1.添加maven依賴(先安裝好cas-server-3.5.2，安裝步驟請檢視本文參考文章)
org.apache.shiro
shiro-spring
1.2.4
org.apache.shiro
shiro-ehcache
1.2.4
org.apache.shiro
shiro-cas
1.2.4
2.啟動累添加@ServletComponentScan注解
@SpringBootApplication
public class Application {
public static void main(String[] args){
ConfigurableApplicationContext context = SpringApplication.run(Application.class,args);
//test if a xml bean inject into springcontext successful
User user = (User)context.getBean("user1");
System.out.println(JSONObject.toJSONString(user));
}
}
3.配置shiro+cas
package com.hdwang.config.shiroCas;
import com.hdwang.dao.UserDao;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.cas.CasFilter;
import org.apache.shiro.cas.CasSubjectFactory;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.filter.authc.LogoutFilter;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.filter.DelegatingFilterProxy;
import javax.servlet.Filter;
import javax.servlet.annotation.WebListener;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;
@Configuration
public class ShiroCasConfiguration {
private static final Logger logger = LoggerFactory.getLogger(ShiroCasConfiguration.class);
// cas server位址
public static final String casServerUrlPrefix = "https://localhost:8443/cas";
// Cas登入頁面位址
public static final String casLoginUrl = casServerUrlPrefix + "/login";
// Cas登出頁面位址
public static final String casLogoutUrl = casServerUrlPrefix + "/logout";
// 目前工程對外提供的服務位址
public static final String shiroServerUrlPrefix = "http://localhost:8081";
// casFilter UrlPattern
public static final String casFilterUrlPattern = "/cas";
// 登入位址
public static final String loginUrl = casLoginUrl + "?service=" + shiroServerUrlPrefix + casFilterUrlPattern;
// 登出位址
public static final String logoutUrl = casLogoutUrl+"?service="+shiroServerUrlPrefix;
// 登入成功位址
public static final String loginSuccessUrl = "/home";
// 權限認證失敗跳轉位址
public static final String unauthorizedUrl = "/error/403.html";
@Bean
public EhCacheManager getEhCacheManager() {
EhCacheManager em = new EhCacheManager();
em.setCacheManagerConfigFile("classpath:ehcache-shiro.xml");
return em;
}
@Bean(name = "myShiroCasRealm")
public MyShiroCasRealm myShiroCasRealm(EhCacheManager cacheManager) {
MyShiroCasRealm realm = new MyShiroCasRealm();
realm.setCacheManager(cacheManager);
//realm.setCasServerUrlPrefix(ShiroCasConfiguration.casServerUrlPrefix);
// 用戶端回調位址
//realm.setCasService(ShiroCasConfiguration.shiroServerUrlPrefix + ShiroCasConfiguration.casFilterUrlPattern);
return realm;
}
@Bean
public ServletListenerRegistrationBean singleSignOutHttpSessionListener(){
ServletListenerRegistrationBean bean = new ServletListenerRegistrationBean();
bean.setListener(new SingleSignOutHttpSessionListener());
// bean.setName(""); //預設為bean name
bean.setEnabled(true);
//bean.setOrder(Ordered.HIGHEST_PRECEDENCE); //設定優先級
return bean;
}
@Bean
public FilterRegistrationBean singleSignOutFilter(){
FilterRegistrationBean bean = new FilterRegistrationBean();
bean.setName("singleSignOutFilter");
bean.setFilter(new SingleSignOutFilter());
bean.addUrlPatterns("
@Bean
public FilterRegistrationBean delegatingFilterProxy() {
FilterRegistrationBean filterRegistration = new FilterRegistrationBean();
filterRegistration.setFilter(new DelegatingFilterProxy("shiroFilter"));
// 該值預設為false,表示生命周期由SpringApplicationContext管理,設定為true則表示由ServletContainer管理
filterRegistration.addInitParameter("targetFilterLifecycle", "true");
filterRegistration.setEnabled(true);
filterRegistration.addUrlPatterns("
@Bean(name = "casFilter")
public CasFilter getCasFilter() {
CasFilter casFilter = new CasFilter();
casFilter.setName("casFilter");
casFilter.setEnabled(true);
// 登入失敗後跳轉的URL，也就是 Shiro 執行 CasRealm 的 doGetAuthenticationInfo 方法向CasServer驗證tiket
casFilter.setFailureUrl(loginUrl);// 我們選擇認證失敗後再打開登入頁面
return casFilter;
}
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager, CasFilter casFilter, UserDao userDao) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
// 必須設定 SecurityManager
shiroFilterFactoryBean.setSecurityManager(securityManager);
// 如果不設定預設會自動尋找Web工程根目錄下的"/login.jsp"頁面
shiroFilterFactoryBean.setLoginUrl(loginUrl);
// 登入成功後要跳轉的連接配接
shiroFilterFactoryBean.setSuccessUrl(loginSuccessUrl);
shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
// 添加casFilter到shiroFilter中
Map filters = new HashMap<>();
filters.put("casFilter", casFilter);
