关于后端:shiro-整合-spring-实战及源码详解

6次阅读

共计 15738 个字符，预计需要花费 40 分钟才能阅读完成。

后面咱们学习了如下内容：

5 分钟入门 shiro 平安框架实战笔记

shiro 整合 spring 实战及源码详解

置信大家对于 shiro 曾经有了最根本的意识，这一节咱们一起来学习写如何将 shiro 与 spring 进行整合。

<dependencies>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.7.0</version>
    </dependency>
    <dependency>
        <groupId>org.springframework</groupId>
        <artifactId>spring-context</artifactId>
        <version>4.3.13.RELEASE</version>
    </dependency>
</dependencies>

定义一个简略的服务类，用于演示 @RequiresPermissions 注解的权限校验。

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Component;

/**
 * Simple Service with methods protected with annotations.
 */
@Component
public class SimpleService {private static Logger log = LoggerFactory.getLogger(SimpleService.class);

    @RequiresPermissions("write")
    public void writeRestrictedCall() {log.info("executing method that requires the'write'permission");
    }

    @RequiresPermissions("read")
    public void readRestrictedCall() {log.info("executing method that requires the'read'permission");
    }
}

咱们对原来的 Quick Start 进行革新如下：

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import javax.annotation.PostConstruct;

/**
 * Simple Bean used to demonstrate subject usage.
 */
@Component
public class QuickStart {private static Logger log = LoggerFactory.getLogger(QuickStart.class);

    @Autowired
    private SecurityManager securityManager;

    @Autowired
    private SimpleService simpleService;

    /**
     * Sets the static instance of SecurityManager. This is NOT needed for web applications.
     */
    @PostConstruct
    private void initStaticSecurityManager() {SecurityUtils.setSecurityManager(securityManager);
    }

    public void run() {
        // get the current subject
        Subject subject = SecurityUtils.getSubject();

        // Subject is not authenticated yet
        System.out.println(!subject.isAuthenticated());

        // login the subject with a username / password
        UsernamePasswordToken token = new UsernamePasswordToken("joe.coder", "password");
        subject.login(token);

        // joe.coder has the "user" role
        subject.checkRole("user");

        // joe.coder does NOT have the admin role
        System.out.println(!subject.hasRole("admin"));

        // joe.coder has the "read" permission
        subject.checkPermission("read");

        // current user is allowed to execute this method.
        simpleService.readRestrictedCall();

        try {
            // but not this one!
            simpleService.writeRestrictedCall();}
        catch (AuthorizationException e) {log.info("Subject was NOT allowed to execute method'writeRestrictedCall'");
        }

        // logout
        subject.logout();
        System.out.println(!subject.isAuthenticated());
    }

}

这里最外围的区别是 SecurityManager 是间接通过 @Autowired 注入失去的。

也没有看到咱们以前初始化 SecurityManager 的 ini 文件，这些在上面的配置文件中。

package com.github.houbb.shiro.inaction02.springalone;

import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.text.TextConfigurationRealm;
import org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration;
import org.apache.shiro.spring.config.ShiroBeanConfiguration;
import org.apache.shiro.spring.config.ShiroConfiguration;
import org.springframework.context.annotation.*;

/**
 * Application bean definitions.
 */
@Configuration
@Import({ShiroBeanConfiguration.class,
         ShiroConfiguration.class,
         ShiroAnnotationProcessorConfiguration.class})
@ComponentScan("com.github.houbb.shiro.inaction02.springalone")
public class CliApp {

    /**
     * Example hard coded Realm bean.
     * @return hard coded Realm bean
     */
    @Bean
    public Realm realm() {TextConfigurationRealm realm = new TextConfigurationRealm();
        realm.setUserDefinitions("joe.coder=password,user\n" +
                                 "jill.coder=password,admin");

        realm.setRoleDefinitions("admin=read,write\n" +
                                 "user=read");
        realm.setCachingEnabled(true);
        return realm;
    }

}

这里通过 @Bean 的形式申明了用户角色等信息，能够简略了解为和 Ini 文件初始化是等价的。

@Import 导入了 3 个配置类，咱们前面进行介绍。

spring 利用的启动：

public static void main(String[] args) {AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext(CliApp.class);
    context.getBean(QuickStart.class).run();}

