org.apache.shiro.spring.web.ShiroFilterFactoryBean#setSecurityManager

Source File: BootStrap.java From MyBlog with Apache License 2.0

6 votes

@Bean//@Bean的默认name是方法名也就是shiroFilter
    public ShiroFilterFactoryBean shiroFilter() {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(securityManager());
        //设置访问权限
        LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
//        filterChainDefinitionMap.put("/api/addBlog", "myRoles[admin]");
//        filterChainDefinitionMap.put("/api/delBlogs", "myRoles[admin]");
        filterChainDefinitionMap.put("/api/userList", "myRoles[admin]");
        filterChainDefinitionMap.put("/api/delUsers", "myAuthc[admin],myRoles[admin]");
        filterChainDefinitionMap.put("/api/file", "myRoles[special]");
        filterChainDefinitionMap.put("/api/logout", "logout");
        bean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        //设置自定义filter
        Map<String, Filter> filters = Maps.newHashMap();
        filters.put("myRoles", new MyRolesFilter());
        filters.put("myUser", new MyUserFilter());
        filters.put("myAuthc", new MyAuthcFilter());
        bean.setFilters(filters);
        return bean;
    }

Source File: ShiroConfig.java From blog-sample with Apache License 2.0

6 votes

/**
 * Filter工厂，设置过滤条件与跳转条件
 */
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
    ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();

    // Shiro的核心安全接口
    bean.setSecurityManager(securityManager);

    // 设置登陆页
    bean.setLoginUrl("/login");

    // 自定义拦截规则
    Map<String,String> map = new HashMap<>(16);
    map.put("/", "anon");
    // 设置退出登陆
    map.put("/logout", "logout");
    // 对所有用户认证
    map.put("/**", "authc");

    bean.setFilterChainDefinitionMap(map);
    return bean;
}

Source File: ShiroConfig.java From mall with MIT License

6 votes

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    filterChainDefinitionMap.put("/admin/auth/login", "anon");
    filterChainDefinitionMap.put("/admin/auth/401", "anon");
    filterChainDefinitionMap.put("/admin/auth/index", "anon");
    filterChainDefinitionMap.put("/admin/auth/403", "anon");

    filterChainDefinitionMap.put("/admin/**", "authc");
    shiroFilterFactoryBean.setLoginUrl("/admin/auth/401");
    shiroFilterFactoryBean.setSuccessUrl("/admin/auth/index");
    shiroFilterFactoryBean.setUnauthorizedUrl("/admin/auth/403");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

Source File: ShiroConfiguration.java From easyweb with Apache License 2.0

6 votes

@Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(
            DefaultWebSecurityManager securityManager,
            FormAuthenticationFilter formAuthenticationFilter) {

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 必须设置 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/oss/login");
        // 登录成功后要跳转的连接
        shiroFilterFactoryBean.setSuccessUrl("/admin/index");
        shiroFilterFactoryBean.setUnauthorizedUrl("/403");
        Map map = new HashMap<>();
//        map.put("authc",formAuthenticationFilter);
        shiroFilterFactoryBean.setFilters(map);
        loadShiroFilterChain(shiroFilterFactoryBean);
        return shiroFilterFactoryBean;
    }

Source File: ShiroCasWebFilterConfiguration.java From shiro-cas-spring-boot-starter with Apache License 2.0

6 votes

@Bean
  @Override
  protected ShiroFilterFactoryBean shiroFilterFactoryBean() {

ShiroFilterFactoryBean filterFactoryBean = new ShiroCasFilterFactoryBean();
      
      //登录地址：会话不存在时访问的地址
		filterFactoryBean.setLoginUrl(CasUrlUtils.constructLoginRedirectUrl(casProperties, serverProperties.getServlet().getContextPath(), casProperties.getServerCallbackUrl()));
		//系统主页：登录成功后跳转路径
		filterFactoryBean.setSuccessUrl(bizProperties.getSuccessUrl());
		//异常页面：无权限时的跳转路径
		filterFactoryBean.setUnauthorizedUrl(bizProperties.getUnauthorizedUrl());
    
