apache-shiro 学习笔记
(一) 看到SpringSide4居然也用shiro作为安全框架，不是用的spring-security。着实有点惊讶。
apache-shiro的强大可见一斑。
(二) apache-shiro依赖的包
除此之外还有一些东西也不可少spring, spring-mvc, ibatis等
(三) demo采取比较典型的“User-Role-Permission”模型
自己实现一个UserDao, ibatis实现。
这个不是本文要记述的重点，简单贴一下代码。
(三) 用户和权限数据源是自己设计的，应该实现自己的Realm对象。
(四) apache-shiro的配置
web.xml
spring-shiro.xml
spring-mvc.xml
(五) jsp-taglib 支持
[官方文档] http://shiro.apache.org/web.html#Web-taglibrary
(六) 默认过滤器(10个)
anon:例子/admins/**=anon 没有参数，表示可以匿名使用。
authc:例如/admins/user/**=authc表示需要认证(登录)才能使用，没有参数
roles：例子/admins/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。
perms：例子/admins/user/**=perms[user:add:*],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。
rest：例子/admins/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。
port：例子/admins/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。
authcBasic：例如/admins/user/**=authcBasic没有参数表示httpBasic认证
ssl:例子/admins/user/**=ssl没有参数，表示安全的url请求，协议为https
user:例如/admins/user/**=user没有参数表示必须存在用户，当登入操作时不做检查
[官方文档] http://shiro.apache.org/web.html#Web-FilterChainDefinitions
(七) 常用元注释
apache-shiro的强大可见一斑。
(二) apache-shiro依赖的包
<dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.2.1</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-web</artifactId> <version>1.2.1</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>1.2.1</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.2.1</version> </dependency>
除此之外还有一些东西也不可少spring, spring-mvc, ibatis等
- spring.3.1.2
- spring-mvc.3.1.2
- ibatis.2.3.4
- cglib.2.2
(三) demo采取比较典型的“User-Role-Permission”模型
-- ----------------------------------------------------- -- Table `shiro`.`TBL_PERMISSION` -- ----------------------------------------------------- DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION` ; CREATE TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION` ( `PERMISSION_ID` INT NOT NULL AUTO_INCREMENT , `PERMISSION_NAME` VARCHAR(45) NULL , PRIMARY KEY (`PERMISSION_ID`) , UNIQUE INDEX `PERMISSION_NAME_UNIQUE` (`PERMISSION_NAME` ASC) ) ENGINE = InnoDB; -- ----------------------------------------------------- -- Table `shiro`.`TBL_ROLE` -- ----------------------------------------------------- DROP TABLE IF EXISTS `shiro`.`TBL_ROLE` ; CREATE TABLE IF NOT EXISTS `shiro`.`TBL_ROLE` ( `ROLE_ID` INT NOT NULL AUTO_INCREMENT , `ROLE_NAME` VARCHAR(45) NULL , PRIMARY KEY (`ROLE_ID`) , UNIQUE INDEX `ROLE_NAME_UNIQUE` (`ROLE_NAME` ASC) ) ENGINE = InnoDB; -- ----------------------------------------------------- -- Table `shiro`.`TBL_USER` -- ----------------------------------------------------- DROP TABLE IF EXISTS `shiro`.`TBL_USER` ; CREATE TABLE IF NOT EXISTS `shiro`.`TBL_USER` ( `USER_ID` INT NOT NULL AUTO_INCREMENT , `USER_USERNAME` VARCHAR(45) NOT NULL , `USER_PASSWORD` CHAR(32) NOT NULL , PRIMARY KEY (`USER_ID`) , UNIQUE INDEX `USER_USERNAME_UNIQUE` (`USER_USERNAME` ASC) ) ENGINE = InnoDB; -- ----------------------------------------------------- -- Table `shiro`.`TBL_PERMISSION_ROLE` -- ----------------------------------------------------- DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION_ROLE` ; CREATE TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION_ROLE` ( `ROLE_ID` INT NOT NULL , `PERMISSION_ID` INT NOT NULL , PRIMARY KEY (`ROLE_ID`, `PERMISSION_ID`) ) ENGINE = InnoDB; -- ----------------------------------------------------- -- Table `shiro`.`TBL_ROLE_USER` -- ----------------------------------------------------- DROP TABLE IF EXISTS `shiro`.`TBL_ROLE_USER` ; CREATE TABLE IF NOT EXISTS `shiro`.`TBL_ROLE_USER` ( `ROLE_ID` INT NOT NULL , `USER_ID` INT NOT NULL , PRIMARY KEY (`ROLE_ID`, `USER_ID`) ) ENGINE = InnoDB;
自己实现一个UserDao, ibatis实现。
这个不是本文要记述的重点，简单贴一下代码。
