角色为member）为shiro 密码为123456时 再次登入/member/index.htm时就不会跳转到login界面了