安全认证（三）Shiro安全框架入门

/**
 * Shiro认证 测试
 */
public class AuthenticationTest {
    // 构建一个简单的数据源
    SimpleAccountRealm simpleAccountRealm = new SimpleAccountRealm();
    @Before
    public void addUser(){
        // 参数分别为：用户名，密码，权限...
        simpleAccountRealm.addAccount("chaooo", "123456", "admin","user");
    }
    /**
     * 认证测试方法
     */
    @Test
    public void testAuthentication(){
        // 1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(simpleAccountRealm);
        // 2. 主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        // 3. 调用Subject.login(token)方法开始用户认证流程
        UsernamePasswordToken token = new UsernamePasswordToken("chaooo", "123456");
        try {
        　　subject.login(token);
        } catch (UnknownAccountException e) {
        　　logger.error(String.format("用户不存在: %s", username), e);
        } catch (IncorrectCredentialsException e) {
        　　logger.error(String.format("密码不正确: %s", username), e);
        } catch (ConcurrentAccessException e) {
        　　logger.error(String.format("用户重复登录: %s", username), e);
        } catch (AccountException e) {
        　　logger.error(String.format("其他账户异常: %s", username), e);
        }
    }
}

// 在执行访问授权验证之前，必须执行用户认证
// 角色验证
Subject subject = SecurityUtils.getSubject();
if(subject.hasRole("admin")) {
　　//用户属于角色admin
}else{
　　//用户不属于角色admin
}
// subject.checkRoles("admin","user");同时check多个角色
// 权限验证
String perm = "log:manage:*";
if(subject.isPermitted(perm)) {
　　logger.info(String.format("用户： %s 拥有权限：%s", name, perm));
}else {
　　logger.error(String.format("用户：%s 没有权限：%s", name, perm));
}

@RequiresPermissions(value={"log:manage:*"})
public ModelAndView home(HttpServletRequest req) {
　　ModelAndView mv = new ModelAndView("home");
　　return mv;
}

<!-- 使用shiro标签 -->
<shiro:hasPermission name="log:manage:*">
　　<a href="<%=request.getContextPath()%>/user/home">操作日志审计</a><br/>
</shiro:hasPermission>

# -----------------------------------------------------------------------------
# Users and their assigned roles
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc
# -----------------------------------------------------------------------------
[users]
# user 'root' with password 'secret' and the 'admin' role
root = secret, admin
# user 'guest' with the password 'guest' and the 'guest' role
guest = guest, guest
# user 'chaooo' with password '123456' and roles 'user' and 'guest'
chaooo = 123456, user, guest

# -----------------------------------------------------------------------------
# Roles with assigned permissions
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
# -----------------------------------------------------------------------------
[roles]
# 'admin' role has all permissions, indicated by the wildcard '*'
admin = *
# The 'schwartz' role can do anything (*) with any lightsaber:
user = user:*
# The 'goodguy' role is allowed to 'query' (action) the user (type) with license plate 'zhangsan' (instance specific id)
guest = user:query:zhangsan

public class Quickstart {

    private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);

    public static void main(String[] args) {
        // 构建SecurityManager环境
        DefaultSecurityManager securityManager = new DefaultSecurityManager();
        IniRealm iniRealm = new IniRealm("classpath:shiro.ini");
        securityManager.setRealm(iniRealm);
        SecurityUtils.setSecurityManager(securityManager);

        // get the currently executing user:
        // 获取当前的 Subject
        Subject currentUser = SecurityUtils.getSubject();

        // Do some stuff with a Session (no need for a web or EJB container!!!)
        // 测试使用 shiro的Session
        Session session = currentUser.getSession();
        session.setAttribute("someKey", "aValue");
        String value = (String) session.getAttribute("someKey");
        if (value.equals("aValue")) {
            log.info("---> Retrieved the correct value! [" + value + "]");
        }

