认证与Shiro安全框架

 <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-all</artifactId>

            <version>${shiro.version}</version>

 </dependency>

    <!-- Shiro Security filter  filter-name这个名字的值将来还会在spring中用到  -->

    <filter>

         <filter-name>shiroFilter</filter-name>

         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

         <init-param>

             <param-name>targetFilterLifecycle</param-name>

             <param-value>true</param-value>

         </init-param>

     </filter>

     <filter-mapping>

         <filter-name>shiroFilter</filter-name>

         <url-pattern>/*</url-pattern>

     </filter-mapping>
     

 <?xml version="1.0" encoding="UTF-8"?>

 <beans xmlns="http://www.springframework.org/schema/beans"

     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

     xmlns:p="http://www.springframework.org/schema/p"

     xmlns:context="http://www.springframework.org/schema/context"

     xmlns:tx="http://www.springframework.org/schema/tx"

     xmlns:aop="http://www.springframework.org/schema/aop"

     xsi:schemaLocation="http://www.springframework.org/schema/beans

     http://www.springframework.org/schema/beans/spring-beans.xsd

     http://www.springframework.org/schema/aop

     http://www.springframework.org/schema/aop/spring-aop.xsd

     http://www.springframework.org/schema/tx

     http://www.springframework.org/schema/tx/spring-tx.xsd

     http://www.springframework.org/schema/context

     http://www.springframework.org/schema/context/spring-context.xsd">

     <description>Shiro的配置文件</description>

     <!-- SecurityManager配置 -->

     <!-- 配置Realm域 -->

     <!-- 密码比较器 -->

     <!-- 代理如何生成？ 用工厂来生成Shiro的相关过滤器-->

     <!-- 配置缓存：ehcache缓存 -->

     <!-- 安全管理 -->

     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

         <!-- Single realm app.  If you have multiple realms, use the 'realms' property instead. -->

         <property name="realm" ref="authRealm"/><!-- 引用自定义的realm -->

         <!-- 缓存 -->

         <property name="cacheManager" ref="shiroEhcacheManager"/>

     </bean>

     <!-- 自定义权限认证 -->

     <bean id="authRealm" class="cn.itcast.jk.shiro.AuthRealm">

         <property name="userService" ref="userService"/>

         <!-- 自定义密码加密算法  -->

         <property name="credentialsMatcher" ref="passwordMatcher"/>

     </bean>

     <!-- 设置密码加密策略 md5hash -->

     <bean id="passwordMatcher" class="cn.itcast.jk.shiro.CustomCredentialsMatcher"/>

     <!-- filter-name这个名字的值来自于web.xml中filter的名字 -->

     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

         <property name="securityManager" ref="securityManager"/>

         <!--登录页面  -->

         <property name="loginUrl" value="/index.jsp"></property>

         <!-- 登录成功后 -->

         <property name="successUrl" value="/home.action"></property>

         <property name="filterChainDefinitions">

             <!-- /**代表下面的多级目录也过滤 -->

             <value>

                 /index.jsp* = anon

                 /home* = anon

                 /sysadmin/login/login.jsp* = anon

                 /sysadmin/login/logout.jsp* = anon

                 /login* = anon

                 /logout* = anon

                 /components/** = anon

                 /css/** = anon

                 /images/** = anon

                 /js/** = anon

                 /make/** = anon

                 /skin/** = anon

                 /stat/** = anon

                 /ufiles/** = anon

                 /validator/** = anon

                 /resource/** = anon

                 /** = authc

                 /*.* = authc

             </value>

         </property>

     </bean>

     <!-- 用户授权/认证信息Cache, 采用EhCache  缓存 -->

     <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">

         <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>

     </bean>

     <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->

     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

     <!-- 生成代理，通过代理进行控制 -->

     <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"

           depends-on="lifecycleBeanPostProcessor">

         <property name="proxyTargetClass" value="true"/>

     </bean>

     <!-- 安全管理器 -->

     <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">

         <property name="securityManager" ref="securityManager"/>

     </bean>

 </beans>

 /**

  * 密码比较器：规范是extends SimpleCredentialsMatcher

  * @author Administrator

  *

  */

 public class CustomCredentialsMatcher extends SimpleCredentialsMatcher {

     /**

      * 重写父类的密码比较的方法

      * 比较的算法：

      *     1.接收用户在密码框输入的明文

      *     2.使用Md5Hash算法进行加密

      *     3.获取数据库中的加密的密码进行比较

      *

      *     第一个参数token:代表用户在界面上输入的用户名和密码

      *     第二个参数info:它内部会包含数据库中的密码（当前用户加密后的密码）

      *

      *     返回值：如果返回true代表密码验证成功，如果返回false代表密码比对失败，失败后程序就会出现异常

      *

      */

     public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {

         //1.向下转型

         UsernamePasswordToken upToken = (UsernamePasswordToken) token;

