apache-shiro 学习笔记

使用过Spring Security 3，了解到shiro，没时间自己研究，就先转个博客学习一下，在这里做下记录，另外找时间比较一下二者的区别。

原文地址：http://yingzhuo.iteye.com/blog/1709002

(一) 看到SpringSide4居然也用shiro作为安全框架，不是用的spring-security。着实有点惊讶。 

apache-shiro的强大可见一斑。 

(二) apache-shiro依赖的包 

 <dependency>
     <groupId>org.apache.shiro</groupId>
     <artifactId>shiro-core</artifactId>
     <version>1.2.1</version>
 </dependency>
 <dependency>
     <groupId>org.apache.shiro</groupId>
     <artifactId>shiro-web</artifactId>
     <version>1.2.1</version>
 </dependency>
 <dependency>
     <groupId>org.apache.shiro</groupId>
     <artifactId>shiro-ehcache</artifactId>
     <version>1.2.1</version>
 </dependency>
 <dependency>
     <groupId>org.apache.shiro</groupId>
     <artifactId>shiro-spring</artifactId>
     <version>1.2.1</version>
 </dependency>

除此之外还有一些东西也不可少spring, spring-mvc, ibatis等 

• spring.3.1.2
• spring-mvc.3.1.2
• ibatis.2.3.4
• cglib.2.2

(三) demo采取比较典型的“User-Role-Permission”模型 

 -- -----------------------------------------------------
 -- Table `shiro`.`TBL_PERMISSION`
 -- -----------------------------------------------------
 DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION` ;

 CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION` (
   `PERMISSION_ID` INT NOT NULL AUTO_INCREMENT ,
   `PERMISSION_NAME` VARCHAR(45) NULL ,
   PRIMARY KEY (`PERMISSION_ID`) ,
   UNIQUE INDEX `PERMISSION_NAME_UNIQUE` (`PERMISSION_NAME` ASC) )
 ENGINE = InnoDB;

 -- -----------------------------------------------------
 -- Table `shiro`.`TBL_ROLE`
 -- -----------------------------------------------------
 DROP TABLE IF EXISTS `shiro`.`TBL_ROLE` ;

 CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_ROLE` (
   `ROLE_ID` INT NOT NULL AUTO_INCREMENT ,
   `ROLE_NAME` VARCHAR(45) NULL ,
   PRIMARY KEY (`ROLE_ID`) ,
   UNIQUE INDEX `ROLE_NAME_UNIQUE` (`ROLE_NAME` ASC) )
 ENGINE = InnoDB;

 -- -----------------------------------------------------
 -- Table `shiro`.`TBL_USER`
 -- -----------------------------------------------------
 DROP TABLE IF EXISTS `shiro`.`TBL_USER` ;

 CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_USER` (
   `USER_ID` INT NOT NULL AUTO_INCREMENT ,
   `USER_USERNAME` VARCHAR(45) NOT NULL ,
   `USER_PASSWORD` CHAR(32) NOT NULL ,
   PRIMARY KEY (`USER_ID`) ,
   UNIQUE INDEX `USER_USERNAME_UNIQUE` (`USER_USERNAME` ASC) )
 ENGINE = InnoDB;

 -- -----------------------------------------------------
 -- Table `shiro`.`TBL_PERMISSION_ROLE`
 -- -----------------------------------------------------
 DROP TABLE IF EXISTS `shiro`.`TBL_PERMISSION_ROLE` ;

 CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_PERMISSION_ROLE` (
   `ROLE_ID` INT NOT NULL ,
   `PERMISSION_ID` INT NOT NULL ,
   PRIMARY KEY (`ROLE_ID`, `PERMISSION_ID`) )
 ENGINE = InnoDB;

 -- -----------------------------------------------------
 -- Table `shiro`.`TBL_ROLE_USER`
 -- -----------------------------------------------------
 DROP TABLE IF EXISTS `shiro`.`TBL_ROLE_USER` ;

 CREATE  TABLE IF NOT EXISTS `shiro`.`TBL_ROLE_USER` (
   `ROLE_ID` INT NOT NULL ,
   `USER_ID` INT NOT NULL ,
   PRIMARY KEY (`ROLE_ID`, `USER_ID`) )
 ENGINE = InnoDB;

自己实现一个UserDao, ibatis实现。 
这个不是本文要记述的重点，简单贴一下代码。 

 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE sqlMap PUBLIC "-//ibatis.apache.org//DTD SQL Map 2.0//EN" "http://ibatis.apache.org/dtd/sql-map-2.dtd">
 <sqlMap namespace="user">

