shiro安全框架扩展教程--整合cas框架扩展自定义CasRealm-阿里云开发者社区

这次我给大家讲讲如何在shiro中整合cas框架,以及扩展自定义的角色和资源体系,啰嗦话不多说了,直接上代码说明

第一步,搭建cas服务器,我也不说拉,这个大家用现有的cas服务就行了

第二步,先加入cas-client的包到我们的项目,然后再下载个shiro-cas.jar也放到项目里

第三步配置shiro中的cas设置

<description>shiro配置</description>

	<!-- 安全管理器 -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="cacheManager" ref="shiroCacheManager" />
		<property name="sessionManager" ref="sessionManager" />
		<property name="realm" ref="casRealm" />
		<property name="subjectFactory" ref="casSubjectFactory" />
		<!-- <property name="realm" ref="simpleUserRealm" /> -->
	</bean>

	<!-- 会话管理器 -->
	<bean id="sessionManager"
		class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
		<property name="sessionValidationSchedulerEnabled" value="false" />
		<property name="sessionDAO" ref="sessionDAO" />
		<property name="globalSessionTimeout" value="600000" />
	</bean>

	<!-- 缓存管理器 -->
	<bean id="shiroCacheManager"
		class="com.silvery.security.shiro.cache.SimpleShiroCacheManager">
		<property name="cache" ref="shiroCache" />
	</bean>

	<!-- 缓存实现类,注入自定义缓存机制 -->
	<bean id="shiroCache" class="com.silvery.security.shiro.cache.SimpleShiroCache">
		<property name="cacheManager" ref="simpleCacheManager" />
	</bean>

	<!-- 会话读写实现类 -->
	<bean id="sessionDAO" class="com.silvery.security.shiro.session.CacheSessionDAO" />

	<!-- 用户认证实现 -->
	<bean id="simpleUserRealm" class="com.silvery.security.shiro.realm.SimpleUserRealm" />

	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

	<bean id="casFilter" class="org.apache.shiro.cas.CasFilter">
		<!-- 配置验证错误时的失败页面 -->
		<property name="failureUrl"
			value="https://cas.test.com:8443/login?service=http://test.com/mh/cas/login.do" />
	</bean>

	<bean id="casRealm" class="com.silvery.security.shiro.realm.SimpleCasRealm">
		<property name="defaultRoles" value="ROLE_USER" />
		<property name="casServerUrlPrefix" value="https://cas.test.com:8443" />
		<!-- 客户端的回调地址设置，必须和下面的过滤器拦截的地址一致 -->
		<property name="casService" value="http://test.com/mh/cas/login.do" />
	</bean>

	<!-- 如果要实现cas的remember me的功能，需要用到下面这个bean，并设置到securityManager的subjectFactory中 -->
	<bean id="casSubjectFactory" class="org.apache.shiro.cas.CasSubjectFactory" />

	<bean
		class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
		<property name="staticMethod"
			value="org.apache.shiro.SecurityUtils.setSecurityManager" />
		<property name="arguments" ref="securityManager" />
	</bean>

	<!-- 过滤链配置 -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl"
			value="https://cas.test.com:8443/login?service=http://test.com/mh/cas/login.do" />
		<property name="filters">
			<map>
				<entry key="cas" value-ref="casFilter" />
				<entry key="role">
					<bean
						class="com.silvery.security.shiro.filter.SimpleRoleAuthorizationFilter" />
				</entry>
				<entry key="authc">
					<bean
						class="com.silvery.security.shiro.filter.SimpleFormAuthenticationFilter" />
				</entry>
				<entry key="exec">
					<bean class="com.silvery.security.shiro.filter.SimpleExecutiveFilter" />
				</entry>
			</map>
		</property>
	</bean>

	<!-- 权限资源配置 -->
	<bean id="filterChainDefinitionsService"
		class="com.silvery.security.shiro.service.ini.impl.SimpleFilterChainDefinitionsService">
		<property name="definitions">
			<value>
				/mh/cas/login.do = cas
				/mh/casUrl.do = role[ROLE_USER]
				/static/** = anon
				/** = exec
			</value>
		</property>
	</bean>

关于这一个步骤的配置里面注释写的比较清楚了,至于一些类是自己重写的,可以自己参考前面的文章,/mh/cas/login.do其实就是cas拦截器的指定路径,如果想登录就请求这个路径即可,如果没有登录他会跳转cas的login页面

