SpringMvc-Httl-shiro的整合

2019-11-15 00:36:14

字體：大中小

來源：轉載

供稿：網友

SPRingMvc-Httl-shiro的整合

來到新的公司一個月，以前實習公司的用的是srping+hibernate+struts2,而在這里不在用的這些了，而是用的springMVC和jdbc模板來操作數據了，所以又用了一段時間去慢慢融入這個新的體系中去；但終究這些技術是萬變不離其宗的，學習也是很快的事，所以我也就很快的就融入了這個團隊；

進入正題吧！我這里其實就是想把學習新東西自己記錄下來，這有助于我的學習也有助于大家的學習;把springmvc+httl+shiro+maven給整合起來;我剛來到新公司這里已經是搭建好了這個項目；所以我也在空閑時間之余把這些知識給過了一遍，也有助于我開發效率的提高；

我使用的開發工具室MyEclipse(開發工具的使用都是大同小異)；

至于httl和shiro的優勢我就不多說了有興趣的看：

http://www.open-open.com/open342321.htm；

http://blog.csdn.net/boonya/article/details/8233303

廢話不多說，開始搭建吧。。。

1：首先建立一個javaweb項目

2：配置pom.xml導入必須的jar包

<dependencies>          <!-- junit核心jar包 -->        <dependency>            <groupId>junit</groupId>            <artifactId>junit</artifactId>            <version>4.12</version>        </dependency>        <!-- springMVC核心jar包 -->        <dependency>            <groupId>org.springframework</groupId>            <artifactId>spring-webmvc</artifactId>            <version>4.0.5.RELEASE</version>        </dependency>        <!-- httl 核心jar包  -->        <dependency>            <groupId>com.github.httl</groupId>            <artifactId>httl-springmvc</artifactId>            <version>1.0.10</version>        </dependency>        <dependency>            <groupId>com.github.httl</groupId>            <artifactId>httl</artifactId>            <version>1.0.11</version>        </dependency>                <!--當你運行的環境是jre是時;httl模板必須加入這個jar包；還有就是必須在httl的 httl.properties注入屬性值：        compiler=httl.spi.compilers.JavassistCompiler。。這點很重要,不然當你啟動tomcat時會一直拋classnotfound異常-->        <dependency>            <groupId>org.javassist</groupId>            <artifactId>javassist</artifactId>            <version>3.18.2-GA</version>        </dependency>                 <dependency>              <groupId>commons-logging</groupId>              <artifactId>commons-logging</artifactId>              <version>1.1.3</version>          </dependency>          <!-- shiro -->        <dependency>              <groupId>org.apache.shiro</groupId>              <artifactId>shiro-core</artifactId>              <version>1.2.2</version>          </dependency>          <dependency>            <groupId>org.apache.shiro</groupId>            <artifactId>shiro-web</artifactId>            <version>1.2.2</version>        </dependency>        <dependency>            <groupId>org.apache.shiro</groupId>            <artifactId>shiro-ehcache</artifactId>            <version>1.2.2</version>        </dependency>            <dependency>            <groupId>org.apache.shiro</groupId>            <artifactId>shiro-spring</artifactId>            <version>1.2.2</version>        </dependency>        <dependency>            <groupId>org.apache.shiro</groupId>            <artifactId>shiro-quartz</artifactId>            <version>1.2.2</version>        </dependency>        <dependency>            <groupId>javax.servlet</groupId>            <artifactId>javax.servlet-api</artifactId>            <version>3.1.0</version>        </dependency>                <!-- spring aop -->        <dependency>            <groupId>org.aspectj</groupId>            <artifactId>aspectjrt</artifactId>            <version>1.8.5</version>        </dependency>        <dependency>            <groupId>org.aspectj</groupId>            <artifactId>aspectjweaver</artifactId>            <version>1.8.5</version>        </dependency>  </dependencies>

