Shiro和Spring的集成，涉及到很多相关的配置，涉及到shiro的filer机制以及它拥有的各种默认filter，涉及到shiro的权限判断标签，权限注解，涉及到session管理等等方面。
1. 配置
首先需要在web.接入shiro的filter:
<!-- shiro 安全过滤器 --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <async-supported>true</async-supported> <init-param> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
并且需要放在所有filter中靠前的位置，比如需要放在siteMesh的过滤器之前。
DelegatingFilterProxy 表示这是一个代理filter，它会将实际的工作，交给spring配置文件中 id="shiroFilter" 的bean来处理：
public class DelegatingFilterProxy extends GenericFilterBean { private String contextAttribute; private WebApplicationContext webApplicationContext; private String targetBeanName; private boolean targetFilterLifecycle = false; private volatile Filter delegate; private final Object delegateMonitor = new Object(); @Override protected void initFilterBean() throws ServletException { synchronized (this.delegateMonitor) { if (this.delegate == null) { // If no target bean name specified, use filter name. if (this.targetBeanName == null) { this.targetBeanName = getFilterName(); } // Fetch Spring root application context and initialize the delegate early, // if possible. If the root application context will be started after this // filter proxy, we'll have to resort to lazy initialization. WebApplicationContext wac = findWebApplicationContext(); if (wac != null) { this.delegate = initDelegate(wac); } } } }public abstract class GenericFilterBean implements Filter, BeanNameAware, EnvironmentAware, ServletContextAware, InitializingBean, DisposableBean { @Override public final void init(FilterConfig filterConfig) throws ServletException { Assert.notNull(filterConfig, "FilterConfig must not be null"); if (logger.isDebugEnabled()) { logger.debug("Initializing filter '" + filterConfig.getFilterName() + "'"); } this.filterConfig = filterConfig; // Set bean properties from init parameters. try { PropertyValues pvs = new FilterConfigPropertyValues(filterConfig, this.requiredProperties); BeanWrapper bw = PropertyAccessorFactory.forBeanPropertyAccess(this); ResourceLoader resourceLoader = new ServletContextResourceLoader(filterConfig.getServletContext()); bw.registerCustomEditor(Resource.class, new ResourceEditor(resourceLoader, this.environment)); initBeanWrapper(bw); bw.setPropertyValues(pvs, true); } catch (BeansException ex) { String msg = "Failed to set bean properties on filter '" + filterConfig.getFilterName() + "': " + ex.getMessage(); logger.error(msg, ex); throw new NestedServletException(msg, ex); } // Let subclasses do whatever initialization they like. initFilterBean(); if (logger.isDebugEnabled()) { logger.debug("Filter '" + filterConfig.getFilterName() + "' configured successfully"); } }// Let subclasses do whatever initialization they like.
initFilterBean();
Filter 接口的 init 方法调用 initFilterBean()， 而该方法在子类中进行实现，它先获得 this.targetBeanName = getFilterName(); bean的名称，也就是id，然后对其进行初始化：this.delegate = initDelegate(wac); 其实就是从bean工厂中根据bean的名称找到bean.
protected Filter initDelegate(WebApplicationContext wac) throws ServletException { Filter delegate = wac.getBean(getTargetBeanName(), Filter.class); if (isTargetFilterLifecycle()) { delegate.init(getFilterConfig()); } return delegate; }而 shiroFilter在spring中的配置如下：
<!-- Shiro的Web过滤器 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager"/> <property name="loginUrl" value="/login"/> <property name="successUrl" value="/"/> <property name="unauthorizedUrl" value="/unauthorized"/> <property name="filters"> <util:map> <entry key="authc" value-ref="passThruAuthenticationFilter"/> </util:map> </property> <property name="filterChainDefinitions"> <value> /reg/** = anon <!-- 注册相关 --> /login = authc /logout = logout /authenticated = authc /loginController = anon /js/** = anon /css/** = anon /img/** = anon /html/** = anon /font-awesome/** = anon <!-- /** = anon /user/modifyPassword = perms["user:update", "user:select"] --> /** = user </value> </property> </bean>
上面的shiroFilter的配置又引出了 securityManager 和 shiro 的filter机制和他自带的一些filter.
