本文介绍了如何在WEB应用中使用Shiro进行身份认证。
在web.xml文件中配置一个Servlet ContextListener的监听器和Filter过滤器。
<listener>
<listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
</listener>
<filter>
<filter-name>ShiroFilter</filter-name>
<filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>ShiroFilter</filter-name>
<url-pattern>/login.do</url-pattern>
</filter-mapping>
JSP页面提交用户名和口令。
<FORM name="form1" action="login.do" method="POST">
<TABLE cellSpacing=0 cellPadding=0 align=center
border=0>
<TBODY>
<TR>
<TD width=250>
<TABLE cellSpacing=3 cellPadding=0 border=0>
<TBODY>
<TR>
<TD width=90><IMG height=29
src="images/title_yhm.gif" width=90></TD>
<TD><INPUT class=logininput name=loginName>
</TD>
</TR>
<TR>
<TD width=90><IMG height=27
src="images/title_mima.gif" width=90></TD>
<TD><INPUT class=logininput type=password
name=password></TD>
</TR>
<TR>
<TD width=90></TD>
<TD align="right"></TD>
</TR>
</TBODY>
</TABLE>
</TD>
<TD vAlign=top>
<TABLE cellSpacing=6 cellPadding=0 border=0>
<TBODY>
<TR>
<TD><IMG style="CURSOR: hand"
onclick=doSubmit() height=35
src="images/button_login.gif" width=77
border=0></TD>
</TR>
</TBODY>
</TABLE>
</TD>
</TR>
</TBODY>
</TABLE>
</FORM>
Shiro的配置文件，/WEB-INF/Shiro.ini。
main]
ds = com.mysql.jdbc.jdbc2.optional.MysqlDataSource
ds.serverName = 127.0.0.1
ds.user = root
ds.password = 123456
ds.databaseName = shiro
ds.url = jdbc:mysql://127.0.0.1:3306/shiro
jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.permissionsLookupEnabled = true
jdbcRealm.authenticationQuery = SELECT password FROM user_credence_information WHERE username = ?
jdbcRealm.dataSource = $ds
shiro.loginUrl = /login.jsp
[users]
# format: username = password, role1, role2, ..., roleN
[roles]
# format: roleName = permission1, permission2, ..., permissionN
[urls]
# The /login.jsp is not restricted to authenticated users (otherwise no one could log in!), but
# the 'authc' filter must still be specified for it so it can process that url's
# login submissions. It is 'smart' enough to allow those requests through as specified by the
# shiro.loginUrl above.
/success.jsp = authc
服务端认证程序。
public class LoginController implements Controller {
private static final Log log = LogFactory.getLog(LoginController.class);
protected ErrMg error;
public ModelAndView doReturnError(HttpServletRequest request,
HttpServletResponse response, ErrMg message, String errpath) {
request.setAttribute("Error_Message", message);
return new ModelAndView(errpath);
}
public ModelAndView handleRequest(HttpServletRequest request,
HttpServletResponse response) throws Exception {
String loginName = request.getParameter("loginName");
String loginPwd = request.getParameter("password");
log.info("用户认证开始:" + loginName + " , " + loginPwd);
String userid = null;
String username = null;
error = new ErrMg();
AuthenticationToken token = new UsernamePasswordToken(loginName,
loginPwd);
Subject currentUser = SecurityUtils.getSubject();
try {
currentUser.login(token);
userid = (String)currentUser.getPrincipal();
log.info( "User [" + currentUser.getPrincipal() + "] logged in successfully." );
log.info("用户认证完毕:" + loginName + " , " + userid);
HttpSession session = request.getSession(true);
session.setAttribute("USERINFORMATION", userid);
session.setAttribute("USERNAME", userid);
return new ModelAndView("success.jsp");
} catch (UnknownAccountException uae) {
log.info("用户认证失败:" + "username wasn't in the system.");
error.setErrorMessage("username wasn't in the system.");
} catch (IncorrectCredentialsException ice) {
log.info("用户认证失败:" + "password didn't match.");
error.setErrorMessage("password didn't match.");
} catch (LockedAccountException lae) {
log.info("用户认证失败:" + "account for that username is locked - can't login.");
error.setErrorMessage("account for that username is locked - can't login.");
} catch (AuthenticationException ae) {
log.info("用户认证失败:" + "unexpected condition.");
error.setErrorMessage("unexpected condition.");
}
return this.doReturnError(request, response, error, "error.jsp");
}
}