apache shiro

http://shiro.apache.org/spring.html

 Shiro applications need an application singleton SecurityManager instance

 

http://shiro.apache.org/documentation.html

 

主要对象SecurityManager

 

...



    
    







    
    

 

web.xml

    shiroFilter
    org.springframework.web.filter.DelegatingFilterProxy
    
        targetFilterLifecycle
        true
    


...





    shiroFilter
    /*

 

基本概念

 comprehensive solution to authentication, authorization, cryptography, and session management
 
 authenticate 认证
 
 Authorization  授权
 
 

Subject currentUser = SecurityUtils.getSubject();

 
 if ( !currentUser.isAuthenticated() ) {
    //collect user principals and credentials in a gui specific manner 
    //such as username/password html form, X509 certificate, OpenID, etc.
    //We'll use the username/password example here since it is the most common.
    //(do you know what movie this is from? ;)
    UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
    //this is all you have to do to support 'remember me' (no config - built in!):
    token.setRememberMe(true);
    currentUser.login(token);
}


try {
    currentUser.login( token );
    //if no exception, that's it, we're done!
} catch ( UnknownAccountException uae ) {
    //username wasn't in the system, show them an error message?
} catch ( IncorrectCredentialsException ice ) {
    //password didn't match, try again?
} catch ( LockedAccountException lae ) {
    //account for that username is locked - can't login.  Show them a message?
} 
    ... more types exceptions to check if you want ...
} catch ( AuthenticationException ae ) {
    //unexpected condition - error?
}

 

if ( currentUser.hasRole( "schwartz" ) ) {
    log.info("May the Schwartz be with you!" );
} else {
    log.info( "Hello, mere mortal." );
}

 

if ( currentUser.isPermitted( "winnebago:drive:eagle5" ) ) {
    log.info("You are permitted to 'drive' the 'winnebago' with license plate (id) 'eagle5'.  " +
                "Here are the keys - have fun!");
} else {
    log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
}

 

Realm
http://shiro.apache.org/realm.html

A Realm is a component that can access application-specific security data
such as users, roles, and permissions

 A Realm is essentially a security-specific DAO
 
 
 Because most of these data sources usually store both
  authentication data (credentials such as passwords) as well as authorization data (such as roles or permissions),
 every Shiro Realm can perform both authentication and authorization operations.