基于Shiro 拦截URL，实现权限控制

 

虽然网上很多关于Shiro的样例，但是LZ看了很多，觉得他们好多都不是自己想要的。

 

不是没有URL过滤功能，就是写死在xml配置文件里，还有好多不能使。

 

LZ不才，只能写一些简单样例给大家看看。

 

基础要求：SSH都会，了解权限管理的架构。

 

接下来是代码：

 

 先给出表

CREATE TABLE `t_privilege` (
  `id` int(11) NOT NULL auto_increment,
  `perms` varchar(255) default NULL,
  `url` varchar(255) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;


CREATE TABLE `t_user` (
  `id` int(11) NOT NULL auto_increment,
  `password` varchar(255) default NULL,
  `username` varchar(255) default NULL,
  `role_id` int(11) default NULL,
  PRIMARY KEY  (`id`),
  KEY `FKCB63CCB613F1722F` (`role_id`),
  CONSTRAINT `FKCB63CCB613F1722F` FOREIGN KEY (`role_id`) REFERENCES `t_role` (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;


CREATE TABLE `t_role` (
  `id` int(11) NOT NULL,
  `name` varchar(255) default NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;


CREATE TABLE `t_role_t_privilege` (
  `t_role_id` int(11) NOT NULL,
  `privileges_id` int(11) NOT NULL,
  PRIMARY KEY  (`t_role_id`,`privileges_id`),
  KEY `FK6947A6C85C5EE234` (`privileges_id`),
  KEY `FK6947A6C8CF836564` (`t_role_id`),
  CONSTRAINT `FK6947A6C8CF836564` FOREIGN KEY (`t_role_id`) REFERENCES `t_role` (`id`),
  CONSTRAINT `FK6947A6C85C5EE234` FOREIGN KEY (`privileges_id`) REFERENCES `t_privilege` (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

 这里设计的就是一个User，一个Role。但是Role有很多的URL。

 

DAO，Service 就不给了。

 

action：

 

 

package com.vti.action;

import javax.annotation.Resource;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;

import com.vti.model.User;
import com.vti.service.UserService;

@Controller
@RequestMapping(value="/")
public class LoginController {

    private UserService userService;

    public UserService getUserService() {
        return userService;
    }

    @Resource
    public void setUserService(UserService userService) {
        this.userService = userService;
    }

    @RequestMapping(value = "/login")
    public String login(String username, String password, ModelMap map){
        if(this.userService.checkUser(username, password)){
            setLogin(username, password);
            return "index.do";
        }else{
            map.addAttribute("msg", "username or password error !");
            return "login.jsp";
        }
    }

    @RequestMapping(value = "/index")
    public String index(HttpServletRequest request, HttpServletResponse response,ModelMap map){
        Subject currentUser = SecurityUtils.getSubject();
        User user=userService.getByUserLoginId(currentUser.getPrincipal().toString());
        map.addAttribute("LoginUser",user);
        return "index.jsp";
    }

    @RequestMapping(value = "/logout")
    public String logout(HttpServletRequest request, HttpServletResponse response,ModelMap map){
        Subject currentUser = SecurityUtils.getSubject();
        currentUser.logout();
        return "login.jsp";
    }

    private void setLogin(String userName, String password) {
        Subject currentUser = SecurityUtils.getSubject();
        if (!currentUser.isAuthenticated()) {
            UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
            token.setRememberMe(false);
            currentUser.login(token);
        }
    }
}

 

 

 

web.xml

 

 

xml version="1.0" encoding="UTF-8"?>
<web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
    http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

    <welcome-file-list>
        <welcome-file>login.jspwelcome-file>
    welcome-file-list>


    <context-param>
        <param-name>contextConfigLocationparam-name>
        <param-value>classpath:beans.xmlparam-value>
    context-param>

    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListenerlistener-class>
    listener>

    <filter>
        <filter-name>shiroFilterfilter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
        <init-param>
            <param-name>targetFilterLifecycleparam-name>
            <param-value>trueparam-value>
        init-param>
    filter>
    <filter-mapping>
        <filter-name>shiroFilterfilter-name>
        <url-pattern>/*url-pattern>
        <dispatcher>REQUESTdispatcher>
        <dispatcher>FORWARDdispatcher>
        <dispatcher>INCLUDEdispatcher>
        <dispatcher>ERRORdispatcher>
    filter-mapping>

