Question

我似乎找不到从JPA对象加载[users] AND [urls]的示例。我想仅在[main]部分使用shiro.ini。

到目前为止我所取得的源代码是： Unable to @Inject my DAO in a Custom Apache Shiro AuthorizingRealm

是否存在从数据库中完全加载[users]（用户/传递）和[urls]（角色，权限）的示例？我无法在任何地方找到它。我现在正在寻找它一周。

Answer 1

经过长时间的研究，最好的＆＃34;我想出的解决方案是：

shiro.ini

[main]
jsfFilter = com.test.security.CustomAuthorizationFilter
jsfFilter.loginUrl = /login.jsf

[urls]
/** = jsfFilter

//您可以添加方法来过滤此过滤器中BalusC描述的Ajax请求。 CustomAuthorizationFilter.java

public class CustomAuthorizationFilter extends AuthorizationFilter {

@Override
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {

        HttpServletRequest httpRequest = (HttpServletRequest) request;

        if (!httpRequest.getRequestURI().startsWith(httpRequest.getContextPath() + ResourceHandler.RESOURCE_IDENTIFIER)) {

            Subject subject = SecurityUtils.getSubject();

            AuthenticatingSecurityManager authenticatingSecurityManager = ((AuthenticatingSecurityManager) SecurityUtils.getSecurityManager());

            PrincipalCollection principals = subject.getPrincipals();
            JPARealm jpaRealm = (JPARealm) authenticatingSecurityManager.getRealms().iterator().next();
            AuthorizationInfo authorizationInfo = jpaRealm.getAuthorizationInfo(principals);

            for (String permission : authorizationInfo.getStringPermissions()) {
                if (pathsMatch(permission, request)) {
                    return true;
                }
            }

        } else {
            return true;
        }
        return false;
    }
}

pathsMatch(permission, request)方法将尝试验证/比较收到的字符串权限与用户尝试访问的路径。此过滤器依赖于ALWAYS具有经过身份验证的用户。如果subject.getPrincipal()为空，则需要更多编码。如果有人需要整个代码，请告诉我。

配置Apache Shiro以从JPA实体完全加载[urls]部分

1 个答案: