7、Shiro+SpringMVC+oracle+maven整合

2023-11-10

本章节主要介绍Shiro+SpringMVC+oracle+maven整合，并实现shiro的身份验证和授权。

建表并插入数据

--1、用户表

CREATETABLEusers_Table(

user_id number(10)primarykey,

user_name varchar2(64) ,

passwordvarchar2(48)

) ;

createsequence users_seq;

insertintousers_Tablevalues(users_seq.nextval,'admin','123456');

insertinto users_Tablevalues(users_seq.nextval,'afeng','qw123456');

insertinto users_Tablevalues(users_seq.nextval,'czf','we2133');

select *from users_Table;

--2、角色表

CREATETABLE roles_Table (

role_id number(10)primarykey,

role_name varchar2(64)

)

createsequence roles_seq;

insertinto roles_Tablevalues(roles_seq.nextval,'admin');

insertinto roles_Tablevalues(roles_seq.nextval,'manager');

insertinto roles_Tablevalues(roles_seq.nextval,'programmer');

select *from roles_Table;

--3、权限表

CREATETABLE permissions_Table (

permission_id number(10)primarykey,

permission_namevarchar2(64)

);

createsequence permissions_seq;

insertinto permissions_Tablevalues(permissions_seq.nextval,'add');

insertinto permissions_Tablevalues(permissions_seq.nextval,'update');

insertinto permissions_Tablevalues(permissions_seq.nextval,'delete');

insertinto permissions_Tablevalues(permissions_seq.nextval,'query');

insertinto permissions_Tablevalues(permissions_seq.nextval,'create_user');

select *from permissions_Table;

--4、用户和角色的关系表

CREATETABLE user_role_table(

idnumber(10)primarykey,

user_id number(10) ,

role_id number(10)

)

dropsequence user_role_seq;

createsequence user_role_seq;

insertinto user_role_tablevalues(user_role_seq.nextval,1,1);

insertinto user_role_tablevalues(user_role_seq.nextval,2,2);

insertinto user_role_tablevalues(user_role_seq.nextval,3,3);

select *from user_role_table;

--5、角色和权限的关系

CREATETABLErole_permissions_table (

idnumber(10)primarykey,

permission_id number(10),

role_id number(10)

);

dropsequencerole_permission_seq;

createsequencerole_permission_seq;

insertinto role_permissions_tablevalues(role_permission_seq.nextval,1,1);

insertinto role_permissions_tablevalues(role_permission_seq.nextval,1,2);

insertinto role_permissions_tablevalues(role_permission_seq.nextval,1,3);

insertinto role_permissions_tablevalues(role_permission_seq.nextval,2,1);

select *from role_permissions_table;

--6、常见语句

--1、根据用户名查询密码

SELECTpasswordFROM users_TableWHERE user_name='admin';

--2、根据用户名查询角色

SELECT role_namefromuser_role_tableleftjoin roles_Tableusing(role_id)leftjoin

users_Tableusing(user_id)WHERE user_name ='afeng';

--3、根据角色查询权限

SELECT permission_nameFROMrole_permissions_tableleftjoin roles_Tableusing(role_id)left

joinpermissions_Tableusing(permission_id)WHERErole_name ='admin';

整体架构

见上图
加载依赖

需要注意的是，加载shiro-spring包时，shiro-core等jar包也会加载，因为shiro-core是shiro-spring的必须的依赖包。

另外，maven中央服务器不在提供oracle10g的驱动包的下载，有两种解决方案，一种是下载oracle10g的驱动包，并放在本地maven仓库，另外一种改成更高版本的驱动包。

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-spring</artifactId>

</dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>4.3.9.RELEASE</version>

</dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-jdbc</artifactId>

<version>4.3.9.RELEASE</version>

</dependency>

<groupId>com.oracle</groupId>

<artifactId>ojdbc6</artifactId>

</dependency>

配置文件

web.xml

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

<init-param>

<param-name>targetFilterLifecycle</param-name>

<param-value>true</param-value>

</init-param>

<init-param>

<param-name>targetBeanName</param-name>

<param-value>shiroFilter</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>shiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

</listener>

<context-param>

<param-name>contextConfigLocation</param-name>

<param-value>classpath:Shiro.xml</param-value>

</context-param>

<servlet-name>SpringMVC</servlet-name>

<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

<init-param>

<param-name>contextConfigLocation</param-name>

<param-value>classpath:SpringMVC.xml</param-value>

</init-param>

</servlet>

<servlet-mapping>

<servlet-name>SpringMVC</servlet-name>

<url-pattern>*.do</url-pattern>

</servlet-mapping>

<error-page>

<error-code>401</error-code>

</error-page>

SpringMVC.xml

<?xmlversion="1.0"encoding="UTF-8"?>

<beansxmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xmlns:context="http://www.springframework.org/schema/context"

xmlns:mvc="http://www.springframework.org/schema/mvc"

xmlns:tx="http://www.springframework.org/schema/tx"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans.xsd

http://www.springframework.org/schema/context

http://www.springframework.org/schema/context/spring-context-4.3.xsd

http://www.springframework.org/schema/tx

http://www.springframework.org/schema/tx/spring-tx-4.3.xsd

http://www.springframework.org/schema/mvc

http://www.springframework.org/schema/mvc/spring-mvc-4.3.xsd">

<mvc:annotation-driven></mvc:annotation-driven>

<context:component-scanbase-package="cn.com.bochy"></context:component-scan>

<beanid="ViewResolver"class="org.springframework.web.servlet.view.InternalResourceViewResolver">