         //2.获取用户名或密码

         String username = upToken.getUsername();

         //获取密码并使用Md5Hash算法进行加密

         String inputPwdEncrypt = Encrypt.md5(new String(upToken.getPassword()), username);

         //3.获取数据库中的加密的密码

         String dbPwd = info.getCredentials().toString();

         return equals(inputPwdEncrypt, dbPwd);

     }

 }

 public class AuthRealm extends AuthorizingRealm {

     private UserService userService;

     public void setUserService(UserService userService) {

         this.userService = userService;

     }

     //授权   第一个参数PrincipalCollection：Principal的集合，其实它里面放了一个用户的信息

     /**

      * 当jsp页面碰到shiro标签时，就会自动这个方法

      */

     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection pc) {

         //1.从Shiro中取出当前认证的用户对象

         User user = (User)pc.fromRealm(this.getName()).iterator().next();

         //2.获取用户的相关权限，首先要去找到角色

         Set<Role> roles = user.getRoles();//对象导航

         List<String> permissions = new ArrayList<String>();//产生一个用于保存模块列表的集合

         //3.遍历集合

         for(Role role :roles){

             //得到每个角色对象

             Set<Module> modules = role.getModules();//对象导航，得到这个角色下面的模块列表

             for(Module module :modules){

                 //可以取到每个模块

                 permissions.add(module.getCpermission());

             }

         }

         //产生一个返回值的对象

         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

         info.addStringPermissions(permissions);

         return info;

     }

     //认证   第一个参数token:代表用户在界面上输入的用户名和密码    AuthenticationInfo

     //如果函数返回null，程序也会抛出异常    如果正常程序就会自动进入到密码比较器

     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

         //1.向下转型

         UsernamePasswordToken upToken = (UsernamePasswordToken) token;

         //2.获取用户名

         String username = upToken.getUsername();

         //3.根据用户名查询数据库

         List<User> userList = userService.find("from User where userName=?" , User.class, new String[]{username});

         if(userList!=null && userList.size()>0){

             User user = userList.get(0);

             //第一个参数：代表用户的实体对象             第二个参数credentials：密码       第三个参数：relam的名字

             return new SimpleAuthenticationInfo(user,user.getPassword(),this.getName());

         }

         return null;

     }

 }

 public class LoginAction extends BaseAction {

     private static final long serialVersionUID = 1L;

     private String username;

     private String password;

     //SSH传统登录方式

     public String login() throws Exception {

 //        if(true){

 //            String msg = "登录错误，请重新填写用户名密码!";

 //            this.addActionError(msg);

 //            throw new Exception(msg);

 //        }

 //        User user = new User(username, password);

 //        User login = userService.login(user);

 //        if (login != null) {

 //            ActionContext.getContext().getValueStack().push(user);

 //            session.put(SysConstant.CURRENT_USER_INFO, login);    //记录session

 //            return SUCCESS;

 //        }

 //        return "login";

         if(UtilFuns.isEmpty(username)){

             return "login";

         }

         try {

             //1.得到Subject

             Subject subject =SecurityUtils.getSubject();

             //2.调用它的登录方法

             UsernamePasswordToken token = new UsernamePasswordToken(username,password);

             subject.login(token);

             //3.取出Shiro中保存的用户信息

             User user = (User) subject.getPrincipal();

             //4.将用户信息保存到session中

             session.put(SysConstant.CURRENT_USER_INFO, user);

             return SUCCESS;

         } catch (Exception e) {

             e.printStackTrace();

             request.put("errorInfo", "登录失败，用户名或密码错误！");

             return "login";

         }

     }

     //退出

     public String logout(){

         session.remove(SysConstant.CURRENT_USER_INFO);        //删除session

         SecurityUtils.getSubject().logout();

         return "logout";

     }

     public String getUsername() {

         return username;

     }

     public void setUsername(String username) {

         this.username = username;

     }

     public String getPassword() {

         return password;

     }

     public void setPassword(String password) {

         this.password = password;

     }

 }