Shiro整合SSO单点登录系统

小咪咪 2022-05-26 05:10 261阅读 0赞

# Shiro整合SSO单点登录系统 #

## 前言 ##

shiro是一个非常强大的权限管理框架，关于shiro与cas整合的示例有很多，但是我们平时开发的时候，很多公司并不是使用cas来做SSO的，而是自己公司会用自己开发的。本文就主要针对这种方式的整合。

## 新增SSO相关的properties ##

#sso服务器登录地址，service参数表示登录成功后要跳转的地址
    ssoServiceUrl=http://www.authserver.com/auth/login?service=http://www.client.com/user/login
    
    #sso的token的校验地址
    tokenValidateUrl=http://www.authserver.com:9999/auth/validatetoken
    
    #应用名称标识
    microServiceId=app
    
    #redis相关信息
    JedisUrl=198.168.1.101
    JedisPort=6379
    JedisPassword=666666

## 修改spring-shiro.xml ##

<bean id="shiroSecurityFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
       <property name="securityManager" ref="securityManager" />
       <property name="loginUrl" value="${ssoServiceUrl}" />
       
       <property name="filters">
               <map>
                   <entry key="authc" value-ref="ssoFilter"/>
               </map>
       </property>
       <property name="filterChainDefinitions">
          <value>
             /kaptcha.jpg=anon
             /assets/** = anon
             /images/** = anon
             /javascripts/** = anon
             /stylesheets/** = anon
             /user/login = anon
             /httpserver/* = anon
             /** = authc
          </value>
       </property>
    </bean>
    <bean id="ssoFilter" class="com.demo.web.sso.SSOFilter"/>

## 自定义ssoFilter ##

/** * sso自定义过滤器 */
    public class SSOFilter implements Filter{ 
    
        public void init(FilterConfig filterConfig) throws ServletException {
        }
    
        public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
            {
                HttpServletRequest request = (HttpServletRequest)servletRequest;
                HttpServletResponse response = (HttpServletResponse)servletResponse;
                String token = request.getParameter("token");
                PropertiesTool propertiesTool = PropertiesTool.getInstance();
                String ssoServiceUrl = propertiesTool.getValue("ssoServiceUrl");
                String tokenValidateUrl = propertiesTool.getValue("tokenValidateUrl");
                if(null == token) {
                    Cookie cookie = CookieUtil.getCookieByName(request, "token");
                    if(null != cookie) {
                        token = cookie.getValue();
                    }
                }
                if(null == token) {
                    //没有token，重定向至sso server登录页
                    response.sendRedirect(ssoServiceUrl);
                }else {
                    String urlString = request.getRequestURI();
                    if(urlString.endsWith("/logout")) {
                        String JedisUrl = propertiesTool.getValue("JedisUrl");
                        String JedisPort = propertiesTool.getValue("JedisPort");
                        Jedis jedis = new Jedis(JedisUrl, Integer.parseInt(JedisPort));
                        jedis.del(token.getBytes());
                        jedis.close();
                        SecurityUtils.getSubject().logout();
                        response.sendRedirect(ssoServiceUrl);//重定向至sso server登录页
                        return;
                    }
    
                    //有token,去sso server验证token的有效性
                    Map<String, String> map = new HashMap<>();
                    map.put("token", token);
                    String result = HttpClientUtil.doGet(tokenValidateUrl, map);
                    if(StringUtils.isNotBlank(result)){
        //验证成功，跳转至首页，并从redis中获取权限
                        SystemSession.setUser(SSOTokenUtil.getToken(request));//设置系统session(把用户信息保存在ThreadLocal中)
                        Cookie cookie = new Cookie("token", token);
                        cookie.setPath("/");
                        response.addCookie(cookie);
                        filterChain.doFilter(request, response);
                    } else{
                        response.sendRedirect(ssoServiceUrl);//验证失败，重定向至sso server登录页
                    }
                }
            }
        }
    
    
        public void destroy() {
    
        }

## 自定义shiro的realm ##

在spring-shiro.xml中添加：

realm类：

public class MyRealm extends AuthorizingRealm{ 
    
        public MyRealm() {
            setName("myRealm");
            HashedCredentialsMatcher hcm = new HashedCredentialsMatcher();
            //使用SHA-512 加密
            hcm.setHashAlgorithmName(Sha512Hash.ALGORITHM_NAME);
            setCredentialsMatcher(hcm);
        }
    
