你的位置:首页 > Java教程

[Java教程]Java 权限框架 Shiro 实战二:与spring集成、filter机制

Shiro和Spring的集成,涉及到很多相关的配置,涉及到shiro的filer机制以及它拥有的各种默认filter,涉及到shiro的权限判断标签,权限注解,涉及到session管理等等方面。

1. 配置

首先需要在web.接入shiro的filter:

  <!-- shiro 安全过滤器 -->  <filter>    <filter-name>shiroFilter</filter-name>    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>    <async-supported>true</async-supported>    <init-param>      <param-name>targetFilterLifecycle</param-name>      <param-value>true</param-value>    </init-param>  </filter>  <filter-mapping>    <filter-name>shiroFilter</filter-name>    <url-pattern>/*</url-pattern>  </filter-mapping>

并且需要放在所有filter中靠前的位置,比如需要放在siteMesh的过滤器之前。

DelegatingFilterProxy 表示这是一个代理filter,它会将实际的工作,交给spring配置文件中 id="shiroFilter" 的bean来处理:

public class DelegatingFilterProxy extends GenericFilterBean {  private String contextAttribute;  private WebApplicationContext webApplicationContext;  private String targetBeanName;  private boolean targetFilterLifecycle = false;  private volatile Filter delegate;  private final Object delegateMonitor = new Object();  @Override  protected void initFilterBean() throws ServletException {    synchronized (this.delegateMonitor) {      if (this.delegate == null) {        // If no target bean name specified, use filter name.        if (this.targetBeanName == null) {          this.targetBeanName = getFilterName();        }        // Fetch Spring root application context and initialize the delegate early,        // if possible. If the root application context will be started after this        // filter proxy, we'll have to resort to lazy initialization.        WebApplicationContext wac = findWebApplicationContext();        if (wac != null) {          this.delegate = initDelegate(wac);        }      }    }  }

public abstract class GenericFilterBean implements    Filter, BeanNameAware, EnvironmentAware, ServletContextAware, InitializingBean, DisposableBean {  @Override  public final void init(FilterConfig filterConfig) throws ServletException {    Assert.notNull(filterConfig, "FilterConfig must not be null");    if (logger.isDebugEnabled()) {      logger.debug("Initializing filter '" + filterConfig.getFilterName() + "'");    }    this.filterConfig = filterConfig;    // Set bean properties from init parameters.    try {      PropertyValues pvs = new FilterConfigPropertyValues(filterConfig, this.requiredProperties);      BeanWrapper bw = PropertyAccessorFactory.forBeanPropertyAccess(this);      ResourceLoader resourceLoader = new ServletContextResourceLoader(filterConfig.getServletContext());      bw.registerCustomEditor(Resource.class, new ResourceEditor(resourceLoader, this.environment));      initBeanWrapper(bw);      bw.setPropertyValues(pvs, true);    }    catch (BeansException ex) {      String msg = "Failed to set bean properties on filter '" +        filterConfig.getFilterName() + "': " + ex.getMessage();      logger.error(msg, ex);      throw new NestedServletException(msg, ex);    }    // Let subclasses do whatever initialization they like.    initFilterBean();    if (logger.isDebugEnabled()) {      logger.debug("Filter '" + filterConfig.getFilterName() + "' configured successfully");    }  }

// Let subclasses do whatever initialization they like.

initFilterBean();

Filter 接口的 init 方法调用 initFilterBean(), 而该方法在子类中进行实现,它先获得 this.targetBeanName = getFilterName(); bean的名称,也就是id,然后对其进行初始化:this.delegate = initDelegate(wac); 其实就是从bean工厂中根据bean的名称找到bean.

  protected Filter initDelegate(WebApplicationContext wac) throws ServletException {    Filter delegate = wac.getBean(getTargetBeanName(), Filter.class);    if (isTargetFilterLifecycle()) {      delegate.init(getFilterConfig());    }    return delegate;  }

而 shiroFilter在spring中的配置如下:

  <!-- Shiro的Web过滤器 -->  <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">    <property name="securityManager" ref="securityManager"/>    <property name="loginUrl" value="/login"/>    <property name="successUrl" value="/"/>    <property name="unauthorizedUrl" value="/unauthorized"/>    <property name="filters">      <util:map>        <entry key="authc" value-ref="passThruAuthenticationFilter"/>      </util:map>    </property>    <property name="filterChainDefinitions">      <value>        /reg/** = anon  <!-- 注册相关 -->        /login = authc        /logout = logout        /authenticated = authc        /loginController = anon        /js/** = anon         /css/** = anon          /img/** = anon         /html/** = anon        /font-awesome/** = anon       <!-- /** = anon         /user/modifyPassword = perms["user:update", "user:select"]      -->        /** = user      </value>    </property>  </bean>

上面的shiroFilter的配置又引出了 securityManager 和 shiro 的filter机制和他自带的一些filter.