2. securityManager 级相关配置
在上一篇文章 Java 权限框架 Shiro 实战一：理论基础 中我们知道securityManager是shiro的顶层对象，它管理和调用其它所有子系统，负责系统的安全。我们知道shiro有两个类型的securityManager：一个是JavaSE环境，默认是DefaultSecurityManager；一个是web环境，默认是DefaultWebSecurityManager。所以我们web环境肯定应该使用后者。我们从顶层对象一层一层向下配置。先看securityManager如何配置：
<!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) --> <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean"> <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/> <property name="arguments" ref="securityManager"/> </bean>
上面的配置相当于调用SecurityUtils.setSecurityManager(securityManager) ，来注入了下面配置的 securityManager(DefaultWebSecurityManager) ：
<!-- 安全管理器 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="userRealm"/> <property name="cacheManager" ref="cacheManager"/> <property name="rememberMeManager" ref="rememberMeManager"/> </bean>
它默认使用的session管理器是 ServletContainerSessionManager，所以上面没有配置，所以就使用默认值。配置了就会覆盖下面的默认值:
public DefaultWebSecurityManager() { super(); ((DefaultSubjectDAO) this.subjectDAO).setSessionStorageEvaluator(new DefaultWebSessionStorageEvaluator()); this.sessionMode = HTTP_SESSION_MODE; setSubjectFactory(new DefaultWebSubjectFactory()); setRememberMeManager(new CookieRememberMeManager()); setSessionManager(new ServletContainerSessionManager()); }显然 securityManager 最重要的工作就是用户登录认证和获得用户的权限等相关信息，所以 realm 是其最重要的依赖：
<!-- Realm实现 --> <bean id="userRealm" class="com.ems.shiro.UserRealm"> <property name="credentialsMatcher" ref="credentialsMatcher"/> <property name="cachingEnabled" value="false"/> </bean>
要理解上面userRealm的配置，就的先理解 UserRealm 的继承体系：
UserRealm 继承 AuthorizingRealm 显然是为了获取权限信息，对用户进行访问控制；继承AuthenticatingRealm显然是为了获得用户的认证信息，对用户进行认证。而 credentialsMatcher 就是 AuthenticatingRealm 使用来进行密码验证的依赖的组件：
public abstract class AuthenticatingRealm extends CachingRealm implements Initializable {/** * Credentials matcher used to determine if the provided credentials match the credentials stored in the data store. */ private CredentialsMatcher credentialsMatcher;再看其credentialsMatcher bean的配置：
<!-- 凭证匹配器(验证登录密码是否正确) --> <bean id="credentialsMatcher" class="com.ems.shiro.RetryLimitHashedCredentialsMatcher"> <constructor-arg ref="cacheManager"/> <property name="hashAlgorithmName" value="SHA-256"/> <property name="hashIterations" value="2"/> <property name="storedCredentialsHexEncoded" value="true"/> </bean>
配置就是 hash加密的相关参数：hash算法，hash迭代次数等。到这里 shiro 登录验证的配置就完了。至于获取用户信息和用户的权限的信息，都在userRealm中实现了：
public class UserRealm extends AuthorizingRealm { @Autowired private UserService userService; @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { String userName = (String)principals.getPrimaryPrincipal(); User user = userService.getUserByUserName (userName ); SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(); authorizationInfo.setRoles(userService.findRolesByUserId(user.getId())); authorizationInfo.setStringPermissions(userService.findPermissionsByUserId(user.getId())); return authorizationInfo; } @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { String userName = (String)token.getPrincipal(); User user = userService.getUserByUserName(userName); if(user == null) { throw new UnknownAccountException();//没找到账户 } if(user.getLocked() == 0) { throw new LockedAccountException(); //帐号锁定 } if(user.getLocked() == 2){ throw new AuthenticationException("account was inactive"); } SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo( user.getUserName(), user.getPassword(), // 密码 ByteSource.Util.bytes(user.getCredentialsSalt()), // salt=no+salt getName() // realm name ); return authenticationInfo; }securityManager会在需要的时候回调上面 的 doGetAuthorizationInfo 和 doGetAuthenticationInfo 方法，从realm中获得登录认证信息和用户权限信息。至于 rememberMeManager 主要是实现使用cookie表示我已经登录过了，下次不需要重新登录，这一个功能，也就是“记住我”登录过这一功能：
<!-- rememberMe管理器 --> <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager"> <!-- rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度（128 256 512 位）--> <property name="cipherKey" value="#{T(org.apache.shiro.codec.Base64).decode('9FvVhtFLUs0KnA3Kprsdyg==')}"/> <property name="cookie" ref="rememberMeCookie"/> </bean> <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie"> <constructor-arg value="rememberMe"/> <property name="httpOnly" value="true"/> <property name="maxAge" value="2592000"/><!-- 30天 --> </bean>还有cacheManager的配置：
<!--ehcache--> <bean id="ehcacheManager" class="org.springframework.cache.ehcache.EhCacheManagerFactoryBean"> <property name="configLocation" value="classpath:ehcache/ehcache./> </bean> <bean id="springCacheManager" class="org.springframework.cache.ehcache.EhCacheCacheManager"> <property name="cacheManager" ref="ehcacheManager"/> </bean> <!-- 缓存管理器 --> <bean id="cacheManager" class="com.ems.shiro.SpringCacheManagerWrapper"> <property name="cacheManager" ref="springCacheManager"/> </bean>
使用的是 EhCache.