		//必须设置 SecurityManager
	filterFactoryBean.setSecurityManager(securityManager);
	//拦截规则
	filterFactoryBean.setFilterChainDefinitionMap(shiroFilterChainDefinition.getFilterChainMap());
    
	return filterFactoryBean;
      
  }

Source File: ShiroConfiguration.java From spring-boot-quickstart with Apache License 2.0

6 votes

@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean
            .setSecurityManager(securityManager);
    shiroFilterFactoryBean.setLoginUrl("/login");
    shiroFilterFactoryBean.setSuccessUrl("/");
    filterChainDefinitionMap.put("/login", "authc");
    filterChainDefinitionMap.put("/logout", "logout");
    filterChainDefinitionMap.put("/static/**", "anon");
    filterChainDefinitionMap.put("/api/**", "anon");
    filterChainDefinitionMap.put("/register/**", "anon");
    filterChainDefinitionMap.put("/admin/**", "roles[admin]");
    filterChainDefinitionMap.put("/**", "user");

    shiroFilterFactoryBean
            .setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

Source File: ShiroConfig.java From springboot-shiro with MIT License

6 votes

/**
 * ShiroFilterFactoryBean 处理拦截资源文件问题。
 * 注意：单独一个ShiroFilterFactoryBean配置是或报错的，因为在
 * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
 * Filter Chain定义说明
 * 1、一个URL可以配置多个Filter，使用逗号分隔
 * 2、当设置多个过滤器时，全部验证通过，才视为通过
 * 3、部分过滤器可指定参数，如perms，roles
 */
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    // 必须设置 SecurityManager
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    shiroFilterFactoryBean.setLoginUrl("/passport/login/");
    // 登录成功后要跳转的链接
    shiroFilterFactoryBean.setSuccessUrl("/index");
    // 未授权界面;
    shiroFilterFactoryBean.setUnauthorizedUrl("/error/403");
    // 配置数据库中的resource
    Map<String, String> filterChainDefinitionMap = shiroService.loadFilterChainDefinitions();
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

Source File: ShiroConfig.java From springboot-admin with Apache License 2.0

5 votes

@Bean("shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);

    //过滤
    Map<String, Filter> filters = new HashMap<>();
    filters.put("shiro", new ShiroAuthenticatingFilter());
    shiroFilter.setFilters(filters);

    Map<String, String> filterMap = new LinkedHashMap<>();
    filterMap.put("/api/**", "anon");
    filterMap.put("/druid/**", "anon");
    filterMap.put("/sys/login", "anon");
    filterMap.put("/sys/doGetKaptchaOnOff", "anon");
    filterMap.put("/**/*.css", "anon");
    filterMap.put("/**/*.js", "anon");
    filterMap.put("/**/*.html", "anon");
    filterMap.put("/fonts/**", "anon");
    filterMap.put("/plugins/**", "anon");
    filterMap.put("/favicon.ico", "anon");
    filterMap.put("/captcha.jpg", "anon");
    filterMap.put("/image/**", "anon");
    filterMap.put("/uploadFile/**", "anon");//上传文件映射的地址
    filterMap.put("/", "anon");
    filterMap.put("/**", "shiro");
    shiroFilter.setFilterChainDefinitionMap(filterMap);

    return shiroFilter;
}

Source File: ShiroConfig.java From notes with Apache License 2.0

5 votes

/**
     * ShiroFilterFactoryBean 处理拦截资源文件问题。
     * 注意：单独一个ShiroFilterFactoryBean配置是或报错的，以为在
     * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager Filter Chain定义说明
     * 1、一个URL可以配置多个Filter，使用逗号分隔
     * 2、当设置多个过滤器时，全部验证通过，才视为通过
     * 3、部分过滤器可指定参数，如perms，roles
     */
    @Bean("shiroFilter")
    public ShiroFilterFactoryBean shiroFilter(org.apache.shiro.mgt.SecurityManager securityManager) {

