Java安全框架——Apache Shiro（二十四）

持续创作，加速成长！这是我参与「掘金日新计划 · 10 月更文挑战」的第16天，点击查看活动详情

【3】ShiroConfig代码

package com.itheima.shiro.config;  
  
  
import com.itheima.shiro.core.ShiroDbRealm;  
import com.itheima.shiro.core.impl.ShiroDbRealmImpl;  
import com.itheima.shiro.properties.PropertiesUtil;  
import lombok.extern.log4j.Log4j2;  
import org.apache.shiro.spring.LifecycleBeanPostProcessor;  
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;  
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;  
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;  
import org.apache.shiro.web.servlet.SimpleCookie;  
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;  
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;  
import org.springframework.context.annotation.Bean;  
import org.springframework.context.annotation.ComponentScan;  
import org.springframework.context.annotation.Configuration;  
import org.springframework.context.annotation.DependsOn;  
  
import java.util.LinkedHashMap;  
import java.util.List;  
import java.util.Map;  
  
/**  
 * @Description：权限配置类  
 */  
@Configuration  
@ComponentScan(basePackages = "com.itheima.shiro.core")  
@Log4j2  
public class ShiroConfig {  
  
    /**  
     * @Description 创建cookie对象  
     */  
    @Bean(name="sessionIdCookie")  
    public SimpleCookie simpleCookie(){  
        SimpleCookie simpleCookie = new SimpleCookie();  
        simpleCookie.setName("ShiroSession");  
        return simpleCookie;  
    }  
  
    /**  
     * @Description 权限管理器  
     */  
    @Bean(name="securityManager")  
    public DefaultWebSecurityManager defaultWebSecurityManager(){  
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();  
        securityManager.setRealm(shiroDbRealm());  
        securityManager.setSessionManager(shiroSessionManager());  
        return securityManager;  
    }  
  
    /**  
     * @Description 自定义RealmImpl  
     */  
    @Bean(name="shiroDbRealm")  
    public ShiroDbRealm shiroDbRealm(){  
        return new ShiroDbRealmImpl();  
    }  
  
  
    /**  
     * @Description 会话管理器  
     */  
    @Bean(name="sessionManager")  
    public DefaultWebSessionManager shiroSessionManager(){  
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();  
        sessionManager.setSessionValidationSchedulerEnabled(false);  
        sessionManager.setSessionIdCookieEnabled(true);  
        sessionManager.setSessionIdCookie(simpleCookie());  
        sessionManager.setGlobalSessionTimeout(3600000);  
        return sessionManager;  
    }  
  
    /**  
     * @Description 保证实现了Shiro内部lifecycle函数的bean执行  
     */  
    @Bean(name = "lifecycleBeanPostProcessor")  
    public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {  
        return new LifecycleBeanPostProcessor();  
    }  
  
    /**  
     * @Description AOP式方法级权限检查  
     */  
    @Bean  
    @DependsOn("lifecycleBeanPostProcessor")  
    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {  
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();  
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);  
        return defaultAdvisorAutoProxyCreator;  
    }  
  
    /**  
     * @Description 配合DefaultAdvisorAutoProxyCreator事项注解权限校验  
     */  
    @Bean  
    public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor() {  
        AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();  
        aasa.setSecurityManager(defaultWebSecurityManager());  
        return new AuthorizationAttributeSourceAdvisor();  
    }  
  
    /**  
     * @Description 过滤器链  
     */  
    private Map<String, String> filterChainDefinition(){  
        List<Object> list  = PropertiesUtil.propertiesShiro.getKeyList();  
        Map<String, String> map = new LinkedHashMap<>();  
        for (Object object : list) {  
            String key = object.toString();  
            String value = PropertiesUtil.getShiroValue(key);  
            log.info("读取防止盗链控制：---key{},---value:{}",key,value);  
            map.put(key, value);  
        }  
        return map;  
    }  
  
    /**  
     * @Description Shiro过滤器  
     */  
    @Bean("shiroFilter")  
    public ShiroFilterFactoryBean shiroFilterFactoryBean(){  
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();  
        shiroFilter.setSecurityManager(defaultWebSecurityManager());  
        shiroFilter.setFilterChainDefinitionMap(filterChainDefinition());  
        shiroFilter.setLoginUrl("/login");  
        shiroFilter.setUnauthorizedUrl("/login");  
        return shiroFilter;  
    }  
  
}  
  

6、Shiro过滤器、过滤器链

【1】过滤器

Shiro内置了很多默认的过滤器，比如身份验证、授权等相关的。默认过滤器可以参考org.apache.shiro.web.filter.mgt.DefaultFilter中的枚举过滤器

【2】过滤器链

定义：authentication.properties

#静态资源不过滤
/static/=anon
#登录链接不过滤
/login/=anon
#其他链接是需要登录的
/**=authc

注意：这里定义的过滤器是有执行顺序的，从上向下执行

【3】加载原理分析

定义：PropertiesUtil，从classpath中加载authentication.properties

package com.itheima.shiro.properties;

import com.itheima.shiro.utils.EmptyUtil;
import lombok.extern.log4j.Log4j2;

/**
* @Description 读取Properties的工具类
*/
@Log4j2
public class PropertiesUtil {

    public static LinkProperties propertiesShiro = new LinkProperties();

    /**
* 读取properties配置文件信息
*/
static {
String sysName = System.getProperty("sys.name");
if (EmptyUtil.isNullOrEmpty(sysName)) {
sysName = "application.properties";
} else {
sysName += ".properties";
}
try {
propertiesShiro.load(PropertiesUtil.class.getClassLoader()
.getResourceAsStream("authentication.properties"));
} catch (Exception e) {
log.warn("资源路径中不存在authentication.properties权限文件，忽略读取！");
}
}

    /**
* 根据key得到value的值
*/
public static String getShiroValue(String key) {
return propertiesShiro.getProperty(key);
}

}