Shiro的授权整合SSH

爱被打了一巴掌 2022-05-13 19:44 214阅读 0赞

完整项目代码：[https://download.csdn.net/download/zeal9s/10744751][https_download.csdn.net_download_zeal9s_10744751]  
**1.新建或者导入一个SSH项目**  
项目模块图如下  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 1]  
**2.导入shiro依赖到pom.xml**  
pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    	<modelVersion>4.0.0</modelVersion>
    	<groupId>SSH_02</groupId>
    	<artifactId>SSH_02</artifactId>
    	<packaging>war</packaging>
    	<version>0.0.1-SNAPSHOT</version>
    	<name>SSH_02 Maven Webapp</name>
    	<url>http://maven.apache.org</url>
    	<properties>
    		<spring.version>4.3.10.RELEASE</spring.version>
    	</properties>
    	<dependencies>
    		<dependency>
    			<groupId>junit</groupId>
    			<artifactId>junit</artifactId>
    			<version>4.12</version>
    			<scope>test</scope>
    		</dependency>
    		
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>javax.servlet-api</artifactId>
    			<version>4.0.0-b07</version>
    			<scope>provided</scope>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.apache.struts</groupId>
    			<artifactId>struts2-core</artifactId>
    			<version>2.3.33</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.struts</groupId>
    			<artifactId>struts2-spring-plugin</artifactId>
    			<version>2.5.12</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.logging.log4j</groupId>
    			<artifactId>log4j-core</artifactId>
    			<version>2.8.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.hibernate</groupId>
    			<artifactId>hibernate-core</artifactId>
    			<version>5.2.10.Final</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>mysql</groupId>
    			<artifactId>mysql-connector-java</artifactId>
    			<version>5.1.43</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>com.mchange</groupId>
    			<artifactId>c3p0</artifactId>
    			<version>0.9.5.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-orm</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aspects</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-core</artifactId>
    			<version>1.3.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-web</artifactId>
    			<version>1.3.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-spring</artifactId>
    			<version>1.3.2</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>commons-logging</groupId>
    			<artifactId>commons-logging</artifactId>
    			<version>1.2</version>
    		</dependency>
    	</dependencies>
    	<build>
    		<finalName>SSH_02</finalName>
    	</build>
    </project>

**3.新建shiro包和MyRealm类**  
MyRealm.java

package com.zs.shiro;
    
    import java.util.ArrayList;
    import java.util.List;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    
    public class MyRealm extends AuthorizingRealm { 
    
    	// 授权
    	@Override
    	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { 
    		//获取认证完成之后的用户名
    		String uname=(String) principals.getPrimaryPrincipal();
    		//模拟通过用户名查询的角色
    		List<String> roles=new ArrayList<String>();
    		roles.add("son");
    		//模拟通过角色查询角色所拥有的权限
    		List<String> behaves=new ArrayList<String>();
    		behaves.add("add");
    		//认证成功之后才能进行授权
    		SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
    		//将查询到的角色赋予用户
    		info.addRoles(roles);
    		//将查询到的权限赋予给角色
    		info.addStringPermissions(behaves);
    		//将授权信息返回给测试类TestShiro
    		return info;
    	}
    
    	// 认证
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { 
    		// 创建认证的令牌
    		UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
    		// 用户名输入的名称和密码
    		String uname = usernamePasswordToken.getUsername();
    		String pwd = new String(usernamePasswordToken.getPassword());
    		// 数据库查询出的用户名密码
    		String dbpwd = "1234";
    		System.out.println("用户名输入的名称和密码\t" + uname + "\t" + pwd);
    		SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(uname, dbpwd, getName());
    		return info;
    	}
    
    }

**4.新建applicationContext-shiro.xml**  
applicationContext-shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd">
    	
    	<bean id="shiroFilterFactoryBean" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    		
    		<property name="securityManager" ref="securityManager"></property>
    		
    		<property name="loginUrl" value="/login.jsp"></property>
    		
    		<property name="successUrl" value="/success.jsp"></property>
    		
    		<property name="filterChainDefinitions">
    		     <value>
    		     
    		     /login.jsp*=anon
    		     
    		     /success.jsp*=authc
    		     
    		     /father.jsp*=roles[father]
    		     /son.jsp*=roles[son]
    		     </value>
    		</property>
    		
    		<property name="unauthorizedUrl" value="/nopremission.jsp"></property>
    	</bean>
    
    
    
    	
    	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    		<property name="realm" ref="myRealm"></property>
    	</bean>
    
    	
    	<bean id="myRealm" class="com.zs.shiro.MyRealm"></bean>
    
    
    </beans>

**5.在web.xml添加shiro在spring的过滤器**  
web.xml

<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd" >
    
    <web-app>
    	<display-name>Archetype Created Web Application</display-name>
    	
    	
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:applicationContext-*.xml</param-value>
    	</context-param>
    	
    	<filter>
    	    <filter-name>shiroFilterFactoryBean</filter-name>
    	    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    	</filter>
    	
    	<filter>
    		<filter-name>struts2</filter-name>
    		<filter-class>org.apache.struts2.dispatcher.ng.filter.StrutsPrepareAndExecuteFilter</filter-class>
    	</filter>
    	
