整合后实现功能
1.登录认证
2.权限处理
3.自定义role拦截
4.md5加密
ssm整合shiro步骤
ssm框架整合链接:https://blog.csdn.net/IManiy/article/details/81393256
开发工具:IDEA
Demo框架:Spring+SpringMVC+Mybatis+Maven
先看看整合完成后的项目结构
新建一个maven项目
配置pom.xml文件
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>top.maniy</groupId>
<artifactId>shiro-ssm</artifactId>
<version>1.0-SNAPSHOT</version>
<properties>
<junit.version>4.12</junit.version>
<spring.version>4.1.3.RELEASE</spring.version>
<mybatis.version>3.2.8</mybatis.version>
<mybatis.spring.version>1.2.2</mybatis.spring.version>
<mybatis.paginator.version>1.2.15</mybatis.paginator.version>
<mysql.version>5.1.32</mysql.version>
<slf4j.version>1.6.4</slf4j.version>
<jackson.version>2.4.2</jackson.version>
<druid.version>1.0.9</druid.version>
<jstl.version>1.2</jstl.version>
<servlet-api.version>2.5</servlet-api.version>
<jsp-api.version>2.0</jsp-api.version>
<commons-lang3.version>3.3.2</commons-lang3.version>
<commons-io.version>1.3.2</commons-io.version>
<commons-net.version>3.3</commons-net.version>
<pagehelper.version>3.4.1</pagehelper.version>
<shiro-spring>1.2.3</shiro-spring>
<shiro-core>1.2.3</shiro-core>
</properties>
<dependencies>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>${druid.version}</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>${mysql.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-core</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-beans</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jdbc</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-aspects</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jms</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context-support</artifactId>
<version>${spring.version}</version>
</dependency>
<!-- Mybatis -->
<dependency>
<groupId>org.mybatis</groupId>
<artifactId>mybatis</artifactId>
<version>${mybatis.version}</version>
</dependency>
<dependency>
<groupId>org.mybatis</groupId>
<artifactId>mybatis-spring</artifactId>
<version>${mybatis.spring.version}</version>
</dependency>
<dependency>
<groupId>com.github.miemiedev</groupId>
<artifactId>mybatis-paginator</artifactId>
<version>${mybatis.paginator.version}</version>
</dependency>
<dependency>
<groupId>com.github.pagehelper</groupId>
<artifactId>pagehelper</artifactId>
<version>${pagehelper.version}</version>
</dependency>
<!-- Apache工具组件 -->
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>${commons-lang3.version}</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-io</artifactId>
<version>${commons-io.version}</version>
</dependency>
<dependency>
<groupId>commons-net</groupId>
<artifactId>commons-net</artifactId>
<version>${commons-net.version}</version>
</dependency>
<!-- Jackson Json处理工具包 -->
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${jackson.version}</version>
</dependency>
<!-- 单元测试 -->
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>${junit.version}</version>
<scope>test</scope>
</dependency>
<!-- 日志处理 -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${slf4j.version}</version>
</dependency>
<!-- JSP相关 -->
<dependency>
<groupId>jstl</groupId>
<artifactId>jstl</artifactId>
<version>${jstl.version}</version>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>servlet-api</artifactId>
<version>${servlet-api.version}</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>javax.servlet</groupId>
<artifactId>jsp-api</artifactId>
<version>${jsp-api.version}</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-test</artifactId>
<version>${spring.version}</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>${shiro-core}</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>${shiro-spring}</version>
</dependency>
</dependencies>
</project>
进行SSM框架整合
通过project Structure新建webpp及其下面目录
新建项目结构文件夹及文件
sqlMapConfig.xml、spring-service、spring-dao、jdbc.properites与下面链接相同
ssm框架整合链接:https://blog.csdn.net/IManiy/article/details/81393256
spring-shiro.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:util="http://www.springframework.org/schema/util"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-2.0.xsd">
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="login.html"/>
<property name="unauthorizedUrl" value="403.html" />
<property name="filterChainDefinitions">
<value>
<!-- 这里顺序执行 anon不要认证 authc需要认证,一般情况下 /*放在最下面-->
<!--加载静态资源 /js/** = anon-->
/login.html = anon
/subLogin = anon
/testRole2=roles["admin"]
/testRole3=rolesOr["admin","admin1"]
/testPerms =perms[user:select]
