一、添加相關(guān)依賴
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
<dependency> <groupid>org.apache.shiro</groupid> <artifactid>shiro-core</artifactid> <version>1.2.1</version> </dependency> <dependency> <groupid>org.apache.shiro</groupid> <artifactid>shiro-web</artifactid> <version>1.2.1</version> </dependency> <dependency> <groupid>org.apache.shiro</groupid> <artifactid>shiro-ehcache</artifactid> <version>1.2.1</version> </dependency> <dependency> <groupid>org.apache.shiro</groupid> <artifactid>shiro-spring</artifactid> <version>1.2.1</version> </dependency> <dependency> <groupid>commons-logging</groupid> <artifactid>commons-logging</artifactid> <version>1.2</version> </dependency> |
二、編寫代碼
1、自定義realm
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
public class commonrealm extends authorizingrealm { @autowired private userloginservice userloginservice; @override public string getname() { return "commonrealm"; } //授權(quán) @override protected authorizationinfo dogetauthorizationinfo(principalcollection principals) { string usernmae = (string) principals.getprimaryprincipal(); list<string> permissions = new arraylist<string>(); if ("admin".equals(usernmae)) { permissions.add("admin:ee"); } simpleauthorizationinfo info = new simpleauthorizationinfo(); info.addstringpermissions(permissions); return info; } //身份認證 @override protected authenticationinfo dogetauthenticationinfo(authenticationtoken token) throws authenticationexception { string username = (string) token.getprincipal(); user user = userloginservice.getuser(username); if (user == null) { return null; } simpleauthenticationinfo info = new simpleauthenticationinfo(username, user.getpassword(), getname()); return info; }} |
2、login controller
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
|
@controllerpublic class useraction { @autowired private userloginservice userloginservice; @requestmapping("/login.do") public string userlogin(httpservletrequest request, string username, string password) throws exception { // 如果登陸失敗從request中獲取異常信息，shirologinfailure就是shiro異常類的全限定名 string exceptionclassname = (string) request.getattribute("shirologinfailure"); if (exceptionclassname != null) { if (unknownaccountexception.class.getname().equals(exceptionclassname)) { // 最終會拋給異常處理器 throw new xxxexception("用戶名不存在"); } else if (incorrectcredentialsexception.class.getname().equals(exceptionclassname)) { throw new xxxexception("用戶名/密碼錯誤"); } else { throw new exception();// 最終在異常處理器生成未知錯誤 } } // 如果登錄成功的話不走此方法，shiro認證成功會自動跳轉(zhuǎn)到上一個請求路徑，配的的successurl沒效果，后邊會說 // 登陸失敗走此方法，捕獲異常，然后 return ~ ,還到login頁面 return "login.jsp"; }} |
3、檢測權(quán)限 controller
|
1
2
3
4
5
6
|
//此方法為了驗證權(quán)限是否生效@requestmapping("/findall.do")@requirespermissions("admin:ee")public modelandview list(httpservletrequest request){ ....... } |
三、常見問題
因為有一些特別常見的問題，需要修改xml配置，所以現(xiàn)在先手問題，把xml配置放在后邊，直接就配置完善好的xml
問題一：登陸成功后shiro默認跳到上一次請求，沒有上一次請求默認跳到/ ，那我們就想控制調(diào)到自己定義的路徑咋辦呢？
解決方案：
步驟一：繼承formauthenticationfilter類，重寫onloginsuccess方法，這里可以自定義路徑，因為這里自定義了成功跳轉(zhuǎn)的路徑，所以配置里的successurl不用配置，賠了也沒效果。。
|
1
2
3
4
5
6
7
8
|
public class loginsuccesstofilter extends formauthenticationfilter { @override protected boolean onloginsuccess(authenticationtoken token, subject subject, servletrequest request, servletresponse response) throws exception { webutils.getandclearsavedrequest(request); webutils.redirecttosavedrequest(request,response,"/findall.do"); return false; }} |
步驟二：
在shiro的xml配置文件中配置
|
1
|
<bean id="myfilter" class="com.xxx.realm.loginsuccesstofilter"></bean> |
在 shirofilter配置中引入,完整xml在后邊
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
|
