[北京|结业弟子]JAVA-铁木儿|2018年09月09日的日报-技能树.IT修真院

发表于： 2018-09-09 21:55:50

1 454

今天完成的事情：shiro

页面测试

<body>
    <h4>Login Page</h4>
    <form action="shiro/login" method="post">
        username:<input type="text" name="username"/>
        <br><br>
        password:<input type="password" name="password"/>
        <br><br>
        <input type="submit" value="Submit"/>
    </form>
</body>

list.jsp

<body>
    <h4>List Page</h4>
    <br><br>
    <a href="admin.jsp">admin page</a>
    <br><br>
    <a href="user.jsp">user page</a>
    <br><br>
    <a href="shiro/logout">Logout</a>
</body>

controller

@Controller
@RequestMapping("/shiro")
public class ShiroController {
    @RequestMapping("/login")
    public String login(@RequestParam("username") String username
            ,@RequestParam("password") String password){
        Subject currentUser = SecurityUtils.getSubject();
        // let's login the current user so we can check against roles and permissions:
        //测试当前用户是否已经被认证，既是否登陆
        //调用.isAuthenticated()
        //登陆测试
        if (!currentUser.isAuthenticated()) {
            //将用户名和密码封装为UsernamePasswordToken
            UsernamePasswordToken token = new UsernamePasswordToken(username, password);
            //Remember
            token.setRememberMe(true);
            try {
                //登陆
                currentUser.login(token);
                System.out.println("Controller里的tokenhash"+token.hashCode());
            }
            // ... catch more exceptions here (maybe custom ones specific to your application?
            //所有认证类异常的父类
            catch (AuthenticationException ae) {
                System.out.println("登陆失败："+ae.getMessage());
                //unexpected condition?  error?
            }
        }
        return "redirect:/list.jsp";
    }
}

拦截策略

<!--配置shiroFilter，id必须和web.xml中配置的DelegatingFilterProxy的filterName一致-->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/login.jsp"/>
    <property name="successUrl" value="/list.jsp"/>
    <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    <!--
    配置哪些页面需要收到保护，以及相应的权限
    1.anon可以被匿名访问
    2.authc需要认证后访问
    3.拦截采取按顺序匹配的原则
    -->
    <property name="filterChainDefinitions">
        <value>
            /login.jsp = anon
            /shiro/login = anon
            /shiro/logout = logout
            /user.jsp = roles[user]
            /admin.jsp = roles[admin]
            # everything else requires authentication:
            /** = authc
        </value>
    </property>
</bean>