阳光VIP

少壮不努力，老大徒伤悲。平日弗用功，自到临期悔。
  博客园  :: 首页  :: 新随笔  :: 联系 :: 订阅 订阅  :: 管理

基于Spring框架的Shiro配置

Posted on 2012-02-14 11:18  阳光VIP  阅读(503)  评论(0)    收藏  举报

一、在web.xml中添加shiro过滤器

Xml代码 复制代码 收藏代码
  1. <!-- Shiro filter-->  
  2. <filter>  
  3.     <filter-name>shiroFilter</filter-name>  
  4.     <filter-class>  
  5.         org.springframework.web.filter.DelegatingFilterProxy   
  6.     </filter-class>  
  7. </filter>  
  8. <filter-mapping>  
  9.     <filter-name>shiroFilter</filter-name>  
  10.     <url-pattern>/*</url-pattern>  
  11. </filter-mapping>  
	<!-- Shiro filter-->
	<filter>
		<filter-name>shiroFilter</filter-name>
		<filter-class>
			org.springframework.web.filter.DelegatingFilterProxy
		</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>shiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>


二、在Spring的applicationContext.xml中添加shiro配置

Xml代码 复制代码 收藏代码
  1. <!-- Shiro Filter -->  
  2. <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
  3.     <property name="securityManager" ref="securityManager" />  
  4.     <property name="loginUrl" value="/login" />  
  5.     <property name="successUrl" value="/user/list" />  
  6.     <property name="unauthorizedUrl" value="/login" />  
  7.     <property name="filterChainDefinitions">  
  8.         <value>  
  9.             /login = anon  
  10.             /user/** = authc   
  11.             /role/edit/* = perms[role:edit]   
  12.             /role/save = perms[role:edit]   
  13.             /role/list = perms[role:view]   
  14.             /** = authc   
  15.         </value>  
  16.     </property>  
  17. </bean>  
<!-- Shiro Filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
	<property name="securityManager" ref="securityManager" />
	<property name="loginUrl" value="/login" />
	<property name="successUrl" value="/user/list" />
	<property name="unauthorizedUrl" value="/login" />
	<property name="filterChainDefinitions">
		<value>
			/login = anon
			/user/** = authc
			/role/edit/* = perms[role:edit]
			/role/save = perms[role:edit]
			/role/list = perms[role:view]
			/** = authc
		</value>
	</property>
</bean>


2、添加securityManager定义

  
Xml代码 复制代码 收藏代码
  1. <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
  2.     <property name="realm" ref="myRealm" />  
  3. </bean>  
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="myRealm" />
	</bean>


3、添加realm定义

Xml代码 复制代码 收藏代码
  1. <bean id=" myRealm" class="com...MyRealm" />  
<bean id=" myRealm" class="com...MyRealm" />


三、实现MyRealm：继承AuthorizingRealm，并重写认证授权方法

Java代码 复制代码 收藏代码
  1. public class MyRealm extends AuthorizingRealm{      
  2.      
  3.     private AccountManager accountManager;      
  4.     public void setAccountManager(AccountManager accountManager) {      
  5.         this.accountManager = accountManager;      
  6.     }      
  7.      
  8.     /**    
  9.      * 授权信息    
  10.      */     
  11.     protected AuthorizationInfo doGetAuthorizationInfo(      
  12.                 PrincipalCollection principals) {      
  13.         String username=(String)principals.fromRealm(getName()).iterator().next();      
  14.         if( username != null ){      
  15.             User user = accountManager.get( username );      
  16.             if( user != null && user.getRoles() != null ){      
  17.                 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();      
  18.                 for( SecurityRole each: user.getRoles() ){      
  19.                         info.addRole(each.getName());      
  20.                         info.addStringPermissions(each.getPermissionsAsString());      
  21.                 }      
  22.                 return info;      
  23.             }      
  24.         }      
  25.         return null;      
  26.     }      
  27.      
  28.     /**    
  29.      * 认证信息    
  30.      */     
  31.     protected AuthenticationInfo doGetAuthenticationInfo(      
  32.                 AuthenticationToken authcToken ) throws AuthenticationException {      
  33.         UsernamePasswordToken token = (UsernamePasswordToken) authcToken;      
  34.         String userName = token.getUsername();      
  35.         if( userName != null && !"".equals(userName) ){      
  36.             User user = accountManager.login(token.getUsername(),      
  37.                             String.valueOf(token.getPassword()));      
  38.      
  39.             if( user != null )      
  40.                 return new SimpleAuthenticationInfo(      
  41.                             user.getLoginName(),user.getPassword(), getName());      
  42.         }      
  43.         return null;      
  44.     }      
  45.      
  46. }  
public class MyRealm extends AuthorizingRealm{   
  
    private AccountManager accountManager;   
    public void setAccountManager(AccountManager accountManager) {   
        this.accountManager = accountManager;   
    }   
  
    /**  
     * 授权信息  
     */  
    protected AuthorizationInfo doGetAuthorizationInfo(   
                PrincipalCollection principals) {   
        String username=(String)principals.fromRealm(getName()).iterator().next();   
        if( username != null ){   
            User user = accountManager.get( username );   
            if( user != null && user.getRoles() != null ){   
                SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();   
                for( SecurityRole each: user.getRoles() ){   
                        info.addRole(each.getName());   
                        info.addStringPermissions(each.getPermissionsAsString());   
                }   
                return info;   
            }   
        }   
        return null;   
    }   
  
    /**  
     * 认证信息  
     */  
    protected AuthenticationInfo doGetAuthenticationInfo(   
                AuthenticationToken authcToken ) throws AuthenticationException {   
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;   
        String userName = token.getUsername();   
        if( userName != null && !"".equals(userName) ){   
            User user = accountManager.login(token.getUsername(),   
                            String.valueOf(token.getPassword()));   
  
            if( user != null )   
                return new SimpleAuthenticationInfo(   
                            user.getLoginName(),user.getPassword(), getName());   
        }   
        return null;   
    }   
  
}
 相关参考：
http://www.cnblogs.com/skyme/archive/2011/09/11/2173760.html
http://kdboy.iteye.com/blog/1154644
http://www.xmsydw.com