Question

我对Shiro身份验证过滤器有一些问题。我在我的项目中使用了spring framework（3.2）和JSF 2.2。

我已经像shiro官方指南一样完成了spring xml，web.xml，faces-config配置文件。

这是我的spring xml配置（applicationContext.xml）

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager"/>
    <property name="loginUrl" value="/faces/login.xhtml"/>
    <property name="filterChainDefinitions">
        <value>
               /** = authc
        </value>
    </property>
</bean>
<bean id="propertyConfigurer"
      class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer"
      p:location="/WEB-INF/jdbc.properties" />

<bean id="myRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
    <property name="dataSource" ref="dataSource"/>
    <property name="authenticationQuery" value="SELECT password FROM User WHERE nip = ?"/>
    <property name="userRolesQuery" value="SELECT role FROM User WHERE nip = ?"/>
    <property name="permissionsLookupEnabled" value="true" />
    <property name="permissionsQuery" value="SELECT action FROM role_action WHERE role = ?"/>

</bean>

<bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager">
    <property name="realm" ref="myRealm"/>
</bean>

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
    <property name="arguments" ref="securityManager"/>
</bean>

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager"/>
</bean>

这是我的web.xml

<web-app>
<context-param>
    <param-name>javax.faces.PROJECT_STAGE</param-name>
    <param-value>Development</param-value>
</context-param>

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
        <param-name>targetFilterLifecycle</param-name>
        <param-value>true</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

<listener>
    <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<listener>
    <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>

 <!--///////////////////////////SPRING SERVLET////////////////////////////////-->
<servlet>
    <servlet-name>appServlet</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>/WEB-INF/applicationContext.xml</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>appServlet</servlet-name>
    <url-pattern>/rest/*</url-pattern>
</servlet-mapping>


<servlet>
    <servlet-name>Faces Servlet</servlet-name>
    <servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>Faces Servlet</servlet-name>
    <url-pattern>/faces/*</url-pattern>
</servlet-mapping>
<session-config>
    <session-timeout>
        30
    </session-timeout>
</session-config>
<welcome-file-list>
    <welcome-file>faces/index.xhtml</welcome-file>
</welcome-file-list>

问题是身份验证过滤器无法正常工作。如果我还没有登录，我就不会被重定向到login.xhtml。在这种情况下，我仍然可以访问任何页面而无需登录。

我的配置有问题吗？或者我该怎么办？感谢

Answer 1

我认为我解决了这个问题，因为它是安全管理器bean。我使用了错误的类，我使用defaultsecuritymanager而不是defaultwebsecuritymanager。

使用Spring + JSF在Shiro中进行身份验证过滤

1 个答案: