apache-shiro 学习笔记-白红宇

apache-shiro 学习笔记

阅读量：6179 次

发布时间：2019-06-21

本文共 20995 字，大约阅读时间需要 69 分钟。

(一) 看到SpringSide4居然也用shiro作为安全框架，不是用的spring-security。着实有点惊讶。

apache-shiro的强大可见一斑。

(二) apache-shiro依赖的包

Xml代码

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

<version>1.2.1</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-web</artifactId>

<version>1.2.1</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-ehcache</artifactId>

<version>1.2.1</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-spring</artifactId>

<version>1.2.1</version>

</dependency>


     	
      
       org.apache.shiro
      	
      
       shiro-core
      	
      
       1.2.1
      
     
     	
      
       org.apache.shiro
      	
      
       shiro-web
      	
      
       1.2.1
      
     
     	
      
       org.apache.shiro
      	
      
       shiro-ehcache
      	
      
       1.2.1
      
     
     	
      
       org.apache.shiro
      	
      
       shiro-spring
      	
      
       1.2.1

除此之外还有一些东西也不可少spring, spring-mvc, ibatis等

spring.3.1.2

spring-mvc.3.1.2

ibatis.2.3.4

cglib.2.2

(三) demo采取比较典型的“User-Role-Permission”模型

Sql代码

-- -----------------------------------------------------

-- Table `shiro`.`TBL_PERMISSION`

-- -----------------------------------------------------

DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION` ;

CREATE TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION` (

`PERMISSION_ID` INT NOT NULL AUTO_INCREMENT ,

`PERMISSION_NAME` VARCHAR(45) NULL ,

PRIMARY KEY (`PERMISSION_ID`) ,

UNIQUE INDEX `PERMISSION_NAME_UNIQUE` (`PERMISSION_NAME` ASC) )

ENGINE = InnoDB;

-- -----------------------------------------------------

-- Table `shiro`.`TBL_ROLE`

-- -----------------------------------------------------

DROP TABLE IF EXISTS `shiro`.`TBL_ROLE` ;

CREATE TABLE IF NOT EXISTS `shiro`.`TBL_ROLE` (

`ROLE_ID` INT NOT NULL AUTO_INCREMENT ,

`ROLE_NAME` VARCHAR(45) NULL ,

PRIMARY KEY (`ROLE_ID`) ,

UNIQUE INDEX `ROLE_NAME_UNIQUE` (`ROLE_NAME` ASC) )

ENGINE = InnoDB;

-- -----------------------------------------------------

-- Table `shiro`.`TBL_USER`

-- -----------------------------------------------------

DROP TABLE IF EXISTS `shiro`.`TBL_USER` ;

CREATE TABLE IF NOT EXISTS `shiro`.`TBL_USER` (

`USER_ID` INT NOT NULL AUTO_INCREMENT ,

`USER_USERNAME` VARCHAR(45) NOT NULL ,

`USER_PASSWORD` CHAR(32) NOT NULL ,

PRIMARY KEY (`USER_ID`) ,

UNIQUE INDEX `USER_USERNAME_UNIQUE` (`USER_USERNAME` ASC) )

ENGINE = InnoDB;

-- -----------------------------------------------------

-- Table `shiro`.`TBL_PERMISSION_ROLE`

-- -----------------------------------------------------

DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION_ROLE` ;

CREATE TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION_ROLE` (

`ROLE_ID` INT NOT NULL ,

`PERMISSION_ID` INT NOT NULL ,

PRIMARY KEY (`ROLE_ID`, `PERMISSION_ID`) )

ENGINE = InnoDB;

-- -----------------------------------------------------

-- Table `shiro`.`TBL_ROLE_USER`

-- -----------------------------------------------------

DROP TABLE IF EXISTS `shiro`.`TBL_ROLE_USER` ;

CREATE TABLE IF NOT EXISTS `shiro`.`TBL_ROLE_USER` (

`ROLE_ID` INT NOT NULL ,

`USER_ID` INT NOT NULL ,

PRIMARY KEY (`ROLE_ID`, `USER_ID`) )

ENGINE = InnoDB;

