Shiro+Cas微服务化及前后端完全分离

本文实例为大家分享了Shiro Cas微服务化及前后端完全分离，供大家参考，具体内容如下

shiro+cas微服务化笔记

1.Spring Boot 配置

有如下两个配置文件：ShirobaseConfig.java

import lombok.extern.log4j.Log4j;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.MemoryConstrainedCacheManager;
import org.apache.shiro.cas.CasFilter;
import org.apache.shiro.codec.base64;
import org.apache.shiro.session.mgt.eis.MemorySessionDAO;
import org.apache.shiro.web.mgt.cookieRememberMeManager;
import org.apache.shiro.web.servlet.Simplecookie;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;


@Configuration
@Log4j
public class ShirobaseConfiguration {
 @Value("${cas.server.url.prefix}")
 private String casPrefix;
 @Value("${cas.service}")
 private String casService;
 
 
 @Bean
 public Simplecookie sessionIdcookie() {
  Simplecookie simplecookie = new Simplecookie("sid");
  simplecookie.setHttponly(true);
  simplecookie.setMaxAge(1800000);
  return simplecookie;
 }

 
 @Bean
 public Simplecookie remembercookie() {
  Simplecookie simplecookie = new Simplecookie("rememberMe");
  simplecookie.setHttponly(true);
  simplecookie.setMaxAge(2592000);//30天
  return simplecookie;
 }

 
 @Bean
 public cookieRememberMeManager rememberMeManager(Simplecookie remembercookie) {
  cookieRememberMeManager cookieRememberMeManager = new cookieRememberMeManager();
  cookieRememberMeManager.setCipherKey(base64.decode(""));// rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度（128 256 512 位）
  cookieRememberMeManager.setcookie(remembercookie);
  return cookieRememberMeManager;
 }

 
 @Bean
 public MemorySessionDAO sessionDAO() {
  return new MemorySessionDAO();
 }


 @Bean
 public CacheManager shiroCacheManager() {
  return new MemoryConstrainedCacheManager();
 }

 @Bean
 public KryCasRealm casRealm(CacheManager shiroCacheManager) {
  return new KryCasRealm(casPrefix, casService, shiroCacheManager);
 }

 @Bean
 public CasFilter casFilter() {
  CasFilter casFilter = new CasFilter();
  casFilter.setEnabled(true);
  casFilter.setName("casFilter");
  casFilter.setFailureUrl("/authority/casFailure");
  return casFilter;
 }


}

下面ShiroManagerConfiguration.java 文件

import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cas.CasFilter;
import org.apache.shiro.cas.CasSubjectFactory;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.filter.authc.LogoutFilter;
import org.apache.shiro.web.mgt.cookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.session.mgt.ServletContainerSessionManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.beans.factory.config.MethodInvokingFactoryBean;
import org.springframework.boot.autoconfigure.AutoConfigureAfter;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.servlet.Filter;
import java.util.HashMap;
import java.util.Map;


@Configuration
@AutoConfigureAfter(
  {ShirobaseConfiguration.class}
)
public class ShiroManagerConfiguration {
 @Autowired
 private KryCasRealm kryCasRealm;
 @Autowired
 private CacheManager shiroCacheManager;
 @Autowired
 private cookieRememberMeManager rememberMeManager;
 @Value("${cas.server.login.url}")
 private String loginUrl;
 @Value("${cas.client.url.prefix}")
 private String urlPrefix;
 @Autowired
 private CasFilter casFilter;
 @Value("${cas.server.logout.url}")
 private String logoutUrl;
 @Value("${cas.client.index.url}")
 private String indexUrl;

 @Bean
 public DefaultWebSecurityManager securityManager() {
  DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  securityManager.setRealm(kryCasRealm);
  securityManager.setSessionManager(new ServletContainerSessionManager());
  securityManager.setCacheManager(shiroCacheManager);
  securityManager.setRememberMeManager(rememberMeManager);
  securityManager.setSubjectFactory(new CasSubjectFactory());
  return securityManager;
 }

 
 @Bean
 public MethodInvokingFactoryBean methodInvokingFactoryBean(DefaultWebSecurityManager securityManager) {
  MethodInvokingFactoryBean bean = new MethodInvokingFactoryBean();
  bean.setStaticMethod("org.apache.shiro.SecurityUtils.setSecurityManager");
  bean.setArguments(new Object[]{securityManager});
  return bean;
 }

 @Bean
 public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
   ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
  factoryBean.setSecurityManager(securityManager);
  factoryBean.setLoginUrl(loginUrl + serviceStr + urlPrefix + "/cas");
  factoryBean.setSuccessUrl("../mind/index.do");
  factoryBean.setUnauthorizedUrl("/unauthorized.jsp");
  Map filterMap = new HashMap<>();
  filterMap.put("cas", casFilter);
  filterMap.put("user", portalUserFilter);
  //只能在这里初始化LogoutFilter，不然会被spring boot注册到
public class PortalCasFilter extends CasFilter {

 @Override
 protected void issueSuccessRedirect(ServletRequest request, ServletResponse response) throws Exception {
  String successUrl = ((ShiroHttpServletRequest) request).getHeader("page-url");//前端页面在请求的时候在header中带上请求这个接口的url。这样便将登录成功后需要跳转的地址绑定到了对应的Subject对象中。以便于在登录以后跳转到这个页面
  if (StringUtil.isBlank(successUrl)) {
   WebUtils.redirectToSavedRequest(request, response, getSuccessUrl());
  } else {
   WebUtils.redirectToSavedRequest(request, response, successUrl);
  }
 }
}

#4.用户安全的退出

后期发现直接依靠原有的logout会发生session未注销的情况。所以重写了LogoutFilter。登出的时候直接调用配置的URL即可

public class PortalLogoutFilter extends AdviceFilter {

 private static final Logger log = LoggerFactory.getLogger(LogoutFilter.class);

 public static final String DEFAULT_REDIRECT_URL = "/";

 private String redirectUrl = DEFAULT_REDIRECT_URL;

 @Override
 protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
  Subject subject = getSubject(request, response);
  String redirectUrl = getRedirectUrl(request, response, subject);
  //try/catch added for SHIRO-298:
  try {
   subject.logout();
   Session session = subject.getSession();
   session.stop();
  } catch (SessionException ise) {
   log.debug("Encountered session exception during logout. This can generally safely be ignored.", ise);
  }
  issueRedirect(request, response, redirectUrl);
  return false;
 }
}

以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持考高分网。