shiro 开发配置

我不是女神ヾ 2022-05-15 06:47 148阅读 0赞

maven依赖

<dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.4.0</version>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.4.0</version>
    </dependency>

/shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
           
           <bean id="advisorAutoProxyCreator" class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator">
                  <property name="proxyTargetClass" value="true"></property>
           </bean>
           <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"/>
           
           <bean id="customRealm" class="shiro.CustomRealm"></bean>
           <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
                  <property name="realm" ref="customRealm"></property>
                  <property name="rememberMeManager" ref="rememberMeManager"/>
           </bean>
           
           <bean id="sessionIdGenerator"
                 class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>
           
    
           <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    
                  <property name="sessionIdUrlRewritingEnabled" value="false" />
    
                  
    
                  <property name="globalSessionTimeout" value="3600000" />
    
           
    
                  <property name="sessionIdCookie" ref="sessionIdCookie" />
    
               
    
           </bean>
           
           <bean id="rememberMeManager"
                 class="org.apache.shiro.web.mgt.CookieRememberMeManager">
                  <property name="cipherKey" value="
                  #{T(org.apache.shiro.codec.Base64).decode('4AvVhmFLUs0KTA3Kprsdag==')}"/>
                  <property name="cookie" ref="rememberMeCookie"/>
           </bean>
           
           <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
                  <constructor-arg value="sid"/>
                  <property name="httpOnly" value="true"/>
                  <property name="maxAge" value="-1"/>
                  <property name="name" value="JSHIROSESSIONID"></property>
           </bean>
           <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
                  <constructor-arg value="rememberMe"/>
                  <property name="httpOnly" value="true"/>
                  <property name="maxAge" value="2592000"/>
           </bean>
           
           <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
                  <property name="securityManager" ref="securityManager"></property>
                  
                  <property name="loginUrl" value="/login"></property>
                  
                  <property name="successUrl" value="/index.jsp"/>
                  <property name="filters">
                         <map>
                                <entry key="authc">
                                       <bean class="shiro.ShiroAccessImpl"></bean>//针对未登录的用户进行拦截
                                </entry>
                                
                              
                         </map>
                  </property>
                  
                  <property name="filterChainDefinitions" >
                         <value>
                                /logout = logout
                                /index/** =  authc
                         </value>
                  </property>
    
           </bean>
           
         
    </beans>

自定义realm

/**
     * 授权
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }
    
    /**
     * 认证
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String userName = (String)authenticationToken.getPrincipal();
        if("".equals(userName)){
            throw new AuthenticationException("用户为空");
        }
        SimpleAuthenticationInfo token = new SimpleAuthenticationInfo (userName,"123456",this.getName());
        return token;
    }

登录操作

@RequestMapping("/login")
    public JSONObject login(){
        logger.info("=============start===============");
        JSONObject jsonObject = new JSONObject();
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken("admin", "123");
        try {
            subject.login(token);
        } catch (UnknownAccountException e) {
            e.printStackTrace();
            jsonObject.put("userName", "用户名错误！");
        } catch (IncorrectCredentialsException e) {
            e.printStackTrace();
            jsonObject.put("passwd", "密码错误");
        }
        return jsonObject;
    }

//判断是否进行登录操作
    public class ShiroAccessImpl extends org.apache.shiro.web.filter.authc.FormAuthenticationFilter {
        @Override
        protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
            if(this.isLoginRequest(request, response)) {
                if(this.isLoginSubmission(request, response)) {
                    return this.executeLogin(request, response);
                } else {
    
    
                    return true;
                }
            } else {
                if(isAjax(request)){
                    Map<String,Object> result=new HashMap<String,Object>();
                    result.put("isLogin",false);
                    response.getWriter().print(result);
                }else{
                    this.saveRequestAndRedirectToLogin(request, response);
                }
                return false;
            }
        }
    
    
        public static boolean isAjax(ServletRequest request){
            String header = ((HttpServletRequest) request).getHeader("X-Requested-With");
            if("XMLHttpRequest".equalsIgnoreCase(header)){
                System.out.println( "当前请求为Ajax请求");
                return Boolean.TRUE;
            }
            System.out.println(  "当前请求非Ajax请求");
            return Boolean.FALSE;
        }
    }