3：修改web.xml文件

<?xml version="1.0" encoding="UTF-8"?><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"    version="3.0">    <display-name></display-name>        <context-param>        <param-name>contextConfigLocation</param-name>        <param-value>          classpath:applicationContext-shiro.xml        </param-value>    </context-param>    <!-- 配置Shiro過濾器,先讓Shiro過濾系統接收到的請求 -->    <!-- 這里filter-name必須對應applicationContext.xml中定義的<bean id="shiroFilter" /> -->    <!-- 使用[/*]匹配所有請求,保證所有的可控請求都經過Shiro的過濾 -->    <!-- 通常會將此filter-mapping放置到最前面(即其他filter-mapping前面),以保證它是過濾器鏈中第一個起作用的 -->    <filter>        <filter-name>shiroFilter</filter-name>        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>        <init-param>            <!-- 該值缺省為false,表示生命周期由SpringApplicationContext管理,設置為true則表示由ServletContainer管理 -->            <param-name>targetFilterLifecycle</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>shiroFilter</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping>            <!-- 加載httl的屬性文件 -->    <context-param>        <param-name>httl.properties</param-name>        <param-value>classpath:httl.properties</param-value>    </context-param>            <!-- Character Encoding filter -->    <filter>        <filter-name>encodingFilter</filter-name>        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>        <init-param>            <param-name>encoding</param-name>            <param-value>UTF-8</param-value>        </init-param>        <init-param>            <param-name>forceEncoding</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>encodingFilter</filter-name>        <url-pattern>/*</url-pattern>        <dispatcher>REQUEST</dispatcher>        <dispatcher>FORWARD</dispatcher>    </filter-mapping>    <!-- Spring MVC Servlet 載入 -->    <servlet>        <servlet-name>springMVC</servlet-name>        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>        <init-param>            <param-name>contextConfigLocation</param-name>            <param-value>classpath:spring-mvc.xml</param-value>        </init-param>        <load-on-startup>1</load-on-startup>    </servlet>    <servlet-mapping>        <servlet-name>springMVC</servlet-name>        <url-pattern>/</url-pattern>    </servlet-mapping>    <!-- 實例化Spring容器 -->    <!-- 應用啟動時,該監聽器被執行,它會讀取Spring相關配置文件,其默認會到WEB-INF中查找applicationContext.xml -->    <listener>        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>    </listener>        <welcome-file-list>        <welcome-file>index.jsp</welcome-file>    </welcome-file-list></web-app>

4：添加httl.properties文件

import.packages+=com.lishun.controller

template.directory=/WEB-INF/templates

template.suffix=.httl

input.encoding=utf-8

output.encoding=utf-8

reloadable=true

precompiled=true

compiler=httl.spi.compilers.JavassistCompiler

import.methods+=com.lishun.httl.staticMethods.ShiroKit

注:import.packages：領域模型包導入

import.methods:這里可以封裝在httl模板頁面上使用的靜態方法

template.directory：模板文件目錄；

template.suffix：模板文件后綴

input.encoding：資源加載編碼

output.encoding: 模板輸出編碼

precompiled:是否預編譯

reloadable: 是否熱加載;開發模式下建議開啟

compiler：（摘自httl官網）

用于將模板類編譯成字節碼，缺省使用根據JDK版本自適應編譯器：(缺省值不用配)

1	compiler=httl.spi.compilers.AdaptiveCompiler

當前運行環境為JDK1.6以前版本時，AdaptiveCompiler將適配到JavassistCompiler，否則將適配到JdkCompiler。

你可以強制指定使用jdk自帶的編譯器：(必需要用JDK運行，JRE不行，JDK比JRE多編譯工具包)

1	compiler=httl.spi.compilers.JdkCompiler

你也可以換成javassist編譯：(如果為JRE運行，請使用javassist編譯)