测试日志如下：

 十二月 31, 2020 10:33:02 上午 org.springframework.context.annotation.AnnotationConfigApplicationContext prepareRefresh
信息: Refreshing org.springframework.context.annotation.AnnotationConfigApplicationContext@6267c3bb: startup date [Thu Dec 31 10:33:02 CST 2020]; root of context hierarchy
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
信息: Bean 'org.apache.shiro.spring.config.ShiroBeanConfiguration' of type [org.apache.shiro.spring.config.ShiroBeanConfiguration$$EnhancerBySpringCGLIB$$fbe016b3] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
...
信息: Bean 'org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration' of type [org.apache.shiro.spring.config.ShiroAnnotationProcessorConfiguration$$EnhancerBySpringCGLIB$$f9d46e86] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
信息: Bean 'eventBus' of type [org.apache.shiro.event.support.DefaultEventBus] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
十二月 31, 2020 10:33:03 上午 org.springframework.context.support.PostProcessorRegistrationDelegate$BeanPostProcessorChecker postProcessAfterInitialization
信息: Bean 'org.apache.shiro.spring.config.ShiroConfiguration' of type [org.apache.shiro.spring.config.ShiroConfiguration$$EnhancerBySpringCGLIB$$3db21503] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)
...
true
true
true

@Import 共计导入了 3 个配置类，咱们接下来逐个剖析下这 3 个配置类。

@Configuration
public class ShiroBeanConfiguration extends AbstractShiroBeanConfiguration {

    @Bean
    @Override
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {return super.lifecycleBeanPostProcessor();
    }

    @Bean
    @Override
    protected EventBus eventBus() {return super.eventBus();
    }

    @Bean
    @Override
    public ShiroEventBusBeanPostProcessor shiroEventBusAwareBeanPostProcessor() {return super.shiroEventBusAwareBeanPostProcessor();
    }
}

这 3 个办法都是继承自父类，间接调用的父类办法。

AbstractShiroBeanConfiguration.java

public class AbstractShiroBeanConfiguration {protected LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {return new LifecycleBeanPostProcessor();
    }

    protected EventBus eventBus() {return new DefaultEventBus();
    }

    protected ShiroEventBusBeanPostProcessor shiroEventBusAwareBeanPostProcessor() {return new ShiroEventBusBeanPostProcessor(eventBus());
    }
}

实际上这里初始化了 3 个对象：LifecycleBeanPostProcessor/DefaultEventBus/ShiroEventBusBeanPostProcessor。

这个类实际上比较简单，次要做了 2 件事件。

（1）执行 init() 和 destory()。

（2）指定对应的优先级，默认为最低。

外围局部如下：

init 初始化

public Object postProcessBeforeInitialization(Object object, String name) throws BeansException {if (object instanceof Initializable) {
        try {if (log.isDebugEnabled()) {log.debug("Initializing bean [" + name + "]...");
            }
            ((Initializable) object).init();} catch (Exception e) {throw new FatalBeanException("Error initializing bean [" + name + "]", e);
        }
    }
    return object;
}

destory 销毁

public void postProcessBeforeDestruction(Object object, String name) throws BeansException {if (object instanceof Destroyable) {
        try {if (log.isDebugEnabled()) {log.debug("Destroying bean [" + name + "]...");
            }
            ((Destroyable) object).destroy();} catch (Exception e) {throw new FatalBeanException("Error destroying bean [" + name + "]", e);
        }
    }
}

这个类如其名，就是默认的事件总线类。

接口的如下：

public interface EventBus {void publish(Object var1);

    void register(Object var1);

    void unregister(Object var1);
}

别离对应的是事件的公布，注册和勾销注册。

实现局部理论就是调用对应的 EventListener 类，并且通过读写锁保障并发平安，临时不做开展。

这个类实际上是配合 EventBus 应用的，外围实现如下：

public class ShiroEventBusBeanPostProcessor implements BeanPostProcessor {

    final private EventBus eventBus;

    public ShiroEventBusBeanPostProcessor(EventBus eventBus) {this.eventBus = eventBus;}

    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        //1. 如果实现了 EventBusAware 接口
        if (bean instanceof EventBusAware) {((EventBusAware) bean).setEventBus(eventBus);
        }
        //2. 如果有 Subscribe 注解信息
        else if (isEventSubscriber(bean)) {eventBus.register(bean);
        }

        return bean;
    }

}

这里会把实现了 EventBusAware 接口，和指定了 @Subscribe 注解的对象，注解对应的 eventbus。

咱们 QuickStart 中主动注入了 SecurityManager 对象，这个对象是在哪里初始化的呢？

外围局部如下：

@Configuration
@Import({ShiroBeanConfiguration.class})
public class ShiroConfiguration extends AbstractShiroConfiguration {

    @Bean
    @Override
    protected SessionsSecurityManager securityManager(List<Realm> realms) {return super.securityManager(realms);
    }

    @Bean
    @Override
    protected SessionManager sessionManager() {return super.sessionManager();
    }