3. Shiro 的filter机制和自带的filter
Shiro的filter是基于Servlet的Filter接口实现的。我们通过Shiro提供的form登录filter：FormAuthenticationFilter 和 ShiroFilter 看看其实现：
继承中的每一层都实现了一些功能：
1> NameableFilter：实现给filter取名的功能(Allows a filter to be named via JavaBeans-compatible)
/** * Allows a filter to be named via JavaBeans-compatible*/public abstract class NameableFilter extends AbstractFilter implements Nameable { /** * The name of this filter, unique within an application. */ private String name;2> OncePerRequestFilter : 保证对于同一个request，fiter只执行一次(Filter base class that guarantees to be just executed once per request)
/** * Filter base class that guarantees to be just executed once per request, * on any servlet container. It provides a {@link #doFilterInternal} * method with HttpServletRequest and HttpServletResponse arguments.*/public abstract class OncePerRequestFilter extends NameableFilter {3> AdviceFilter： SpringMVC风格的过滤器(就是preHandle， postHandle，afterCompletion 三接口的过滤器)
/**
* A Servlet Filter that enables AOP-style "around" advice for a ServletRequest via
* preHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse),
* postHandle(javax.servlet.ServletRequest, javax.servlet.ServletResponse),
* and afterCompletion(javax.servlet.ServletRequest, javax.servlet.ServletResponse, Exception)hooks.
*/
public abstract class AdviceFilter extends OncePerRequestFilter { protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception { return true; } @SuppressWarnings({"UnusedDeclaration"}) protected void postHandle(ServletRequest request, ServletResponse response) throws Exception { } @SuppressWarnings({"UnusedDeclaration"}) public void afterCompletion(ServletRequest request, ServletResponse response, Exception exception) throws Exception { }
4> PathMatchingFilter：该过滤器仅仅处理指定的路径(比如上面的配置：/js/** = anon，表示对 /js/ 目录和其子目录的请求，交给anon过滤器处理)
/** * <p>Base class for Filters that will process only specified paths and allow all others to pass through.</p>*/public abstract class PathMatchingFilter extends AdviceFilter implements PathConfigProcessor {5> AccessControlFilter: 实现提供对资源的访问控制，没有权限时，重定向到登录页面，登录之后跳转到原来的那个页面
/** * Superclass for any filter that controls access to a resource and may redirect the user to the login page * if they are not authenticated. This superclass provides the method * saveRequestAndRedirectToLogin(javax.servlet.ServletRequest, javax.servlet.ServletResponse) * which is used by many subclasses as the behavior when a user is unauthenticated.*/public abstract class AccessControlFilter extends PathMatchingFilter {6> AuthenticationFilter: 实现对访问用户的认证要求，也就是必须登录了才能访问
/** * Base class for all Filters that require the current user to be authenticated. This class encapsulates the * logic of checking whether a user is already authenticated in the system while subclasses are required to perform * specific logic for unauthenticated requests.*/public abstract class AuthenticationFilter extends AccessControlFilter {7> AuthenticatingFilter: 实现判断用户是否有权限访问某资源。
/** * An AuthenticationFilter that is capable of automatically performing an authentication attempt * based on the incoming request.*/public abstract class AuthenticatingFilter extends AuthenticationFilter {8> FormAuthenticationFilter：shiro提供的用于实现用户登录功能，如果我们打算自己实现登录，那么我们应用 PassThruAuthenticationFilter 来替代