// filters.put("logout",logoutFilter());
shiroFilterFactoryBean.setFilters(filters);
loadShiroFilterChain(shiroFilterFactoryBean, userDao);
return shiroFilterFactoryBean;
}
private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean, UserDao userDao){
/// 下面這些規則配置最好配置到配置檔案中 ///
Map filterChainDefinitionMap = new LinkedHashMap();
// authc：該過濾器下的頁面必須登入後才能通路，它是Shiro内置的一個攔截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter
// anon: 可以了解為不攔截
// user: 登入了就不攔截
// roles["admin"] 使用者擁有admin角色
// perms["permission1"] 使用者擁有permission1權限
// filter順序按照定義順序比對，比對到就驗證，驗證完畢結束。
// url比對通配符支援：? * **,分别表示比對1個，比對0-n個(不含子路徑)，比對下級所有路徑
//1.shiro內建cas後，首先添加該規則
filterChainDefinitionMap.put(casFilterUrlPattern, "casFilter");
//filterChainDefinitionMap.put("/logout","logout"); //logut請求采用logout filter
//2.不攔截的請求
filterChainDefinitionMap.put("/css
public class MyShiroCasRealm extends CasRealm{
private static final Logger logger = LoggerFactory.getLogger(MyShiroCasRealm.class);
@Autowired
private UserDao userDao;
@PostConstruct
public void initProperty(){
// setDefaultRoles("ROLE_USER");
setCasServerUrlPrefix(ShiroCasConfiguration.casServerUrlPrefix);
// 用戶端回調位址
setCasService(ShiroCasConfiguration.shiroServerUrlPrefix + ShiroCasConfiguration.casFilterUrlPattern);
}
//
// @Override
// protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
//
// AuthenticationInfo authc = super.doGetAuthenticationInfo(token);
//
// String account = (String) authc.getPrincipals().getPrimaryPrincipal();
//
// User user = userDao.getByName(account);
// //将使用者資訊存入session中
// SecurityUtils.getSubject().getSession().setAttribute("user", user);
//
// return authc;
// }
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
logger.info("##################執行Shiro權限認證##################");
//擷取目前登入輸入的使用者名，等價于(String) principalCollection.fromRealm(getName()).iterator().next();
String loginName = (String)super.getAvailablePrincipal(principalCollection);
//到資料庫查是否有此對象(1.本地查詢 2.可以遠端查詢casserver 3.可以由casserver帶過來角色／權限其它資訊)
User user=userDao.getByName(loginName);// 實際項目中，這裡可以根據實際情況做緩存，如果不做，Shiro自己也是有時間間隔機制，2分鐘内不會重複執行該方法
if(user!=null){
//權限資訊對象info,用來存放查出的使用者的所有的角色(role)及權限(permission)
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
//給使用者添加角色(讓shiro去驗證)
Set roleNames = new HashSet<>();
if(user.getName().equals("boy5")){
roleNames.add("admin");
}
info.setRoles(roleNames);
if(user.getName().equals("李四")){
//給使用者添權重限(讓shiro去驗證)
info.addStringPermission("user:delete");
}
// 或者按下面這樣添加
//添加一個角色,不是配置意義上的添加,而是證明該使用者擁有admin角色
// simpleAuthorInfo.addRole("admin");
//添權重限
// simpleAuthorInfo.addStringPermission("admin:manage");
// logger.info("已為使用者[mike]賦予了[admin]角色和[admin:manage]權限");
return info;
}
// 傳回null的話，就會導緻任何使用者通路被攔截的請求時，都會自動跳轉到unauthorizedUrl指定的位址
return null;
}
}
package com.hdwang.controller;
import com.hdwang.config.shiroCas.ShiroCasConfiguration;
import com.hdwang.entity.User;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import javax.servlet.http.HttpSession;
@Controller
@RequestMapping("")
public class CasLoginController {
@RequestMapping(value="/login",method= RequestMethod.GET)
public String loginForm(Model model){
model.addAttribute("user", new User());
// return "login";
return "redirect:" + ShiroCasConfiguration.loginUrl;
}
@RequestMapping(value = "logout", method = { RequestMethod.GET,
RequestMethod.POST })
public String loginout(HttpSession session)
{
return "redirect:"+ShiroCasConfiguration.logoutUrl;
}
}
package com.hdwang.controller;
import com.alibaba.fastjson.JSONObject;
import com.hdwang.entity.User;
import com.hdwang.service.datajpa.UserService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.mgt.SecurityManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
@Controller
@RequestMapping("/home")
public class HomeController {
@Autowired
UserService userService;
@RequestMapping("")
public String index(HttpSession session, ModelMap map, HttpServletRequest request){
// User user = (User) session.getAttribute("user");
System.out.println(request.getUserPrincipal().getName());
System.out.println(SecurityUtils.getSubject().getPrincipal());
User loginUser = userService.getLoginUser();
System.out.println(JSONObject.toJSONString(loginUser));
map.put("user",loginUser);
return "home";
}
}
4.運作驗證
登入
登出
cas server端登出(也行)
以上所述是小編給大家介紹的spring boot 1.5.4 內建shiro+cas,實作單點登入和權限控制，希望對大家有所幫助，如果大家有任何疑問請給我留言，小編會及時回複大家的。在此也非常感謝大家對腳本之家網站的支援！