    	<filter-mapping>
    	    <filter-name>shiroFilterFactoryBean</filter-name>
    	    <url-pattern>/*</url-pattern>
    	</filter-mapping>
    	<filter-mapping>
    		<filter-name>struts2</filter-name>
    		<url-pattern>*.action</url-pattern>
    	</filter-mapping>
    	
    	<listener>
    	    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    </web-app>

**6.新建login.jsp和success.jsp、father.jsp、son.jsp、nopremission.jsp  
login.jsp**

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
    <form action="testAction_login.action" method="post">
    用户名：<input type="text" name="uname"><br>
    密    码：<input type="password" name="pwd"><br>
    <input type="submit" value="登录">
    </form>
    </body>
    </html>

success.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <%@ taglib uri="http://shiro.apache.org/tags"  prefix="shiro"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
    认证成功之后才能进入的页面！
    <p>
    
    欢迎<shiro:principal></shiro:principal>登录！
    <p>
    
    <shiro:hasRole name="son">
    <a href="son.jsp">son拥有的页面</a>
    </shiro:hasRole>
    <shiro:hasRole name="father">
    <a href="father.jsp">father拥有的页面</a>
    </shiro:hasRole>
    </body>
    </html>

son.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
    拥有son角色才能进入的页面！！！！
    </body>
    </html>

father.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
    拥有father角色才能进入的页面！！！！
    </body>
    </html>

**7.新建TestAction,并且在spring注入属性和在struts里面配置action  
TestAction**

package com.ssh.action;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.subject.Subject;
    
    import com.opensymphony.xwork2.ActionSupport;
    
    /** * * @ClassName: TestAction * @Description:测试页面收集的用户名和密码认证是否通过 * @author 小思 * @date 2018年8月29日 下午2:43:48 * */
    public class TestAction extends ActionSupport { 
    	private SecurityManager securityManager;
    	// 收集login.jsp页面的用户名和密码
    	private String uname;
    	private String pwd;
    
    	public String getUname() { 
    		return uname;
    	}
    
    	public void setUname(String uname) { 
    		this.uname = uname;
    	}
    
    	public String getPwd() { 
    		return pwd;
    	}
    
    	public void setPwd(String pwd) { 
    		this.pwd = pwd;
    	}
    
    	public SecurityManager getSecurityManager() { 
    		return securityManager;
    	}
    
    	public void setSecurityManager(SecurityManager securityManager) { 
    		this.securityManager = securityManager;
    	}
    
    	// 登录
    	public String login() { 
    		// 利用帮助类将安全管理者添加到当前的安全管理环境中
    		SecurityUtils.setSecurityManager(securityManager);
    		// 获取安全管理的项目
    		Subject subject = SecurityUtils.getSubject();
    		// 定义返回类型
    		String ret = "SUCCESS";
    		// 创建保存用户用户名和密码的令牌(用户名和密码是页面收集的，是用户在页面上填写的)
    		UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(uname, pwd);
    		// 保存认证结果
    		boolean authenticated = false;
    		try { 
    			subject.login(usernamePasswordToken);
    			authenticated = subject.isAuthenticated();
    		} catch (Exception e) { 
    			// 认证失败，则返回原登录页面
    			ret = "login";
    		}
    		System.out.println("认证结果：" + authenticated);
    
    		// 授权过程之后的使用
    		// 判断用户是否具有某个角色
    		boolean role = subject.hasRole("son");
    		System.out.println("用户具有son角色吗？" + role);
    		// 角色是否拥有某个权限
    		boolean behave = subject.isPermitted("add");
    		System.out.println("son具有add权限吗？" + behave);
    		// 角色是否拥有某个权限
    		boolean behaves = subject.isPermittedAll("update", "query");
    		System.out.println("son具有update、query权限吗？" + behaves);
            return ret;
    	}
    
    }

**8.运行结果**  
运行login.jsp  
（1）使用admin,1234登录，则是跳转到success.jsp，此页面显示son该有的页面  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 2]  
(2)使用admin登录之后，强行访问father.jsp则会跳转到nopremission.jsp  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 3]  
（3）不登录，直接访问其他页面则是跳转到login.jsp

备注:（1）整个项目需要在有网的情况运行，不然会报错  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 4]  
（2）如果要精确到权限，则在success.jsp添加shiro的自定义标签中的

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 5]

**说在最后的话：编写实属不易，若喜欢或者对你有帮助记得点赞+关注或者收藏哦~**

[https_download.csdn.net_download_zeal9s_10744751]: https://download.csdn.net/download/zeal9s/10744751
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70]: /images/20220504/4a1afd0a0b1244e9b4a1ad9d06e5288e.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 1]: /images/20220504/ff6cccfccf05493a8398c0013f0e65ee.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 2]: /images/20220504/f01331416da44246a288e20e175bebe9.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 3]: /images/20220504/57062dfd7b3f44479c9e82c96ef50584.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 4]: /images/20220504/0b92096b5cb4442ca139264fc17aa9d5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3plYWw5cw_size_27_color_FFFFFF_t_70 5]: /images/20220504/249d81fccc00410b8c385ec0a0a5191c.png