1	compiler=httl.spi.compilers.JavassistCompiler

當然，也就需要增加javassist的jar包依賴：

javassist-3.15.0-GA.jar

<groupId>org.javassist</groupId>

<artifactId>javassist</artifactId>

</dependency>

5:編寫applicationContext-shiro.xml 注：該文件是管理shiro的

<!-- 這里別忘了配置，否則會導致自定義的Realm的屬性值無法注入 -->    <context:component-scan base-package="com.lishun"></context:component-scan>    <!-- 繼承自AuthorizingRealm的自定義Realm,即指定Shiro驗證用戶登錄的類為自定義的UserRealm.java -->     <bean id="shiroRealm" class="com.lishun.shiro.realm.UserRealm" >          </bean>         <!-- 基于Form表單的身份驗證過濾器 -->    <bean id="formAuthenticationFilter"        class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">        <property name="usernameParam" value="username" />        <property name="passWordParam" value="password" />        <property name="loginUrl" value="/users/index.html" />        <property name="successUrl" value="/index/index.html" />    </bean>    <context:component-scan base-package="com.lishun"></context:component-scan>    <bean        class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"        depends-on="lifecycleBeanPostProcessor">        <property name="proxyTargetClass" value="true" />    </bean>        <!-- 這里主要是設置自定義的單Realm應用,若有多個Realm,可使用'realms'屬性代替 -->    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">        <property name="realm" ref="shiroRealm" />    </bean>    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">        <!-- 調用自定義的權限管理器 -->        <property name="securityManager" ref="securityManager" />        <!-- 配置登陸成功后跳轉地址 -->        <property name="successUrl" value="/index/index" />        <!-- 配置登陸時請求的地址 -->        <property name="loginUrl" value="/users/index" />        <!-- 如果請求的資源不再你的權限范圍內，則跳轉到error.htm -->        <property name="unauthorizedUrl" value="/users/noAuth" />        <property name="filters">            <map>                <entry key="authc" value-ref="formAuthenticationFilter"></entry>            </map>        </property>        <property name="filterChainDefinitions">            <value>                <!-- anon表示此地址不需要任何權限即可訪問 -->                /users/*=anon                <!--login頁面和logout頁面不需要驗證 -->                /login* = anon                <!--訪問所有文件,authc必須通過驗證后才能訪問 -->                /** = authc            </value>        </property>    </bean>        <!-- 相當于調用SecurityUtils.setSecurityManager(securityManager) -->    <bean        class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">        <property name="staticMethod"            value="org.apache.shiro.SecurityUtils.setSecurityManager" />        <property name="arguments" ref="securityManager" />    </bean>    <!-- Shiro生命周期處理器 -->    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

6.編寫spring-mvc.xml文件注:該文件是管理springmvc的

<!-- 自動掃描且只掃描@Controller -->    <context:component-scan base-package="com.lishun"        use-default-filters="false">        <context:include-filter type="annotation"            expression="org.springframework.stereotype.Controller" />        <context:include-filter type="annotation"            expression="org.springframework.web.bind.annotation.ControllerAdvice" />    </context:component-scan>    <!-- 啟用SpringMVC的注解功能,它會自動注冊HandlerMapping、HandlerAdapter、ExceptionResolver的相關實例 -->    <mvc:annotation-driven />    <!-- 配置SpringMVC的視圖解析器 httl視圖 -->    <bean id="viewResolver" class="httl.web.springmvc.HttlViewResolver">        <property name="contentType" value="text/html; charset=UTF-8" />    </bean>    <!-- 在spring-mvc.xml配置文件添加Shiro Spring AOP權限注解的支持： -->    <aop:config proxy-target-class="true"></aop:config>    <bean        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">        <property name="securityManager" ref="securityManager" />    </bean>    <!-- 當前用戶沒有權限時跳轉到的頁面： -->    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">            <property name="exceptionMappings">                <props>                    <prop key="org.apache.shiro.authz.UnauthorizedException">/users/unauthorizedView</prop>              </props>            </property>        </bean>

