springmvc集成shiro登录失败处理操作

2023-07-14 16:13:03 71

一般的登录流程会有：用户名不存在，密码错误，验证码错误等..

在集成shiro后，应用程序的外部访问权限以及访问控制交给了shiro来管理。

shiro提供了两个主要功能：认证(Authentication)和授权(Authorization);认证的作用是证明自身可以访问，一般是用户名加密码，授权的作用是谁可以访问哪些资源，通过开发者自己的用户角色权限系统来控制。

shiro的会话管理和缓存管理不在本文范围内。

下面通过登录失败的处理流程来介绍springmvc与shiro的集成。

依赖项目

依赖名称版本 spring 4.1.4.RELEASE shiro 1.2.2 self4j 1.7.5 log4j 1.2.17

在web.xml里配置shiro


shiroFilter
org.springframework.web.filter.DelegatingFilterProxy

targetFilterLifecycle
true



shiroFilter
/*

新建一个spring-context-shiro.xml配置shiro相关信息，使用spring加载




ShiroConfiguration












/sys/login=authc
/sys/logout=logout
/sys/**=user

新建一个登录认证过滤器FormAuthenticationFilter.java

importjavax.servlet.ServletRequest;
importjavax.servlet.ServletResponse;
importorg.apache.shiro.authc.AuthenticationToken;
importorg.apache.shiro.web.util.WebUtils;
importorg.springframework.stereotype.Service;

/**
*表单验证（包含验证码）过滤类*/
@Service
publicclassFormAuthenticationFilterextendsorg.apache.shiro.web.filter.authc.FormAuthenticationFilter{
publicstaticfinalStringDEFAULT_CAPTCHA_PARAM="validateCode";

privateStringcaptchaParam=DEFAULT_CAPTCHA_PARAM;

publicStringgetCaptchaParam(){
returncaptchaParam;
}

protectedStringgetCaptcha(ServletRequestrequest){
returnWebUtils.getCleanParam(request,getCaptchaParam());
}

protectedAuthenticationTokencreateToken(ServletRequestrequest,ServletResponseresponse){
Stringusername=getUsername(request);
Stringpassword=getPassword(request);
Stringlocale=request.getParameter("locale");

if(password==null){
password="";
}
booleanrememberMe=isRememberMe(request);
Stringhost=getHost(request);
Stringcaptcha=getCaptcha(request);
returnnewUsernamePasswordToken(username,password.toCharArray(),locale,rememberMe,host,captcha);
}
}

新建令牌类UsernamePasswordToken.java

packagecom.chunhui.webservice.modules.sys.security;

/**
*用户和密码（包含验证码）令牌类*/
publicclassUsernamePasswordTokenextendsorg.apache.shiro.authc.UsernamePasswordToken{
privatestaticfinallongserialVersionUID=1L;
privateStringcaptcha;
privateStringlocale;

publicStringgetCaptcha(){
returncaptcha;
}

publicvoidsetCaptcha(Stringcaptcha){
this.captcha=captcha;
}

publicStringgetLocale(){
returnlocale;
}

publicvoidsetLocale(Stringlocale){
this.locale=locale;
}

publicUsernamePasswordToken(){
super();
}

publicUsernamePasswordToken(Stringusername,char[]password,booleanrememberMe,Stringhost,Stringcaptcha){
super(username,password,rememberMe,host);
this.captcha=captcha;
}
publicUsernamePasswordToken(Stringusername,char[]password,Stringlocale,booleanrememberMe,Stringhost,Stringcaptcha){
super(username,password,rememberMe,host);
this.captcha=captcha;
this.locale=locale;
}
}

最后一个是认证实现类SystemAuthorizationRealm:

packagecom.chunhui.webservice.modules.sys.security;
importjava.io.Serializable;
importjava.util.HashMap;
importjava.util.List;
importjava.util.Map;
importjavax.annotation.PostConstruct;

importcom.chunhui.webservice.common.utils.EmployeeType;
importcom.chunhui.webservice.common.utils.VertifyStatus;
importorg.apache.commons.lang3.StringUtils;
importorg.apache.shiro.SecurityUtils;
importorg.apache.shiro.authc.*;
importorg.apache.shiro.authc.credential.HashedCredentialsMatcher;
importorg.apache.shiro.authz.AuthorizationInfo;
importorg.apache.shiro.authz.SimpleAuthorizationInfo;
importorg.apache.shiro.cache.Cache;
importorg.apache.shiro.realm.AuthorizingRealm;
importorg.apache.shiro.session.Session;
importorg.apache.shiro.subject.PrincipalCollection;
importorg.apache.shiro.subject.SimplePrincipalCollection;
importorg.apache.shiro.subject.Subject;
importorg.springframework.context.annotation.DependsOn;
importorg.springframework.stereotype.Service;
importcom.chunhui.webservice.common.servlet.ValidateCodeServlet;
importcom.chunhui.webservice.common.utils.SpringContextHolder;
importcom.chunhui.webservice.modules.sys.entity.Employee;
importcom.chunhui.webservice.modules.sys.entity.Menu;
importcom.chunhui.webservice.modules.sys.service.SystemService;
importcom.chunhui.webservice.modules.sys.utils.SystemUtils;
importcom.chunhui.webservice.modules.sys.web.LoginController;

