7、spring boot 1.5.4 集成shiro+cas，實現單點登陸和權限控制

時間 2019-11-11

標籤 spring boot 1.5.4 集成 shiro+cas shiro cas 實現單點登陸權限控制欄目 Spring 简体版

原文原文鏈接

1.安裝cas-server-3.5.2css

官網：https://github.com/apereo/cas/releases/tag/v3.5.2html

下載地址：cas-server-3.5.2-release.zipjava

安裝參考文章：http://blog.csdn.net/xuxuchuan/article/details/54924933git

注意：github

輸入 <tomcat_key> 的密鑰口令

(若是和密鑰庫口令相同, 按回車) ,這裏直接回車，也採用keystore密碼changeit，不然tomcat啓動報錯！

2.配置ehcache緩存web

<?xml version="1.0" encoding="UTF-8"?>
<ehcache updateCheck="false" name="shiroCache">

    <defaultCache
            maxElementsInMemory="10000"
            eternal="false"
            timeToIdleSeconds="120"
            timeToLiveSeconds="120"
            overflowToDisk="false"
            diskPersistent="false"
            diskExpiryThreadIntervalSeconds="120"
    />
</ehcache>

3.添加maven依賴spring

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.2.4</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>1.2.4</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-cas</artifactId>
            <version>1.2.4</version>
        </dependency>

4.啓動類添加@ServletComponentScan註解數據庫

@ServletComponentScan
@SpringBootApplication
public class Application {

    public static void main(String[] args){
        SpringApplication.run(Application.class,args);
    }
}

5.配置shiro+casapache

package com.hdwang.config.shiroCas;

import com.hdwang.dao.UserDao;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.cas.CasFilter;
import org.apache.shiro.cas.CasSubjectFactory;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.filter.authc.LogoutFilter;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.jasig.cas.client.session.SingleSignOutFilter;
import org.jasig.cas.client.session.SingleSignOutHttpSessionListener;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.boot.web.servlet.ServletListenerRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.Ordered;
import org.springframework.web.filter.DelegatingFilterProxy;

import javax.servlet.Filter;
import javax.servlet.annotation.WebListener;
import java.util.HashMap;
import java.util.LinkedHashMap;
import java.util.Map;

/**
 * Created by hdwang on 2017/6/20.
 * shiro+cas 配置
 */
@Configuration
public class ShiroCasConfiguration {

    private static final Logger logger = LoggerFactory.getLogger(ShiroCasConfiguration.class);

    // cas server地址
    public static final String casServerUrlPrefix = "https://localhost:8443/cas";
    // Cas登陸頁面地址
    public static final String casLoginUrl = casServerUrlPrefix + "/login";
    // Cas登出頁面地址
    public static final String casLogoutUrl = casServerUrlPrefix + "/logout";
    // 當前工程對外提供的服務地址
    public static final String shiroServerUrlPrefix = "http://localhost:8081";
    // casFilter UrlPattern
    public static final String casFilterUrlPattern = "/cas";
    // 登陸地址
    public static final String loginUrl = casLoginUrl + "?service=" + shiroServerUrlPrefix + casFilterUrlPattern;
    // 登出地址（casserver啓用service跳轉功能，需在webapps\cas\WEB-INF\cas.properties文件中啓用cas.logout.followServiceRedirects=true）
    public static final String logoutUrl = casLogoutUrl+"?service="+shiroServerUrlPrefix;
    // 登陸成功地址
    public static final String loginSuccessUrl = "/home";
    // 權限認證失敗跳轉地址
    public static final String unauthorizedUrl = "/error/403.html";


    @Bean
    public EhCacheManager getEhCacheManager() {
        EhCacheManager em = new EhCacheManager();
        em.setCacheManagerConfigFile("classpath:ehcache-shiro.xml");
        return em;
    }