7：編寫用戶實體（User）和角色實體（Role）

public class User {    private String name;    private String password;    private Role role;    @Override    public String toString() {        return "User [name=" + name + ", password=" + password + ", role="                + role + "]";    }    public String getName() {        return name;    }    public User() {        super();    }    public void setName(String name) {        this.name = name;    }    public User(String name, String password) {        super();        this.name = name;        this.password = password;    }    public String getPassword() {        return password;    }    public void setPassword(String password) {        this.password = password;    }    public Role getRole() {        return role;    }    public void setRole(Role role) {        this.role = role;    }}---------------------------------------------------分割線public class Role {    private String roleName;    private Set<String> rolePermissions;    public Set<String> getRolePermissions() {        return rolePermissions;    }    public void setRolePermissions(Set<String> rolePermissions) {        this.rolePermissions = rolePermissions;    }    public String getRoleName() {        return roleName;    }    public void setRoleName(String roleName) {        this.roleName = roleName;    }}

8：在httl模板上執行靜態函數的類

/* * 在httl模板上可以直接使用的函數 */public class ShiroKit {    /**     * 禁止初始化     */    private ShiroKit() {    }    /**     * 獲取 Subject     *      * @return Subject     */    protected static Subject getSubject() {        return SecurityUtils.getSubject();    }    /**     * 驗證當前用戶是否擁有指定權限,使用時與lacksPermission 搭配使用     *      * @param permission     *            權限名     * @return 擁有權限：true，否則false     */    public static boolean hasPermission(String permission) {        boolean ret = getSubject() != null && permission != null && permission.length() > 0 && getSubject().isPermitted(permission);        return ret;    }    /**     * 與hasPermission標簽邏輯相反，當前用戶沒有制定權限時，驗證通過。     *      * @param permission     *            權限名     * @return 擁有權限：true，否則false     */    public static boolean lacksPermission(String permission) {        return !hasPermission(permission);    }}

9：自定義用戶驗證規則(必須繼承AuthorizingRealm)

public class UserRealm extends AuthorizingRealm {        @Autowired    @Qualifier("userDao")    private UserDao userDao;            /*     * 權限認證     */    @Override    protected AuthorizationInfo doGetAuthorizationInfo(            PrincipalCollection principals) {        // 根據用戶配置用戶與權限        if (principals == null) {            throw new AuthorizationException(                    "PrincipalCollection method argument cannot be null.");        }        String name = (String) getAvailablePrincipal(principals);        List<String> roles = new ArrayList<String>();        User user = userDao.getUserByName(name);        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();        // 把當前用戶的角色保存到Subject中        roles.add(user.getRole().getRoleName());        info.addRoles(roles);        // 把當前用戶的權限保存到Subject中        info.setStringPermissions(user.getRole().getRolePermissions());        return info;    }    /*     * 登陸認證     */    @Override    protected AuthenticationInfo doGetAuthenticationInfo(            AuthenticationToken authcToken) throws AuthenticationException {        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;        //獲取頁面輸入用戶名        String username=(String) token.getPrincipal();        //從dao層獲取該用戶        System.out.println(userDao);        User user = userDao.getUserByName(username);        if (user == null) {            throw new AuthorizationException();        }                SimpleAuthenticationInfo info = null;        //存儲令牌信息        if (user.getName().equals(token.getUsername())) {            info = new SimpleAuthenticationInfo(user.getName(),                    user.getPassword(), getName());        }        return info;    }    }

