springmvc integrated shiro login permission sample code
- 2020-06-07 04:36:19
- OfStack
1 login process will have: user name does not exist, password error, verification code error, etc..
After integration with shiro, the external access rights and access control for the application are managed by shiro.
shiro provides two main functions: authentication (Authentication) and authorization (Authorization); The role of authentication is to prove that they can access, 1 generally is the user name and password, the role of authorization is who can access which resources, through the developer's own user role permission system to control.
Session management and cache management for shiro are beyond the scope of this article.
The integration of springmvc with shiro is described below through the process of login failure.
Project dependencies:
| 依赖名称 | 版本 |
| spring | 4.1.4.RELEASE |
| shiro | 1.2.2 |
| self4j | 1.7.5 |
| log4j | 1.2.17 |
Configure shiro in ES24en.xml
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
Create a new ES31en-ES32en-ES33en.xml configure shiro and load it using spring
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"
xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd"
default-lazy-init="true">
<description>Shiro Configuration</description>
<!-- Safety certification filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/sys/login" />
<property name="successUrl" value="/sys" />
<property name="filters">
<map>
<!-- Custom login validation filters -->
<entry key="authc" value-ref="formAuthenticationFilter" />
</map>
</property>
<property name="filterChainDefinitions">
<value>
/sys/login = authc
/sys/logout = logout
/sys/** = user
</value>
</property>
</bean>
<!-- define Shiro Main Business object -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="systemAuthorizingRealm" />
<property name="cacheManager" ref="shiroCacheManager" />
</bean>
<!-- The session ID The generator -->
<bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>
<!-- Session manager, set session timeout and save -->
<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
<!-- Global session timeout in milliseconds, default 30 minutes -->
<property name="globalSessionTimeout" value="1800000" />
<property name="sessionDAO" ref="sessionDAO"/>
</bean>
<!-- Session validation scheduler, per 30 Minutes to perform 1 Time to verify -->
<!-- <bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler"> -->
<bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.ExecutorServiceSessionValidationScheduler">
<property name="interval" value="1800000"/>
<property name="sessionManager" ref="sessionManager"/>
</bean>
<!-- sessionDAO Save authentication information -->
<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
<property name="activeSessionsCacheName" value="shiro-activeSessionCache" />
<property name="cacheManager" ref="shiroCacheManager" />
<property name="sessionIdGenerator" ref="sessionIdGenerator"/>
</bean>
<!-- User authorization information Cache, using EhCache -->
<bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManager" ref="cacheManager" />
</bean>
<!-- Shiro Life cycle processor -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<!-- AOP Formula method-level permission checks -->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
<property name="proxyTargetClass" value="true" />
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager" />
</bean>
</beans>
Create a new login authentication filter FormAuthenticationFilter.java
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.web.util.WebUtils;
import org.springframework.stereotype.Service;
/**
* Form validation (including captchAs) filter classes */
@Service
public class FormAuthenticationFilter extends org.apache.shiro.web.filter.authc.FormAuthenticationFilter {
public static final String DEFAULT_CAPTCHA_PARAM = "validateCode";
private String captchaParam = DEFAULT_CAPTCHA_PARAM;
public String getCaptchaParam() {
return captchaParam;
}
protected String getCaptcha(ServletRequest request) {
return WebUtils.getCleanParam(request, getCaptchaParam());
}
protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) {
String username = getUsername(request);
String password = getPassword(request);
String locale = request.getParameter("locale");
if (password == null) {
password = "";
}
boolean rememberMe = isRememberMe(request);
String host = getHost(request);
String captcha = getCaptcha(request);
return new UsernamePasswordToken(username, password.toCharArray(),locale, rememberMe, host, captcha);
}
}
New token class ES47en.java
package com.chunhui.webservice.modules.sys.security;
/**
* User and password (including captcha) token classes */
public class UsernamePasswordToken extends org.apache.shiro.authc.UsernamePasswordToken {
private static final long serialVersionUID = 1L;
private String captcha;
private String locale;
public String getCaptcha() {
return captcha;
}
public void setCaptcha(String captcha) {
this.captcha = captcha;
}
public String getLocale() {
return locale;
}
public void setLocale(String locale) {
this.locale = locale;
}
public UsernamePasswordToken() {
super();
}
public UsernamePasswordToken(String username, char[] password, boolean rememberMe, String host, String captcha) {
super(username, password, rememberMe, host);
this.captcha = captcha;
}
public UsernamePasswordToken(String username, char[] password, String locale,boolean rememberMe, String host, String captcha) {
super(username, password, rememberMe, host);
this.captcha = captcha;
this.locale = locale;
}
}
The last one is the authentication implementation class SystemAuthorizationRealm:
package com.chunhui.webservice.modules.sys.security;
import java.io.Serializable;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import javax.annotation.PostConstruct;
import com.chunhui.webservice.common.utils.EmployeeType;
import com.chunhui.webservice.common.utils.VertifyStatus;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.SimplePrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.context.annotation.DependsOn;
import org.springframework.stereotype.Service;
import com.chunhui.webservice.common.servlet.ValidateCodeServlet;
import com.chunhui.webservice.common.utils.SpringContextHolder;
import com.chunhui.webservice.modules.sys.entity.Employee;
import com.chunhui.webservice.modules.sys.entity.Menu;
import com.chunhui.webservice.modules.sys.service.SystemService;
import com.chunhui.webservice.modules.sys.utils.SystemUtils;
import com.chunhui.webservice.modules.sys.web.LoginController;
/**
* System security authentication implementation class */
@Service
@DependsOn({ "employeeDao", "roleDao", "menuDao" })
public class SystemAuthorizingRealm extends AuthorizingRealm {
private SystemService systemService;
/**
* Authenticate the callback function , Call at login
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
// Judgment verification code
Session session = SecurityUtils.getSubject().getSession();
// Set independent session Session timeout session.setTimeout(60000);
String code = (String) session.getAttribute(ValidateCodeServlet.VALIDATE_CODE);
if (token.getCaptcha() == null || !token.getCaptcha().toUpperCase().equals(code)) {
throw new CaptchaException(" Verification code error! ");
}
// If the account does not exist, output
//throw new UnknownAccountException();
// If the account is disabled, output
//throw new DisabledAccountException();
// Save the language you selected when you logged in
SecurityUtils.getSubject().getSession().setAttribute("locale", token.getLocale());
try{
SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(new Principal(employee), employee.getPassword(), getName());
return info;
}catch (Throwable t){
t.printStackTrace();
throw new AuthenticationException();
}
}/**
* Authorized query callback function , Called when authentication is performed but there is no authorization information from the user in the cache
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
Principal principal = (Principal) getAvailablePrincipal(principals);
Employee employee = getSystemService().getEmployeeByName(principal.getUsername());
if (employee != null) {
SystemUtils.putCache("employee", employee);
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
List<Menu> list = SystemUtils.getMenuList();
for (Menu menu : list) {
if (StringUtils.isNotBlank(menu.getPermission())) {
// Add based on Permission Permission information of
for (String permission : StringUtils.split(menu.getPermission(), ",")) {
info.addStringPermission(permission);
}
}
}
// Update the login IP And time
getSystemService().updateEmployeeLoginInfo(employee.getId());
return info;
} else {
return null;
}
}
/**
* Clear user associated permission authentication and reload it the next time it is used
*/
public void clearCachedAuthorizationInfo(String principal) {
SimplePrincipalCollection principals = new SimplePrincipalCollection(principal, getName());
clearCachedAuthorizationInfo(principals);
}
/**
* Empty all associated certifications
*/
public void clearAllCachedAuthorizationInfo() {
Cache<Object, AuthorizationInfo> cache = getAuthorizationCache();
if (cache != null) {
for (Object key : cache.keys()) {
cache.remove(key);
}
}
}
/**
* Gets the system business object
*/
public SystemService getSystemService() {
if (systemService == null) {
systemService = SpringContextHolder.getBean(SystemService.class);
}
return systemService;
}
/**
* Authorized User information
*/
public static class Principal implements Serializable {
private static final long serialVersionUID = 1L;
private String id;
private String username;
private String realname;
private Map<String, Object> cacheMap;
public Principal(Employee employee) {
this.id = employee.getId();
this.username = employee.getUsername();
this.realname = employee.getRealname();
}
public String getId() {
return id;
}
public String getUsername() {
return username;
}
public String getRealname() {
return realname;
}
public Map<String, Object> getCacheMap() {
if (cacheMap == null) {
cacheMap = new HashMap<String, Object>();
}
return cacheMap;
}
}
}
On the JSP page, you can display the cause of the error by getting the specific exception type of the logon exception
<%String error = (String) request.getAttribute(FormAuthenticationFilter.DEFAULT_ERROR_KEY_ATTRIBUTE_NAME);%>
<c:set var="exp_type" value="<%=error %>"/>
<c:set var="tips" value=""></c:set>
<c:if test="${fn:contains(exp_type,'CaptchaException')}">
<c:set var="tips" value=" Verification code error "></c:set>
</c:if>
<c:if test="${fn:contains(exp_type,'FailVertifyException')}">
<c:set var="tips" value=" This account has not been approved and is not allowed to log in !"></c:set>
</c:if>
<c:if test="${fn:contains(exp_type,'NotVertifyException')}">
<c:set var="tips" value=" The account is under review ... No login allowed !"></c:set>
</c:if>
<c:if test="${fn:contains(exp_type,'UnknownAccountException')}">
<c:set var="tips" value=" The account does not exist !"></c:set>
</c:if>
<c:if test="${fn:contains(exp_type,'DisabledAccountException')}">
<c:set var="tips" value=" Login is not allowed !"></c:set>
</c:if>
<c:if test="${fn:contains(exp_type,'IncorrectCredentialsException')}">
<c:set var="tips" value=" Password mistake !"></c:set>
</c:if>