-- ------------------------------------------------------- Table `shiro`.`TBL_PERMISSION`-- -----------------------------------------------------DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION` ;CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION` (  `PERMISSION_ID` INT NOT NULL AUTO_INCREMENT ,  `PERMISSION_NAME` VARCHAR(45) NULL ,  PRIMARY KEY (`PERMISSION_ID`) ,  UNIQUE INDEX `PERMISSION_NAME_UNIQUE` (`PERMISSION_NAME` ASC) )ENGINE = InnoDB;-- ------------------------------------------------------- Table `shiro`.`TBL_ROLE`-- -----------------------------------------------------DROP TABLE IF EXISTS `shiro`.`TBL_ROLE` ;CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_ROLE` (  `ROLE_ID` INT NOT NULL AUTO_INCREMENT ,  `ROLE_NAME` VARCHAR(45) NULL ,  PRIMARY KEY (`ROLE_ID`) ,  UNIQUE INDEX `ROLE_NAME_UNIQUE` (`ROLE_NAME` ASC) )ENGINE = InnoDB;-- ------------------------------------------------------- Table `shiro`.`TBL_USER`-- -----------------------------------------------------DROP TABLE IF EXISTS `shiro`.`TBL_USER` ;CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_USER` (  `USER_ID` INT NOT NULL AUTO_INCREMENT ,  `USER_USERNAME` VARCHAR(45) NOT NULL ,  `USER_PASSWORD` CHAR(32) NOT NULL ,  PRIMARY KEY (`USER_ID`) ,  UNIQUE INDEX `USER_USERNAME_UNIQUE` (`USER_USERNAME` ASC) )ENGINE = InnoDB;-- ------------------------------------------------------- Table `shiro`.`TBL_PERMISSION_ROLE`-- -----------------------------------------------------DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION_ROLE` ;CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION_ROLE` (  `ROLE_ID` INT NOT NULL ,  `PERMISSION_ID` INT NOT NULL ,  PRIMARY KEY (`ROLE_ID`, `PERMISSION_ID`) )ENGINE = InnoDB;-- ------------------------------------------------------- Table `shiro`.`TBL_ROLE_USER`-- -----------------------------------------------------DROP TABLE IF EXISTS `shiro`.`TBL_ROLE_USER` ;CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_ROLE_USER` (  `ROLE_ID` INT NOT NULL ,  `USER_ID` INT NOT NULL ,  PRIMARY KEY (`ROLE_ID`, `USER_ID`) )ENGINE = InnoDB;

自己实现一个UserDao, ibatis实现。

这个不是本文要记述的重点，简单贴一下代码。

Xml代码

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE sqlMap PUBLIC "-//ibatis.apache.org//DTD SQL Map 2.0//EN" "http://ibatis.apache.org/dtd/sql-map-2.dtd">

<sqlMap namespace="user">

<typeAlias alias="User" type="com.ztgame.sd.domain.User"/>

<resultMap class="User" id="result-map-01" groupBy="id">

<result property="id" column="USER_ID" />

<result property="username" column="USER_USERNAME" />

<result property="password" column="USER_PASSWORD" />

<result property="roleSet" resultMap="role.result-map-01" />

</resultMap>

<sql id="select-base-01">

SELECT

u.USER_ID,

u.USER_USERNAME,

u.USER_PASSWORD,

r.ROLE_ID,

r.ROLE_NAME,

p.PERMISSION_ID,

p.PERMISSION_NAME

FROM

tbl_user as u,

tbl_role as r,

tbl_permission as p,

tbl_permission_role as pr,

tbl_role_user as ru

WHERE

u.USER_ID = ru.USER_ID

r.ROLE_ID = ru.ROLE_ID

p.PERMISSION_ID = pr.PERMISSION_ID

r.ROLE_ID = pr.ROLE_ID

</sql>

<select id="select-01" parameterClass="string" resultMap="result-map-01">

<include refid="select-base-01" />

u.USER_USERNAME = #username#

</select>

</sqlMap>


     
     	
      	
      		
       		
       		
       		
       			
       	
       
        		SELECT 			u.USER_ID,			u.USER_USERNAME,			u.USER_PASSWORD,			r.ROLE_ID,			r.ROLE_NAME,			p.PERMISSION_ID,			p.PERMISSION_NAME		FROM		  tbl_user as u,		  tbl_role as r,		  tbl_permission as p,		  tbl_permission_role as pr,		  tbl_role_user as ru		WHERE		  u.USER_ID = ru.USER_ID		AND		  r.ROLE_ID = ru.ROLE_ID		AND		  p.PERMISSION_ID = pr.PERMISSION_ID		AND		  r.ROLE_ID = pr.ROLE_ID			
        		
        		
         		AND			u.USER_USERNAME = #username#

Java代码

public interface UserDao {

User findUserByUsername(String username);