第四步就是需要重写我们的casrealm,你可以看到上面的配置有SimpleCasRealm,这个类是我自己重写的,是为了方便分配自己本地系统的权限体系,因为shiro-cas提供的默认CasRealm功能比较有限,不能动态角色体系,下面可以看看这个原始的CasRealm源码

public class CasRealm extends AuthorizingRealm
{

    public CasRealm()
    {
        validationProtocol = "CAS";
        rememberMeAttributeName = "longTermAuthenticationRequestTokenUsed";
        setAuthenticationTokenClass(org/apache/shiro/cas/CasToken);
    }

    protected void onInit()
    {
        super.onInit();
        ensureTicketValidator();
    }

    protected TicketValidator ensureTicketValidator()
    {
        if(ticketValidator == null)
            ticketValidator = createTicketValidator();
        return ticketValidator;
    }

    protected TicketValidator createTicketValidator()
    {
        String urlPrefix = getCasServerUrlPrefix();
        if("saml".equalsIgnoreCase(getValidationProtocol()))
            return new Saml11TicketValidator(urlPrefix);
        else
            return new Cas20ServiceTicketValidator(urlPrefix);
    }

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
        throws AuthenticationException
    {
        CasToken casToken = (CasToken)token;
        if(token == null)
            return null;
        String ticket = (String)casToken.getCredentials();
        if(!StringUtils.hasText(ticket))
            return null;
        TicketValidator ticketValidator = ensureTicketValidator();
        try
        {
            Assertion casAssertion = ticketValidator.validate(ticket, getCasService());
            AttributePrincipal casPrincipal = casAssertion.getPrincipal();
            String userId = casPrincipal.getName();
            log.debug("Validate ticket : {} in CAS server : {} to retrieve user : {}", new Object[] {
                ticket, getCasServerUrlPrefix(), userId
            });
            Map attributes = casPrincipal.getAttributes();
            casToken.setUserId(userId);
            String rememberMeAttributeName = getRememberMeAttributeName();
            String rememberMeStringValue = (String)attributes.get(rememberMeAttributeName);
            boolean isRemembered = rememberMeStringValue != null && Boolean.parseBoolean(rememberMeStringValue);
            if(isRemembered)
                casToken.setRememberMe(true);
            List principals = CollectionUtils.asList(new Object[] {
                userId, attributes
            });
            PrincipalCollection principalCollection = new SimplePrincipalCollection(principals, getName());
            return new SimpleAuthenticationInfo(principalCollection, ticket);
        }
        catch(TicketValidationException e)
        {
            throw new CasAuthenticationException((new StringBuilder()).append("Unable to validate ticket [").append(ticket).append("]").toString(), e);
        }
    }

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals)
    {
        SimplePrincipalCollection principalCollection = (SimplePrincipalCollection)principals;
        List listPrincipals = principalCollection.asList();
        Map attributes = (Map)listPrincipals.get(1);
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        addRoles(simpleAuthorizationInfo, split(defaultRoles));
        addPermissions(simpleAuthorizationInfo, split(defaultPermissions));
        List attributeNames = split(roleAttributeNames);
        String value;
        for(Iterator i$ = attributeNames.iterator(); i$.hasNext(); addRoles(simpleAuthorizationInfo, split(value)))
        {
            String attributeName = (String)i$.next();
            value = (String)attributes.get(attributeName);
        }

        attributeNames = split(permissionAttributeNames);
        String value;
        for(Iterator i$ = attributeNames.iterator(); i$.hasNext(); addPermissions(simpleAuthorizationInfo, split(value)))
        {
            String attributeName = (String)i$.next();
            value = (String)attributes.get(attributeName);
        }

        return simpleAuthorizationInfo;
    }

    private List split(String s)
    {
        List list = new ArrayList();
        String elements[] = StringUtils.split(s, ',');
        if(elements != null && elements.length > 0)
        {
            String arr$[] = elements;
            int len$ = arr$.length;
            for(int i$ = 0; i$ < len$; i$++)
            {
                String element = arr$[i$];
                if(StringUtils.hasText(element))
                    list.add(element.trim());
            }

        }
        return list;
    }

    private void addRoles(SimpleAuthorizationInfo simpleAuthorizationInfo, List roles)
    {
        String role;
        for(Iterator i$ = roles.iterator(); i$.hasNext(); simpleAuthorizationInfo.addRole(role))
            role = (String)i$.next();