    //... 省略其余组件
}

这里能够发现实际上曾经导入了 ShiroBeanConfiguration 配置类，所以官网的 demo 能够简化如下：

@Configuration
@Import({ShiroConfiguration.class,
         ShiroAnnotationProcessorConfiguration.class})
@ComponentScan("com.github.houbb.shiro.inaction02.springalone")
public class CliApp{}

理论测试了一下，也是通过的。

我简略的看了下 SecurityManager 实现子类还是比拟多得。断点能够发现默认的类型是 DefaultSecurityManager。

这些都能够在 AbstractShiroConfiguration 类中找到答案。

AbstractShiroConfiguration.java

外围实现如下：

public class AbstractShiroConfiguration {

    @Autowired
    protected EventBus eventBus;

    protected SessionsSecurityManager securityManager(List<Realm> realms) {SessionsSecurityManager securityManager = createSecurityManager();
        securityManager.setEventBus(eventBus);
        
        // 省略其余属性设置
        return securityManager;
    }

    protected SessionsSecurityManager createSecurityManager() {DefaultSecurityManager securityManager = new DefaultSecurityManager();
        securityManager.setSubjectDAO(subjectDAO());
        securityManager.setSubjectFactory(subjectFactory());

        RememberMeManager rememberMeManager = rememberMeManager();
        if (rememberMeManager != null) {securityManager.setRememberMeManager(rememberMeManager);
        }

        return securityManager;
    }

}

securityManager(List<Realm> realms) 办法会把咱们 CliApp 中定义的 Realm 对象当作参数传入。

createSecurityManager() 办法就会初始化 DefaultSecurityManager 对象。

咱们在 SampleService 中应用了注解 @RequiresPermissions("write")，就能够校验对应的权限了。

然而这所有是如何被主动实现的呢？

@Configuration
public class ShiroAnnotationProcessorConfiguration extends AbstractShiroAnnotationProcessorConfiguration{

    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    protected DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {return super.defaultAdvisorAutoProxyCreator();
    }

    @Bean
    protected AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {return super.authorizationAttributeSourceAdvisor(securityManager);
    }

}

自身没有什么源码，次要看下父类。

public class AbstractShiroAnnotationProcessorConfiguration {protected DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {return new DefaultAdvisorAutoProxyCreator();
    }

    protected AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }

}

DefaultAdvisorAutoProxyCreator 是 spring 中的主动代理实现类，此处不做开展。

咱们重点看一下 AuthorizationAttributeSourceAdvisor 对象：

这里次要做了两件事：

（1）设置对应的 securityManager

（2）解决有 RequiresPermissions 等 shiro 的内置注解的办法。

@SuppressWarnings({"unchecked"})
public class AuthorizationAttributeSourceAdvisor extends StaticMethodMatcherPointcutAdvisor {private static final Logger log = LoggerFactory.getLogger(AuthorizationAttributeSourceAdvisor.class);

    private static final Class<? extends Annotation>[] AUTHZ_ANNOTATION_CLASSES =
            new Class[] {
                    RequiresPermissions.class, RequiresRoles.class,
                    RequiresUser.class, RequiresGuest.class, RequiresAuthentication.class
            };

    protected SecurityManager securityManager = null;

    /**
     * Create a new AuthorizationAttributeSourceAdvisor.
     */
    public AuthorizationAttributeSourceAdvisor() {setAdvice(new AopAllianceAnnotationsAuthorizingMethodInterceptor());
    }

    public SecurityManager getSecurityManager() {return securityManager;}

    public void setSecurityManager(org.apache.shiro.mgt.SecurityManager securityManager) {this.securityManager = securityManager;}

}

这个名字起的，好家伙，真长。

这里就是对于注解的响应办法 aop 拦截器实现。

package org.apache.shiro.spring.security.interceptor;

import org.aopalliance.intercept.MethodInterceptor;
import org.aopalliance.intercept.MethodInvocation;
import org.apache.shiro.aop.AnnotationResolver;
import org.apache.shiro.authz.aop.*;
import org.apache.shiro.spring.aop.SpringAnnotationResolver;

import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;

/**
 * Allows Shiro Annotations to work in any <a href="http://aopalliance.sourceforge.net/">AOP Alliance</a>
 * specific implementation environment (for example, Spring).
 *
 * @since 0.2
 */
public class AopAllianceAnnotationsAuthorizingMethodInterceptor
        extends AnnotationsAuthorizingMethodInterceptor implements MethodInterceptor {public AopAllianceAnnotationsAuthorizingMethodInterceptor() {
        List<AuthorizingAnnotationMethodInterceptor> interceptors =
                new ArrayList<AuthorizingAnnotationMethodInterceptor>(5);