10：編寫dao層

/* * 這里我就不查詢數據數據了，側重點不在這里，所以寫死用戶數據 */public class UserDao {        private static List<User> list=new ArrayList<User>();    private static Set<String> userPermissions=new HashSet<String>();    private static Set<String> adminPermissions=new HashSet<String>();    static {        //lishun普通用戶        User lishun =new User();        lishun.setName("lishun");        lishun.setPassword("123");        Role lishunRole=new Role();        lishunRole.setRoleName("user");        //lishun普通用戶只擁有一個權限        userPermissions.add("user:lishun:view");        lishunRole.setRolePermissions(userPermissions);        lishun.setRole(lishunRole);                //admin超級用戶        User admin =new User();        admin.setName("admin");        admin.setPassword("123");        Role adminRole=new Role();        adminRole.setRoleName("admin");        //admin用戶擁有所有權限        adminPermissions.add("user:lishun:view");        adminPermissions.add("manager:lishun:view");        adminRole.setRolePermissions(adminPermissions);        admin.setRole(adminRole);        list.add(admin);        list.add(lishun);    }    public User getUserByName(String name){        for (User u : list) {            if(u.getName().equals(name)){                return u;            }        }        return null;    }

11：編寫控制器：用戶登陸控制器

//不用任何權限都可以訪問該控制器的方法@Controllerpublic class UserController {    /*     * 登陸頁面     */    @RequestMapping(value = "users/index", method = RequestMethod.GET)    public String index() {                return "users/login";    }    /*     * 驗證用戶     */    @RequestMapping(value = "users/login", method = RequestMethod.POST)    public String login(String username,String password,Model model){        //獲取到當前用戶的的Subject及創建用戶名/密碼身份驗證Token（即用戶身份/憑證）        Subject subject = SecurityUtils.getSubject();        UsernamePasswordToken token = new UsernamePasswordToken(username, password);                String error = null;        try {            //驗證登陸            subject.login(token);        } catch (AuthenticationException e) {            error = "warning message:Login failed,please check your username and password";             model.addAttribute("errorMessage", error);        }        if (error==null) {                    return "redirect:../index/index";        } else {            return "redirect:index";        }    }    /*     * 沒有權限后跳轉的頁面     */    @RequestMapping(value = "users/unauthorizedView", method = RequestMethod.GET)    public String unauthorizedView() {        return "users/unauthorizedView";    }}

12：login.httl文件

<!--#set(String msg="httl模板測試") --><!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html><body>    <form action="${manageHost}/users/login" method="post">        <label style="color: red">${errorMessage}</label>        <table>            <tr>                <td>UserName:</td>                <td><input type="text" name="username" />                </td>            </tr>            <tr>                <td>Password:</td>                <td><input type="password" name="password" />                </td>            </tr>            <tr>                <td colspan="2"><input type="submit" value="Login" />                </td>            </tr>        </table>    </form></body></html> -----------------------分隔符

至于httl的語法大家可以去官網上瀏覽,我這里就不多說，http://httl.github.io/zh/syntax.html

打開url：http://localhost:8080/SpringMvc-Httl-shiro/users/login

就可以瀏覽了

13 編寫控制器：用戶主頁控制器

@Controllerpublic class IndexController {        /*     * 普通用戶就可以訪問該頁面     */    @RequiresPermissions("user:lishun:view")    @RequestMapping(value = "index/index", method = RequestMethod.GET)    public String index() {        System.out.println(SecurityUtils.getSubject().isPermitted("user:lishun:view"));        return "index/index";    }}-------------------------------------------分割線

用戶主頁模板index.httl

<!--#set(String msg="httl模板測試") --><!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html><body>    #if(hasPermission("manager:lishun:view"))        超級用戶登陸        <a href="${manageHost}/manager/user">管理用戶</a>    #else(hasPermission("user:lishun:view"))        普通用戶登陸    #end</body></html>

14 編寫控制器：管理員控制器

@Controller@RequestMapping("manager")public class ManagerController {    /*     * 只有管理員才有權限查看本頁面     */    @RequiresPermissions("manager:lishun:view")    @RequestMapping(value = "/user", method = RequestMethod.GET)    public String index() {                return "manager/userManager";    }    }-------------------------------------------分割線

管理用戶模板userManager.httl

<!--#set(String msg="httl模板測試") --><!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html><body>    <h1>只有admin角色才可以訪問</h1></body></html>

當你是普通用戶訪問該頁面時因沒有權限而跳轉到無權限頁面