/** * Requires the requesting user to be authenticated for the request to continue, and if they are not, forces the user * to login via by redirecting them to the setLoginUrl(String) you configure. * If you would prefer to handle the authentication validation and login in your own code, consider using the * PassThruAuthenticationFilter instead, which allows requests to the loginUrl to pass through to your application's code directly.*/public class FormAuthenticationFilter extends AuthenticatingFilter {9> PassThruAuthenticationFilter : 用于我们自己在controller中实现登录逻辑时替代FormAuthenticationFilter
/** * An authentication filter that redirects the user to the login page when they are trying to access * a protected resource. However, if the user is trying to access the login page, the filter lets * the request pass through to the application code. * The difference between this filter and the FormAuthenticationFilter is that * on a login submission (by default an HTTP POST to the login URL), the FormAuthenticationFilter filter * attempts to automatically authenticate the user by passing the username and password request parameter values to * Subject.login(AuthenticationToken) directly. * Conversely, this controller always passes all requests to the loginUrl through, both GETs and POSTs.
* This is useful in cases where the developer wants to write their own login behavior, which should include a * call to Subject.login(AuthenticationToken) at some point. For example, if the developer has their own custom MVC
* login controller or validator, this PassThruAuthenticationFilter may be appropriate.*/public class PassThruAuthenticationFilter extends AuthenticationFilter { protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { if (isLoginRequest(request, response)) { return true; } else { saveRequestAndRedirectToLogin(request, response); return false; } }}
10> Shiro 自带的filter:
Shiro自身提供了很多的默认filter 来供我们使用，主要分为两种：一是 登录认证相关的filter；一是权限访问控制相关的filter;
登录认证相关的filter有：
1）filter名称: anon, 实现类org.apache.shiro.web.filter.authc.AnonymousFilter，主要用于静态资源的访问，表示无需登录就可以访问；
2）filter名称: authc, 实现类org.apache.shiro.web.filter.authc.FormAuthenticationFilter，主要用于表单登录，没有登录则跳转登录url；
3）filter名称: user, 实现类org.apache.shiro.web.filter.authc.UserFilter，主要用于要求用户已经登录或者通过“记住我”功能登录了也行。
4）filter名称: logout, 实现类org.apache.shiro.web.filter.authc.LogoutFilter，主要用于用户登出
5）filter名称: authcBasic，authc的简化形式，略。
权限访问控制相关的filter有：
1）filter名称: roles, 实现类org.apache.shiro.web.filter.authc.RolesAuthorizationFilter，主要用于验证用户必须拥有某角色，才能继续访问；
2）filter名称: perms, 实现类org.apache.shiro.web.filter.authc.PermissionsAuthorizationFilter，主要用于验证用户必须拥有某权限，才能继续访问；
3）filter名称: ssl, 实现类org.apache.shiro.web.filter.authc.SslFilter，主要用于要求访问协议是https才能访问，不然跳转到https的443短裤；
4）filter名称: port rest noSessionCreation，略。
我们上面的shiroFilter的配置中，已经使用过了上面这些自带的filter:
/reg/** = anon <!-- 注册相关 --> /login = authc /logout = logout /authenticated = authc /loginController = anon /js/** = anon /css/** = anon /img/** = anon /html/** = anon /font-awesome/** = anon /** = user
我们看到 /reg/** 注册相关的，/js/**静态资源都是使用的 anon匿名过滤器，不要求用户已经登录就可以访问。
/** = user 放在最后是要求除了上面那些 url 之外的访问路径，都需要登录认证过或者通过记住我登录认证过。因为路径比较是从上面开始列出来的先开始比较的，匹配了就走该过滤器，不会继续下面的过滤器了。
4. shiro的权限标签
对双方都
原标题：Java 权限框架 Shiro 实战二：与spring集成、filter机制
关键词：JAVA
我知道了 