        //use a Spring-specific Annotation resolver - Spring's AnnotationUtils is nicer than the
        //raw JDK resolution process.
        AnnotationResolver resolver = new SpringAnnotationResolver();
        //we can re-use the same resolver instance - it does not retain state:
        interceptors.add(new RoleAnnotationMethodInterceptor(resolver));
        interceptors.add(new PermissionAnnotationMethodInterceptor(resolver));
        interceptors.add(new AuthenticatedAnnotationMethodInterceptor(resolver));
        interceptors.add(new UserAnnotationMethodInterceptor(resolver));
        interceptors.add(new GuestAnnotationMethodInterceptor(resolver));

        setMethodInterceptors(interceptors);
    }
    
    // 省略 invoke 局部
}

到这里实际上就比较简单了，置信聪慧如你肯定曾经晓得整个 spring-shiro 面纱背地的机密了。

咱们间接看一下 PermissionAnnotationMethodInterceptor 的实现。

import org.apache.shiro.aop.AnnotationResolver;

public class PermissionAnnotationMethodInterceptor extends AuthorizingAnnotationMethodInterceptor {public PermissionAnnotationMethodInterceptor() {super( new PermissionAnnotationHandler() );
    }

    /**
     * @param resolver
     * @since 1.1
     */
    public PermissionAnnotationMethodInterceptor(AnnotationResolver resolver) {super( new PermissionAnnotationHandler(), resolver);
    }
}

解决类实现如下：

package org.apache.shiro.authz.aop;

import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.subject.Subject;

import java.lang.annotation.Annotation;


public class PermissionAnnotationHandler extends AuthorizingAnnotationHandler {public PermissionAnnotationHandler() {super(RequiresPermissions.class);
    }

    
    // 获取对应的注解值
    protected String[] getAnnotationValue(Annotation a) {RequiresPermissions rpAnnotation = (RequiresPermissions) a;
        return rpAnnotation.value();}

    // 校验以后主题，是否领有对应的权限。public void assertAuthorized(Annotation a) throws AuthorizationException {if (!(a instanceof RequiresPermissions)) return;

        RequiresPermissions rpAnnotation = (RequiresPermissions) a;
        String[] perms = getAnnotationValue(a);
        Subject subject = getSubject();

        if (perms.length == 1) {subject.checkPermission(perms[0]);
            return;
        }
        if (Logical.AND.equals(rpAnnotation.logical())) {getSubject().checkPermissions(perms);
            return;
        }
        if (Logical.OR.equals(rpAnnotation.logical())) {
            // Avoid processing exceptions unnecessarily - "delay" throwing the exception by calling hasRole first
            boolean hasAtLeastOnePermission = false;
            for (String permission : perms) if (getSubject().isPermitted(permission)) hasAtLeastOnePermission = true;
            // Cause the exception if none of the role match, note that the exception message will be a bit misleading
            if (!hasAtLeastOnePermission) getSubject().checkPermission(perms[0]);
            
        }
    }
}

这一节咱们解说了如何整合 spring 与 shiro，下一节咱们将实战整合 springboot 与 shiro，感兴趣的小伙伴能够关注一波不迷路。

为了便于大家学习，所有源码都已开源：

https://gitee.com/houbinbin/shiro-inaction/tree/master/shiro-inaction-02-springalone

心愿本文对你有所帮忙，如果喜爱，欢送点赞珍藏转发一波。

我是老马，期待与你的下次相遇。

10 Minute Tutorial on Apache Shiro

https://shiro.apache.org/reference.html

https://shiro.apache.org/session-management.html

本文由博客一文多发平台 OpenWrite 公布！

正文完

后端

发表至：后端

2024-02-22

0

关于后端:EECS-461模拟转换数字算法

关于后端:Java8中你可能不知道的一些地方之接口默认方法

关于后端:安装svn工具tortoisesvn

关于后端:终极指南Terraform的进阶技巧

关于网络:关于使用-Python-和-Selenium-chrome-driver-访问-url-时修改-source-ip-的问题

关于后端:shiro-整合-spring-实战及源码详解

序言

spring 整合

maven 依赖

服务类定义

疾速开始

配置类

启动

ShiroBeanConfiguration 配置类

源码

LifecycleBeanPostProcessor

DefaultEventBus

ShiroEventBusBeanPostProcessor

ShiroConfiguration 配置

思考

外围源码

SecurityManager 初始化

ShiroAnnotationProcessorConfiguration 配置

思考

源码

AbstractShiroAnnotationProcessorConfiguration

AuthorizationAttributeSourceAdvisor

AopAllianceAnnotationsAuthorizingMethodInterceptor

PermissionAnnotationMethodInterceptor

小结

参考资料

站内搜索