Shiro身份认证(principals-credentials)

身份认证

        在shiro中，用户需要提供principals （身份）和credentials（证明）给shiro，从而应用能验证用户身份.
principals:身份即主体的标识属性,可以是任何东西.如用户名,邮箱等.唯一即可.一个主体可以有多个principals，但只有一个Primary principals，一般是用户名/密码/手机号。
credentials:证明/凭证，即只有主体知道的安全值。如密码
最常见的principals和credentials组合就是用户名、密码了。
现在使用的是SSM+Maven+Shiro搭建项目框架，使用Shiro需要在maven的pom.xml中添加依赖（缓存jar包没有加，后续加入redis）

dependency>
        <dependency>
        <groupId>org.apache.shirogroupId>
        <artifactId>shiro-coreartifactId>
        <version>1.2.2version>
    dependency>
    <dependency>
        <groupId>org.apache.shirogroupId>
        <artifactId>shiro-webartifactId>
        <version>1.2.2version>
    dependency>
    <dependency>
        <groupId>org.apache.shirogroupId>
        <artifactId>shiro-springartifactId>
        <version>1.2.2version>
    dependency>

在spring-shiro.xml中整合配置:

<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://www.springframework.org/schema/beans" xmlns:context="http://www.springframework.org/schema/context"
    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
   http://www.springframework.org/schema/beans/spring-beans.xsd 
   http://www.springframework.org/schema/context 
   http://www.springframework.org/schema/context/spring-context.xsd 
   http://www.springframework.org/schema/aop 
   http://www.springframework.org/schema/aop/spring-aop.xsd 
   http://www.springframework.org/schema/tx 
   http://www.springframework.org/schema/tx/spring-tx.xsd
   http://www.springframework.org/schema/util 
   http://www.springframework.org/schema/util/spring-util.xsd
   ">
    <description>Shiro Configurationdescription>

    
    <context:property-placeholder
        ignore-unresolvable="true" location="classpath:video.properties" />

    
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache.xml" />
    bean>

    
    <bean id="credentialsMatcher"
        class="com.zhiyou.video.security.RetryLimitHashedCredentialsMatcher">
        <constructor-arg ref="cacheManager" />
        
        <property name="hashAlgorithmName" value="md5" />
        
        <property name="hashIterations" value="2" />
        <property name="storedCredentialsHexEncoded" value="true" />
    bean>

    
    <bean id="systemAuthorizingRealm" class="com.zhiyou.video.security.SystemAuthorizingRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher" />
    bean>

    
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="systemAuthorizingRealm" />
        <property name="sessionManager" ref="sessionManager" />
        <property name="cacheManager" ref="cacheManager" />
    bean>

    
    <bean id="sessionIdGenerator"
        class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator" />

    
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="sid" />
        <property name="httpOnly" value="true" />
        <property name="maxAge" value="-1" />
    bean>

    
    <bean id="sessionValidationScheduler"
        class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler">
        <property name="sessionValidationInterval" value="1800000" />
        <property name="sessionManager" ref="sessionManager" />
    bean>

    
    <bean id="sessionManager"
        class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="globalSessionTimeout" value="1800000" />
        <property name="deleteInvalidSessions" value="true" />
        <property name="sessionValidationSchedulerEnabled" value="true" />
        <property name="sessionValidationScheduler" ref="sessionValidationScheduler" />
        <property name="sessionDAO" ref="sessionDAO" />
        <property name="sessionIdCookieEnabled" value="true" />
        <property name="sessionIdCookie" ref="sessionIdCookie" />
    bean>

    
    <bean
        class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <property name="staticMethod"
            value="org.apache.shiro.SecurityUtils.setSecurityManager" />
        <property name="arguments" ref="securityManager" />
    bean>

    
    <bean id="sessionDAO" class="com.zhiyou.video.security.session.CacheSessionDAO">
        <property name="sessionIdGenerator" ref="idGen" />
        <property name="activeSessionsCacheName" value="activeSessionsCache" />
        <property name="cacheManager" ref="cacheManager" />
    bean>

    
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

    <bean
        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    bean>

    
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        
        <property name="securityManager" ref="securityManager" />
        
        <property name="loginUrl" value="/admin/login.action" />
        
        <property name="filterChainDefinitions">
            <value>
                
                /static/** = anon
                
                /admin/login.action = authc
                
                /admin/logout.action =logout
                /admin/** = user
            value>
        property>
    bean>
beans>

在web.xml原有的配置中添加如下配置:

                                <context-param>
        <param-name>contextConfigLocationparam-name>
           <param-value> 
                  classpath:applicationContext.xml,
                  classpath:spring-mybatis.xml,
                  classpath:spring-shiro.xml
           param-value>
    context-param>

    
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListenerlistener-class>
    listener>

    
    <filter>
        <filter-name>shiroFilterfilter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
        <init-param>
            <param-name>targetFilterLifecycleparam-name>
            <param-value>trueparam-value>
        init-param>
    filter>

    <filter-mapping>
        <filter-name>shiroFilterfilter-name>
        <url-pattern>/*url-pattern>
    filter-mapping>

通过ContextLoaderListener加载contextConfigLocation指定的Spring配置文件。
DelegatingFilterProxy会自动到Spring容器中查找名字为shiroFilter的bean并把filter请求交给它处理。
    如果使用Shiro的权限注解的话,就需要使用AOP的功能来进行判断，如Spring AOP；Shiro提供了Spring AOP集成用于权限注解的解析和验证。
在spring-mvc.xml配置文件添加Shiro Spring AOP权限注解的支持：

<aop:config proxy-target-class="true">aop:config>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    bean>

表示代理类.
具体的注解使用点击这里1    点击这里2