怎么利用shiro权限动态控制每个url资源呢？主要包括jsp(html)页面、action的url访问，而静态资源和登录资源则可直接访问。
所谓动态控制url就是url的权限控制不是手动写死在配置文件中，而是根据数据库的变化而变化。
表结构：
user2：用户表
t_role：角色表
t_user_role：用户角色表
t_privilege：权限资源表
t_role_privilege：角色权限资源表
shiro动态控制url资源：
applicationContext-shiro.xml配置chainDefinitionSectionMetaSource：
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:util="http://www.springframework.org/schema/util"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:p="http://www.springframework.org/schema/p"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"> <description>apache shiro配置</description> <bean id="chainDefinitionSectionMetaSource" class="com.test.www.web.filter.ChainDefinitionSectionMetaSource">
<property name="filterChainDefinitions">
<value>
<!-- 静态资源允许访问 -->
<!-- /** = anon -->
<!-- /app/** = anon
/assets/** = anon -->
<!-- 登录页允许访问 -->
<!-- /user/login.htm = anon -->
<!-- /login.jsp = anon -->
<!-- /*.jsp = anon -->
<!-- /js/**=anon -->
<!-- 登录页面 -->
/index2.jsp = anon
/js/** = anon
/css/** = anon
/images/** = anon
/assets/** = anon
/test/loginAdmin.html=anon
/logout=logout <!-- 这才是对退出的配置 -->
<!-- /test/add.html = perms["user:add"] -->
<!-- /test/add.html = perms["/test/add.html"] -->
<!-- 其他资源需要认证 -->
<!-- /** = authc -->
<!-- /logout=logout --> <!-- 这才是对退出的配置，不能放在/** = authc的后面 --> </value>
</property>
</bean> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="filters">
<map>
<entry key="logout" value-ref="logoutFilter"/>
</map>
</property>
<property name="securityManager" ref="securityManager"/>
<!-- <property name="loginUrl" value="/index2.jsp"/>
<property name="successUrl" value="/main/main.htm"/>
<property name="unauthorizedUrl" value="/page/401.htm"/> -->
<!-- shiro判断是否登录，没有登录则跳转到登录页面，loginUrl对应登录页面的路径 -->
<property name="loginUrl" value="/index2.jsp"/>
<property name="unauthorizedUrl" value="/page/401.htm"/><!-- /page/401.htm --> <property name="filterChainDefinitionMap" ref="chainDefinitionSectionMetaSource" />
</bean> <!-- 缓存管理器 使用Ehcache实现 -->
<!--
<bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" p:cacheManagerConfigFile="/WEB-INF/conf/ehcache-shiro.xml">
</bean>
-->
<!-- 会话DAO -->
<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO"/> <!-- 会话管理器 -->
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<property name="sessionDAO" ref="sessionDAO"/>
</bean> <!-- 安全管理器 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realms">
<list>
<ref bean="securityRealm"/>
</list>
</property>
<!-- cacheManager,集合spring缓存工厂 -->
<!-- <property name="cacheManager" ref="shiroEhcacheManager" />
<property name="sessionManager" ref="sessionManager" /> -->
</bean> <!-- Shiro生命周期处理器 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> </beans>
ChainDefinitionSectionMetaSource.java：
package com.test.www.web.filter; import java.text.MessageFormat;
import java.util.List; import javax.annotation.Resource; import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.config.Ini;
import org.apache.shiro.config.Ini.Section;
import org.springframework.beans.factory.FactoryBean; import com.test.www.web.entity.user.TPrivilege;
import com.test.www.web.service.user.TPrivilegeService; public class ChainDefinitionSectionMetaSource implements FactoryBean<Ini.Section>{ public static final String PREMISSION_STRING="perms[\"{0}\"]"; private String filterChainDefinitions; /*private PrivilegeDao privilegeDao; public PrivilegeDao getPrivilegeDao() {
return privilegeDao;
}*/ @Resource
private TPrivilegeService tPrivilegeService; public String getFilterChainDefinitions() {
return filterChainDefinitions;
} @Resource
public void setFilterChainDefinitions(String filterChainDefinitions) {
String fiter="";//改正后的url配置
/*List<Privilege> list = privilegeDao.getAll();
for (Iterator<Privilege> it = list.iterator(); it.hasNext();) {
Privilege privilege = it.next();
if(!StringUtils.isEmpty(privilege.getUrl())) {
fiter+="/"+privilege.getUrl()+" = authc," +MessageFormat.format(PREMISSION_STRING,privilege.getPerms()) +"\n";
}//追加beans.xml中已经有的过滤
}*/ List<TPrivilege> tPrivilegeList = tPrivilegeService.selectAllPrivileges();
if(tPrivilegeList!=null && tPrivilegeList.size()>0){
for (TPrivilege tPrivilege : tPrivilegeList) {
if(!StringUtils.isEmpty(tPrivilege.getUrl())) {
fiter += tPrivilege.getUrl()+" = authc," +MessageFormat.format(PREMISSION_STRING,tPrivilege.getUrl()) +"\n";
}//追加beans.xml中已经有的过滤
}
} //对url拦截
fiter += "/**"+" = authc" +"\n";
//fiter+="/test/add.html"+" = authc," +MessageFormat.format(PREMISSION_STRING,"/test/add.html") +"\n";
//fiter+="/js/**"+" = authc," +MessageFormat.format(PREMISSION_STRING,"/js/**") +"\n";