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 必须设置 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //验证码过滤器
        Map<String, Filter> filtersMap = shiroFilterFactoryBean.getFilters();
        filtersMap.put("jwt", new JwtFilter());
        shiroFilterFactoryBean.setFilters(filtersMap);

        // 拦截器
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
        //swagger 接口文档
        filterChainDefinitionMap.put("/v2/api-docs", "anon");
        filterChainDefinitionMap.put("/webjars/**", "anon");
        filterChainDefinitionMap.put("/swagger-resources/**", "anon");
        filterChainDefinitionMap.put("/swagger-ui.html", "anon");
        filterChainDefinitionMap.put("/login","anon");
        filterChainDefinitionMap.put("/register","anon");

        // 访问401和404页面不通过我们的Filter
//        filterChainDefinitionMap.put("/401", "anon");
//        filterChainDefinitionMap.put("/404", "anon");
        // 其他的
//        filterChainDefinitionMap.put("/admins","anyRole[admin,superadmin]");
        filterChainDefinitionMap.put("/admins", "jwt");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

Source File: ShiroConfig.java From renren-fast with GNU General Public License v3.0

5 votes

@Bean("shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);

    //oauth过滤
    Map<String, Filter> filters = new HashMap<>();
    filters.put("oauth2", new OAuth2Filter());
    shiroFilter.setFilters(filters);

    Map<String, String> filterMap = new LinkedHashMap<>();
    filterMap.put("/webjars/**", "anon");
    filterMap.put("/druid/**", "anon");
    filterMap.put("/api/**", "anon");

    //swagger配置
    filterMap.put("/swagger**", "anon");
    filterMap.put("/v2/api-docs", "anon");
    filterMap.put("/swagger-resources/configuration/ui", "anon");

    filterMap.put("/sys/login", "anon");
    filterMap.put("/**/*.css", "anon");
    filterMap.put("/**/*.js", "anon");
    filterMap.put("/**/*.html", "anon");
    filterMap.put("/fonts/**", "anon");
    filterMap.put("/plugins/**", "anon");
    filterMap.put("/favicon.ico", "anon");
    filterMap.put("/captcha.jpg", "anon");
    filterMap.put("/", "anon");
    filterMap.put("/**", "oauth2");
    shiroFilter.setFilterChainDefinitionMap(filterMap);

    return shiroFilter;
}

Source File: ShiroConfig.java From spring-boot-shiro with Apache License 2.0

5 votes

/**
 * Filter工厂，设置对应的过滤条件和跳转条件
 * create by: leigq
 * create time: 2019/7/3 14:29
 *
 * @return ShiroFilterFactoryBean
 */
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {

    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    // 过滤器链定义映射
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

    /*
     * anon:所有url都都可以匿名访问，authc:所有url都必须认证通过才可以访问;
     * 过滤链定义，从上向下顺序执行，authc 应放在 anon 下面
     * */
    filterChainDefinitionMap.put("/login", "anon");
    // 配置不会被拦截的链接 顺序判断，因为前端模板采用了thymeleaf，这里不能直接使用 ("/static/**", "anon")来配置匿名访问，必须配置到每个静态目录
    filterChainDefinitionMap.put("/css/**", "anon");
    filterChainDefinitionMap.put("/fonts/**", "anon");
    filterChainDefinitionMap.put("/img/**", "anon");
    filterChainDefinitionMap.put("/js/**", "anon");
    filterChainDefinitionMap.put("/html/**", "anon");
    // 所有url都必须认证通过才可以访问
    filterChainDefinitionMap.put("/**", "authc");

    // 配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了, 位置放在 anon、authc下面
    filterChainDefinitionMap.put("/logout", "logout");

    // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    // 配器shirot认登录累面地址，前后端分离中登录累面跳转应由前端路由控制，后台仅返回json数据, 对应LoginController中unauth请求
    shiroFilterFactoryBean.setLoginUrl("/un_auth");

