shiro——整合web


shiro——整合web_第1张图片
图片.png

ini配置文件默认取src目录下的shiro.ini

[main]
authc.loginUrl=/login
#如果authc拦截器没通过,则跳转login
roles.unauthorizedUrl=/unauthorized.jsp
perms.unauthorizedUrl=/unauthorized.jsp

[users]
zb=123,admin
zz=123,teacher

[roles]
admin=user:*
teacher=student:*

[urls]
/login=anon
/admin=authc
/student=roles[teacher]
/teacher=perms["user:create"]

anon拦截器表示匿名访问(即不需要登录即可访问)
authc拦截器表示需要身份认证通过后才能访问
roles[admin]拦截器表示需要有admin角色授权才能访问
而perms["user:create"]拦截器表示需要有“user:create”权限才能访问

| 默认拦截器名 | 说明(括号里的表示默认值)
----|------|----
身份验证相关的 | authc | 基于表单的拦截器;如“/=authc”,如果没有登录会跳到相应的登录页面登录;主要属性:usernameParam:表单提交的用户名参数名( username); passwordParam:表单提交的密码参数名(password); rememberMeParam:表单提交的密码参数名(rememberMe); loginUrl:登录页面地址(/login.jsp);successUrl:登录成功后的默认重定向地址; failureKeyAttribute:登录失败后错误信息存储key(shiroLoginFailure)
| authcBasic | Basic HTTP身份验证拦截器,主要属性: applicationName:弹出登录框显示的信息(application);
| logout | 退出拦截器,主要属性:redirectUrl:退出成功后重定向的地址(/);示例“/logout=logout”
| user | 用户拦截器,用户已经身份验证/记住我登录的都可;示例“/
=user”
| anon | 匿名拦截器,即不需要登录即可访问;一般用于静态资源过滤;示例“/static/=anon”
授权相关的 | roles | 角色授权拦截器,验证用户是否拥有所有角色;主要属性: loginUrl:登录页面地址(/login.jsp);unauthorizedUrl:未授权后重定向的地址;示例“/admin/
=roles[admin]”
| perms | 权限授权拦截器,验证用户是否拥有所有权限;属性和roles一样;示例“/user/**=perms["user:create"]”
| port | 端口拦截器,主要属性:port(80):可以通过的端口;示例“/test= port[80]”,如果用户访问该页面是非80,将自动将请求端口改为80并重定向到该80端口,其他路径/参数等都一样
| rest | rest风格拦截器,自动根据请求方法构建权限字符串(GET=read, POST=create,PUT=update,DELETE=delete,HEAD=read,TRACE=read,OPTIONS=read, MKCOL=create)构建权限字符串;示例“/users=rest[user]”,会自动拼出“user:read,user:create,user:update,user:delete”权限字符串进行权限匹配(所有都得匹配,isPermittedAll);
| ssl | SSL拦截器,只有请求协议是https才能通过;否则自动跳转会https端口(443);其他和port拦截器一样;
其他 | noSessionCreation | 不创建会话拦截器,调用 subject.getSession(false)不会有什么问题,但是如果 subject.getSession(true)将抛出 DisabledSessionException异常

url模式使用Ant风格模式:

Ant路径通配符支持?、*,注意通配符匹配不包括目录分隔符“/”:
?:匹配一个字符,如”/admin?”将匹配/admin1,但不匹配/admin或/admin2;
:匹配零个或多个字符串,如/admin将匹配/admin、/admin123,但不匹配/admin/1;
:匹配路径中的零个或多个路径,如/admin/将匹配/admin/a或/admin/a/b。


web.xml:



    _shiro_test


    
    
        org.apache.shiro.web.env.EnvironmentLoaderListener
    
    
        ShiroFilter
        org.apache.shiro.web.servlet.ShiroFilter
    
    
        ShiroFilter
        /*
    


    
    
        loginServlet
        test.LoginServlet
    
    
        loginServlet
        /login
    

    
        adminServlet
        test.AdminServlet
    
    
        adminServlet
        /admin
    




LoginServlet类:

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;

public class LoginServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {

        System.out.println("login doget");
        req.getRequestDispatcher("login.jsp").forward(req, resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        System.out.println("login dopost");
        String userName = req.getParameter("userName");
        String password = req.getParameter("password");

        // 得到当前执行用户
        Subject currentUser = SecurityUtils.getSubject();

        UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
        try {
            currentUser.login(token);
            resp.sendRedirect("success.jsp");
        } catch (Exception e) {
            e.printStackTrace();
            req.setAttribute("errorInfo", "用户名或者密码错误");
            req.getRequestDispatcher("login.jsp").forward(req, resp);
        }
    }

}

AdminServlet类:

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class AdminServlet extends HttpServlet {

    @Override
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        System.out.println("admin do get");
        req.getRequestDispatcher("admin.jsp").forward(req, resp);
    }

    @Override
    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
        System.out.println("admin do post");
        resp.sendRedirect("admin.jsp");
    }

}

你可能感兴趣的:(shiro——整合web)