spring 整合shiro

1. 核心依赖

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>

2. web.xml中配置shiro过滤器

• ShiroFilter：DelegatingFilterProxy作用是自动到Spring 容器查找名字为shiroFilter（filter-name）的bean并把所有Filter 的操作委托给它。

• applicationContext-shiro.xml中的id必须和web.xml文件中配置的DelegatingFilterProxy的 <filter-name> 一致，若不一致，则会抛出：NoSuchBeanDefinitionException. 因为 Shiro 会来 IOC 容器中查找和 <filter-name> 名字对应的 filter bean.

 <!--配置shiro的过滤器-->
<filter>
    <!--filter name不能随便写-->
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <!--将shiro生命周期交给servlet托管-->
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

3. 自定义Realm

public class MyRealm extends AuthorizingRealm {
    @Autowired
    private UserMapper userMapper;

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        // 获取用户输入的用户名
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username = token.getUsername();
        User user = userMapper.queryUserByLoginName(username);
        if (user == null) {
            return null;
        }
        // 根据输入的用户名去数据库中查找密码
        String password = user.getPassword();
        String salt = user.getSalt();
        return new SimpleAuthenticationInfo(username, password, ByteSource.Util.bytes(salt), getName());
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        String username = (String) principalCollection.getPrimaryPrincipal();
        List<String> roles = userMapper.queryRolesByLoginName(username);
        List<String> perms = userMapper.queryPermsByLoginName(username);
        //将当前登陆用户的所有角色和权限封装进AuthorizationInfo 对象中，返回给shiro进行比对
        //将所有角色设置进去
        info.addRoles(roles);
        //将所有权限设置进去
        info.addStringPermissions(perms);
        //将AuthorizationInfo对象返还给shiro
        return info;
    }
}

4. 创建applicationContext-shiro.xml 配置安全管理器，自定义realm，过滤器工厂

• anon /admin/**=anon 没有参数，匿名可用（不登录就能用的接口）

• authc 登录后才能使用，没有参数

• roles roles[admin,student] 表示登录后角色，至少有一个参数，多个时必须加上引号，多个参数中间用逗号隔开,可以写多个参数，每个参数通过才算通过，相当于hasAllRoles()方法

• perms perms[admin:add,admin:update] 表示登录后拥有的权限，多个时必须加上引号，至少有一个参数，多个参数中间用逗号隔开,当有多个参数时必须每个参数都通过才算通过，相当于isPermittedAll();

• 匹配规则有顺序 从上往下匹配

<bean id="myRealm" class="net.wanho.realm.MyRealm"></bean>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="myRealm"/>
</bean>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/login.jsp"/>
    <property name="unauthorizedUrl" value="/unauth.jsp"/>
    <property name="successUrl" value="/success.jsp"/>
    <property name="filterChainDefinitions">
        <value>
            <!--​
            rest [admin:post/get/delete] 根据请求方法
            port port[8080] 根据请求端口
            authcBasic httpBasic认证
            ssl https验证
            user 必须存在用户，必须登录
            注意 anon authcBasic authc user 时认证过滤器
                 perms roles ssl rest port 是授权过滤器
            -->
            /user/query = authc
            /user/login = anon
            /register.jsp = anon
            /user/register = anon
            /user/logout = authc
            /success.jsp = anon
            /** = authc
        </value>
    </property>
</bean>