- 浏览: 157101 次
- 性别:
- 来自: 大连
文章分类
最新评论
-
eclipseakwolf:
很棒的文章
Shiro User Manual-Authentication -
xugangqiang:
very good
Java Concurrent Programming (1) -
jlcon:
是不是AbstractShiroTest还需要继承EasyMo ...
Shiro User Manual-Testing -
jlcon:
createNiceMock这个EasyMockSupport ...
Shiro User Manual-Testing -
Technoboy:
53873039oycg 写道楼主:问下,你的那个dao接口的 ...
Shiro Example
1. Overview
Shiro的JavaBeans兼容性使其可以很容易的配置在Spring XML或其他基于Spring的配置。Shiro需要应用级的SecurityManager单例。注意,它不需要是静态单例,只要保证在应用中存在一个SecurityManager实例即可。
2. Standalone Applications
在Spring应用中配置应用级SecurityManager单例:
3. Web Applications
Shiro支持Spring的web应用。在web应用中,所有Shiro可以访问的请求,都要经过主过滤器。这个主过滤器允许基于URL路径表达式,进行自主定义过滤器链。
下面是基于Spring web应用中配置Shiro:
a. web.xml
除了需要在web.xml中定义Spring元素(ContextLoaderListener, Log4jConfigListener等),还需要定义如下的过滤器:
b. applicationContext.xml
在applicationContext.xml文件中,定义SecurityManager和与web.xml中过滤器同名的"shiroFilter" bean:
4. Enabling Shiro Annotations
可以使用Shiro的注解在单应用或web应用中进行安全检查(@RequiresRoles, @RequiresPermissions等),这需要集成Spring AOP。
在applicationContext.xml如下配置即可:
5. Secure Spring Remoting
两部分配置来支持Spring远程调用: 客户端和服务端。
a. Server-side Configuration
当一个远程方法调用进入Shiro服务器时,Subject关联的RPC调用必须绑定到接受线程上才能在线程执行间访问。这是通过在applicationContext.xml中定义SecureRemoteInvocationExecutor:
然后,将定义的bean配置到使用的远程Exporter中。Exporter的实现将根据使用的远程协议定义。如果使用基于HTTP的远程协议:
b. Client-side Configuration
当执行远程调用,Subject的标识信息必须附加到远程调用的负载上使服务器知道谁在执行远程调用。如果客户端是基于Spring,可以通过SecureRemoteInvocationFactory:
然后,将定义的bean配置到使用的ProxyFactoryBean中。如果使用基于HTTP的远程协议:
Shiro的JavaBeans兼容性使其可以很容易的配置在Spring XML或其他基于Spring的配置。Shiro需要应用级的SecurityManager单例。注意,它不需要是静态单例,只要保证在应用中存在一个SecurityManager实例即可。
2. Standalone Applications
在Spring应用中配置应用级SecurityManager单例:
<!-- Define the realm you want to use to connect to your back-end security datasource: --> <bean id="myRealm" class="..."> ... </bean> <bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager"> <!-- Single realm app. If you have multiple realms, use the 'realms' property instead. --> <property name="realm" ref="myRealm"/> </bean> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <!-- For simplest integration, so that all SecurityUtils.* methods work in all cases, --> <!-- make the securityManager bean a static singleton. DO NOT do this in web --> <!-- applications - see the 'Web Applications' section below instead. --> <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean"> <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/> <property name="arguments" ref="securityManager"/> </bean>
3. Web Applications
Shiro支持Spring的web应用。在web应用中,所有Shiro可以访问的请求,都要经过主过滤器。这个主过滤器允许基于URL路径表达式,进行自主定义过滤器链。
下面是基于Spring web应用中配置Shiro:
a. web.xml
除了需要在web.xml中定义Spring元素(ContextLoaderListener, Log4jConfigListener等),还需要定义如下的过滤器:
<!-- The filter-name matches name of a 'shiroFilter' bean inside applicationContext.xml --> <filter> <filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <init-param> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> ... <!-- Make sure any request you want accessible to Shiro is filtered. /* catches all --> <!-- requests. Usually this filter mapping is defined first (before all others) to --> <!-- ensure that Shiro works in subsequent filters in the filter chain: --> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
b. applicationContext.xml
在applicationContext.xml文件中,定义SecurityManager和与web.xml中过滤器同名的"shiroFilter" bean:
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager"/> <!-- override these for application-specific URLs if you like: <property name="loginUrl" value="/login.jsp"/> <property name="successUrl" value="/home.jsp"/> <property name="unauthorizedUrl" value="/unauthorized.jsp"/> --> <!-- The 'filters' property is not necessary since any declared javax.servlet.Filter bean --> <!-- defined will be automatically acquired and available via its beanName in chain --> <!-- definitions, but you can perform instance overrides or name aliases here if you like: --> <!-- <property name="filters"> <util:map> <entry key="anAlias" value-ref="someFilter"/> </util:map> </property> --> <property name="filterChainDefinitions"> <value> # some example chain definitions: /admin/** = authc, roles[admin] /docs/** = authc, perms[document:read] /** = authc # more URL-to-FilterChain definitions here </value> </property> </bean> <!