    @Bean(name = "myShiroCasRealm")
    public MyShiroCasRealm myShiroCasRealm(EhCacheManager cacheManager) {
        MyShiroCasRealm realm = new MyShiroCasRealm();
        realm.setCacheManager(cacheManager);
        //realm.setCasServerUrlPrefix(ShiroCasConfiguration.casServerUrlPrefix);
        // 客戶端回調地址
        //realm.setCasService(ShiroCasConfiguration.shiroServerUrlPrefix + ShiroCasConfiguration.casFilterUrlPattern);
        return realm;
    }

    /**
     * 註冊單點登出listener
     * @return
     */
    @Bean
    public ServletListenerRegistrationBean singleSignOutHttpSessionListener(){
        ServletListenerRegistrationBean bean = new ServletListenerRegistrationBean();
        bean.setListener(new SingleSignOutHttpSessionListener());
//        bean.setName(""); //默認爲bean name
        bean.setEnabled(true);
        //bean.setOrder(Ordered.HIGHEST_PRECEDENCE); //設置優先級
        return bean;
    }

    /**
     * 註冊單點登出filter
     * @return
     */
    @Bean
    public FilterRegistrationBean singleSignOutFilter(){
        FilterRegistrationBean bean = new FilterRegistrationBean();
        bean.setName("singleSignOutFilter");
        bean.setFilter(new SingleSignOutFilter());
        bean.addUrlPatterns("/*");
        bean.setEnabled(true);
        //bean.setOrder(Ordered.HIGHEST_PRECEDENCE);
        return bean;
    }



    /**
     * 註冊DelegatingFilterProxy（Shiro）
     *
     * @return
     * @author SHANHY
     * @create  2016年1月13日
     */
    @Bean
    public FilterRegistrationBean delegatingFilterProxy() {
        FilterRegistrationBean filterRegistration = new FilterRegistrationBean();
        filterRegistration.setFilter(new DelegatingFilterProxy("shiroFilter"));
        //  該值缺省爲false,表示生命週期由SpringApplicationContext管理,設置爲true則表示由ServletContainer管理
        filterRegistration.addInitParameter("targetFilterLifecycle", "true");
        filterRegistration.setEnabled(true);
        filterRegistration.addUrlPatterns("/*");
        return filterRegistration;
    }


    @Bean(name = "lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();
        daap.setProxyTargetClass(true);
        return daap;
    }

    @Bean(name = "securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(MyShiroCasRealm myShiroCasRealm) {
        DefaultWebSecurityManager dwsm = new DefaultWebSecurityManager();
        dwsm.setRealm(myShiroCasRealm);
//      <!-- 用戶受權/認證信息Cache, 採用EhCache 緩存 -->
        dwsm.setCacheManager(getEhCacheManager());
        // 指定 SubjectFactory
        dwsm.setSubjectFactory(new CasSubjectFactory());
        return dwsm;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();
        aasa.setSecurityManager(securityManager);
        return aasa;
    }


    /**
     * CAS過濾器
     *
     * @return
     * @author SHANHY
     * @create  2016年1月17日
     */
    @Bean(name = "casFilter")
    public CasFilter getCasFilter() {
        CasFilter casFilter = new CasFilter();
        casFilter.setName("casFilter");
        casFilter.setEnabled(true);
        // 登陸失敗後跳轉的URL，也就是 Shiro 執行 CasRealm 的 doGetAuthenticationInfo 方法向CasServer驗證tiket
        casFilter.setFailureUrl(loginUrl);// 咱們選擇認證失敗後再打開登陸頁面
        return casFilter;
    }

    /**
     * ShiroFilter<br/>
     * 注意這裏參數中的 StudentService 和 IScoreDao 只是一個例子，由於咱們在這裏能夠用這樣的方式獲取到相關訪問數據庫的對象，
     * 而後讀取數據庫相關配置，配置到 shiroFilterFactoryBean 的訪問規則中。實際項目中，請使用本身的Service來處理業務邏輯。
     *
     * @param securityManager
     * @param casFilter
     * @param userDao
     * @return
     * @author SHANHY
     * @create  2016年1月14日
     */
    @Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager, CasFilter casFilter, UserDao userDao) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 必須設置 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 若是不設置默認會自動尋找Web工程根目錄下的"/login.jsp"頁面
        shiroFilterFactoryBean.setLoginUrl(loginUrl);
        // 登陸成功後要跳轉的鏈接
        shiroFilterFactoryBean.setSuccessUrl(loginSuccessUrl);
        shiroFilterFactoryBean.setUnauthorizedUrl(unauthorizedUrl);
        // 添加casFilter到shiroFilter中
        Map<String, Filter> filters = new HashMap<>();
        filters.put("casFilter", casFilter);
       // filters.put("logout",logoutFilter());
        shiroFilterFactoryBean.setFilters(filters);

