spring+shiro+springmvc+maven权限卡控示例

时间：2022-11-04 16:35:48

项目结构

spring+shiro+springmvc+maven权限卡控示例

UserController , 主要负责用户登入和注销。

LinewellController, 主要负责请求受权限卡控的数据。

MyRealm，自定义realm。

Authorization，主要是权限过滤器。

UserController

package com.linewell.controller;

import com.alibaba.fastjson.JSON;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.subject.Subject;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.ResponseBody;

import java.util.HashMap;

import java.util.Map;

@Controller

@RequestMapping("/user")

public class UserController {

    /**

     * 用户登录

     */

    @RequestMapping("/login")

    @ResponseBody

    public String login(String username, String password) {

        Map<String, Object> result = new HashMap<>();

        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);

        Subject subject = SecurityUtils.getSubject();

        subject.login(usernamePasswordToken);

        result.put("success", true);

        return JSON.toJSONString(result);

    }

    /**

     * 注销登录

     */

    @RequestMapping("/logout")

    public String logout() {

        Map<String, Object> result = new HashMap<>();

        SecurityUtils.getSubject().logout();

        result.put("success", true);

        return JSON.toJSONString(result);

    }

}

LinewellController：

package com.linewell.controller;

import com.alibaba.fastjson.JSONObject;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.ResponseBody;

import java.util.HashMap;

import java.util.Map;

@Controller

@RequestMapping("/linewell")

public class LinewellController {

    @RequestMapping("/getData")

    @ResponseBody

    public String getData() {

        Map<String, Object> result = new HashMap<>();

        result.put("data", "you have put data to result");

        return JSONObject.toJSONString(result);

    }

}

MyRealm:

package com.linewell.system;

import org.apache.shiro.authc.*;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;

import java.util.Set;

public class MyRealm extends AuthorizingRealm {

    public String getName(){

        return "myRealm";

    }

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();

        Set<String> set = new HashSet<>();

        set.add("admin");

        set.add("user");

        simpleAuthorizationInfo.setRoles(set);

        Set<String> permissions = new HashSet<>();

        permissions.add("/linewell/getData");

        System.out.println(permissions);

        simpleAuthorizationInfo.setStringPermissions(permissions);

        return simpleAuthorizationInfo;

    }

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;

        String principal = String.valueOf(usernamePasswordToken.getPrincipal());

        String credential = String.valueOf(usernamePasswordToken.getPassword());

        if (principal.equals("admin") && credential.equals("123123")) {

        } else {

            throw new AuthenticationException("账号或者密码错误");

        }

        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(token.getPrincipal(), token.getCredentials(), getName());

        return simpleAuthenticationInfo;

    }

    @Override

    public void clearCachedAuthorizationInfo(PrincipalCollection principals) {

        super.clearCachedAuthorizationInfo(principals);

    }

    @Override

    public void clearCachedAuthenticationInfo(PrincipalCollection principals) {

        super.clearCachedAuthenticationInfo(principals);

    }

    @Override

    public void clearCache(PrincipalCollection principals) {

        super.clearCache(principals);

    }

    public void clearAllCachedAuthorizationInfo() {

        getAuthorizationCache().clear();

    }

    public void clearAllCachedAuthenticationInfo() {

        getAuthenticationCache().clear();

    }

}

Authorization:

package com.linewell.system;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.web.filter.authz.AuthorizationFilter;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

public class Authorization extends AuthorizationFilter {

    @Override

    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {

        HttpServletRequest req = (HttpServletRequest) servletRequest;

        Subject subject = SecurityUtils.getSubject();

        if (!subject.isAuthenticated()) {

            return false;

        }

        String effectivePath = req.getRequestURI().substring(req.getContextPath().length());

        System.out.println(effectivePath);

        if (subject.isPermitted(effectivePath)) {

            return true;

        } else {

            return false;

        }

    }

}

web.xml:

<?xml version="1.0" encoding="UTF-8"?>

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:web="http://java.sun.com/xml/ns/javaee" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" version="3.0">