2. securityManager 级相关配置

在上一篇文章 Java 权限框架 Shiro 实战一:理论基础 中我们知道securityManager是shiro的顶层对象,它管理和调用其它所有子系统,负责系统的安全。我们知道shiro有两个类型的securityManager一个是JavaSE环境,默认是DefaultSecurityManager一个是web环境,默认是DefaultWebSecurityManager。所以我们web环境肯定应该使用后者。我们从顶层对象一层一层向下配置。先看securityManager如何配置:

  <!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) -->  <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>    <property name="arguments" ref="securityManager"/>  </bean>

上面的配置相当于调用SecurityUtils.setSecurityManager(securityManager) ,来注入了下面配置的 securityManager(DefaultWebSecurityManager) :

  <!-- 安全管理器 -->  <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">    <property name="realm" ref="userRealm"/>    <property name="cacheManager" ref="cacheManager"/>    <property name="rememberMeManager" ref="rememberMeManager"/>  </bean>

它默认使用的session管理器是 ServletContainerSessionManager,所以上面没有配置,所以就使用默认值。配置了就会覆盖下面的默认值:

  public DefaultWebSecurityManager() {    super();    ((DefaultSubjectDAO) this.subjectDAO).setSessionStorageEvaluator(new DefaultWebSessionStorageEvaluator());    this.sessionMode = HTTP_SESSION_MODE;    setSubjectFactory(new DefaultWebSubjectFactory());    setRememberMeManager(new CookieRememberMeManager());    setSessionManager(new ServletContainerSessionManager());  }

显然 securityManager 最重要的工作就是用户登录认证和获得用户的权限等相关信息,所以 realm 是其最重要的依赖:

  <!-- Realm实现 -->  <bean id="userRealm" class="com.ems.shiro.UserRealm">    <property name="credentialsMatcher" ref="credentialsMatcher"/>    <property name="cachingEnabled" value="false"/>  </bean>

要理解上面userRealm的配置,就的先理解 UserRealm 的继承体系:

UserRealm 继承  AuthorizingRealm 显然是为了获取权限信息,对用户进行访问控制;继承AuthenticatingRealm显然是为了获得用户的认证信息,对用户进行认证。而 credentialsMatcher 就是 AuthenticatingRealm 使用来进行密码验证的依赖的组件:

public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {/**   * Credentials matcher used to determine if the provided credentials match the credentials stored in the data store.   */  private CredentialsMatcher credentialsMatcher;

再看其credentialsMatcher bean的配置:

  <!-- 凭证匹配器(验证登录密码是否正确) -->  <bean id="credentialsMatcher" class="com.ems.shiro.RetryLimitHashedCredentialsMatcher">    <constructor-arg ref="cacheManager"/>    <property name="hashAlgorithmName" value="SHA-256"/>    <property name="hashIterations" value="2"/>    <property name="storedCredentialsHexEncoded" value="true"/>  </bean>

配置就是 hash加密的相关参数:hash算法,hash迭代次数等。到这里 shiro 登录验证的配置就完了。至于获取用户信息和用户的权限的信息,都在userRealm中实现了:

public class UserRealm extends AuthorizingRealm {  @Autowired  private UserService userService;  @Override  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {    String userName = (String)principals.getPrimaryPrincipal();    User user = userService.getUserByUserName (userName );    SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();    authorizationInfo.setRoles(userService.findRolesByUserId(user.getId()));    authorizationInfo.setStringPermissions(userService.findPermissionsByUserId(user.getId()));    return authorizationInfo;  }    @Override  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {    String userName = (String)token.getPrincipal();    User user = userService.getUserByUserName(userName);    if(user == null) {      throw new UnknownAccountException();//没找到账户    }    if(user.getLocked() == 0) {      throw new LockedAccountException(); //帐号锁定    }    if(user.getLocked() == 2){      throw new AuthenticationException("account was inactive");    }    SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(        user.getUserName(),        user.getPassword(), // 密码        ByteSource.Util.bytes(user.getCredentialsSalt()),  // salt=no+salt        getName() // realm name    );        return authenticationInfo;  }

securityManager会在需要的时候回调上面 的 doGetAuthorizationInfo 和 doGetAuthenticationInfo 方法,从realm中获得登录认证信息和用户权限信息。至于 rememberMeManager 主要是实现使用cookie表示我已经登录过了,下次不需要重新登录,这一个功能,也就是“记住我”登录过这一功能:

