spring 整合shiro ,并实现动态url 配置

shiro 与Spring 结合

• 数据库实现，参考RBAC角色权限控制的实现

• maven 导入相关包

<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-core -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.3.2</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>1.3.2</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.3.2</version>
        </dependency>
        <!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-ehcache -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>1.3.2</version>
        </dependency>

• web.xml 配置

<filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

• spring_shiro.xml

<!-- 自定义Realm -->
    <bean id="myRealm" class="com.nzs.listener.MyShiroRealm"/>
    <!-- 缓存管理 -->
    <bean id="mycacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/>

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm"/>
        <property name="cacheManager" ref="mycacheManager"></property>
    </bean>

    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>


    <!-- Shiro过滤器 -->
    <!--<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">-->
    <bean id="shiroFilter" class="com.nzs.listener.ShiroPermissionFactory">

        <property name="manageUserService" ref="manageUserService"/>
        <!-- Shiro的核心安全接口,这个属性是必须的 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 身份认证失败，则跳转到登录页面的配置 -->
        <property name="loginUrl" value="/login.jsp"/>
        <!-- 登录成功跳转页面的配置 -->
        <property name="successUrl" value="/index"/>
        <!-- 权限认证失败，则跳转到指定页面 -->
        <property name="unauthorizedUrl" value="/norole.jsp"/>
        <!-- Shiro连接约束配置,即过滤链的定义 -->
        <property name="filterChainDefinitions">
            <value>
                /manageUser/login=anon
                <!--/** = authc-->
            </value>
        </property>
    </bean>

• 自定义的realm

public class MyShiroRealm extends AuthorizingRealm {
    static IManageUserService manageUserService;
    public static final String SESSION_USER_KEY = "temp";

    /**
     * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用,负责在应用程序中决定用户的访问控制的方法
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    //可自定义实现内容
        SecurityUtils.getSubject().getSession()
     .getAttribute(OneballShiroRealm.SESSION_USER_KEY);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        return info;
    }

    /**
     * 认证回调函数，登录信息和用户验证信息验证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken authcToken) throws AuthenticationException {
        //判断 manageUserService 是否为空
        if (manageUserService == null) {
            manageUserService = (ManageUserService) ApplicationContextUtil.getBean("manageUserService");
        }
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
        String userName = token.getUsername();
        String passWord = String.valueOf(token.getPassword());
        ManageUser manageUser = manageUserService.login(userName, passWord);

        if (manageUser == null) {
            return null; // 异常处理，找不到数据
        }

        Subject subject =  SecurityUtils.getSubject();

        //shiro session
        Session session = SecurityUtils.getSubject().getSession();
        session.setTimeout(60 * 60 * 3 * 1000);
        session.setAttribute(OneballShiroRealm.SESSION_USER_KEY, manageUser);

        //当前 Realm 的 name
        String realmName = this.getName();
        //登陆的主要信息: 可以是一个实体类的对象, 但该实体类的对象一定是根据 token 的 username 查询得到的.
        Object principal = authcToken.getPrincipal();
        return new SimpleAuthenticationInfo(principal, passWord, realmName);
    }


    public IManageUserService getManageUserService() {
        return manageUserService;
    }

    public void setManageUserService(IManageUserService manageUserService) {
        this.manageUserService = manageUserService;
    }
}

• 继承ShiroFilterFactoryBean，实现从数据库动态加载权限信息

public class ShiroPermissionFactory extends ShiroFilterFactoryBean {

    private ManageUserService manageUserService;


    /**记录配置中的过滤链*/
    public static String definition="";


    /**
     * 初始化设置过滤链
     */
    @Override
    public void setFilterChainDefinitions(String definitions) {
//        String token =  manageUserService.getAdminToken(0);

        //可从数据库读取后，添加至过滤链，参考此处已注释的代码
        definition = definitions;//记录配置的静态过滤链
//        List<Permission> permissions = permissService.findAll();
        Map<String, String> otherChains = new HashMap<String,String>();
//        permissions.forEach(permiss->{
//            //perms.add(e)
            otherChains.put("/discover/newstag", "authc,roles[user,admin]");
//        });
        //加载配置默认的过滤链
        Ini ini = new Ini();
        ini.load(definitions);
        Ini.Section section = ini.getSection(IniFilterChainResolverFactory.URLS);
        if (CollectionUtils.isEmpty(section)) {
            section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
        }
        //加上数据库中过滤链
        section.putAll(otherChains);
        setFilterChainDefinitionMap(section);

    }

    public ManageUserService getManageUserService() {
        return manageUserService;
    }

    public void setManageUserService(ManageUserService manageUserService) {
        this.manageUserService = manageUserService;
    }
}

• FilterChainDefinitionsService实现，无需部署，重新加载权限

@Service
public class FilterChainDefinitionsService implements IFilterChainDefinitionsService {
    @Autowired
    private ShiroPermissionFactory permissFactory;

    @Override
    public void reloadFilterChains() {
        synchronized (permissFactory) {   //强制同步，控制线程安全
            AbstractShiroFilter shiroFilter = null;

            try {
                shiroFilter = (AbstractShiroFilter) permissFactory.getObject();

                PathMatchingFilterChainResolver resolver = (PathMatchingFilterChainResolver) shiroFilter
                        .getFilterChainResolver();
                // 过滤管理器
                DefaultFilterChainManager manager = (DefaultFilterChainManager) resolver.getFilterChainManager();
                // 清除权限配置
                manager.getFilterChains().clear();
                permissFactory.getFilterChainDefinitionMap().clear();
                // 重新设置权限
                permissFactory.setFilterChainDefinitions(ShiroPermissionFactory.definition);//传入配置中的filterchains

                Map<String, String> chains = permissFactory.getFilterChainDefinitionMap();
                //重新生成过滤链
                if (!CollectionUtils.isEmpty(chains)) {
                    chains.forEach((url, definitionChains) -> {
                        manager.createChain(url, definitionChains.trim().replace(" ", ""));
                    });
                }
                // manager.addToChain("/discover/banner", "perms", "sssss");


            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }

}

• 登录验证的实现

 //示例代码，未实现加密验证
 private String loginUser(ManageUser user) {
//        if (isRelogin(user)) {
//            // 如果已经登陆，无需重新登录
//            return "success";
//        }
        return shiroLogin(user); // 调用shiro的登陆验证
    }

    private String shiroLogin(ManageUser user) {
        UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword().toCharArray(), null);
//        token.setRememberMe(true);
        // shiro登陆验证
        try {
//            System.out.println(SecurityUtils.getSubject());
            SecurityUtils.getSubject().login(token);
        } catch (UnknownAccountException ex) {
            return "用户不存在或者密码错误！";
        } catch (IncorrectCredentialsException ex) {
            return "用户不存在或者密码错误！";
        }catch (ExcessiveAttemptsException ex) {
            return "账号或密码错误次数过多,请稍后重试！";
        } catch (AuthenticationException ex) {
            return ex.getMessage(); // 自定义报错信息
        } catch (Exception ex) {
            ex.printStackTrace();
            return "内部错误，请重试！";
        }
        return "success";
    }

    private boolean isRelogin(ManageUser user) {
        Subject us = SecurityUtils.getSubject();
        if (us.isAuthenticated()) {
            return true; // 参数未改变，无需重新登录，默认为已经登录成功
        }
        return false; // 需要重新登陆
    }