Java安全框架 Apache Shiro学习-1-ini 配置

简单登录流程：

1.  SecurityManager  
2.  SecurityUtils.setSecurityManager
3.  SecurityUtils.getSubject    
4.  token（UsernamePasswordToken等） 
5.  subject.login

Apache Shiro Configuration

Shiro 配置--ini

》适用于用户少且不需要在运行时动态创建的情景
1. web.xml 中自定义shiro.ini位置（默认位置）
  1. /WEB-INF/shiro.ini or classpath:shiro.ini
    配置内容
  1. <filter>
  2.     <filter-name>ShiroFilter</filter-name>
  3.     <filter-class>org.apache.shiro.web.servlet.IniShiroFilter</filter-class>
  4.     <init-param>
  5.         <param-name>configPath</param-name>
  6.         <param-value>/WEB-INF/anotherFile.ini</param-value>
  7.     </init-param>
  8. </filter>
2. Shiro.ini 示例
  1. # =======================
  2. # Shiro INI configuration
  3. # =======================
  5. [main]
  6. # Objects and their properties are defined here, 
  7. # Such as the securityManager, Realms and anything
  8. # else needed to build the SecurityManager 
  10. [users]
  11. # The 'users' section is for simple deployments
  12. # when you only need a small number of statically-defined 
  13. # set of User accounts.
  15. [roles]
  16. # The 'roles' section is for simple deployments
  17. # when you only need a small number of statically-defined
  18. # roles.
  20. [urls]
  21. # The 'urls' section is used for url-based security
  22. # in web applications.  We'll discuss this section in the
  23. # Web documentation

说明：

[main]  主配置

configure the application's SecurityManager instance and any of its dependencies, such as Realms.
配置SecurityManager 及其依赖，如Realms（安全数据源）.
  1. [main]
  2. sha256Matcher = org.apache.shiro.authc.credential.Sha256CredentialsMatcher # 加密密码匹配
  3. # true = hex, false = base64:
  4. sha256Matcher.storedCredentialsHexEncoded = false
  5. myRealm = com.company.security.shiro.DatabaseRealm
  6. myRealm.connectionTimeout = 30000
  7. myRealm.username = jsmith # 内部被转换为 myRealm.setUsername("jsmith");
  8. myRealm.password = secret
  9. myRealm.credentialsMatcher = $sha256Matcher # 凭证（密码）加密
  10. securityManager.sessionManager.globalSessionTimeout = 1800000

多个属性（逗号 ，）
  1. securityManager.sessionManager.sessionListeners = $sessionListener1, $sessionListener2
Map形式属性设置
  1. object1 = com.company.some.Class
  2. object2 = com.company.another.Class
  3. ...
  4. anObject = some.class.with.a.Map.property
  5. anObject.mapProperty = key1:$object1, key2:$object2
重复设置的属性，后写的覆盖前面的
  1. myRealm = com.company.security.MyRealm
  2. ...
  3. myRealm = com.company.security.DatabaseRealm  #（覆盖了前面的myRealm）

[users] 用户配置

  1. [users]
  2. admin = secret # A password is required.
  3. lonestarr = vespa, goodguy, schwartz 
  4. darkhelmet = ludicrousspeed, badguy, schwartz
  5. # user1 = sha256-hashed-hex-encoded password, role1, role2, ... # 可以使用 shiro 的 Command Line Hasher 来加密密码。需要配置 credentialsMatcher
格式： 用户 = 密码，角色1，角色2，... ，角色N
  1. username = password, roleName1, roleName2, ..., roleNameN

[roles] 角色配置

  1. [roles]
  2. # 'admin' role has all permissions, indicated by the wildcard '*'
  3. admin = * # 所有权限
  4. # The 'schwartz' role can do anything (*) with any lightsaber:
  5. schwartz = lightsaber:* # 角色 schwartz 拥有对资源 lightsaber 做任何事的权限
  6. # The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with
  7. # license plate 'eagle5' (instance specific id)
  8. goodguy = winnebago:drive:eagle5 # 角色 goodguy 拥有对 id 为 eagle5 的 winnebago 资源执行 drive 的权限
格式：角色 = 权限定义1，权限定义2，... ，权限定义N
  1. rolename = permissionDefinition1, permissionDefinition2, ..., permissionDefinitionN

权限定义：http://shiro.apache.org/permissions.html

[url] web应用中url过滤

  1. [urls]
  3. /index.html = anon
  4. /user/create = anon
  5. /account/**=ssl,authc # Any request to my application's path of /account or any of it's sub paths (/account/foo, /account/bar/baz, etc) will trigger the 'ssl, authc' filter chain
  6. /user/** = authc
  7. /admin/** = authc, roles[administrator]
  8. /rest/** = authc, rest
  9. /remoting/rpc/** = authc, perms["remote:invoke"]
格式：
  1. URL_Ant_Path_Expression = Path_Specific_Filter_Chain
注意：
1. 所有URL都是相对于 HttpServletRequest.getContextPath()  值而言的
2. URL过滤原则是 FIRST MATCH WINS.  后面的不会覆盖前面的！
url中过滤器（anno等）定义：
  1. filter1[optional_config1], filter2[optional_config2], ..., filterN[optional_configN] # 如 authc, perms["remote:invoke"]
注意：若filter不是shiro中已定义的（DefaultFilter），而是自己继承 PathMatchingFilter 实现的，则需要在【main】中先声明
测试时，可以在【main】中禁用 filter
  1. [main]
  2. ...
  3. # configure Shiro's default 'ssl' filter to be disabled while testing:
  4. ssl.enabled = false

登录请求login.do不能设为authc





posted @ 2016-07-19 18:10  yes_V_can  阅读(1714)  评论(0)    收藏  举报