  <!-- rememberMe管理器 -->  <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">    <!-- rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度(128 256 512 位)-->    <property name="cipherKey"         value="#{T(org.apache.shiro.codec.Base64).decode('9FvVhtFLUs0KnA3Kprsdyg==')}"/>    <property name="cookie" ref="rememberMeCookie"/>  </bean>  <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">    <constructor-arg value="rememberMe"/>    <property name="httpOnly" value="true"/>    <property name="maxAge" value="2592000"/><!-- 30天 -->  </bean>

还有cacheManager的配置:

  <!--ehcache-->  <bean id="ehcacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean">    <property name="configLocation" value="classpath:ehcache/ehcache./>  </bean>  <bean id="springCacheManager" class="org.springframework.cache.ehcache.EhCacheCacheManager">    <property name="cacheManager" ref="ehcacheManager"/>  </bean>  <!-- 缓存管理器 -->  <bean id="cacheManager" class="com.ems.shiro.SpringCacheManagerWrapper">    <property name="cacheManager" ref="springCacheManager"/>  </bean>

使用的是 EhCache.

3. Shiro 的filter机制和自带的filter

Shiro的filter是基于Servlet的Filter接口实现的。我们通过Shiro提供的form登录filter:FormAuthenticationFilter 和 ShiroFilter 看看其实现:

 

继承中的每一层都实现了一些功能:

1> NameableFilter:实现给filter取名的功能(Allows a filter to be named via JavaBeans-compatible)

/** * Allows a filter to be named via JavaBeans-compatible*/public abstract class NameableFilter extends AbstractFilter implements Nameable {  /**   * The name of this filter, unique within an application.   */  private String name;

2> OncePerRequestFilter : 保证对于同一个request,fiter只执行一次(Filter base class that guarantees to be just executed once per request)

/** * Filter base class that guarantees to be just executed once per request, * on any servlet container. It provides a [email protected] #doFilterInternal} * method with HttpServletRequest and HttpServletResponse arguments.*/public abstract class OncePerRequestFilter extends NameableFilter {

3> AdviceFilter: SpringMVC风格的过滤器(就是preHandle, postHandle,afterCompletion 三接口的过滤器)

 /**
 * A Servlet Filter that enables AOP-style &quot;around&quot; advice for a ServletRequest via
* preHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse),
 * postHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse),
 * and afterCompletion(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Exception)hooks.
 */
public abstract class AdviceFilter extends OncePerRequestFilter { protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception { return true; } @SuppressWarnings({"UnusedDeclaration"}) protected void postHandle(ServletRequest request, ServletResponse response) throws Exception { } @SuppressWarnings({"UnusedDeclaration"}) public void afterCompletion(ServletRequest request, ServletResponse response, Exception exception) throws Exception { }

4> PathMatchingFilter:该过滤器仅仅处理指定的路径(比如上面的配置:/js/** = anon,表示对 /js/ 目录和其子目录的请求,交给anon过滤器处理)

/** * <p>Base class for Filters that will process only specified paths and allow all others to pass through.</p>*/public abstract class PathMatchingFilter extends AdviceFilter implements PathConfigProcessor {

5> AccessControlFilter: 实现提供对资源的访问控制,没有权限时,重定向到登录页面,登录之后跳转到原来的那个页面

/** * Superclass for any filter that controls access to a resource and may redirect the user to the login page * if they are not authenticated. This superclass provides the method * saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) * which is used by many subclasses as the behavior when a user is unauthenticated.*/public abstract class AccessControlFilter extends PathMatchingFilter {

6> AuthenticationFilter: 实现对访问用户的认证要求,也就是必须登录了才能访问

/** * Base class for all Filters that require the current user to be authenticated. This class encapsulates the * logic of checking whether a user is already authenticated in the system while subclasses are required to perform * specific logic for unauthenticated requests.*/public abstract class AuthenticationFilter extends AccessControlFilter {