-- Define any javax.servlet.Filter beans you want anywhere in this application context. --> <!-- They will automatically be acquired by the 'shiroFilter' bean above and made available --> <!-- to the 'filterChainDefinitions' property. Or you can manually/explicitly add them --> <!-- to the shiroFilter's 'filters' Map if desired. See its JavaDoc for more details. --> <bean id="someFilter" class="..."/> <bean id="anotherFilter" class="..."> ... </bean> ... <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <!-- Single realm app. If you have multiple realms, use the 'realms' property instead. --> <property name="realm" ref="myRealm"/> <!-- By default the servlet container sessions will be used. Uncomment this line to use shiro's native sessions (see the JavaDoc for more): --> <!-- <property name="sessionMode" value="native"/> --> </bean> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <!-- Define the Shiro Realm implementation you want to use to connect to your back-end --> <!-- security datasource: --> <bean id="myRealm" class="..."> ... </bean>
4. Enabling Shiro Annotations
可以使用Shiro的注解在单应用或web应用中进行安全检查(@RequiresRoles, @RequiresPermissions等),这需要集成Spring AOP。
在applicationContext.xml如下配置即可:
<!-- Enable Shiro Annotations for Spring-configured beans. Only run after --> <!-- the lifecycleBeanProcessor has run: --> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager"/> </bean>
5. Secure Spring Remoting
两部分配置来支持Spring远程调用: 客户端和服务端。
a. Server-side Configuration
当一个远程方法调用进入Shiro服务器时,Subject关联的RPC调用必须绑定到接受线程上才能在线程执行间访问。这是通过在applicationContext.xml中定义SecureRemoteInvocationExecutor:
<!-- Secure Spring remoting: Ensure any Spring Remoting method invocations --> <!-- can be associated with a Subject for security checks. --> <bean id="secureRemoteInvocationExecutor" class="org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor"> <property name="securityManager" ref="securityManager"/> </bean>
然后,将定义的bean配置到使用的远程Exporter中。Exporter的实现将根据使用的远程协议定义。如果使用基于HTTP的远程协议:
<bean name="/someService" class="org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter"> <property name="service" ref="someService"/> <property name="serviceInterface" value="com.pkg.service.SomeService"/> <property name="remoteInvocationExecutor" ref="secureRemoteInvocationExecutor"/> </bean>
b. Client-side Configuration
当执行远程调用,Subject的标识信息必须附加到远程调用的负载上使服务器知道谁在执行远程调用。如果客户端是基于Spring,可以通过SecureRemoteInvocationFactory:
<bean id="secureRemoteInvocationFactory" class="org.apache.shiro.spring.remoting.SecureRemoteInvocationFactory"/>
然后,将定义的bean配置到使用的ProxyFactoryBean中。如果使用基于HTTP的远程协议:
<bean id="someService" class="org.springframework.remoting.httpinvoker.HttpInvokerProxyFactoryBean"> <property name="serviceUrl" value="http://host:port/remoting/someService"/> <property name="serviceInterface" value="com.pkg.service.SomeService"/> <property name="remoteInvocationFactory" ref="secureRemoteInvocationFactory"/> </bean>
发表评论
-
Shiro Filters
2013-05-06 14:07 30151. Overview 对于web应用 ... -
Shiro Example
2013-04-23 16:11 17431. 说明: maven项目,基于Spring3.1,My ... -
Shiro用户手册-中文版pdf
2013-04-21 19:47 2123Apache Shiro用户手册中文版。 -
Shiro User Manual-Custom Subjects
2013-04-18 11:03 20561. Custom Subject Instances Sh ... -
Shiro User Manual-Testing
2013-04-18 10:59 37031. Test Setup 创建的Subject实例,必须要 ... -
Shiro User Manual-Architecture
2013-04-16 11:02 12611. Overview Shiro的设计目标是通过直观而简易 ... -
Shiro User Manual-Tutorial
2013-04-16 10:52 22551. Your First Apache Shiro Appl ... -
Shiro User Manual-Introduction
2013-04-16 10:42 11851. What is Apache Shiro? Shiro ... -
Shiro User Manual-Command Line Hasher
2013-04-19 11:49 17891. Overview Shiro1.2及其以 ... -
Shiro User Manual-Configuration
2013-04-16 11:19 18791. Configuration Shiro可以 ... -
Shiro User Manual-Web Support
2013-04-18 10:41 27881. Configuration 将Shiro集成到web应 ... -
Shiro User Manual-Caching
2013-04-18 10:52 18021. Caching Shiro团队了解 ... -
Shiro User Manual-Session Management
2013-04-17 22:41 68721. Session Management Shiro提供了 ... -
Shiro User Manual-Realms
2013-04-17 11:54 19241. Realms Realm是可以访问应用系统中数据,例如 ... -
Shiro User Manual-Authorization-Permissions
2013-04-17 09:31 19871. Wildcard Permissions 为了 ... -
Shiro User Manual-Authorization
2013-04-17 09:22 23411. Authorization Authorizatio ... -
Shiro User Manual-Authentication
2013-04-16 11:28 33491.Authentication Authenticatio ...