}

@Repository("userDao")

public class UserDaoImpl implements UserDao {

@Resource

private SqlMapClientTemplate sqlMapClientTemplate;

@Override

public User findUserByUsername(String username) {

Validate.notEmpty(username, "用户名不可为null或empty string");

return (User) sqlMapClientTemplate.queryForObject("user.select-01", username);

}

}

public interface UserDao {	User findUserByUsername(String username);}@Repository("userDao")public class UserDaoImpl implements UserDao {	@Resource	private SqlMapClientTemplate sqlMapClientTemplate;		@Override	public User findUserByUsername(String username) {		Validate.notEmpty(username, "用户名不可为null或empty string");		return (User) sqlMapClientTemplate.queryForObject("user.select-01", username);	}}

(三) 用户和权限数据源是自己设计的，应该实现自己的Realm对象。

Java代码

package com.ztgame.sd.security.realm;

import java.util.HashSet;

import java.util.Set;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.realm.Realm;

import org.apache.shiro.subject.PrincipalCollection;

import org.springframework.beans.factory.InitializingBean;

import org.springframework.util.Assert;

import com.ztgame.sd.dao.UserDao;

import com.ztgame.sd.domain.Permission;

import com.ztgame.sd.domain.Role;

import com.ztgame.sd.domain.User;

public class JdbcRealm extends AuthorizingRealm

implements

Realm,

InitializingBean

{

private UserDao userDao;

// ------------------------------------------------------------------------------------------------------------

@Override

public void afterPropertiesSet() throws Exception {

Assert.notNull(userDao);

}

// ------------------------------------------------------------------------------------------------------------

@Override

public String getName() {

return getClass().getName();

}

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String username = (String) super.getAvailablePrincipal(principals);

User user = userDao.findUserByUsername(username);

SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

Set<String> roles = new HashSet<String>();

Set<String> permissions = new HashSet<String>();

for (Role role : user.getRoleSet()) {

roles.add(role.getName());

for (Permission per : role.getPermissionSet()) {

permissions.add(per.getName());

}

}

info.addRoles(roles);

info.addStringPermissions(permissions);

return info;

}

@Override

protected AuthenticationInfo doGetAuthenticationInfo(

AuthenticationToken token) throws AuthenticationException {

SimpleAuthenticationInfo info = null;

UsernamePasswordToken upt = (UsernamePasswordToken) token;

String username = upt.getUsername();

User user = userDao.findUserByUsername(username);

if (user == null) {

throw new AuthenticationException();

}

info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());

return info;

}

// ------------------------------------------------------------------------------------------------------------

public void setUserDao(UserDao userDao) {

this.userDao = userDao;

}

}

package com.ztgame.sd.security.realm;import java.util.HashSet;import java.util.Set;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.AuthenticationInfo;import org.apache.shiro.authc.AuthenticationToken;import org.apache.shiro.authc.SimpleAuthenticationInfo;import org.apache.shiro.authc.UsernamePasswordToken;import org.apache.shiro.authz.AuthorizationInfo;import org.apache.shiro.authz.SimpleAuthorizationInfo;import org.apache.shiro.realm.AuthorizingRealm;import org.apache.shiro.realm.Realm;import org.apache.shiro.subject.PrincipalCollection;import org.springframework.beans.factory.InitializingBean;import org.springframework.util.Assert;import com.ztgame.sd.dao.UserDao;import com.ztgame.sd.domain.Permission;import com.ztgame.sd.domain.Role;import com.ztgame.sd.domain.User;public class JdbcRealm extends AuthorizingRealm 	implements			Realm, 			InitializingBean{	private UserDao userDao;	// ------------------------------------------------------------------------------------------------------------	@Override	public void afterPropertiesSet() throws Exception {		Assert.notNull(userDao);	}	// ------------------------------------------------------------------------------------------------------------	@Override	public String getName() {		return getClass().getName();	}	@Override	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {				String username = (String) super.getAvailablePrincipal(principals);		User user = userDao.findUserByUsername(username);				SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();		Set
     
       roles = new HashSet
      
       ();		Set
       
         permissions = new HashSet
        
         ();		for (Role role : user.getRoleSet()) {			roles.add(role.getName());			for (Permission per : role.getPermissionSet()) {				permissions.add(per.getName());			}		}		info.addRoles(roles);		info.addStringPermissions(permissions);		return info;	}	@Override	protected AuthenticationInfo doGetAuthenticationInfo(			AuthenticationToken token) throws AuthenticationException {		SimpleAuthenticationInfo info = null;		UsernamePasswordToken upt = (UsernamePasswordToken) token;		String username = upt.getUsername();		User user = userDao.findUserByUsername(username);				if (user == null) {			throw new AuthenticationException();		}		info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());		return info;	}	// ------------------------------------------------------------------------------------------------------------	public void setUserDao(UserDao userDao) {		this.userDao = userDao;	}}