        // let's login the current user so we can check against roles and permissions:
        // 测试当前的用户是否已经被认证. 即是否已经登录.
        // 调动 Subject 的 isAuthenticated()
        if (!currentUser.isAuthenticated()) {
            // 把用户名和密码封装为 UsernamePasswordToken 对象
            UsernamePasswordToken token = new UsernamePasswordToken("chaooo", "123456");
            // rememberme
            token.setRememberMe(true);
            try {
                // 执行登录.
                currentUser.login(token);
            }
            // 若没有指定的账户, 则 shiro 将会抛出 UnknownAccountException 异常.
            catch (UnknownAccountException uae) {
                log.info("----> There is no user with username of " + token.getPrincipal());
                return;
            }
            // 若账户存在, 但密码不匹配, 则 shiro 会抛出 IncorrectCredentialsException 异常。
            catch (IncorrectCredentialsException ice) {
                log.info("----> Password for account " + token.getPrincipal() + " was incorrect!");
                return;
            }
            // 用户被锁定的异常 LockedAccountException
            catch (LockedAccountException lae) {
                log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                        "Please contact your administrator to unlock it.");
            }
            // ... catch more exceptions here (maybe custom ones specific to your application?
            // 所有认证时异常的父类.
            catch (AuthenticationException ae) {
                //unexpected condition?  error?
            }
        }

        //say who they are:
        //print their identifying principal (in this case, a username):
        log.info("----> User [" + currentUser.getPrincipal() + "] logged in successfully.");

        //test a role:
        // 测试是否有某一个角色. 调用 Subject 的 hasRole 方法.
        if (currentUser.hasRole("admin")) {
            log.info("----> May the Admin be with you!");
        } else {
            log.info("----> Hello, mere mortal.");
            return;
        }

        //test a typed permission (not instance-level)
        // 测试用户是否具备某一个行为. 调用 Subject 的 isPermitted() 方法。
        if (currentUser.isPermitted("user:query, edit")) {
            log.info("----> You are permitted to 'query' and 'edit' 'user'");
        } else {
            log.info("Sorry, you don't have permission");
        }

        //a (very powerful) Instance Level permission:
        // 测试用户是否具备某一个行为. 资源标识符:操作:对象实例ID
        if (currentUser.isPermitted("user:query:zhangsan")) {
            log.info("----> You are permitted to 'delete' 'user' 'zhangsan'");
        } else {
            log.info("Sorry, you don't have permission!");
        }

        //all done - log out!
        // 执行登出. 调用 Subject 的 Logout() 方法.
        System.out.println("---->" + currentUser.isAuthenticated());
        currentUser.logout();
        System.out.println("---->" + currentUser.isAuthenticated());
        System.exit(0);
    }
}

<!-- shiro配置 -->
<dependency>
　　<groupId>org.apache.shiro</groupId>
   <artifactId>shiro-core</artifactId>
   <version>${version.shiro}</version>
</dependency>
<!-- Enables support for web-based applications. -->
<dependency>
　　<groupId>org.apache.shiro</groupId>
   <artifactId>shiro-web</artifactId>
   <version>${version.shiro}</version>
</dependency>
<!-- Enables AspectJ support for Shiro AOP and Annotations. -->
<dependency>
　　<groupId>org.apache.shiro</groupId>
   <artifactId>shiro-aspectj</artifactId>
   <version>${version.shiro}</version>
</dependency>
<!-- Enables Ehcache-based famework caching. -->
<dependency>
　　<groupId>org.apache.shiro</groupId>
   <artifactId>shiro-ehcache</artifactId>
   <version>${version.shiro}</version>
</dependency>
<!-- Enables Spring Framework integration. -->
<dependency>
　　<groupId>org.apache.shiro</groupId>
   <artifactId>shiro-spring</artifactId>
   <version>${version.shiro}</version>
</dependency>