        loadShiroFilterChain(shiroFilterFactoryBean, userDao);
        return shiroFilterFactoryBean;
    }

    /**
     * 加載shiroFilter權限控制規則（從數據庫讀取而後配置）,角色/權限信息由MyShiroCasRealm對象提供doGetAuthorizationInfo實現獲取來的
     *
     * @author SHANHY
     * @create  2016年1月14日
     */
    private void loadShiroFilterChain(ShiroFilterFactoryBean shiroFilterFactoryBean, UserDao userDao){
        /////////////////////// 下面這些規則配置最好配置到配置文件中 ///////////////////////
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();

        // authc：該過濾器下的頁面必須登陸後才能訪問，它是Shiro內置的一個攔截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter
        // anon: 能夠理解爲不攔截
        // user: 登陸了就不攔截
        // roles["admin"] 用戶擁有admin角色
        // perms["permission1"] 用戶擁有permission1權限
        // filter順序按照定義順序匹配，匹配到就驗證，驗證完畢結束。
        // url匹配通配符支持：? * **,分別表示匹配1個，匹配0-n個（不含子路徑），匹配下級全部路徑

        //1.shiro集成cas後，首先添加該規則
        filterChainDefinitionMap.put(casFilterUrlPattern, "casFilter");
        //filterChainDefinitionMap.put("/logout","logout"); //logut請求採用logout filter

        //2.不攔截的請求
        filterChainDefinitionMap.put("/css/**","anon");
        filterChainDefinitionMap.put("/js/**","anon");
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/logout","anon");
        filterChainDefinitionMap.put("/error","anon");
        //3.攔截的請求（從本地數據庫獲取或者從casserver獲取(webservice,http等遠程方式)，看你的角色權限配置在哪裏）
        filterChainDefinitionMap.put("/user", "authc"); //須要登陸
        filterChainDefinitionMap.put("/user/add/**", "authc,roles[admin]"); //須要登陸，且用戶角色爲admin
        filterChainDefinitionMap.put("/user/delete/**", "authc,perms[\"user:delete\"]"); //須要登陸，且用戶有權限爲user:delete

        //4.登陸過的不攔截
        filterChainDefinitionMap.put("/**", "user");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    }

}

package com.hdwang.config.shiroCas;

import javax.annotation.PostConstruct;

import com.hdwang.dao.UserDao;
import com.hdwang.entity.User;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.cas.CasRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;
import java.util.Set;

/**
 * Created by hdwang on 2017/6/20.
 * 安全數據源
 */
public class MyShiroCasRealm extends CasRealm{

    private static final Logger logger = LoggerFactory.getLogger(MyShiroCasRealm.class);

    @Autowired
    private UserDao userDao;

    @PostConstruct
    public void initProperty(){
//      setDefaultRoles("ROLE_USER");
        setCasServerUrlPrefix(ShiroCasConfiguration.casServerUrlPrefix);
        // 客戶端回調地址
        setCasService(ShiroCasConfiguration.shiroServerUrlPrefix + ShiroCasConfiguration.casFilterUrlPattern);
    }

//    /**
//     * 一、CAS認證 ,驗證用戶身份
//     * 二、將用戶基本信息設置到會話中(不用了，隨時能夠獲取的)
//     */
//    @Override
//    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
//
//        AuthenticationInfo authc = super.doGetAuthenticationInfo(token);
//
//        String account = (String) authc.getPrincipals().getPrimaryPrincipal();
//
//        User user = userDao.getByName(account);
//        //將用戶信息存入session中
//        SecurityUtils.getSubject().getSession().setAttribute("user", user);
//
//        return authc;
//    }

