Shiro 自定义角色 认证

由于Shiro filterChainDefinitions中 roles默认是and，

/** = user,roles[system,general]

比如：roles[system,general] ，表示同时需要“system”和“general” 2个角色才通过认证

所以需要自定义 继承 AuthorizationFilter

 

public class RolesAuthorizationFilter extends AuthorizationFilter{

    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue)
            throws Exception {
        Subject subject = getSubject(request, response); 
        String[] rolesArray = (String[]) mappedValue; 

        if (rolesArray == null || rolesArray.length == 0) { 
            //no roles specified, so nothing to check - allow access. 
            return true; 
        } 

        for(int i=0;i<rolesArray.length;i++){  
            if(subject.hasRole(rolesArray[i])){  
                return true;  
            }  
        }  
        return false;  
    }

}

 

 

xml中配置如下：

 

<!-- Shiro Filter -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl" value="/login" />
		<property name="successUrl" value="/success" />
		<property name="filters">
			<map>
				<entry key="anyRoles" value-ref="anyRoles"/>
			</map>
		</property>
		<property name="filterChainDefinitions">
			<value>
				/login = authc
				/login/logout = anon
				/ = anon
				/XXX/** = user,anyRoles[system,general]
                                /TTT = role[system]
				/** = user
			</value>
		</property>
	</bean>
	
	<!--自定义的Roles Filter-->
	<bean id="anyRoles" class="com.jianfei.p.web.common.RolesAuthorizationFilter" />

注意：/XXX/** = user,anyRoles[system,general]， 注意红色的"anyRoles"一定要和 

  <entry key="anyRoles" value-ref="anyRoles"/> key一样就行，否则过滤器不起作用

 

评论

1 楼 zxcq06 2015-09-24  

搞了半天没起作用，原来文件里要这么写，受教了。