<bean id="shirofilter" class="org.apache.shiro.spring.web.shirofilterfactorybean"> <property name="filters"> <map> <entry key="authc" value-ref="myfilter"></entry> </map> </property></bean><bean id="shirofilter" class="org.apache.shiro.spring.web.shirofilterfactorybean"> <property name="filters"> <map> <entry key="authc" value-ref="myfilter"></entry> </map> </property></bean> |
四、xml配置
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
|
applicationcontext-shiro.xml<?xml version="1.0" encoding="utf-8"?><beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:context="http://www.springframework.org/schema/context" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:jee="http://www.springframework.org/schema/jee" xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:util="http://www.springframework.org/schema/util" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"> <bean id="shirofilter" class="org.apache.shiro.spring.web.shirofilterfactorybean"> <!-- 管理器，必須設(shè)置 --> <property name="securitymanager" ref="securitymanager"/> <property name="filters"> <map> <entry key="authc" value-ref="myfilter"></entry> </map> </property> <!-- 攔截到，跳轉(zhuǎn)到的地址,通過此地址去認證 --> <property name="loginurl" value="/login.do"/> <!-- 認證成功統(tǒng)一跳轉(zhuǎn)到/admin/index.do，建議不配置，shiro認證成功自動到上一個請求路徑 --> <!--<property name="successurl" value="/findall.do"/>--> <!-- 通過unauthorizedurl指定沒有權(quán)限操作時跳轉(zhuǎn)頁面 --> <property name="unauthorizedurl" value="/refuse.jsp"/> <!-- 自定義filter，可用來更改默認的表單名稱配置 --> <!--<property name="filters">--> <!--<map>--> <!--<!– 將自定義 的formauthenticationfilter注入shirofilter中 –>--> <!--<entry key="authc" value-ref="formauthenticationfilter" />--> <!--</map>--> <!--</property>--> <property name="filterchaindefinitions"> <value> <!-- 對靜態(tài)資源設(shè)置匿名訪問 --> /image/** = anon /css/** = anon /js/** = anon /logout.do = logout /** = authc </value> </property> </bean> <bean id="lifecyclebeanpostprocessor" class="org.apache.shiro.spring.lifecyclebeanpostprocessor"/> <!-- securitymanager安全管理器 --> <bean id="securitymanager" class="org.apache.shiro.web.mgt.defaultwebsecuritymanager"> <property name="realm" ref="customrealm"/> <!-- 注入緩存管理器 --> <!--<property name="cachemanager" ref="cachemanager" />--> <!-- 注入session管理器 --> <!-- <property name="sessionmanager" ref="sessionmanager" /> --> <!-- 記住我 --> <!--<property name="remembermemanager" ref="remembermemanager" />--> </bean> <!-- 自定義realm --> <bean id="customrealm" class="com.dhl.realm.commonrealm"></bean> <bean id="myfilter" class="com.dhl.realm.loginsuccesstofilter"></bean> <!-- 憑證匹配器 --> <!--<bean id="credentialsmatcher"--> <!--class="org.apache.shiro.authc.credential.hashedcredentialsmatcher">--> <!--<!– 選用md5散列算法 –>--> <!--<property name="hashalgorithmname" value="md5"/>--> <!--<!– 進行一次加密 –>--> <!--<property name="hashiterations" value="1"/>--> <!--</bean>--></beans> |
springmvc的配置
|
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
|
<?xml version="1.0" encoding="utf-8"?><beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/xmlschema-instance" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:jdbc="http://www.springframework.org/schema/jdbc" xsi:schemalocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc.xsd"> <context:component-scan base-package="com.dhl.controller"></context:component-scan> <mvc:annotation-driven></mvc:annotation-driven> <bean class="org.springframework.web.servlet.view.internalresourceviewresolver"></bean> <!-- 開啟shiro注解的配置移動到這兒 --> <bean class="org.springframework.aop.framework.autoproxy.defaultadvisorautoproxycreator" depends-on="lifecyclebeanpostprocessor"> <property name="proxytargetclass" value="true" /> </bean> <bean class="org.apache.shiro.spring.security.interceptor.authorizationattributesourceadvisor"> <property name="securitymanager" ref="securitymanager"/> </bean></beans> |
以上就是一個大概的整合和遇到的兩個問題，博主也是查閱了很多的博客得到的較優(yōu)答案，整理出來，已備后續(xù)參考，遇到一樣問題的同學(xué)可以看看
原文鏈接：https://www.cnblogs.com/mutumango/p/9848128.html