//fiter+="/js/**"+" = " +MessageFormat.format(PREMISSION_STRING,"/js/**") +"\n";
System.out.println(filterChainDefinitions+fiter);
this.filterChainDefinitions = filterChainDefinitions+fiter;
} /*@Resource
public void setPrivilegeDao(PrivilegeDao privilegeDao) {
this.privilegeDao = privilegeDao;
}*/ public Section getObject(){
Ini ini = new Ini();//网上好多都是在这里配置URL的。但是发现是错误的。
ini.load(filterChainDefinitions);
Ini.Section section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
return section;
} public Class<?> getObjectType() {
return this.getClass();
} public boolean isSingleton() {
return false;
} }
服务器启动的时候会执行ChainDefinitionSectionMetaSource类，加载系统权限资源表所有的url到filterChainDefinitions中（在filterChainDefinitions后追加），从而实现对所有url资源的权限控制的配置：
这个类就是用来在filterChainDefinitions中追加url资源权限控制的。
注意：
/** = authc应放在最后，否则会影响追加的权限资源的控制。
当访问资源的时候，例如/test/toAddUser.html，就会进入shiro授权方法中进行权限校验，如果没有权限则进入到401未授权，否则正常访问。
SecurityRealm.java：
package com.test.www.web.security; import java.util.List; import javax.annotation.Resource; import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Component; import com.test.www.web.entity.user.TRolePrivilegeKey;
import com.test.www.web.entity.user.TUserRoleKey;
import com.test.www.web.entity.user.User;
import com.test.www.web.service.user.TRolePrivilegeService;
import com.test.www.web.service.user.TUserRoleService;
import com.test.www.web.service.user.UserService; /**
* 用户身份验证,授权 Realm 组件
*
**/
@Component(value = "securityRealm")
public class SecurityRealm extends AuthorizingRealm {
@Resource
private UserService userService;
@Resource
private TUserRoleService tUserRoleService;
@Resource
private TRolePrivilegeService tRolePrivilegeService;
/**
* 权限检查
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
/*SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
String username = String.valueOf(principals.getPrimaryPrincipal()); System.out.println("ssssssss");*/
String username = principals.getPrimaryPrincipal().toString() ;
System.out.println(username); Subject subject = SecurityUtils.getSubject();
User user = (User)subject.getPrincipal(); SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo() ; /*Set<String> roleName = t_userService.findRoles(username) ;
Set<String> permissions = t_userService.findPermissions(username) ;*/
//final List<Role> roleInfos = roleService.selectRolesByUserId(user.getUserId());
/*for (Role role : roleInfos) {
// 添加角色
System.err.println(role);
authorizationInfo.addRole(role.getRoleSign()); final List<Permission> permissions = permissionService.selectPermissionsByRoleId(role.getRoleId());
for (Permission permission : permissions) {
// 添加权限
System.err.println(permission);
authorizationInfo.addStringPermission(permission.getPermissionSign());
}
}*/ List<TUserRoleKey> tUserRoleKeyList = tUserRoleService.selectRolesByUserId(user.getId());
if(tUserRoleKeyList != null && tUserRoleKeyList.size()>0){
for(TUserRoleKey tUserRoleKey : tUserRoleKeyList){
authorizationInfo.addRole(tUserRoleKey.getCode());
List<TRolePrivilegeKey> tRolePrivilegeKeyList = tRolePrivilegeService.selectPrivilegesByRoleId(tUserRoleKey.getRoleId());
for(TRolePrivilegeKey tRolePrivilegeKey : tRolePrivilegeKeyList){
authorizationInfo.addStringPermission(tRolePrivilegeKey.getUrl());
}
}
}
//Set<String> roleName = new HashSet<String>();
//Set<String> permissions = new HashSet<String>();
//查询角色
//roleName.add("admin");
//根据角色查询权限
//permissions.add("/test/add.html1"); //pub:coursecategory user:add
//permissions.add("/js/**");
//permissions.add("/jsp");
//authorizationInfo.setRoles(roleName);
//authorizationInfo.setStringPermissions(permissions);
return authorizationInfo;
} /**
* 登录验证
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
/* String username = String.valueOf(token.getPrincipal());
String password = new String((char[]) token.getCredentials());
System.out.println("aaaaaaa");
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(username, password, getName());*/
//int i = 1/0; //获取用户账号
//验证账号密码
UsernamePasswordToken userToken = (UsernamePasswordToken) token;
System.out.println("1:"+userToken.getUsername());
User user = userService.getUserByUserName(userToken.getUsername());
System.out.println("2");
if (user != null){
//将查询到的用户账号和密码存放到 authenticationInfo用于后面的权限判断。第三个参数传入realmName。
AuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user,user.getPassword(),this.getClass().getSimpleName()) ;
return authenticationInfo ;
}else{
return null ;
}
} }
至此，shiro动态控制url权限资源已完成。
说明：
url资源（action、静态html或动态页面jsp的url）保存在数据库中。