    }

    private void addPermissions(SimpleAuthorizationInfo simpleAuthorizationInfo, List permissions)
    {
        String permission;
        for(Iterator i$ = permissions.iterator(); i$.hasNext(); simpleAuthorizationInfo.addStringPermission(permission))
            permission = (String)i$.next();

    }

    public String getCasServerUrlPrefix()
    {
        return casServerUrlPrefix;
    }

    public void setCasServerUrlPrefix(String casServerUrlPrefix)
    {
        this.casServerUrlPrefix = casServerUrlPrefix;
    }

    public String getCasService()
    {
        return casService;
    }

    public void setCasService(String casService)
    {
        this.casService = casService;
    }

    public String getValidationProtocol()
    {
        return validationProtocol;
    }

    public void setValidationProtocol(String validationProtocol)
    {
        this.validationProtocol = validationProtocol;
    }

    public String getRememberMeAttributeName()
    {
        return rememberMeAttributeName;
    }

    public void setRememberMeAttributeName(String rememberMeAttributeName)
    {
        this.rememberMeAttributeName = rememberMeAttributeName;
    }

    public String getDefaultRoles()
    {
        return defaultRoles;
    }

    public void setDefaultRoles(String defaultRoles)
    {
        this.defaultRoles = defaultRoles;
    }

    public String getDefaultPermissions()
    {
        return defaultPermissions;
    }

    public void setDefaultPermissions(String defaultPermissions)
    {
        this.defaultPermissions = defaultPermissions;
    }

    public String getRoleAttributeNames()
    {
        return roleAttributeNames;
    }

    public void setRoleAttributeNames(String roleAttributeNames)
    {
        this.roleAttributeNames = roleAttributeNames;
    }

    public String getPermissionAttributeNames()
    {
        return permissionAttributeNames;
    }

    public void setPermissionAttributeNames(String permissionAttributeNames)
    {
        this.permissionAttributeNames = permissionAttributeNames;
    }

    public static final String DEFAULT_REMEMBER_ME_ATTRIBUTE_NAME = "longTermAuthenticationRequestTokenUsed";
    public static final String DEFAULT_VALIDATION_PROTOCOL = "CAS";
    private static Logger log = LoggerFactory.getLogger(org/apache/shiro/cas/CasRealm);
    private String casServerUrlPrefix;
    private String casService;
    private String validationProtocol;
    private String rememberMeAttributeName;
    private TicketValidator ticketValidator;
    private String defaultRoles;
    private String defaultPermissions;
    private String roleAttributeNames;
    private String permissionAttributeNames;

}

其实跟我们普通用的UserRealm或者是JdbcRealm差别不大,但是里面增加了casToken的验证,所以我们应该直接拿过来用,下面再加载出我们的自己的逻辑即可,所以我们可以选择继承当前的CasRealm重载一下他的两个方法

/**
 * 
 * 扩展CAS桥接器,订制角色体系和资源体系
 * 
 * @author shadow
 * 
 */
public class SimpleCasRealm extends CasRealm {

	@Autowired
	private CacheManager cacheManager;

	private final static Logger log = LoggerFactory.getLogger(SimpleCasRealm.class);

	public SimpleCasRealm() {
		super();
		setCacheManager(cacheManager);
	}

	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		CasToken casToken = (CasToken) token;
		if (token == null)
			return null;
		String ticket = (String) casToken.getCredentials();
		if (!StringUtils.hasText(ticket))
			return null;
		TicketValidator ticketValidator = ensureTicketValidator();
		try {
			Assertion casAssertion = ticketValidator.validate(ticket, getCasService());
			AttributePrincipal casPrincipal = casAssertion.getPrincipal();
			String userId = casPrincipal.getName();
			log.debug("Validate ticket : {} in CAS server : {} to retrieve user : {}", new Object[] { ticket,
					getCasServerUrlPrefix(), userId });
			Map attributes = casPrincipal.getAttributes();
			casToken.setUserId(userId);
			String rememberMeAttributeName = getRememberMeAttributeName();
			String rememberMeStringValue = (String) attributes.get(rememberMeAttributeName);
			boolean isRemembered = rememberMeStringValue != null && Boolean.parseBoolean(rememberMeStringValue);
			if (isRemembered)
				casToken.setRememberMe(true);
			List principals = CollectionUtils.asList(new Object[] { userId, attributes });
			PrincipalCollection principalCollection = new SimplePrincipalCollection(principals, getName());

                        // 这里可以拿到Cas的登录账号信息,加载到对应权限体系信息放到缓存中...
 