    // 登录成功后要跳转的链接, 此项目是前后端分离，故此行注释掉，登录成功之后返回用户基本信息及token给前端
    // shiroFilterFactoryBean.setSuccessUrl("/index");

    // 未授权界面, 对应LoginController中 unauthorized 请求
    shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

Source File: ShiroConfig.java From learnjavabug with MIT License

5 votes

@Bean
ShiroFilterFactoryBean shiroFilterFactoryBean() {
    ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
    bean.setSecurityManager(securityManager());
    bean.setLoginUrl("/login");
    bean.setSuccessUrl("/index");
    bean.setUnauthorizedUrl("/unauthorizedurl");
    Map<String, String> map = new LinkedHashMap();
    map.put("/login", "anon");
    map.put("/bypass", "authc");
    bean.setFilterChainDefinitionMap(map);
    return bean;
}

Source File: ShiroConfig.java From web-flash with MIT License

4 votes

@Bean("shiroFilter")
public ShiroFilterFactoryBean factory(DefaultWebSecurityManager securityManager) {
    ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();

    // 添加自己的过滤器并且取名为jwt
    Map<String, Filter> filterMap =  Maps.newHashMap();
    filterMap.put("jwt", new JwtFilter());
    factoryBean.setFilters(filterMap);

    filterMap.put("logout", new SystemLogoutFilter());
    factoryBean.setSecurityManager(securityManager);
    factoryBean.setUnauthorizedUrl("/401");

    /*
     * 自定义url规则
     * http://shiro.apache.org/web.html#urls-
     * 这里最好用LinkedHashMap,否则可能回出现anon配置无效的情况
     */
    Map<String, String> filterRuleMap = new LinkedHashMap<String,String>();
    // 所有请求通过我们自己的JWT Filter
    //swagger资源不拦截
    filterRuleMap.put("/swagger-ui.html","anon");
    filterRuleMap.put("/v2/api-docs/**", "anon");
    filterRuleMap.put("/webjars/**", "anon");
    filterRuleMap.put("/swagger-resources","anon");
    filterRuleMap.put("/images/**","anon");
    filterRuleMap.put("/configuration/security","anon");
    filterRuleMap.put("/configuration/ui","anon");

    filterRuleMap.put("/file/download","anon");
    filterRuleMap.put("/file/getImgStream","anon");
    filterRuleMap.put("/file/getImgBase64","anon");


    //druid监控地址不拦截
    filterRuleMap.put("/druid/**","anon");
    //登录登出不拦截
    filterRuleMap.put("/account/login","anon");
    filterRuleMap.put("/logout", "logout");
    //H5前端不拦截
    filterRuleMap.put("/offcialsite/**","anon");
    // 访问401和404页面不通过我们的Filter
    filterRuleMap.put("/401", "anon");
    filterRuleMap.put("/**", "jwt");
    factoryBean.setFilterChainDefinitionMap(filterRuleMap);
    return factoryBean;
}

Source File: ShiroConfig.java From pybbs with GNU Affero General Public License v3.0

4 votes

@Bean
    public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager securityManager) {
        log.info("开始配置shiroFilter...");
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        Map<String, Filter> filterMap = shiroFilterFactoryBean.getFilters();
//        filterMap.put("myShiroFilter", new MyShiroFilter());
        shiroFilterFactoryBean.setFilters(filterMap);

        //拦截器.
        Map<String, String> map = new HashMap<>();
        // 配置不会被拦截的链接 顺序判断  相关静态资源
        map.put("/static/**", "anon");

        //配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
        map.put("/admin/logout", "logout");

        //<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;

        //<!-- authc:所有url都必须认证通过才可以访问; user: 表示rememberMe后就可以访问 anon:所有url都都可以匿名访问-->
        map.put("/admin/permission/**", "authc");
        map.put("/admin/role/**", "authc");
        map.put("/admin/system/**", "authc");
        map.put("/admin/admin_user/**", "authc");

        map.put("/admin/index", "user");
        map.put("/admin/comment/**", "user");
        map.put("/admin/sensitive_word/**", "user");
        map.put("/admin/tag/**", "user");
        map.put("/admin/topic/**", "user");
        map.put("/admin/user/**", "user");