    <servlet>
        <servlet-name>springMVCservlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServletservlet-class>
        <init-param>
            <param-name>contextConfigLocationparam-name>
            <param-value>classpath:SpringMVC.xmlparam-value>
        init-param>
        <load-on-startup>1load-on-startup>
    servlet>
    <servlet-mapping>
        <servlet-name>springMVCservlet-name>
        <url-pattern>*.dourl-pattern>
    servlet-mapping>

web-app>

 

 

 

beans.xml

 

 

xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
           http://www.springframework.org/schema/context
           http://www.springframework.org/schema/context/spring-context-3.2.xsd
           http://www.springframework.org/schema/aop
           http://www.springframework.org/schema/aop/spring-aop-3.2.xsd
           http://www.springframework.org/schema/tx
           http://www.springframework.org/schema/tx/spring-tx-3.2.xsd">

    <context:annotation-config />
    <context:component-scan base-package="com.vti">context:component-scan>

    <bean id="dataSource" destroy-method="close" class="org.apache.commons.dbcp.BasicDataSource">
        <property name="driverClassName" value="com.mysql.jdbc.Driver" />
        <property name="url" value="jdbc:mysql://localhost:3306/test" />
        <property name="username" value="root" />
        <property name="password" value="admin" />

        <property name="initialSize" value="5" />
        <property name="maxActive" value="500" />
        <property name="maxIdle" value="50" />
        <property name="minIdle" value="10" />
        <property name="timeBetweenEvictionRunsMillis" value="3600000" />
        <property name="minEvictableIdleTimeMillis" value="3600000" />

    bean>

    <bean id="sessionFactory" class="org.springframework.orm.hibernate3.annotation.AnnotationSessionFactoryBean">
        <property name="dataSource" ref="dataSource" />
        <property name="packagesToScan">
            <list>
                <value>com.vti.modelvalue>
                list>
        property>

        <property name="hibernateProperties">
            <props>
                <prop key="hibernate.dialect">
                    org.hibernate.dialect.MySQLDialect
                prop>
                <prop key="hibernate.show_sql">trueprop>
                <prop key="hibernate.hbm2ddl.auto">updateprop>
                props>
        property>

    bean>

    <bean id="hibernateTemplate" class="org.springframework.orm.hibernate3.HibernateTemplate">
        <property name="sessionFactory" ref="sessionFactory">property>
    bean>

    <bean id="txManager"
        class="org.springframework.orm.hibernate3.HibernateTransactionManager">
        <property name="sessionFactory" ref="sessionFactory" />
    bean>

    <aop:config>
        <aop:pointcut id="bussinessService" expression="execution(public * com.vti.service.*.*(..))" />
        <aop:advisor pointcut-ref="bussinessService" advice-ref="txAdvice" />
    aop:config>

    <tx:advice id="txAdvice" transaction-manager="txManager">
        <tx:attributes>
            <tx:method name="save*" propagation="REQUIRED"/>
            <tx:method name="find*" read-only="true"/>
            <tx:method name="get*" read-only="true"/>
        tx:attributes>
    tx:advice>


    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm" />
    bean>

    <bean id="shiroDbRealm" class="com.vti.shiro.MyShiroRealm" />

    <bean id="chainDefinitionSectionMetaSource" class="com.vti.shiro.ChainDefinitionSectionMetaSource">
        <property name="filterChainDefinitions">
            <value>
                /login.do = anon
                /logoutlogout.do = logout
            value>
        property>
    bean>

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login.jsp" />
        <property name="successUrl" value="/index.do" />
        <property name="unauthorizedUrl" value="/403.htm" />

        <property name="filterChainDefinitionMap" ref="chainDefinitionSectionMetaSource" />
    bean>

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" >
    bean>

    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    bean>

beans>

 

 

 

 

 

ChainDefinitionSectionMetaSource

 

 

package com.vti.shiro;

import java.text.MessageFormat;
import java.util.Iterator;
import java.util.List;

import javax.annotation.Resource;

import org.apache.shiro.config.Ini;
import org.apache.shiro.config.Ini.Section;
import org.springframework.beans.factory.FactoryBean;
import org.springframework.util.StringUtils;

import com.vti.dao.PrivilegeDao;
import com.vti.model.Privilege;

public class ChainDefinitionSectionMetaSource implements FactoryBean{

    public static final String PREMISSION_STRING="perms[\"{0}\"]";

    private String filterChainDefinitions;

    private PrivilegeDao privilegeDao;

    public PrivilegeDao getPrivilegeDao() {
        return privilegeDao;
    }

    public String getFilterChainDefinitions() {
        return filterChainDefinitions;
    }