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE sqlMap PUBLIC "-//ibatis.apache.org//DTD SQL Map 2.0//EN" "http://ibatis.apache.org/dtd/sql-map-2.dtd"> <sqlMap namespace="user"> <typeAlias alias="User" type="com.ztgame.sd.domain.User"/> <resultMap class="User" id="result-map-01" groupBy="id"> <result property="id" column="USER_ID" /> <result property="username" column="USER_USERNAME" /> <result property="password" column="USER_PASSWORD" /> <result property="roleSet" resultMap="role.result-map-01" /> </resultMap> <!-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ --> <sql id="select-base-01"> SELECT u.USER_ID, u.USER_USERNAME, u.USER_PASSWORD, r.ROLE_ID, r.ROLE_NAME, p.PERMISSION_ID, p.PERMISSION_NAME FROM tbl_user as u, tbl_role as r, tbl_permission as p, tbl_permission_role as pr, tbl_role_user as ru WHERE u.USER_ID = ru.USER_ID AND r.ROLE_ID = ru.ROLE_ID AND p.PERMISSION_ID = pr.PERMISSION_ID AND r.ROLE_ID = pr.ROLE_ID </sql> <!-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ --> <select id="select-01" parameterClass="string" resultMap="result-map-01"> <include refid="select-base-01" /> AND u.USER_USERNAME = #username# </select> </sqlMap>
public interface UserDao {
User findUserByUsername(String username);
}
@Repository("userDao")
public class UserDaoImpl implements UserDao {
@Resource
private SqlMapClientTemplate sqlMapClientTemplate;
@Override
public User findUserByUsername(String username) {
Validate.notEmpty(username, "用户名不可为null或empty string");
return (User) sqlMapClientTemplate.queryForObject("user.select-01", username);
}
}
(三) 用户和权限数据源是自己设计的，应该实现自己的Realm对象。
package com.ztgame.sd.security.realm;
import java.util.HashSet;
import java.util.Set;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.InitializingBean;
import org.springframework.util.Assert;
import com.ztgame.sd.dao.UserDao;
import com.ztgame.sd.domain.Permission;
import com.ztgame.sd.domain.Role;
import com.ztgame.sd.domain.User;
public class JdbcRealm extends AuthorizingRealm
implements
Realm,
InitializingBean
{
private UserDao userDao;
// ------------------------------------------------------------------------------------------------------------
@Override
public void afterPropertiesSet() throws Exception {
Assert.notNull(userDao);
}
// ------------------------------------------------------------------------------------------------------------
@Override
public String getName() {
return getClass().getName();
}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
String username = (String) super.getAvailablePrincipal(principals);
User user = userDao.findUserByUsername(username);
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
Set<String> roles = new HashSet<String>();
Set<String> permissions = new HashSet<String>();
for (Role role : user.getRoleSet()) {
roles.add(role.getName());
for (Permission per : role.getPermissionSet()) {
permissions.add(per.getName());
}
}
info.addRoles(roles);
info.addStringPermissions(permissions);
return info;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken token) throws AuthenticationException {
SimpleAuthenticationInfo info = null;
UsernamePasswordToken upt = (UsernamePasswordToken) token;
String username = upt.getUsername();
User user = userDao.findUserByUsername(username);
if (user == null) {
throw new AuthenticationException();
}
info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
return info;
}
// ------------------------------------------------------------------------------------------------------------
public void setUserDao(UserDao userDao) {
this.userDao = userDao;
}
}
(四) apache-shiro的配置
web.xml
<?xml version="1.0" encoding="UTF-8"?> <web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"> <!-- apache-shiro 核心拦截器 --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <!-- 其他无关apache-shiro --> </web-app>