//        map.put("/adminlogin", "myShiroFilter");
        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/adminlogin");
        // 登录成功后要跳转的链接
        shiroFilterFactoryBean.setSuccessUrl("/admin/index");

        //未授权界面;
        shiroFilterFactoryBean.setUnauthorizedUrl("/adminlogin");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);

        //    Map<String, Filter> filters = new HashMap<>();
        //    shiroFilterFactoryBean.setFilters(filters);

        return shiroFilterFactoryBean;
    }

Source File: ShiroJwtConfig.java From hdw-dubbo with Apache License 2.0

4 votes

/**
 * Filter Chain定义说明
 *
 * 1、一个URL可以配置多个Filter，使用逗号分隔
 * 2、当设置多个过滤器时，全部验证通过，才视为通过
 * 3、部分过滤器可指定参数，如perms，roles
 */
@Bean("shiroFilter")
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    // 拦截器
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    //TODO:配置不会被拦截的链接 顺序判断
    filterChainDefinitionMap.put("/sys/captcha", "anon"); //登录验证码接口排除
    filterChainDefinitionMap.put("/sys/login", "anon"); //登录接口排除
    filterChainDefinitionMap.put("/sys/logout", "anon"); //登出接口排除
    filterChainDefinitionMap.put("/sys/encrypt", "anon");//加密
    filterChainDefinitionMap.put("/api/**", "anon");// API接口

    //TODO:开放的静态资源
    filterChainDefinitionMap.put("/favicon.ico", "anon");// 网站图标
    filterChainDefinitionMap.put("/bootstrap/**", "anon");
    filterChainDefinitionMap.put("/css/**", "anon");
    filterChainDefinitionMap.put("/font/**", "anon");
    filterChainDefinitionMap.put("/images/**", "anon");
    filterChainDefinitionMap.put("/js/**", "anon");
    filterChainDefinitionMap.put("/plugins/**", "anon");
    filterChainDefinitionMap.put("/upload/**", "anon");
    filterChainDefinitionMap.put("/qr/**", "anon");

    filterChainDefinitionMap.put("/**/*.js", "anon");
    filterChainDefinitionMap.put("/**/*.css", "anon");
    filterChainDefinitionMap.put("/**/*.html", "anon");
    filterChainDefinitionMap.put("/**/*.svg", "anon");
    filterChainDefinitionMap.put("/**/*.pdf", "anon");
    filterChainDefinitionMap.put("/**/*.jpg", "anon");
    filterChainDefinitionMap.put("/**/*.png", "anon");
    filterChainDefinitionMap.put("/**/*.ico", "anon");

    //TODO:排除字体格式的后缀
    filterChainDefinitionMap.put("/**/*.ttf", "anon");
    filterChainDefinitionMap.put("/**/*.woff", "anon");
    filterChainDefinitionMap.put("/**/*.woff2", "anon");

    filterChainDefinitionMap.put("/druid/**", "anon");
    filterChainDefinitionMap.put("/swagger-ui.html", "anon");
    filterChainDefinitionMap.put("/swagger**/**", "anon");
    filterChainDefinitionMap.put("/webjars/**", "anon");
    filterChainDefinitionMap.put("/v2/**", "anon");
    filterChainDefinitionMap.put("/doc.html", "anon");

    //TODO:性能监控
    filterChainDefinitionMap.put("/actuator/**", "anon");

    //TODO:测试示例
    filterChainDefinitionMap.put("/test/**", "anon"); //模板页面

    //TODO:websocket排除
    filterChainDefinitionMap.put("/ws/**", "anon");

    //TODO:添加自己的过滤器并且取名为jwt
    Map<String, Filter> filterMap = new HashMap<String, Filter>(1);
    filterMap.put("jwt", new JwtFilter());
    shiroFilterFactoryBean.setFilters(filterMap);
    //TODO:过滤链定义，从上向下顺序执行，一般将/**放在最为下边
    filterChainDefinitionMap.put("/**", "jwt");