    /**
     * 權限認證，爲當前登陸的Subject授予角色和權限
     * @see 經測試：本例中該方法的調用時機爲需受權資源被訪問時
     * @see 經測試：而且每次訪問需受權資源時都會執行該方法中的邏輯，這代表本例中默認並未啓用AuthorizationCache
     * @see 經測試：若是連續訪問同一個URL（好比刷新），該方法不會被重複調用，Shiro有一個時間間隔（也就是cache時間，在ehcache-shiro.xml中配置），超過這個時間間隔再刷新頁面，該方法會被執行
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        logger.info("##################執行Shiro權限認證##################");
        //獲取當前登陸輸入的用戶名，等價於(String) principalCollection.fromRealm(getName()).iterator().next();
        String loginName = (String)super.getAvailablePrincipal(principalCollection);

        //到數據庫查是否有此對象(1.本地查詢 2.能夠遠程查詢casserver 3.能夠由casserver帶過來角色／權限其它信息)
        User user=userDao.getByName(loginName);// 實際項目中，這裏能夠根據實際狀況作緩存，若是不作，Shiro本身也是有時間間隔機制，2分鐘內不會重複執行該方法
        if(user!=null){
            //權限信息對象info,用來存放查出的用戶的全部的角色（role）及權限（permission）
            SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
            //給用戶添加角色（讓shiro去驗證）
            Set<String> roleNames = new HashSet<>();
            if(user.getName().equals("boy5")){
                roleNames.add("admin");
            }
            info.setRoles(roleNames);

            if(user.getName().equals("李四")){
                //給用戶添加權限（讓shiro去驗證）
                info.addStringPermission("user:delete");
            }


            // 或者按下面這樣添加
            //添加一個角色,不是配置意義上的添加,而是證實該用戶擁有admin角色
//            simpleAuthorInfo.addRole("admin");
            //添加權限
//            simpleAuthorInfo.addStringPermission("admin:manage");
//            logger.info("已爲用戶[mike]賦予了[admin]角色和[admin:manage]權限");
            return info;
        }
        // 返回null的話，就會致使任何用戶訪問被攔截的請求時，都會自動跳轉到unauthorizedUrl指定的地址
        return null;
    }

}

package com.hdwang.controller;

import com.hdwang.config.shiroCas.ShiroCasConfiguration;
import com.hdwang.entity.User;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

import javax.servlet.http.HttpSession;

/**
 * Created by hdwang on 2017/6/21.
 * 跳轉至cas server去登陸（一個入口）
 */
@Controller
@RequestMapping("")
public class CasLoginController {

    /**
     * 通常用不到
     * @param model
     * @return
     */
    @RequestMapping(value="/login",method= RequestMethod.GET)
    public String loginForm(Model model){
        model.addAttribute("user", new User());
//      return "login";
        return "redirect:" + ShiroCasConfiguration.loginUrl;
    }


    @RequestMapping(value = "logout", method = { RequestMethod.GET,
            RequestMethod.POST })
    public String loginout(HttpSession session)
    {
        return "redirect:"+ShiroCasConfiguration.logoutUrl;
    }
}

package com.hdwang.controller;

import com.alibaba.fastjson.JSONObject;
import com.hdwang.entity.User;
import com.hdwang.service.datajpa.UserService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.mgt.SecurityManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.ui.ModelMap;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

/**
 * Created by hdwang on 2017/6/19.
 */
@Controller
@RequestMapping("/home")
public class HomeController {

    @Autowired
    UserService userService;

    @RequestMapping("")
    public String index(HttpSession session, ModelMap map, HttpServletRequest request){
//        User user = (User) session.getAttribute("user");

        System.out.println(request.getUserPrincipal().getName());
        System.out.println(SecurityUtils.getSubject().getPrincipal());

        User loginUser = userService.getLoginUser();
        System.out.println(JSONObject.toJSONString(loginUser));

        map.put("user",loginUser);
        return "home";
    }



}