相关推荐
shiro(shiro-all-1.8.0.jar)
赠送jar包:shiro-core-1.4.0.jar; 赠送原API文档:shiro-core-1.4.0-javadoc.jar; 赠送源代码:shiro-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-core-1.4.0.pom; 包含翻译后的API文档:shiro-core...
赠送jar包:shiro-spring-1.3.2.jar 赠送原API文档:shiro-spring-1.3.2-javadoc.jar 赠送源代码:shiro-spring-1.3.2-sources.jar 包含翻译后的API文档:shiro-spring-1.3.2-javadoc-API文档-中文(简体)-英语-...
赠送jar包:shiro-spring-1.3.2.jar; 赠送原API文档:shiro-spring-1.3.2-javadoc.jar; 赠送源代码:shiro-spring-1.3.2-sources.jar; 包含翻译后的API文档:shiro-spring-1.3.2-javadoc-API文档-中文(简体)版...
解决:升級1.7后附件中文路径报400错误的问题 压缩包中包含: shiro-cas-1.7.0.jar ...shiro-spring-1.7.0.jar shiro-web-1.7.0.jar CustomShiroFilterFactoryBean.java spring-context-shiro.xml 修改说明.txt
标题提到的"shiro-attack-4.7.0-SNAPSHOT-all.zip"很可能是针对Apache Shiro的安全测试工具或者漏洞利用工具包,其主要目的是帮助开发者检测和防范Shiro框架相关的安全问题。 描述中的"序列化验证工具"可能是指该...
shiro-crypto-hash-1.7.1.jar,shiro-ehcache-1.7.1.jar,shiro-event-1.7.1.jar,shiro-guice-1.7.1.jar,shiro-hazelcast-1.7.1.jar,shiro-lang-1.7.1.jar,shiro-quartz-1.7.1.jar,shiro-spring-1.7.1.jar,shiro-web-...
赠送jar包:shiro-config-core-1.4.0.jar; 赠送原API文档:shiro-config-core-1.4.0-javadoc.jar; 赠送源代码:shiro-config-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-core-1.4.0.pom; ...
java运行依赖jar包
赠送jar包:shiro-ehcache-1.4.0.jar; 赠送原API文档:shiro-ehcache-1.4.0-javadoc.jar; 赠送源代码:shiro-ehcache-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-ehcache-1.4.0.pom; 包含翻译后的API文档...
赠送jar包:shiro-spring-1.4.0.jar; 赠送原API文档:shiro-spring-1.4.0-javadoc.jar; 赠送源代码:shiro-spring-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-spring-1.4.0.pom; 包含翻译后的API文档:...
赠送jar包:shiro-crypto-core-1.4.0.jar; 赠送原API文档:shiro-crypto-core-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-core-1.4.0.pom; ...
赠送jar包:shiro-crypto-cipher-1.4.0.jar; 赠送原API文档:shiro-crypto-cipher-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-cipher-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-cipher-1.4.0....
【标题】"SpringMVC-Mybatis-Shiro-redis-master" 涉及的是一个集成框架项目,这个项目集成了四个关键的技术组件:SpringMVC、MyBatis、Shiro和Redis。这些技术在现代Java Web开发中扮演着重要角色。 **SpringMVC**...
赠送jar包:shiro-crypto-core-1.4.0.jar; 赠送原API文档:shiro-crypto-core-1.4.0-javadoc.jar; 赠送源代码:shiro-crypto-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-crypto-core-1.4.0.pom; ...
赠送jar包:shiro-spring-1.2.3.jar; 赠送原API文档:shiro-spring-1.2.3-javadoc.jar; 赠送源代码:shiro-spring-1.2.3-sources.jar; 赠送Maven依赖信息文件:shiro-spring-1.2.3.pom; 包含翻译后的API文档:...
赠送jar包:shiro-config-core-1.4.0.jar; 赠送原API文档:shiro-config-core-1.4.0-javadoc.jar; 赠送源代码:shiro-config-core-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-core-1.4.0.pom; ...
赠送jar包:shiro-config-ogdl-1.4.0.jar; 赠送原API文档:shiro-config-ogdl-1.4.0-javadoc.jar; 赠送源代码:shiro-config-ogdl-1.4.0-sources.jar; 赠送Maven依赖信息文件:shiro-config-ogdl-1.4.0.pom; ...
赠送jar包:shiro-cas-1.2.3.jar; 赠送原API文档:shiro-cas-1.2.3-javadoc.jar; 赠送源代码:shiro-cas-1.2.3-sources.jar; 赠送Maven依赖信息文件:shiro-cas-1.2.3.pom; 包含翻译后的API文档:shiro-cas-...
赠送jar包:shiro-core-1.3.2.jar; 赠送原API文档:shiro-core-1.3.2-javadoc.jar; 赠送源代码:shiro-core-1.3.2-sources.jar; 包含翻译后的API文档:shiro-core-1.3.2-javadoc-API文档-中文(简体)版.zip ...