(四) apache-shiro的配置

web.xml

Xml代码

<?xml version="1.0" encoding="UTF-8"?>

<web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

<filter>

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>shiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

</web-app>


     
     		
      	
      		
       
        shiroFilter
       		
       
        org.springframework.web.filter.DelegatingFilterProxy
       	
      	
      		
       
        shiroFilter
       		
       
        /*

spring-shiro.xml

Xml代码

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"

xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util"

xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"

xmlns:context="http://www.springframework.org/schema/context"

xsi:schemaLocation="

http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd

http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd

http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd

http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd

http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd">

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<property name="securityManager" ref="securityManager" />

<property name="loginUrl" value="/login" />

<property name="successUrl" value="/login/loginSuccessFull" />

<property name="unauthorizedUrl" value="/login/unauthorized" />

<!--

<property name="filterChainDefinitions">

<value>

/ = anon

</value>

</property>

</bean>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="authenticator" ref="authenticator" />

<property name="sessionManager" ref="sessionManager" />

<property name="cacheManager" ref="cacheManager" />

<property name="realms">

<list>

<bean class="com.ztgame.sd.security.realm.JdbcRealm">

<property name="userDao" ref="userDao" />

<property name="credentialsMatcher" ref="hashedCredentialsMatcher" />

</bean>

</list>

</property>

</bean>

<bean id="authenticator" class="org.apache.shiro.authc.pam.ModularRealmAuthenticator" />

<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">

<property name="sessionDAO" ref="sessionDAO" />

</bean>

<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" />

<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO" />

<bean id="hashedCredentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">

<property name="hashAlgorithmName" value="MD5" />

<property name="storedCredentialsHexEncoded" value="true" />

<property name="hashIterations" value="1" />

</bean>

</beans>

spring-mvc.xml

Xml代码

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"

xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util"

xmlns:aop="http://www.springframework.org/schema/aop" xmlns:mvc="http://www.springframework.org/schema/mvc"

xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context"

xsi:schemaLocation="

http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd

http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd

http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd

http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd

http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd

http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd">

<!--

以下两个bean的配置是为了在Controller层使用元注释控制权限

如果使用spring-mvc一定要不要放在webroot的配置文件中

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />

<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">

<property name="securityManager" ref="securityManager" />

</bean>

</beans>

(五) jsp-taglib 支持

<shiro:authenticated> 登录之后

<shiro:notAuthenticated> 不在登录状态时

<shiro:guest> 用户在没有RememberMe时

<shiro:user> 用户在RememberMe时

<shiro:hasAnyRoles name="abc,123" > 在有abc或者123角色时

<shiro:hasRole name="abc"> 拥有角色abc

<shiro:lacksRole name="abc"> 没有角色abc

<shiro:hasPermission name="abc"> 拥有权限abc

<shiro:lacksPermission name="abc"> 没有权限abc

<shiro:principal> 显示用户登录名

[官方文档]

(六) 默认过滤器(10个)

anon -- org.apache.shiro.web.filter.authc.AnonymousFilter

authc -- org.apache.shiro.web.filter.authc.FormAuthenticationFilter

authcBasic -- org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter

perms -- org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter

port -- org.apache.shiro.web.filter.authz.PortFilter

rest -- org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter

roles -- org.apache.shiro.web.filter.authz.RolesAuthorizationFilter

ssl -- org.apache.shiro.web.filter.authz.SslFilter

user -- org.apache.shiro.web.filter.authc.UserFilter

logout -- org.apache.shiro.web.filter.authc.LogoutFilter

anon:例子/admins/**=anon 没有参数，表示可以匿名使用。

authc:例如/admins/user/**=authc表示需要认证(登录)才能使用，没有参数

roles：例子/admins/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。

perms：例子/admins/user/**=perms[user:add:*],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。

rest：例子/admins/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。

port：例子/admins/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。

authcBasic：例如/admins/user/**=authcBasic没有参数表示httpBasic认证

ssl:例子/admins/user/**=ssl没有参数，表示安全的url请求，协议为https

user:例如/admins/user/**=user没有参数表示必须存在用户，当登入操作时不做检查

[官方文档]

(七) 常用元注释