前段时间项目中用到Apache Shiro安全框架用于实现用户认证与授权。
参考资料:
http://www.ibm.com/developerworks/cn/web/wa-apacheshiro/
http://www.ibm.com/developerworks/cn/opensource/os-cn-shiro/
http://www.infoq.com/cn/articles/apache-shiro

配置信息

web.xml中通过spring的代理过滤器将过滤交给shiro。同时applicationContext.xml中需要一个叫shiroFilter的过滤器。
代码如下：

    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

applicationContext-shiro.xml用于shiro安全框架的配置。
代码如下：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd"
    default-lazy-init="true">

    <description>Shiro安全配置</description>

    <!-- Shiro's main business-tier object for web-enabled applications -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm" />
    </bean>

    <!-- 項目自定义的Realm, 所有accountService依赖的dao都需要用depends-on声明 -->
    <bean id="shiroDbRealm" class="xxx.xxx.xxx.service.account.ShiroDbRealm" depends-on="">
        <property name="accountService" ref="accountService"/>
    </bean>
    
    <!-- 自定义url过滤器 -->
    <bean id="URLFilter" class="xxx.xxx.xxx.web.filter.URLFilter">
        <constructor-arg>
        <value>sitemesh=false</value>
        </constructor-arg>
    </bean>
    
    <bean id="UserFormAuthenticationFilter" class="xxx.xxx.xxx.web.filter.UserFormAuthenticationFilter">

    </bean> 
    
    <!-- Shiro Filter /login = authc-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean" depends-on="UserFormAuthenticationFilter">
         <property name="filters">
            <util:map>
                <entry key="UserFormAuthenticationFilter" value-ref="UserFormAuthenticationFilter"/>
                <entry key="urlFilter" value-ref="URLFilter"/>
            </util:map>
        </property> 
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login" />
        <property name="successUrl" value="/" />
        <property name="unauthorizedUrl" value="/PermissionController/403"/>
        <property name="filterChainDefinitions">
            <value>
                /login = UserFormAuthenticationFilter
                /logout = logout
                /static/** = anon
                /register/** = anon
                /views/**/*.jsp = user,urlFilter
                /** = user
            </value>
        </property>
    </bean>
    
    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
</beans>

代码实现部分

ShiroDbRealm继承AuthorizingRealm类实现用户认证和授权的方法。

public class ShiroDbRealm extends AuthorizingRealm
{
    private AccountService accountService;

    public ShiroDbRealm() {
        super();
        //setCredentialsMatcher(new AllowAllCredentialsMatcher());
        //设置认证token的实现类，该处使用UsernamepasswordTken,也可自定义token，如果自定义token则需继承AuthenticationToken;
            setAuthenticationTokenClass(EhrUserToken.class);       
   }
    
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken authcToken) throws AuthenticationException
    {
        return info;
    }
    
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principals)
    {
        
        return info;
    }
}

自定义的过滤器继承AuthenticationFilter

public class URLFilter extends AuthenticationFilter
{

    @Override
    protected boolean onAccessDenied(ServletRequest request,
            ServletResponse response) throws Exception
    {
        HttpServletResponse rsp = (HttpServletResponse)response;
        rsp.sendError(403);
        return false;
    }

    @Override
    public void doFilterInternal(ServletRequest request,
            ServletResponse response, FilterChain chain)
            throws ServletException, IOException
    {
        Exception exception = null;
        try
        {
            //授权成功
            executeChain(request, response, chain);
            postHandle(request, response);
            
            //授权失败
            onAccessDenied(request,response);   
        } catch (Exception e)
        {
             exception = e;
        }
        finally {
            cleanup(request, response, exception);
        }
    }
}