                        return new SimpleAuthenticationInfo(principalCollection, ticket);
		} catch (TicketValidationException e) {
			throw new CasAuthenticationException((new StringBuilder()).append("Unable to validate ticket [")
					.append(ticket).append("]").toString(), e);
		}
	}

	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		SimplePrincipalCollection principalCollection = (SimplePrincipalCollection) principals;
		List listPrincipals = principalCollection.asList();
		Map attributes = (Map) listPrincipals.get(1);
		SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
                
                // 这里可以加载缓存的中的数据到认证实体...

                addRoles(simpleAuthorizationInfo, split(getDefaultRoles()));

		return simpleAuthorizationInfo;
	}

	protected List split(String s) {
		List list = new ArrayList();
		String elements[] = StringUtils.split(s, ',');
		if (elements != null && elements.length > 0) {
			String arr$[] = elements;
			int len$ = arr$.length;
			for (int i$ = 0; i$ < len$; i$++) {
				String element = arr$[i$];
				if (StringUtils.hasText(element))
					list.add(element.trim());
			}

		}
		return list;
	}

	protected void addRoles(SimpleAuthorizationInfo simpleAuthorizationInfo, List roles) {
		String role;
		for (Iterator i$ = roles.iterator(); i$.hasNext(); simpleAuthorizationInfo.addRole(role))
			role = (String) i$.next();

	}

	protected void addPermissions(SimpleAuthorizationInfo simpleAuthorizationInfo, List permissions) {
		String permission;
		for (Iterator i$ = permissions.iterator(); i$.hasNext(); simpleAuthorizationInfo
				.addStringPermission(permission))
			permission = (String) i$.next();

	}

	/** 重写退出时缓存处理方法 */
	protected void doClearCache(PrincipalCollection principals) {
		Object principal = principals.getPrimaryPrincipal();
		try {
			getCache().remove(principal);
			log.debug(new StringBuffer().append(principal).append(" on logout to remove the cache [").append(principal)
					.append("]").toString());
		} catch (CacheException e) {
			log.error(e.getMessage());
		}
	}

	/** 获取缓存管理器的缓存堆实例 */
	protected Cache<Object, Object> getCache() throws CacheException {
		return cacheManager.getCache(CacheEmnu.MEMCACHED_DATA_CACHE);
	}

	public CacheManager getCacheManager() {
		return cacheManager;
	}

	public void setCacheManager(CacheManager cacheManager) {
		this.cacheManager = cacheManager;
	}

}

值得提醒大家的一个关键点,如何获取cas返回过来的对象信息呢?

Subject subject = SecurityUtils.getSubject();
		Object principal = subject.getPrincipal();
		PrincipalCollection principals = subject.getPrincipals();

第一个对象是可以获取到当前登录账号

第二个对象是一个List集合其中0元素是当前登录账号,1元素是一个map集合,这里就存放了我们cas服务给我返回的用户信息

我们写的拦截器判断是否有登录就用第一个Object判断是否有null即可

第五步既然有登录了,那就必须有退出功能,那如何才能完整退出呢?流程应该是先执行当前系统的注销,然后再执行cas的logout,这样就比较完整了,不会出现莫名其妙的问题

调用当前的shiro的subject.logout();注销当前系统的对象,然后返回到页面

@RequestMapping("/mh/cas/logout.do")
	public ModelAndView casLogout(HttpServletRequest request, HttpServletResponse response, UserDetailsVo vo) {
		SimpleUtils.getSubject().logout();
		return createModelAndView("/mh/logout");
	}

页面再重定向到cas的logout,这样就把cas的ticket也注销成功

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>正在注销...</title>
<script type="text/javascript" src="${staticHost}/static/plugin/jquery/core.js"></script>
<script type="text/javascript">
	location.href="https://cas.test.com:8443/logout?service=http://test.com/mh/index.do";
</script>
</head>
<body>
</body>
</html>

我想改造大概很明白了,其实shiro-cas.jar已经大部分拦截处理已经帮我们做好了,所以我们很安心地按照以往的方式来操控shiro的登录方式,希望对还没爬过这个坑的同学有帮助