    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}

Source File: ShiroConfig.java From scaffold-cloud with MIT License

4 votes

@Bean
public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager());

    Map<String, Filter> filters = new LinkedHashMap<>();
    LogoutFilter logoutFilter = new LogoutFilter();
    logoutFilter.setRedirectUrl("/home");
    shiroFilterFactoryBean.setFilters(filters);

    Map<String, String> filterChainDefinitionManager = new LinkedHashMap<String, String>();
    ResponseModel<List<SysMenuBO>> responseModel = sysMenuFeign.findAll();
    List<SysMenuBO> menuList = responseModel.getData();
    if (CollectionUtil.isNotEmpty(menuList)) {
        for (SysMenuBO menu : menuList) {
            if (StrUtil.isNotEmpty(menu.getUrl())) {
                ShiroService.formatUrl2Code(filterChainDefinitionManager, menu, PERMISSION_STRING);
            }
        }
    }
    filterChainDefinitionManager.put("/login", "anon");
    filterChainDefinitionManager.put("/logout", "logout");
    filterChainDefinitionManager.put("/login/check", "anon");
    filterChainDefinitionManager.put("/static/**", "anon");
    filterChainDefinitionManager.put("/notify/**", "anon");
    filterChainDefinitionManager.put("/lang/**", "anon");

    filterChainDefinitionManager.put("/*/login", "anon");
    filterChainDefinitionManager.put("/*/logout", "logout");
    filterChainDefinitionManager.put("/*/login/check", "anon");
    filterChainDefinitionManager.put("/*/static/**", "anon");
    filterChainDefinitionManager.put("/*/notify/**", "anon");
    filterChainDefinitionManager.put("/*/lang/**", "anon");

    filterChainDefinitionManager.put("/**", "anon");

    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionManager);

    shiroFilterFactoryBean.setLoginUrl("/login");
    shiroFilterFactoryBean.setSuccessUrl("/index");
    shiroFilterFactoryBean.setUnauthorizedUrl("/403");
    return shiroFilterFactoryBean;
}

Source File: ShiroConfig.java From SpringBoot-Base-System with GNU Lesser General Public License v3.0

4 votes

/**
 * shiro拦截器
 * 
 * @time 2018年4月10日 下午5:10:12.
 * 
 * @version V1.0
 * @param securityManager
 * @param realm
 * @return ShiroFilterFactoryBean
 */
@Bean(name = "shiroFilter")
@DependsOn("securityManager")
@ConditionalOnMissingBean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultSecurityManager securityManager, Realm realm) {
	securityManager.setRealm(realm);

	ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
	shiroFilter.setSecurityManager(securityManager);
	shiroFilter.setLoginUrl("/admin/login");
	shiroFilter.setSuccessUrl("/admin/index");
	shiroFilter.setUnauthorizedUrl("/assets/401.html");
	Map<String, String> filterChainDefinitionMap = new HashMap<String, String>();
	filterChainDefinitionMap.put("/assets/**", "anon");
	filterChainDefinitionMap.put("/admin/regist", "anon");// 添加
	filterChainDefinitionMap.put("/admin/login", "anon");

	filterChainDefinitionMap.put("/isTrue", "anon"); // 验证码异步验证

	// 个人信息
	filterChainDefinitionMap.put("/admin/info/**", "anon");
	// 自主还书
	filterChainDefinitionMap.put("/admin/borrow/**", "anon");
	filterChainDefinitionMap.put("/admin/user/index", "perms[system:user:index]");
	filterChainDefinitionMap.put("/admin/user/add", "perms[system:user:add]");
	filterChainDefinitionMap.put("/admin/user/edit*", "perms[system:user:edit]");
	filterChainDefinitionMap.put("/admin/user/deleteBatch", "perms[system:user:deleteBatch]");
	filterChainDefinitionMap.put("/admin/user/grant/**", "perms[system:user:grant]");
	filterChainDefinitionMap.put("/admin/user/resume/**", "perms[system:user:resume]");
	// 注册账号验证和添加账号验证
	filterChainDefinitionMap.put("/admin/user/isExist/**", "anon");
	filterChainDefinitionMap.put("/admin/user/isAvailable/**", "anon");
	filterChainDefinitionMap.put("/admin/user/isAllTrue/**", "anon");