<!--
shiro使用slf4j作为日志框架，所以必需配置slf4j。
同时，使用log4j作为底层的日志实现框架。
-->
<dependency>
　　<groupId>org.slf4j</groupId>
　　<artifactId>slf4j-api</artifactId>
　　<version>1.7.25</version>
</dependency>
<dependency>
　　<groupId>org.slf4j</groupId>
　　<artifactId>slf4j-log4j12</artifactId>
　　<version>1.7.25</version>
</dependency>
<dependency>
　　<groupId>log4j</groupId>
　　<artifactId>log4j</artifactId>
　　<version>1.2.17</version>
</dependency>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
  <property name="securityManager" ref="securityManager"/>
  <property name="loginUrl" value="/index"/>
  <property name="successUrl" value="/home"/>
  <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
  <!-- The 'filters' property is not necessary since any declared javax.servlet.Filter bean  -->
  <!-- defined will be automatically acquired and available via its beanName in chain        -->
  <!-- definitions, but you can perform instance overrides or name aliases here if you like: -->
  <!-- <property name="filters">
      <util:map>
          <entry key="logout" value-ref="logoutFilter" />
      </util:map>
  </property> -->
  <property name="filterChainDefinitions">
      <value>
          # some example chain definitions:
          # /admin/** = authc, roles[admin]
          # /docs/** = authc, perms[document:read]
          /login = anon
          /logout = anon
          /error = anon
          /** = user
          # more URL-to-FilterChain definitions here
      </value>
  </property>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
  <!-- Single realm app.  If you have multiple realms, use the 'realms' property instead. -->
  <property name="realm" ref="myRealm" />
  <!-- By default the servlet container sessions will be used.  Uncomment this line
       to use shiro's native sessions (see the JavaDoc for more): -->
  <!-- <property name="sessionMode" value="native"/> -->
</bean>
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
<!-- Define the Shiro Realm implementation you want to use to connect to your back-end -->
<!-- security datasource: -->
<bean id="myRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
  <property name="dataSource" ref="dataSource"/>
  <property name="permissionsLookupEnabled" value="true"/>
</bean>
<!-- Enable Shiro Annotations for Spring-configured beans.  Only run after -->
<!-- the lifecycleBeanProcessor has run: -->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
  <property name="securityManager" ref="securityManager"/>
</bean>

<!-- The filter-name matches name of a 'shiroFilter' bean inside applicationContext.xml -->
<!-- DelegatingFilterProxy作用是自动到Spring 容器查找名字为shiroFilter（filter-name）的bean并把所有Filter 的操作委托给它。 -->
<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<!-- Make sure any request you want accessible to Shiro is filtered. /* catches all -->
<!-- requests.  Usually this filter mapping is defined first (before all others) to -->
<!-- ensure that Shiro works in subsequent filters in the filter chain:             -->
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

Subject subject = SecurityUtils.getSubject();
if(!subject.isAuthenticated()) {
　　UsernamePasswordToken token = new UsernamePasswordToken(name, password);
    try {
    　　subject.login(token);
    } catch (UnknownAccountException e) {
    　　logger.error(String.format("用户不存在: %s", token.getPrincipal()), e);
    } catch (IncorrectCredentialsException e) {
    　　logger.error(String.format("密码不正确: %s", token.getPrincipal()), e);
    } catch (ConcurrentAccessException e) {
    　　logger.error(String.format("用户重复登录: %s", token.getPrincipal()), e);
    } catch (AccountException e) {
    　　logger.error(String.format("其他账户异常: %s", token.getPrincipal()), e);
    }
}

<!-- 在jsp页面中引入shiro标签库 -->
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<!-- 权限控制 -->
<shiro:hasRole name="admin">
　　<a>用户管理</a>
</shiro:hasRole>
<shiro:hasPermission name="winnebago:drive:eagle5">
　　<a>操作审计</a>
</shiro:hasPermission>

String roleAdmin = "admin";
Subject currentUser = SecurityUtils.getSubject();
if(!currentUser.hasRole(roleAdmin)) {
　　//todo something
}

@Controller
public class HomeController {
　　@RequestMapping("/home")
　　@RequiresPermissions(value={"log:manage:*"})
　　public ModelAndView home(HttpServletRequest req) {
　　　　ModelAndView mv = new ModelAndView("home");
　　　　return mv;
　　}
}

create table sessions (
    id varchar(200),
    session varchar(2000),
    constraint pk_sessions primary key(id)
) charset=utf8 ENGINE=InnoDB;