spring与shiro整合

两盒软妹~` 提交于 2020-11-30 01:27:53

spring与shiro整合

(1)加入所需要是jar包

(2)配置shiro Filter(web.xml)

<!-- shiro过虑器,DelegatingFilterProxy通过代理模式将spring容器中的bean和filter关联起来 -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <!-- 设置true由servlet容器控制filter的生命周期 -->
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
        <!-- 设置spring容器filter的bean id,如果不设置则找与filter-name一致的bean-->
        <init-param>
            <param-name>targetBeanName</param-name>
            <param-value>shiroFilter</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

3、添加applicationContext-shiro.xml

<!-- Shiro 的Web过滤器 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <!-- loginUrl认证提交地址,如果没有认证将会请求此地址进行认证,请求此地址将由formAuthenticationFilter进行表单认证 -->
        <property name="loginUrl" value="/login.action" />
        <property name="unauthorizedUrl" value="/refuse.jsp" />
        <!-- 过虑器链定义,从上向下顺序执行,一般将/**放在最下边 -->
        <property name="filterChainDefinitions">
            <value>
                <!-- 退出拦截,请求logout.action执行退出操作 -->
                /logout.action = logout
                <!-- 无权访问页面 -->
                /refuse.jsp = anon
                <!-- roles[XX]表示有XX角色才可访问 -->
                /item/list.action = roles[item],authc
                /js/** anon
                /images/** anon
                /styles/** anon
                /validatecode.jsp anon
                /item/* authc
                <!-- user表示身份认证通过或通过记住我认证通过的可以访问 -->
                /** = authc
            </value>
        </property>
    </bean>

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="userRealm" />
    </bean>

    <!-- 自定义 realm -->
    <bean id="userRealm" class="cn.ssm.realm.CustomRealm1">
    </bean>

4、自定义realm

public class CustomRealm1 extends AuthorizingRealm {
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

}
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {


}

5、添加匹配器认证(applicationContext-shiro.xml)

<!-- 凭证匹配器 -->
    <bean id="credentialsMatcher"
        class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="md5" />
        <property name="hashIterations" value="1" />
    </bean>

<!-- 自定义 realm -->
    <bean id="userRealm" class="cn.ssm.realm.CustomRealm1">
        <property name="credentialsMatcher" ref="credentialsMatcher" />
    </bean>

6、shiro注解配置权限(springmvc.xml)

<!-- 开启aop,对类代理 -->
    <aop:config proxy-target-class="true"></aop:config>
    <!-- 开启shiro注解支持 -->
    <bean
        class="
org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    </bean>
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!