     <typeAlias alias="User" type="com.ztgame.sd.domain.User"/>

     <resultMap class="User" id="result-map-01" groupBy="id">
         <result property="id" column="USER_ID" />
         <result property="username" column="USER_USERNAME" />
         <result property="password" column="USER_PASSWORD" />
         <result property="roleSet" resultMap="role.result-map-01" />
     </resultMap>

     <!-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ -->

     <sql id="select-base-01">
         SELECT
             u.USER_ID,
             u.USER_USERNAME,
             u.USER_PASSWORD,
             r.ROLE_ID,
             r.ROLE_NAME,
             p.PERMISSION_ID,
             p.PERMISSION_NAME
         FROM
           tbl_user as u,
           tbl_role as r,
           tbl_permission as p,
           tbl_permission_role as pr,
           tbl_role_user as ru
         WHERE
           u.USER_ID = ru.USER_ID
         AND
           r.ROLE_ID = ru.ROLE_ID
         AND
           p.PERMISSION_ID = pr.PERMISSION_ID
         AND
           r.ROLE_ID = pr.ROLE_ID
     </sql>

     <!-- +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ -->

     <select id="select-01" parameterClass="string" resultMap="result-map-01">
         <include refid="select-base-01" />
         AND
             u.USER_USERNAME = #username#
     </select>

 </sqlMap>

 public interface UserDao {

     User findUserByUsername(String username);

 }

 @Repository("userDao")
 public class UserDaoImpl implements UserDao {

     @Resource
     private SqlMapClientTemplate sqlMapClientTemplate;

     @Override
     public User findUserByUsername(String username) {
         Validate.notEmpty(username, "用户名不可为null或empty string");
         return (User) sqlMapClientTemplate.queryForObject("user.select-01", username);
     }

 }

(三) 用户和权限数据源是自己设计的，应该实现自己的Realm对象。 

 package com.ztgame.sd.security.realm;

 import java.util.HashSet;
 import java.util.Set;

 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
 import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.realm.Realm;
 import org.apache.shiro.subject.PrincipalCollection;
 import org.springframework.beans.factory.InitializingBean;
 import org.springframework.util.Assert;

 import com.ztgame.sd.dao.UserDao;
 import com.ztgame.sd.domain.Permission;
 import com.ztgame.sd.domain.Role;
 import com.ztgame.sd.domain.User;

 public class JdbcRealm extends AuthorizingRealm
     implements
             Realm,
             InitializingBean
 {

     private UserDao userDao;

     // ------------------------------------------------------------------------------------------------------------

     @Override
     public void afterPropertiesSet() throws Exception {
         Assert.notNull(userDao);
     }

     // ------------------------------------------------------------------------------------------------------------

     @Override
     public String getName() {
         return getClass().getName();
     }

     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

         String username = (String) super.getAvailablePrincipal(principals);
         User user = userDao.findUserByUsername(username);

         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
         Set<String> roles = new HashSet<String>();
         Set<String> permissions = new HashSet<String>();

         for (Role role : user.getRoleSet()) {
             roles.add(role.getName());
             for (Permission per : role.getPermissionSet()) {
                 permissions.add(per.getName());
             }
         }

         info.addRoles(roles);
         info.addStringPermissions(permissions);

         return info;
     }

     @Override
     protected AuthenticationInfo doGetAuthenticationInfo(
             AuthenticationToken token) throws AuthenticationException {

         SimpleAuthenticationInfo info = null;

         UsernamePasswordToken upt = (UsernamePasswordToken) token;
         String username = upt.getUsername();
         User user = userDao.findUserByUsername(username);

         if (user == null) {
             throw new AuthenticationException();
         }

         info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());

         return info;
     }

     // ------------------------------------------------------------------------------------------------------------

     public void setUserDao(UserDao userDao) {
         this.userDao = userDao;
     }

 }

(四) apache-shiro的配置 
web.xml 

 <?xml version="1.0" encoding="UTF-8"?>
 <web-app version="2.4" xmlns="http://java.sun.com/xml/ns/j2ee"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

     <!-- apache-shiro 核心拦截器 -->
     <filter>
         <filter-name>shiroFilter</filter-name>
         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
     </filter>
     <filter-mapping>
         <filter-name>shiroFilter</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>

     <!-- 其他无关apache-shiro -->

 </web-app>

spring-shiro.xml 

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
     xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util"
     xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
     xmlns:context="http://www.springframework.org/schema/context"
     xsi:schemaLocation="
         http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
         http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd
         http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
         http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
         http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd">