spring-shiro.xml
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd"> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <property name="loginUrl" value="/login" /> <property name="successUrl" value="/login/loginSuccessFull" /> <property name="unauthorizedUrl" value="/login/unauthorized" /> <!-- <property name="filterChainDefinitions"> <value> / = anon </value> </property> --> </bean> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="authenticator" ref="authenticator" /> <property name="sessionManager" ref="sessionManager" /> <property name="cacheManager" ref="cacheManager" /> <property name="realms"> <list> <bean class="com.ztgame.sd.security.realm.JdbcRealm"> <property name="userDao" ref="userDao" /> <property name="credentialsMatcher" ref="hashedCredentialsMatcher" /> </bean> </list> </property> </bean> <bean id="authenticator" class="org.apache.shiro.authc.pam.ModularRealmAuthenticator" /> <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> <property name="sessionDAO" ref="sessionDAO" /> </bean> <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" /> <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO" /> <bean id="hashedCredentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <property name="hashAlgorithmName" value="MD5" /> <property name="storedCredentialsHexEncoded" value="true" /> <property name="hashIterations" value="1" /> </bean> </beans>
spring-mvc.xml
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd"> <!-- 其他spring-mvc框架配置 --> <!-- 以下两个bean的配置是为了在Controller层使用元注释控制权限 如果使用spring-mvc一定要不要放在webroot的配置文件中 --> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" /> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager" /> </bean> </beans>
(五) jsp-taglib 支持
- <shiro:authenticated> 登录之后
- <shiro:notAuthenticated> 不在登录状态时
- <shiro:guest> 用户在没有RememberMe时
- <shiro:user> 用户在RememberMe时
- <shiro:hasAnyRoles name="abc,123" > 在有abc或者123角色时
- <shiro:hasRole name="abc"> 拥有角色abc
- <shiro:lacksRole name="abc"> 没有角色abc
- <shiro:hasPermission name="abc"> 拥有权限abc
- <shiro:lacksPermission name="abc"> 没有权限abc
- <shiro:principal> 显示用户登录名
[官方文档] http://shiro.apache.org/web.html#Web-taglibrary
(六) 默认过滤器(10个)
- anon -- org.apache.shiro.web.filter.authc.AnonymousFilter
- authc -- org.apache.shiro.web.filter.authc.FormAuthenticationFilter
- authcBasic -- org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
- perms -- org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
- port -- org.apache.shiro.web.filter.authz.PortFilter
- rest -- org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
- roles -- org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
- ssl -- org.apache.shiro.web.filter.authz.SslFilter
- user -- org.apache.shiro.web.filter.authc.UserFilter
- logout -- org.apache.shiro.web.filter.authc.LogoutFilter
anon:例子/admins/**=anon 没有参数，表示可以匿名使用。
authc:例如/admins/user/**=authc表示需要认证(登录)才能使用，没有参数
roles：例子/admins/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。
perms：例子/admins/user/**=perms[user:add:*],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。
rest：例子/admins/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。
port：例子/admins/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。
authcBasic：例如/admins/user/**=authcBasic没有参数表示httpBasic认证
ssl:例子/admins/user/**=ssl没有参数，表示安全的url请求，协议为https
user:例如/admins/user/**=user没有参数表示必须存在用户，当登入操作时不做检查
[官方文档] http://shiro.apache.org/web.html#Web-FilterChainDefinitions
(七) 常用元注释
- @RequiresAuthentication 验证用户是否登录，等同于方法subject.isAuthenticated() 结果为true时
- @RequiresUser 验证用户是否被记忆，user有两种含义：一种是成功登录的（subject.isAuthenticated()结果为true)另外一种是被记忆的(subject.isRemembered()结果为true）
- @RequiresGuest 验证是否为匿名请求
- @RequiresRoles 必须要有角色
- @RequiresPermissions 必须要有权限