/**
*系统安全认证实现类*/
@Service
@DependsOn({"employeeDao","roleDao","menuDao"})
publicclassSystemAuthorizingRealmextendsAuthorizingRealm{
privateSystemServicesystemService;

/**
*认证回调函数,登录时调用
*/
@Override
protectedAuthenticationInfodoGetAuthenticationInfo(AuthenticationTokenauthcToken)throwsAuthenticationException{
UsernamePasswordTokentoken=(UsernamePasswordToken)authcToken;
//判断验证码
Sessionsession=SecurityUtils.getSubject().getSession();
//设置独立的session会话超时时间session.setTimeout(60000);
Stringcode=(String)session.getAttribute(ValidateCodeServlet.VALIDATE_CODE);
if(token.getCaptcha()==null||!token.getCaptcha().toUpperCase().equals(code)){
thrownewCaptchaException("验证码错误！");
}//如果帐号不存在，输出
//thrownewUnknownAccountException();

//如果帐号被禁用，输出
//thrownewDisabledAccountException();

//保存登录时选择的语言
SecurityUtils.getSubject().getSession().setAttribute("locale",token.getLocale());
try{
SimpleAuthenticationInfoinfo=newSimpleAuthenticationInfo(newPrincipal(employee),employee.getPassword(),getName());
returninfo;
}catch(Throwablet){
t.printStackTrace();
thrownewAuthenticationException();
}
}/**
*授权查询回调函数,进行鉴权但缓存中无用户的授权信息时调用
*/
@Override
protectedAuthorizationInfodoGetAuthorizationInfo(PrincipalCollectionprincipals){
Principalprincipal=(Principal)getAvailablePrincipal(principals);
Employeeemployee=getSystemService().getEmployeeByName(principal.getUsername());
if(employee!=null){
SystemUtils.putCache("employee",employee);
SimpleAuthorizationInfoinfo=newSimpleAuthorizationInfo();
Listlist=SystemUtils.getMenuList();
for(Menumenu:list){
if(StringUtils.isNotBlank(menu.getPermission())){
//添加基于Permission的权限信息
for(Stringpermission:StringUtils.split(menu.getPermission(),",")){
info.addStringPermission(permission);
}
}
}
//更新登录IP和时间
getSystemService().updateEmployeeLoginInfo(employee.getId());
returninfo;
}else{
returnnull;
}
}

/**
*清空用户关联权限认证，待下次使用时重新加载
*/
publicvoidclearCachedAuthorizationInfo(Stringprincipal){
SimplePrincipalCollectionprincipals=newSimplePrincipalCollection(principal,getName());
clearCachedAuthorizationInfo(principals);
}

/**
*清空所有关联认证
*/
publicvoidclearAllCachedAuthorizationInfo(){
Cachecache=getAuthorizationCache();
if(cache!=null){
for(Objectkey:cache.keys()){
cache.remove(key);
}
}
}

/**
*获取系统业务对象
*/
publicSystemServicegetSystemService(){
if(systemService==null){
systemService=SpringContextHolder.getBean(SystemService.class);
}
returnsystemService;
}

/**
*授权用户信息
*/
publicstaticclassPrincipalimplementsSerializable{
privatestaticfinallongserialVersionUID=1L;

privateStringid;
privateStringusername;
privateStringrealname;
privateMapcacheMap;

publicPrincipal(Employeeemployee){
this.id=employee.getId();
this.username=employee.getUsername();
this.realname=employee.getRealname();
}

publicStringgetId(){
returnid;
}

publicStringgetUsername(){
returnusername;
}

publicStringgetRealname(){
returnrealname;
}

publicMapgetCacheMap(){
if(cacheMap==null){
cacheMap=newHashMap();
}
returncacheMap;
}
}
}

那么在JSP页面，可以通过获取登录异常具体的异常类型来在页面显示错误原因

<%Stringerror=(String)request.getAttribute(FormAuthenticationFilter.DEFAULT_ERROR_KEY_ATTRIBUTE_NAME);%>
"/>

以上这篇springmvc集成shiro登录失败处理操作就是小编分享给大家的全部内容了，希望能给大家一个参考，也希望大家多多支持毛票票。

springmvc集成shiro登录失败处理操作

热门推荐

随机推荐