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(
                PrincipalCollection principals) {
            SysUser user = SystemSession.getUser();
            if (user != null) {
                SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
                List<Menu> list = user.getRoles().get(0).getMenuList();
                for (Menu menu : list){
                    if (StringUtils.isNotBlank(menu.getPermission())) {
                        // 添加基于Permission的权限信息
                        for (String permission : StringUtils.split(menu.getPermission(),",")){
                            info.addStringPermission(permission);
                        }
                    }
                }
                // 添加用户权限
                info.addStringPermission("user");
                // 添加用户角色信息
                for (SysRole role : user.getRoles()) {
                    info.addRole(role.getEnglishName());
                }
                return info;
            } else {
                return null;
            }
        }
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(
                AuthenticationToken authcToken) throws AuthenticationException {
            //获取user信息
            SysUser user = SystemSession.getUser();
            if (user != null) {
                if (user.getIsEnable()!=1) {
                    throw new AuthenticationException("msg:该帐号已禁止登录.");
                }
                return new SimpleAuthenticationInfo(new Principal(user), Constants.CREDENTIALS, getName());
            }
            return null;
        }
    
    
        public static class Principal implements Serializable { 
    
            private static final long serialVersionUID = 1L;
    
            private String id; // 编号
            private String loginName; // 登录名
            private String name; // 姓名
            private List<String> roleIdList;
    
    
            public List<String> getRoleIdList() {
                return roleIdList;
            }
    
            public void setRoleIdList(List<String> roleIdList) {
                this.roleIdList = roleIdList;
            }
    
            public Principal(SysUser user) {
                this.id = user.getId();
                this.loginName = user.getUsername();
                this.name = user.getCharacterName();
                this.roleIdList=user.getRoleIdList();
            }
    
            public String getId() {
                return id;
            }
    
            public String getLoginName() {
                return loginName;
            }
    
            public String getName() {
                return name;
            }
    
            @Override
            public String toString() {
                return id;
            }
    
        }
    
    }

由于shrio权限要做登录校验，但我们的登录已交给sso处理，这里只需要保证shiro的前后校验能通过就行，把password改成常量，并取消原来的加盐。CREDENTIALS=”6bf968f0c7b39ddbb7c8aa836b74d092060ed9b85b620a7fb088ecc48c6b3efd696bbd820f74c14f66c80c86c557c4bfda51b8a3743d3d568cc5c08410b7bb6a”;

## 修改index ##

@RequestMapping("index")
    public String index(ModelMap model, String mainFrame, HttpServletRequest request) {
           SysUser currentUser = SSOTokenUtil.getToken(request);
       List<Menu> menus = currentUser.getRoles().get(0).getMenuList();
       List<Menu> sysMenus = new ArrayList<>();
       for(Menu menu : menus){
          if(currentUser.getRemarks().equals(menu.getSysCode())){
             sysMenus.add(menu);
          }
       }
       //设置用户登录信息
       UsernamePasswordToken token = new UsernamePasswordToken(
             currentUser.getUsername(), Constants.PASSWORD);
       SecurityUtils.getSubject().login(token);
       model.addAttribute("menus", sysMenus);
       model.addAttribute("currentUser", currentUser);
    
       return "index";
    }

PASSWORD= “lvadmin”，是CREDENTIALS对应的明文。

文中所用到的一些SSOFilter,SystemSession,SSOTokenUtil等原码，以附件的形式提供下载。  
[Shiro整合SSO单点登录系统工具类下载][Shiro_SSO]

[Shiro_SSO]: http://download.csdn.net/download/m0_37797991/10117729