/testPerms1 =perms["user:select","user:update"]
/* = authc
</value>
</property>
<property name="filters">
<util:map>
<entry key="rolesOr" value-ref="rolesOrFilter"/>
</util:map>
</property>
</bean>
<bean class="top.maniy.demo.filter.RolesOrFilter" id="rolesOrFilter"/>
<!--创建SecurityManager对象 -->
<bean class="org.apache.shiro.web.mgt.DefaultWebSecurityManager" id="securityManager">
<property name="realm" ref="realm"/>
</bean>
<!--自定义realm -->
<bean class="top.maniy.demo.shiro.realm.CustomRealm" id="realm">
<property name="credentialsMatcher" ref="credentialsMatcher" />
</bean>
<!--md5 加密-->
<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher" id="credentialsMatcher">
<property name="hashAlgorithmName" value="md5" />
<property name="hashIterations" value="1"/>
</bean>
</beans>
springmvc.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
xmlns:context="http://www.springframework.org/schema/context"
xmlns:aop="http://www.springframework.org/schema/aop"
xmlns:mvc="http://www.springframework.org/schema/mvc"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd">
<!-- 配置Controller扫描 -->
<context:component-scan base-package="top.maniy.demo.controller" />
<!-- 配置注解驱动 -->
<mvc:annotation-driven />
<!-- 对静态资源放行 -->
<!--<mvc:resources location="/css/" mapping="/css/**"/>
<mvc:resources location="/js/" mapping="/js/**"/>
<mvc:resources location="/fonts/" mapping="/fonts/**"/>-->
<!-- 2.静态资源默认servlet配置 (1)加入对静态资源的处理:js,gif,png (2)允许使用"/"做整体映射 -->
<mvc:resources mapping="/*" location="WEB-INF/" />
<!-- 配置视图解析器 -->
<bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
<property name="viewClass" value="org.springframework.web.servlet.view.JstlView"/>
<!-- 前缀 -->
<property name="prefix" value="/WEB-INF/page/" />
<!-- 后缀 -->
<property name="suffix" value=".jsp" />
</bean>
<aop:config proxy-target-class="true"/>
<!--Shiro配置-->
<!--
1.配置lifecycleBeanPostProcessor,可以在Spring IOC容器中调用shiro的生命周期方法.
-->
<bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<!--
2.开启Spring AOC Shiro注解支持
-->
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
</beans>
web.xml
<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
version="4.0">
<welcome-file-list>
<welcome-file>login.html</welcome-file>
</welcome-file-list>
<!--配置shiro-->
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 配置spring -->
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring/spring-*.xml</param-value>
</context-param>
<!-- 配置监听器加载spring -->
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<!-- 配置过滤器,解决post的乱码问题 -->
<filter>
<filter-name>encoding</filter-name>
<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
<init-param>
<param-name>encoding</param-name>
<param-value>UTF-8</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>encoding</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<!-- 配置SpringMVC -->
<servlet>
<servlet-name>SpringMVC</servlet-name>
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<init-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring/springmvc.xml</param-value>
</init-param>
<!-- 配置springmvc什么时候启动,参数必须为整数 -->
<!-- 如果为0或者大于0,则springMVC随着容器启动而启动 -->
<!-- 如果小于0,则在第一次请求进来的时候启动 -->
<load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
<servlet-name>SpringMVC</servlet-name>
<!-- 所有的请求都进入springMVC -->
<url-pattern>/</url-pattern>
</servlet-mapping>
</web-app>
自定义role拦截RolesOrFilter
/**
* @author liuzonghua
* @Package top.maniy.filter
* @Description:自定义role拦截,定义:如果有一个权限存在就可以跳转
* @date 2018/10/9 12:57
*/
public class RolesOrFilter extends AuthorizationFilter{
protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
Subject subject =getSubject(servletRequest,servletResponse);
String[] roles =(String[]) o;
if(roles ==null || roles.length == 0){
return true;
}
for (String role:roles){
if(subject.hasRole(role)){
return true;
}
}
return false;
}
}
UserMapper.java
public interface UserMapper {
//查询根据username用户信息
User getUserByUserName(String userName);
//根据username查询角色
List<String> queryRolesByUserName(String userName);
//根据username查询权限
List<String> queryPermissionByUserName(String userName);
}
UserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace ="top.maniy.demo.mapper.UserMapper">
<select id="getUserByUserName" resultType="User">
SELECT * FROM users WHERE username=#{username}
</select>
<select id="queryRolesByUserName" resultType="String">
SELECT role_name FROM user_roles WHERE username=#{username}
</select>
<select id="queryPermissionByUserName" resultType="String">