  <display-name>Archetype Created Web Application</display-name>

  <context-param>

    <param-name>contextConfigLocation</param-name>

    <param-value>classpath*:spring-shiro.xml</param-value>

  </context-param>

  <!-- 在 applicationContext.xml 中，过滤器名称 “shiroFilter” bean的名称匹配。-->

  <filter>

    <filter-name>shiroFilter</filter-name>

    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

    <init-param>

      <param-name>targetFilterLifecycle</param-name>

      <param-value>true</param-value>

    </init-param>

  </filter>

  <!-- 确保你想要的任何请求都可以被过滤。/ * 捕获所有

  请求。通常，这个过滤器映射首先 （在所有其他的之前）定义，

  确保 Shiro 在过滤器链的后续过滤器中工作:-->

  <filter-mapping>

    <filter-name>shiroFilter</filter-name>

    <url-pattern>/*</url-pattern>

  </filter-mapping>

  <filter>

    <filter-name>CharacterEncodingFilter</filter-name>

    <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>

    <init-param>

      <param-name>encoding</param-name>

      <param-value>utf-8</param-value>

    </init-param>

  </filter>

  <filter-mapping>

    <filter-name>CharacterEncodingFilter</filter-name>

    <url-pattern>/</url-pattern>

  </filter-mapping>

  <listener>

    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

  </listener>

  <servlet>

    <servlet-name>springmvc</servlet-name>

    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

    <!-- 可以自定义servlet.xml配置文件的位置和名称-->

    <init-param>

      <param-name>contextConfigLocation</param-name>

      <param-value>classpath*:spring-mvc.xml</param-value>

    </init-param>

    <load-on-startup>1</load-on-startup>

  </servlet>

  <servlet-mapping>

    <servlet-name>springmvc</servlet-name>

    <url-pattern>/</url-pattern>

  </servlet-mapping>

  <welcome-file-list>

    <welcome-file>index.jsp</welcome-file>

  </welcome-file-list>

</web-app>

spring-mvc.xml配置:

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

       xmlns:context="http://www.springframework.org/schema/context"

       xmlns:mvc="http://www.springframework.org/schema/mvc"

       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd">

    <!--开启注解扫描-->

    <mvc:annotation-driven />

    <!-- 静态文件目录 -->

    <mvc:resources mapping="/images/**" location="/images/" />

    <mvc:resources mapping="/css/**" location="/css/" />

    <!--设置注解类所在的jar包-->

    <context:component-scan base-package="com.linewell.controller"/>

</beans>

spring-shiro配置:

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"

       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

       xmlns:context="http://www.springframework.org/schema/context"

       xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:util="http://www.springframework.org/schema/util"

       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">

    <!--设置注解类所在的jar包-->

    <context:component-scan base-package="com.linewell" />

    <!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) -->

    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">

        <property name="staticMethod"

                  value="org.apache.shiro.SecurityUtils.setSecurityManager" />

        <property name="arguments" ref="securityManager" />

    </bean>

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"/>

        <!-- 登录页面 -->

        <property name="loginUrl" value="/login.jsp"/>

        <!-- 登录成功后的页面 -->

        <property name="successUrl" value="/index.jsp"/>

        <!-- 非法访问跳转的页面 -->

        <property name="unauthorizedUrl" value="/403"/>

        <!-- 权限配置 -->

        <property name="filters">

            <util:map>

<!--                <entry key="authentic">

                    <bean class="com.linewell.system.Authentic" />

                </entry>-->

                <entry key="authorization">

                    <bean class="com.linewell.system.Authorization" />

                </entry>

            </util:map>

        </property>

        <property name="filterChainDefinitions">

            <value>

                <!-- 无需认证即可访问的静态资源，还可以添加其他 url -->

                /images/** = anon

                /css/** = anon

                <!-- 登入方法无需过滤 -->

                /user/login = anon

                <!--注意：不是/**, 否则后面的都没有办法进行拦截了。-->

                /* = user

                <!-- 除了上述忽略的资源，其他所有资源都需要认证后才能访问 -->

                /linewell/** = authorization

            </value>

        </property>

    </bean>

    <bean id="myRealm" class="com.linewell.system.MyRealm"></bean>

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="myRealm" />

    </bean>

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

</beans>

maven依赖:

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

  <modelVersion>4.0.0</modelVersion>

  <groupId>com.linewell</groupId>

  <artifactId>springshiro</artifactId>

  <version>1.0-SNAPSHOT</version>

  <packaging>war</packaging>

  <name>springshiro Maven Webapp</name>

  <!-- FIXME change it to the project's website -->

  <url>http://www.example.com</url>

  <properties>

    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>

    <maven.compiler.source>1.7</maven.compiler.source>

    <maven.compiler.target>1.7</maven.compiler.target>

   <!--指定spring的版本号-->

    <springframework.version>5.0.4.RELEASE</springframework.version>

    <shiro.version>1.2.3</shiro.version>

  </properties>

  <dependencies>

    <dependency>

      <groupId>junit</groupId>

      <artifactId>junit</artifactId>

      <version>4.11</version>

      <scope>test</scope>

    </dependency>

    <!--spring 依赖-->

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-test</artifactId>

      <version>${springframework.version}</version>

      <scope>test</scope>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-beans</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-context</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-core</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-web</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-webmvc</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-jms</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-tx</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-context-support</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <dependency>

      <groupId>org.springframework</groupId>

      <artifactId>spring-jdbc</artifactId>

      <version>${springframework.version}</version>

    </dependency>

    <!--shiro依赖-->

    <dependency>

      <groupId>org.apache.shiro</groupId>

      <artifactId>shiro-ehcache</artifactId>

      <version>${shiro.version}</version>

    </dependency>

    <dependency>

      <groupId>org.apache.shiro</groupId>

      <artifactId>shiro-web</artifactId>

      <version>${shiro.version}</version>

    </dependency>

    <dependency>

      <groupId>org.apache.shiro</groupId>

      <artifactId>shiro-quartz</artifactId>

      <version>${shiro.version}</version>

    </dependency>

    <dependency>

      <groupId>org.apache.shiro</groupId>

      <artifactId>shiro-spring</artifactId>

      <version>${shiro.version}</version>

    </dependency>

    <dependency>

      <groupId>org.apache.shiro</groupId>

      <artifactId>shiro-core</artifactId>

      <version>${shiro.version}</version>

    </dependency>

    <dependency>

      <groupId>org.apache.commons</groupId>

      <artifactId>commons-lang3</artifactId>

      <version>3.4</version>

    </dependency>

      <dependency>

          <groupId>javax.servlet</groupId>

          <artifactId>javax.servlet-api</artifactId>

          <version>3.1.0</version>

      </dependency>

    <dependency>

      <groupId>com.alibaba</groupId>

      <artifactId>fastjson</artifactId>

      <version>1.2.29</version>

    </dependency>

  </dependencies>

  <build>

    <finalName>springshiro</finalName>

    <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->

      <plugins>

        <plugin>

          <artifactId>maven-clean-plugin</artifactId>

          <version>3.1.0</version>

        </plugin>

        <!-- see http://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_war_packaging -->

        <plugin>

          <artifactId>maven-resources-plugin</artifactId>

          <version>3.0.2</version>

        </plugin>

        <plugin>

          <artifactId>maven-compiler-plugin</artifactId>

          <version>3.8.0</version>

        </plugin>

        <plugin>

          <artifactId>maven-surefire-plugin</artifactId>

          <version>2.22.1</version>

        </plugin>

        <plugin>

          <artifactId>maven-war-plugin</artifactId>

          <version>3.2.2</version>

        </plugin>

        <plugin>

          <artifactId>maven-install-plugin</artifactId>

          <version>2.5.2</version>

        </plugin>

        <plugin>

          <artifactId>maven-deploy-plugin</artifactId>

          <version>2.8.2</version>

        </plugin>

      </plugins>

    </pluginManagement>

  </build>

</project>

相关文章