shiro框架的学习

1shiro框架是什么：是一个权限控制的框架
2shiro框架有什么作用：权限管理，管理那些资源是否需要登录才能访问、控制某些资源需要那些权限才能访问
3shiro框架怎样使用：

　　　　　　　　　 1在web.xml配置shiro的Filter，拦截指定的URL（注意只有被shiroFilter拦截到的URL才能被shiro管理）

  <!-- Shiro filter-->   
    <filter>   
        <filter-name>shiroFilter</filter-name>   
        <filter-class>   
            org.springframework.web.filter.DelegatingFilterProxy   
        </filter-class>   
            <init-param>
      <param-name>targetFilterLifecycle</param-name>
      <param-value>true</param-value>
    </init-param>
    </filter>   
    <filter-mapping>   
        <filter-name>shiroFilter</filter-name>   
        <url-pattern>/*</url-pattern>   
    </filter-mapping> 

　　　　　　 2在shiro的配置文件里配置shiroFilter：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns:context="http://www.springframework.org/schema/context"
    xmlns:tx="http://www.springframework.org/schema/tx"
    xmlns:cache="http://www.springframework.org/schema/cache"
    xmlns:task="http://www.springframework.org/schema/task"
    default-lazy-init="true"
    xmlns:aop="http://www.springframework.org/schema/aop"
    xsi:schemaLocation="http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.2.xsd
        http://www.springframework.org/schema/task http://www.springframework.org/schema/task/spring-task-3.2.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
        http://www.springframework.org/schema/cache http://www.springframework.org/schema/cache/spring-cache-3.2.xsd
        http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd">
    <!-- shiro配置begin -->
    <!-- Shiro Filter -->
    <bean id="shiroFilter"
        class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/admin/login.jsp" />
        <property name="successUrl" value="/index.jsp" />
        <property name="unauthorizedUrl" value="/error.jsp" />
        <property name="filterChainDefinitions">
            <value>
            /admin/login.jsp = authc
            /admin/* = authc
            /validateCode = anon
            /* =anon
            </value>
        </property>
    </bean>
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm" />
    </bean>
    <!-- 項目自定义的Realm -->
    <bean id="shiroDbRealm" class="com.framework.authority.realm.MyRealm" >
        <property name="authorizationCacheName" value="authorization" />
    </bean>


    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />
        <property name="arguments" ref="securityManager" />
    </bean>

    
</beans>

　　3自定义Realm：
　　

package com.framework.authority.realm;

import javax.security.auth.Subject;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class MyRealm extends AuthorizingRealm  {
    public MyRealm() {
        super();    //To change body of overridden methods use File | Settings | File Templates.
    }
    //验证用户的准确性--验证登录
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
       //获取登录信息    
        System.out.println("-------------------验证用户的准确性-----------------------");
        UsernamePasswordToken userToken = (UsernamePasswordToken) authcToken;
        String userName=String.valueOf(userToken.getUsername());
        String password=String.copyValueOf(userToken.getPassword());
        System.out.println("用户名：---->"+userName);
        System.out.println("密码:-------------->"+password);
        userToken.setRememberMe(true);
        if(userName.equals("jeremy")&&password.equals("123")){
            //这个是什么来的？？？--验证登录信息对象
            SimpleAuthenticationInfo info=new SimpleAuthenticationInfo(userName,password,getName());
            System.out.println("getName:-------------->"+getName());
            return info;
        }
        return null;
    }
    //为用户添加角色和权限---验证权限，
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        System.out.println("----------------验证用户的角色与权限--------------------");
        String userName=principals.asList().get(0).toString();
        if(userName.equals("jeremy")){
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        info.addRole("youke");
        return info;
        }
        return null;
        
    }

}

4登录测试（登录提交的页面不用交给任何控制器处理，让shiroFilter来调用Realm来处理）

<%@ page language="java" contentType="text/html; charset=utf-8"
    pageEncoding="utf-8"%>
 <%
String path = request.getContextPath();
String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Insert title here</title>
</head>
<body>
    <form action="login.jsp"  method="POST">
    userName:<input id="username" name="username"><br>
    password:<input id="password" name="password"><br>
    <input type="submit" id="submit" value="submit">
    </form>
</body>
</html>

shiro框架的运行流程：
request(url)---->shiroFilter是否是shiroURL--是-->FormAuthenticationFilter判断是当前URL的权限----没有权限-->longinURL--登录-->FormAuthenticationFilter（调用executeLogin()方法）---ModularRealmAuthenticator.doAuthenticate()---调用自定义的Realm---->doAuthenticationInfo()---->doAuthorizationInfo()--->????
以上流程纯属个人猜测---》》