SELECT permission FROM roles_permissions WHERE role_name=#{role_name}
</select>
</mapper>
自定义CustomRealm
public class CustomRealm extends AuthorizingRealm{
@Autowired
private UserMapper userMapper;
// Map<String,String> userMap =new HashMap<String, String>(16);
// {
// userMap.put("maniy","993121f227e2cef658c392549708d60c");
// super.setName("customRealm");
// }
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
String userName = (String) principalCollection.getPrimaryPrincipal();
Set<String> roles =getRolesByUserName(userName);
Set<String> permissions = getPermissionByUserName(userName);
SimpleAuthorizationInfo simpleAuthorizationInfo =new SimpleAuthorizationInfo();
simpleAuthorizationInfo.setStringPermissions(permissions);
simpleAuthorizationInfo.setRoles(roles);
return simpleAuthorizationInfo;
}
private Set<String> getPermissionByUserName(String userName) {
List<String> listR =userMapper.queryRolesByUserName(userName);
List<String>listP=new ArrayList<String>();
for(String str:listR){
listP.addAll(userMapper.queryPermissionByUserName(str));
}
Set<String> sets =new HashSet<String>(listP);
// Set<String> sets =new HashSet<String>();
// sets.add("user:delete");
// sets.add("user:add");
return sets;
}
private Set<String> getRolesByUserName(String userName) {
System.out.println("从数据库中获取授权数据");
List<String> list =userMapper.queryRolesByUserName(userName);
Set<String> sets=new HashSet<String>(list);
// Set<String> sets =new HashSet<String>();
// sets.add("admin");
// sets.add("user");
return sets;
}
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
throws AuthenticationException {
//1.从主体传过来额认证信息中,获得用户名
String userName = (String) authenticationToken.getPrincipal();
//2.通过用户名到数据库中获取凭证
String password = getPasswordByUserName(userName);
if(password == null){
return null;
}
SimpleAuthenticationInfo simpleAuthenticationInfo =new SimpleAuthenticationInfo
(userName,password,"customRealm");
//shiro需要知道用了什么盐,在去解析密码
simpleAuthenticationInfo.setCredentialsSalt(ByteSource.Util.bytes(userName));
return simpleAuthenticationInfo;
}
/**
* 模拟数据库查询认证
* @param username
* @return
*/
private String getPasswordByUserName(String username){
//
User user =userMapper.getUserByUserName(username);
if(user!=null){
System.out.println(user.getPassword());
return user.getPassword();
}else {
return null;
}
//return userMap.get(username);
}
public static void main(String[] args) {
//单一的是密码加密容易破解,这时候就需要 加盐
Md5Hash md5Hash= new Md5Hash("1234567","Mark");
System.out.println(md5Hash.toString());
}
}
UserController
@Controller
public class UserController {
@RequestMapping(value = "/subLogin" ,method = RequestMethod.POST,
produces = "application/json;charset=utf-8")
@ResponseBody
public String subLogin(User user){
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token =new UsernamePasswordToken(user.getUsername(),
user.getPassword());
try {
token.setRememberMe(user.isRememberMe());
subject.login(token);
} catch (AuthenticationException e) {
return e.getMessage();
}
if(subject.hasRole("admin")){
if (subject.isPermitted("user:select")){
return "权限为user:select";
}
return "有admin权限";
}
return "无admin权限";
}
/**
* 通过注解配置授权
* 用户角色必须具备admin权限才能访问
* @return
*/
@RequiresRoles("admin")
//@RequiresPermissions("xxxx")
@RequestMapping(value = "/testRole",method = RequestMethod.GET)
@ResponseBody
public String TestRole(){
return "testRole success";
}
/**
* 通过注解配置授权
* 用户角色必须具备admin权限才能访问
* @return
*/
@RequiresRoles("admin1")
@RequestMapping(value = "/testRole1",method = RequestMethod.GET)
@ResponseBody
public String TestRole1(){
return "testRole1 success";
}
@RequestMapping(value = "/testRole2",method = RequestMethod.GET)
@ResponseBody
public String TestRole2(){
return "testRole2 success";
}
@RequestMapping(value = "/testRole3",method = RequestMethod.GET)
@ResponseBody
public String TestRole3(){
return "testRole3 success";
}
@RequestMapping(value = "/testPerms",method = RequestMethod.GET)
@ResponseBody
public String TestPerms(){
return "testPerms success";
}
@RequestMapping(value = "/testPerms1",method = RequestMethod.GET)
@ResponseBody
public String TestPerms1(){
return "testPerms1 success";
}
}
login.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>登录</title>
</head>
<body>
<form action="subLogin" method="post">
<input type="text" name="username" /><br>
<input type="password" name="password"/><br>
<input type="checkbox" name="rememberMe" />记住我
<input type="submit" value="登录">
</form>
</body>
</html>