	filterChainDefinitionMap.put("/admin/role/index", "perms[system:role:index]");
	filterChainDefinitionMap.put("/admin/role/add", "perms[system:role:add]");
	filterChainDefinitionMap.put("/admin/role/edit*", "perms[system:role:edit]");
	filterChainDefinitionMap.put("/admin/role/deleteBatch", "perms[system:role:deleteBatch]");
	filterChainDefinitionMap.put("/admin/role/grant/**", "perms[system:role:grant]");

	filterChainDefinitionMap.put("/admin/resource/index", "perms[system:resource:index]");
	filterChainDefinitionMap.put("/admin/resource/add", "perms[system:resource:add]");
	filterChainDefinitionMap.put("/admin/resource/edit*", "perms[system:resource:edit]");
	filterChainDefinitionMap.put("/admin/resource/deleteBatch", "perms[system:resource:deleteBatch]");

	filterChainDefinitionMap.put("/druid/", "perms[system:resource:druid]");// druid
	filterChainDefinitionMap.put("/admin/memorandum/*", "perms[system:memorandum:memorandum]");// 系统记录,只使用一个拦截url
	// 添加过滤条件
	filterChainDefinitionMap.put("/admin/books/book_management", "perms[system:books:book_management]");

	filterChainDefinitionMap.put("/admin/**", "user"); // 默认所有均可依靠cookie,本项目隐藏bug,cookie太大，无法保存在浏览器本地
	shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap);
	return shiroFilter;
}

Source File: ShiroConfiguration.java From dpCms with Apache License 2.0

4 votes

@Bean
public ShiroFilterFactoryBean shiroFilter() {
    ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
    factoryBean.setSecurityManager(securityManager());
    return factoryBean;
}

Source File: ShiroConfiguration.java From mblog with GNU General Public License v3.0

4 votes

/**
 * Shiro的过滤器链
 */
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);
    shiroFilter.setLoginUrl("/login");
    shiroFilter.setSuccessUrl("/");
    shiroFilter.setUnauthorizedUrl("/error/reject.html");

    HashMap<String, Filter> filters = new HashMap<>();
    filters.put("authc", new AuthenticatedFilter());
    shiroFilter.setFilters(filters);

    /**
     * 配置shiro拦截器链
     *
     * anon  不需要认证
     * authc 需要认证
     * user  验证通过或RememberMe登录的都可以
     *
     * 顺序从上到下,优先级依次降低
     *
     */
    Map<String, String> hashMap = new LinkedHashMap<>();
    hashMap.put("/dist/**", "anon");
    hashMap.put("/theme/**", "anon");
    hashMap.put("/storage/**", "anon");
    hashMap.put("/login", "anon");
    hashMap.put("/user/**", "authc");
    hashMap.put("/settings/**", "authc");
    hashMap.put("/post/editing", "authc");
    hashMap.put("/post/submit", "authc");
    hashMap.put("/post/delete/*", "authc");
    hashMap.put("/post/upload", "authc");

    hashMap.put("/admin/channel/list", "authc,perms[channel:list]");
    hashMap.put("/admin/channel/update", "authc,perms[channel:update]");
    hashMap.put("/admin/channel/delete", "authc,perms[channel:delete]");

    hashMap.put("/admin/post/list", "authc,perms[post:list]");
    hashMap.put("/admin/post/update", "authc,perms[post:update]");
    hashMap.put("/admin/post/delete", "authc,perms[post:delete]");

    hashMap.put("/admin/comment/list", "authc,perms[comment:list]");
    hashMap.put("/admin/comment/delete", "authc,perms[comment:delete]");