7> AuthenticatingFilter: 实现判断用户是否有权限访问某资源。

/** * An AuthenticationFilter that is capable of automatically performing an authentication attempt * based on the incoming request.*/public abstract class AuthenticatingFilter extends AuthenticationFilter {

8> FormAuthenticationFilter:shiro提供的用于实现用户登录功能,如果我们打算自己实现登录,那么我们应用 PassThruAuthenticationFilter 来替代

/** * Requires the requesting user to be authenticated for the request to continue, and if they are not, forces the user * to login via by redirecting them to the setLoginUrl(String) you configure. * If you would prefer to handle the authentication validation and login in your own code, consider using the * PassThruAuthenticationFilter instead, which allows requests to the loginUrl to pass through to your application's code directly.*/public class FormAuthenticationFilter extends AuthenticatingFilter {

9> PassThruAuthenticationFilter : 用于我们自己在controller中实现登录逻辑时替代FormAuthenticationFilter

/** * An authentication filter that redirects the user to the login page when they are trying to access * a protected resource. However, if the user is trying to access the login page, the filter lets * the request pass through to the application code. * The difference between this filter and the FormAuthenticationFilter is that * on a login submission (by default an HTTP POST to the login URL), the FormAuthenticationFilter filter * attempts to automatically authenticate the user by passing the username and password request parameter values to * Subject.login(AuthenticationToken) directly. * Conversely, this controller always passes all requests to the loginUrl through, both GETs and POSTs. 
* This is useful in cases where the developer wants to write their own login behavior, which should include a * call to Subject.login(AuthenticationToken) at some point. For example, if the developer has their own custom MVC
* login controller or validator, this PassThruAuthenticationFilter may be appropriate.*/public class PassThruAuthenticationFilter extends AuthenticationFilter { protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { if (isLoginRequest(request, response)) { return true; } else { saveRequestAndRedirectToLogin(request, response); return false; } }}

10> Shiro 自带的filter:

Shiro自身提供了很多的默认filter 来供我们使用,主要分为两种:一是 登录认证相关的filter;一是权限访问控制相关的filter;

登录认证相关的filter有:

1)filter名称: anon, 实现类org.apache.shiro.web.filter.authc.AnonymousFilter,主要用于静态资源的访问,表示无需登录就可以访问;

2)filter名称: authc, 实现类org.apache.shiro.web.filter.authc.FormAuthenticationFilter,主要用于表单登录,没有登录则跳转登录url;

3)filter名称: user, 实现类org.apache.shiro.web.filter.authc.UserFilter,主要用于要求用户已经登录或者通过“记住我”功能登录了也行。

4)filter名称: logout, 实现类org.apache.shiro.web.filter.authc.LogoutFilter,主要用于用户登出

5)filter名称: authcBasic,authc的简化形式,略。

权限访问控制相关的filter有:

1)filter名称: roles, 实现类org.apache.shiro.web.filter.authc.RolesAuthorizationFilter,主要用于验证用户必须拥有某角色,才能继续访问;

2)filter名称: perms, 实现类org.apache.shiro.web.filter.authc.PermissionsAuthorizationFilter,主要用于验证用户必须拥有某权限,才能继续访问;

3)filter名称: ssl, 实现类org.apache.shiro.web.filter.authc.SslFilter,主要用于要求访问协议是https才能访问,不然跳转到https的443短裤;

4)filter名称: port rest noSessionCreation,略。

我们上面的shiroFilter的配置中,已经使用过了上面这些自带的filter:

        /reg/** = anon  <!-- 注册相关 -->        /login = authc        /logout = logout        /authenticated = authc        /loginController = anon        /js/** = anon         /css/** = anon          /img/** = anon         /html/** = anon        /font-awesome/** = anon         /** = user

我们看到 /reg/** 注册相关的,/js/**静态资源都是使用的 anon匿名过滤器,不要求用户已经登录就可以访问。

/** = user 放在最后是要求除了上面那些 url 之外的访问路径,都需要登录认证过或者通过记住我登录认证过。因为路径比较是从上面开始列出来的先开始比较的,匹配了就走该过滤器,不会继续下面的过滤器了。

4. shiro的权限标签

对双方都