Shiro权限框架与SpringMVC整合

1.Shiro整合SpringMVC

　　我们学习Shiro框架肯定是要应用到Web项目上的，所以我们需要整合Shiro和SpringMVC

整合步骤：

第一步：SpringMVC框架的配置

spring-mvc.xml:

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:mvc="http://www.springframework.org/schema/mvc"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd">
    
    
    
    default-servlet-handler/>
   
   
       
   
    

　　spring-context.xml:

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.3.xsd">
    
    package="com.gjs.shiro">
        
        
    

　　web.xml:

  shiro-springmvc-xml
  
    index.html
    index.htm
    index.jsp
    default.html
    default.htm
    default.jsp
  
  
  
    
        CharacterEncodingFilter
        class>org.springframework.web.filter.CharacterEncodingFilterclass>
        
            encoding
            UTF-8
        
    
    
    
        CharacterEncodingFilter
        /*
    
    
    
    
        MVC
        org.springframework.web.servlet.DispatcherServlet
        
        
            contextConfigLocation
            classpath:spring*.xml
        
        
        1
    
    
    
        MVC
        /
    

　　

　　第二步：Shiro配置

　　shiro.ini:

[main]
 shiroRealm=com.gjs.shiro.realm.ShiroRealm
 securityManager.realms=$shiroRealm

　　ShiroRealm:

package com.gjs.shiro.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class ShiroRealm extends AuthorizingRealm{
    /**
     * 校验
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("校验");
        if ("admin".equals(token.getPrincipal())) {
            return new SimpleAuthenticationInfo(token.getPrincipal(), "123456", this.getName());
        }
        return null;
    }
    /**
     * 授权
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        System.out.println("授权");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("role_admin");
        info.addStringPermission("user:list");
        info.addStringPermission("user:add");
        return info;
    }
}

　　第三步：springmvc和shiro整合

　　Shiro是使用Filter拦截请求的，SpringMVC是使用Servlet拦截请求的。而Filter的拦截请求优先级别高于Servlet，那么我们如何让Shiro交给SpringMVC代理？
　　Spring提供了一个Filter代理类，可以让Spring容器代理Filter的操作，DelegatingFilterProxy。实现了在过滤里面可以调用Spring容器的对象，可以让我们把原来配置在web.xml的过滤器配置在Spring配置文件里面（原来shiro配置在shiro.ini的配置也可以配置在Spring配置文件里）。

　　1.在web.xml添加配置：

  
      securityFilter
      class>org.springframework.web.filter.DelegatingFilterProxyclass>
      
      
          targetBeanName
          securityFilter
      
    
    
        targetFilterLifecycle
        true
          
  
  
      securityFilter
      /*
  

　　修改后：

  shiro-springmvc-xml
  
    index.html
    index.htm
    index.jsp
    default.html
    default.htm
    default.jsp
  
  
  
      securityFilter
      class>org.springframework.web.filter.DelegatingFilterProxyclass>
      
      
          targetBeanName
          securityFilter
      
    
    
        targetFilterLifecycle
        true
          
  
  
      securityFilter
      /*
  
  
  
    
        CharacterEncodingFilter
        org.springframework.web.filter.CharacterEncodingFilter
        
            encoding
            UTF-8
        
    
    
    
        CharacterEncodingFilter
        /*
    
    
    
    
        MVC
        org.springframework.web.servlet.DispatcherServlet
        
        
            contextConfigLocation
            classpath:spring*.xml
        
        
        1
    
    
    
        MVC
        /
    

2.创建spring-shiro.xml配置文件

这个配置文件用来配置shiro的相关配置，并创建shiro过滤器用来给spring的代理过滤器调用
配置完毕我们之前的shiro的ini配置文件就可以删掉了

    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    
    class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        
        
        
        
        
        
            
            
                /user/toLogin =anon
                /**=authc
            
        
    
    
    
         
         
    
    
    

　　3.权限控制器标签的使用

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>


   



   

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>   
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>







    
   
      用户增加
   
     
      用户编辑
   
     
      用户删除
   
     
      用户列表
   
   

2.Shiro整合SpringMVC 基于注解

　　第一步：配置webx.xml

  
      securityFilter
      class>org.springframework.web.filter.DelegatingFilterProxyclass>
      
      
          targetBeanName
          securityFilter
      
    
    
        targetFilterLifecycle
        true
          
  
  
      securityFilter
      /*
  

　　第二步：配置Shiro配置类

package com.gjs.rbac.config;

import java.util.LinkedHashMap;
import java.util.Map;

import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import com.gjs.rbac.realms.ShiroRealm;

@Configuration
public class ShiroConfig {
    
    //1.配置shiro过滤器  用于给spring的代理过滤器调用
    @Bean("securityFilter")
    public Object getShiroFilterFactoryBean() {
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        factoryBean.setSecurityManager(this.getSecurityManager());
        factoryBean.setSuccessUrl("/toIndex");
        factoryBean.setLoginUrl("/user/login");
        
        //定义过滤器链，使用LinkedHashMap是因为它是有顺序的（添加顺序）
        Map filterChain =new LinkedHashMap<>();
        filterChain.put("/user/toLogin", "anon");
        filterChain.put("/**", "authc");
        factoryBean.setFilterChainDefinitionMap(filterChain);
        try {
            return factoryBean.getObject();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }
    
    //2.创建SecurityManager
    @Bean
    public SecurityManager getSecurityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(this.getShiroRealm());
        return securityManager;
    }
    //创建自定义的Realm
    @Bean
    public ShiroRealm getShiroRealm() {
        ShiroRealm shiroRealm = new ShiroRealm();
        return shiroRealm;
    }
}