Apache Shiro学习笔记（五）Web集成简单配置
鲁春利的工作笔记，好记性不如烂笔头http://shiro.apache.org/web-features.html
ShiroFilter
Shiro 提供了与Web集成的支持，其通过一个ShiroFilter来指定拦截的URL，然后进行相应的控制。ShiroFilter类似于如Strut2/SpringMVC这种Web框架的前端控制器，其负责读取配置（如ini 配置文件），然后判断URL 是否需要登录/权限等工作。
web.xml
Invicme
org.apache.shiro.web.env.EnvironmentLoaderListener
shiroEnvironmentClass
org.apache.shiro.web.env.IniWebEnvironment
shiroConfigLocations
classpath:shiro/normal-shiro.ini
ShiroFilter
org.apache.shiro.web.servlet.ShiroFilter
ShiroFilter
/*
30
index.jsp
[*] 1、EnvironmentLoaderListener
通 过EnvironmentLoaderListener 来创建相应的WebEnvironment， 并自动绑定到ServletContext，默认使用IniWebEnvironment实现。
[*] 2、shiroConfigLocations
默认是“/WEB-INF/shiro.ini”，IniWebEnvironment 默认是先从/WEB-INF/shiro.ini加载，通过配置指定后就加载classpath:shiro/normal-shiro.ini。
normal-shiro.ini
#默认是/login.jsp
authc.loginUrl=/login
# unauthorizedUrl属性指定如果授权失败时重定向到的地址。
# roles 是org.apache.shiro.web.filter.authz.RolesAuthorizationFilter类型的实例。
roles.unauthorizedUrl=/unauthorized
# perms 是org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter类型的实例。
perms.unauthorizedUrl=/unauthorized
# 用户名=密码，角色
# 说明：这里的密码是加密之后的数据
lucl=e10adc3949ba59abbe56e057f20f883e,admin
wang=e10adc3949ba59abbe56e057f20f883e
admin=user:*,menu:*
/login=anon
/static/**=anon
/role=authc,roles
/permission=authc,perms["user:create"]
/unauthorized=anon
/logout=logout 说明：
其中最重要的就是部分的配置，其格式是： “url=拦截器[参数]，拦截器[参数]”；即如果当前请求的url匹配部分的某个url模式，将会执行其配置的拦截器。
比如anon拦截器表示匿名访问（即不需要登录即可访问）；
authc拦截器表示需要身份认证通过后才能访问；
roles拦截器表示需要有admin 角色授权才能访问；
而perms["user:create"]拦截器表示需要有“user:create”权限才能访问。
Servlet定义
[*] LoginServlet
package com.invicme.apps.servlet.authc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.codec.digest.DigestUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
/**
* @author lucl
*/
@WebServlet("/login")
public class LoginServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
public LoginServlet() {
super();
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
String username = request.getParameter("username");
String password = request.getParameter("password");
if (StringUtils.isBlank(username) || StringUtils.isBlank(password)) {
request.getRequestDispatcher("shiro/admin/login.jsp").forward(request, response);
return;
}
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, DigestUtils.md5Hex(password));
String msg = "";
try {
subject.login(token);
} catch (UnknownAccountException e) {
msg = "用户名/密码错误";
} catch (IncorrectCredentialsException e) {
msg = "用户名/密码错误";
} catch (AuthenticationException e) {
//其他错误，比如锁定，如果想单独处理请单独catch 处理
msg = "其他错误：" + e.getMessage();
}
if(!StringUtils.isBlank(msg)) {//出错了，返回登录页面
request.setAttribute("msg", msg);
request.getRequestDispatcher("shiro/admin/login.jsp").forward(request, response);
} else { // 登录成功
request.setAttribute("subject", subject);
request.getRequestDispatcher("shiro/admin/success.jsp").forward(request, response);
}
}
/**
*
* @param args
*/
public static void main(String[] args) {
System.out.println(DigestUtils.md5Hex("123456"));
}
}
[*] PermissionServlet
package com.invicme.apps.servlet.authc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* @author lucl
*/
@WebServlet("/permission")
public class PermissionServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
public PermissionServlet() {
super();
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
request.getRequestDispatcher("shiro/user/perms.jsp").forward(request, response);
}
}
[*] RoleServlet
package com.invicme.apps.servlet.authc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* @author lucl
*/
@WebServlet("/role")
public class RoleServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
public RoleServlet() {
super();
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
request.getRequestDispatcher("shiro/user/role.jsp").forward(request, response);
}
}
[*] UnauthorizedServlet
package com.invicme.apps.servlet.authc;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* @author lucl
*/
@WebServlet("/unauthorized")
public class UnauthorizedServlet extends HttpServlet {
private static final long serialVersionUID = 1L;
public UnauthorizedServlet() {
super();
}
protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
this.doPost(request, response);
}
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
request.getRequestDispatcher("shiro/user/unauthorized.jsp").forward(request, response);
}
}
Jsp
[*] login.jsp
登录页
This is login page.${msg}
用户名：
密码：
[*] success.jsp
登录成功
Welcome,${subject.principal}.
[*] perms.jsp
权限
This is permission page.
[*] role.jsp
角色
This is role jsp.
[*] unauthorized.jsp
未授权
无访问权限
页:
[1]