    hashMap.put("/admin/user/list", "authc,perms[user:list]");
    hashMap.put("/admin/user/update_role", "authc,perms[user:role]");
    hashMap.put("/admin/user/pwd", "authc,perms[user:pwd]");
    hashMap.put("/admin/user/open", "authc,perms[user:open]");
    hashMap.put("/admin/user/close", "authc,perms[user:close]");

    hashMap.put("/admin/options/index", "authc,perms[options:index]");
    hashMap.put("/admin/options/update", "authc,perms[options:update]");

    hashMap.put("/admin/role/list", "authc,perms[role:list]");
    hashMap.put("/admin/role/update", "authc,perms[role:update]");
    hashMap.put("/admin/role/delete", "authc,perms[role:delete]");

    hashMap.put("/admin/theme/*", "authc,perms[theme:index]");

    hashMap.put("/admin", "authc,perms[admin]");
    hashMap.put("/admin/*", "authc,perms[admin]");

    shiroFilter.setFilterChainDefinitionMap(hashMap);
    return shiroFilter;
}

Source File: ShiroConfiguration.java From spring-boot-seed with MIT License

4 votes

@Bean
public ShiroFilterFactoryBean shiroFilter() {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    // 设置securityManager，其中注入了自定义的Realm
    shiroFilterFactoryBean.setSecurityManager(securityManager());

    // 登陆url
    shiroFilterFactoryBean.setLoginUrl("/login");

    // 成功登陆后打开的url
    shiroFilterFactoryBean.setSuccessUrl("/index");

    // 授权失败跳转的页面
    shiroFilterFactoryBean.setUnauthorizedUrl("/login");

    Map<String, Filter> filtersMap = shiroFilterFactoryBean.getFilters();
    // 添加过滤器，例如：验证码过滤器 KaptchaFilter
    shiroFilterFactoryBean.setFilters(filtersMap);

    // 权限过滤链
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    /*
     * rest： 比如/admins/user/**=rest[user],根据请求的方法，相当于/admins/user/**=perms[user：method] ,其中method为post，get，delete等。
     * port： 比如/admins/user/**=port[8081],当请求的url的端口不是8081是跳转到schemal：//serverName：8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString是你访问的url里的？后面的参数。
     * perms：比如/admins/user/**=perms[user：add：*],perms参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，比如/admins/user/**=perms["user：add：*,user：modify：*"]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。
     * roles：比如/admins/user/**=roles[admin],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，比如/admins/user/**=roles["admin,guest"],每个参数通过才算通过，相当于hasAllRoles()方法。//要实现or的效果看http://zgzty.blog.163.com/blog/static/83831226201302983358670/
     * anon： 比如/admins/**=anon 没有参数，表示可以匿名使用。
     * authc：比如/admins/user/**=authc表示需要认证才能使用，没有参数
     * authcBasic：比如/admins/user/**=authcBasic没有参数表示httpBasic认证
     * ssl：  比如/admins/user/**=ssl没有参数，表示安全的url请求，协议为https
     * user： 比如/admins/user/**=user没有参数表示必须存在用户，当登入操作时不做检查
     */
    filterChainDefinitionMap.put("/login.jsp", "anon");
    filterChainDefinitionMap.put("/test/checkAuthc", "authc");
    filterChainDefinitionMap.put("/test/**", "anon");
    // druid过滤
    filterChainDefinitionMap.put("/druid", "anon");
    // swagger过滤
    filterChainDefinitionMap.put("/swagger", "anon");
    filterChainDefinitionMap.put("/swagger/api/docs", "anon");
    filterChainDefinitionMap.put("/swagger-ui.html", "anon");
    filterChainDefinitionMap.put("/webjars/**", "anon");
    filterChainDefinitionMap.put("/swagger-resources/**", "anon");
    // 其他需要授权
    filterChainDefinitionMap.put("/*", "authc");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

    return shiroFilterFactoryBean;
}

Java Code Examples for org.apache.shiro.spring.web.ShiroFilterFactoryBean#setSecurityManager()