     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
         <property name="securityManager" ref="securityManager" />
         <property name="loginUrl" value="/login" />
         <property name="successUrl" value="/login/loginSuccessFull" />
         <property name="unauthorizedUrl" value="/login/unauthorized" />
         <!--
         <property name="filterChainDefinitions">
             <value>
                 / = anon
             </value>
         </property>
         -->
     </bean>

     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
         <property name="authenticator" ref="authenticator" />
         <property name="sessionManager" ref="sessionManager" />
         <property name="cacheManager" ref="cacheManager" />
         <property name="realms">
             <list>
                 <bean class="com.ztgame.sd.security.realm.JdbcRealm">
                     <property name="userDao" ref="userDao" />
                     <property name="credentialsMatcher" ref="hashedCredentialsMatcher" />
                 </bean>
             </list>
         </property>
     </bean>

     <bean id="authenticator" class="org.apache.shiro.authc.pam.ModularRealmAuthenticator" />

     <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
         <property name="sessionDAO" ref="sessionDAO" />
     </bean>

     <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" />

     <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO" />

     <bean id="hashedCredentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
         <property name="hashAlgorithmName" value="MD5" />
         <property name="storedCredentialsHexEncoded" value="true" />
         <property name="hashIterations" value="1" />
     </bean>
 </beans>

spring-mvc.xml 

 <?xml version="1.0" encoding="UTF-8"?>
 <beans xmlns="http://www.springframework.org/schema/beans"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
     xmlns:c="http://www.springframework.org/schema/c" xmlns:util="http://www.springframework.org/schema/util"
     xmlns:aop="http://www.springframework.org/schema/aop" xmlns:mvc="http://www.springframework.org/schema/mvc"
     xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context"
     xsi:schemaLocation="
         http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd
         http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-3.1.xsd
         http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.1.xsd
         http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.1.xsd
         http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.1.xsd
         http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.1.xsd">

     <!-- 其他spring-mvc框架配置 -->

     <!--
         以下两个bean的配置是为了在Controller层使用元注释控制权限
         如果使用spring-mvc一定要不要放在webroot的配置文件中
      -->
     <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />

     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
         <property name="securityManager" ref="securityManager" />
     </bean>

 </beans>

(五) jsp-taglib 支持 

• <shiro:authenticated> 登录之后
• <shiro:notAuthenticated> 不在登录状态时
• <shiro:guest> 用户在没有RememberMe时
• <shiro:user> 用户在RememberMe时
• <shiro:hasAnyRoles name="abc,123" > 在有abc或者123角色时
• <shiro:hasRole name="abc"> 拥有角色abc
• <shiro:lacksRole name="abc"> 没有角色abc
• <shiro:hasPermission name="abc"> 拥有权限abc
• <shiro:lacksPermission name="abc"> 没有权限abc
• <shiro:principal> 显示用户登录名

[官方文档]  http://shiro.apache.org/web.html#Web-taglibrary  

(六) 默认过滤器(10个) 

• anon -- org.apache.shiro.web.filter.authc.AnonymousFilter
• authc -- org.apache.shiro.web.filter.authc.FormAuthenticationFilter
• authcBasic -- org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
• perms -- org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
• port -- org.apache.shiro.web.filter.authz.PortFilter
• rest -- org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
• roles -- org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
• ssl -- org.apache.shiro.web.filter.authz.SslFilter
• user -- org.apache.shiro.web.filter.authc.UserFilter
• logout -- org.apache.shiro.web.filter.authc.LogoutFilter

anon:例子/admins/**=anon 没有参数，表示可以匿名使用。 
authc:例如/admins/user/**=authc表示需要认证(登录)才能使用，没有参数 
roles：例子/admins/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。 
perms：例子/admins/user/**=perms[user:add:*],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/**=perms["user:add:*,user:modify:*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。 
rest：例子/admins/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user:method] ,其中method为post，get，delete等。 
port：例子/admins/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。 
authcBasic：例如/admins/user/**=authcBasic没有参数表示httpBasic认证 
ssl:例子/admins/user/**=ssl没有参数，表示安全的url请求，协议为https 
user:例如/admins/user/**=user没有参数表示必须存在用户，当登入操作时不做检查 
[官方文档]  http://shiro.apache.org/web.html#Web-FilterChainDefinitions  

(七) 常用元注释 

• @RequiresAuthentication 验证用户是否登录，等同于方法subject.isAuthenticated() 结果为true时
• @RequiresUser 验证用户是否被记忆，user有两种含义：一种是成功登录的（subject.isAuthenticated()结果为true)另外一种是被记忆的(subject.isRemembered()结果为true）
• @RequiresGuest 验证是否为匿名请求
• @RequiresRoles 必须要有角色
• @RequiresPermissions 必须要有权限