<propertyname="prefix"value="/WEB-INF/view/"></property>

<propertyname="suffix"value=".jsp"></property>

</bean>

</beans>

Shiro.xml

<?xmlversion="1.0"encoding="UTF-8"?>

<beansxmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://www.springframework.org/schema/beans

http://www.springframework.org/schema/beans/spring-beans.xsd">

<beanid="ds"

class="org.springframework.jdbc.datasource.DriverManagerDataSource">

<propertyname="driverClassName"value="oracle.jdbc.driver.OracleDriver"/>

<propertyname="url"value="jdbc:oracle:thin:@localhost:1521:orcl"/>

<propertyname="username"value="system"/>

<propertyname="password"value="orcl"/>

</bean>

<!-- 2、Shiro生命周期处理器：保证实现了Shiro内部lifecycle函数的bean执行，

LifecycleBeanPostProcessor用于在实现了Initializable接口的Shiro bean初始化时调用Initializable接口回调，

在实现了Destroyable接口的Shiro bean销毁时调用Destroyable接口回调。如UserRealm就实现了Initializable，

而DefaultSecurityManager实现了Destroyable -->

<beanid="lifecycleBeanPostProcessor"

class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

<beanid="jdbcRealm"class="org.apache.shiro.realm.jdbc.JdbcRealm">

<propertyname="permissionsLookupEnabled"value="true"></property>

<propertyname="dataSource"ref="ds"></property>

<propertyname="authenticationQuery"

value="SELECTpassword FROM users_Table WHERE user_name = ?"></property>

<propertyname="userRolesQuery"

value="SELECTrole_name from user_role_table left join roles_Table using(role_id) left join

users_Tableusing(user_id) WHERE user_name = ?"></property>

<propertyname="permissionsQuery"

value="SELECTpermission_name FROM role_permissions_table left join roles_Tableusing(role_id) left

join permissions_Tableusing(permission_id) WHERE role_name = ?"></property>

</bean>

<beanid="securityManager"class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<propertyname="realm"ref="jdbcRealm"></property>

</bean>

<!--

Shiro主过滤器本身功能十分强大，其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行

Web应用中，Shiro可控制的Web请求必须经过Shiro主过滤器的拦截，Shiro对基于Spring的Web应用提供了完美的支持

-->

<beanid="shiroFilter"class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<propertyname="securityManager"ref="securityManager"></property>

<propertyname="loginUrl"value="/login.do"></property>

<propertyname="filterChainDefinitions">

<value>

/security/**=anon

/admin/** =authc,roles[admin]

/edit/**=authc,roles[admin],perms[update]

/manager.do=authc,perms[manager]

</value>

</property>

</bean>

</beans>

ShiroSpringMVCController.java

package cn.com.bochy.controller;

import javax.servlet.http.HttpServletRequest;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.DisabledAccountException;

import org.apache.shiro.authc.ExcessiveAttemptsException;

import org.apache.shiro.authc.ExpiredCredentialsException;

import org.apache.shiro.authc.IncorrectCredentialsException;

import org.apache.shiro.authc.LockedAccountException;

import org.apache.shiro.authc.UnknownAccountException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.authz.UnauthorizedException;

import org.apache.shiro.subject.Subject;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.RequestMapping;

@Controller

publicclass ShiroSpringMVCController {

@RequestMapping("/login")

public String sayHello(){

return"security/login";

}

@RequestMapping("/manager")

public String sayManager(){

System.out.println("manager...");

return"manager/query";

}

@RequestMapping("/main")

public String main(){

return"main";

}

@RequestMapping(value ="/dologin")

public String doLogin(HttpServletRequestrequest, Model model) {

Subject subject =SecurityUtils.getSubject();

String msg ="";

String userName =request.getParameter("userName");

System.out.println(userName);

String password = request.getParameter("password");

System.out.println(password);

UsernamePasswordTokentoken =new UsernamePasswordToken(userName, password);

token.setRememberMe(true);

try {

subject.login(token);

System.out.println(subject.hasRole("admin"));

System.out.println(subject.hasRole("manager"));

System.out.println(subject.isPermitted("add"));

System.out.println(subject.isPermitted("query"));

if(subject.isAuthenticated()) {

return"redirect:/main.do";

} else {

return"security/login";

}

} catch(IncorrectCredentialsException e) {

msg = "登录密码错误. Password for account " +token.getPrincipal() +" wasincorrect.";