    @Resource
    public void setFilterChainDefinitions(String filterChainDefinitions) {
        String fiter="";//改正后的url配置
        List list = privilegeDao.getAll();
        for (Iterator it = list.iterator(); it.hasNext();) {
            Privilege privilege = it.next();
            if(!StringUtils.isEmpty(privilege.getUrl())) {
                fiter+="/"+privilege.getUrl()+" = authc," +MessageFormat.format(PREMISSION_STRING,privilege.getPerms()) +"\n";
            }//追加beans.xml中已经有的过滤
        }
        System.out.println(filterChainDefinitions+fiter);
        this.filterChainDefinitions = filterChainDefinitions+fiter;
    }

    @Resource
    public void setPrivilegeDao(PrivilegeDao privilegeDao) {
        this.privilegeDao = privilegeDao;
    }

    public Section getObject(){
        Ini ini = new Ini();//网上好多都是在这里配置URL的。但是发现是错误的。
        ini.load(filterChainDefinitions);
        Ini.Section section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
        return section;
    }

    public Class getObjectType() {
        return this.getClass();
    }

    public boolean isSingleton() {
        return false;
    }

}

 

 

 

 

MyShiroRealm

 

 

package com.vti.shiro;

import java.util.List;

import javax.annotation.Resource;

import org.apache.shiro.authc.AccountException;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.util.StringUtils;

import com.vti.model.Privilege;
import com.vti.model.User;
import com.vti.service.UserService;

public class MyShiroRealm extends AuthorizingRealm{
    private UserService userService;

    public UserService getUserService() {
        return userService;
    }

    @Resource
    public void setUserService(UserService userService) {
        this.userService = userService;
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        if(principals == null){
            throw new AuthorizationException("principals should not be null");
        }
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        String username =(String) principals.fromRealm(this.getName()).iterator().next();
        List privileges = userService.getAllPrivilegeByUserId(username);
        for(Privilege p : privileges){
            info.addStringPermission(p.getPerms());
        }
        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authecToken){
        UsernamePasswordToken token = (UsernamePasswordToken)authecToken;

        if(StringUtils.isEmpty(token.getUsername())){
            throw new AccountException("用户名不能为空");
        }

        User user = userService.getByUserLoginId(token.getUsername());
        if(user == null){
            throw new UnknownAccountException("用户名没找到");
        } else if(user.getPassword().equals(new String(token.getPassword()))){
            return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), this.getName());
        } else {
            throw new AuthenticationException("授权失败");
        }
    }


}

 

 

 

给出index,jsp

有shiro的标签使用

<%@ page language="java" contentType="text/html; utf-8" pageEncoding="utf-8"%>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>

>
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; utf-8">
        <title>Insert title heretitle>
    head>
    <body>

    <shiro:authenticated>
        <h3>Login User Can see ith3>
        <h4>You are  ${LoginUser.role.name}, Your name is ${LoginUser.username}h4>
    shiro:authenticated>

    <shiro:hasPermission name="set">
        <a href="3.jsp">系统设置a><br>
    shiro:hasPermission>
    <shiro:hasPermission name="view">
        <a href="2.jsp">总账查看a><br>
    shiro:hasPermission>
    <shiro:hasPermission name="sale">
        <a href="1.jsp">卖货a><br><br>
    shiro:hasPermission>

    <shiro:notAuthenticated>
        Please <a href="login.jsp">logina> in order to update your credit card information.
    shiro:notAuthenticated>

    <shiro:authenticated>
        <a href="logout.do">注销a>
    shiro:authenticated>

    body>

html>

 

 

最后讲下逻辑思路：

 

 系统分为三个等级。 分别是：售货员，经理，管理员

 售货员：登录，卖货，注销

经理：查账，登录，卖货，注销

管理员：系统设置，查账，登录，卖货，注销。

 

主要是围绕这样的功能去分配url的。

数据库在附件中给出。

 

• shiro.rar (898 Bytes)
• 下载次数: 112