如何以编程方式配置过滤器链？

Question

有没有办法根据上述users role 对user 访问特定[URL] 进行编程限制。

例如，在shiro.ini 文件中，您可以定义：

      [urls]
      ...
  1.  /app/**= user

可以在代码中定义filter chain，如下所示：

 .....

 UserFilter user = new UserFilter();//create user filter
 user.setLoginUrl("login.xhtml");


FilterChainManager fcMan = new DefaultFilterChainManager();
fcMan.addFilter("user", user);//add filter to filter chain
fcMan.createChain("/app/**", "user");//define url path expression for filterName

.....

我的问题是如何使用roles 实现这一点，就像我在shiro.ini 文件中所做的那样：

[urls]
...
/api/admin/**= user, roles[admin]
...

例如：

RolesAuthorizationFilter adminRole = new RolesAuthorizationFilter();//eg create role filter      
adminRole.setLoginUrl("login.xhtml");
UserFilter user = new UserFilter();//create user filter
user.setLoginUrl("login.xhtml");


FilterChainManager fcMan = new DefaultFilterChainManager();

fcMan.addFilter("user", user);
fcMan.addFilter("admin", adminRole);      
fcMan.createChain("/api/admin/**", "admin");

Answer 1

我是《Pairing Apache Shiro and Java EE 7》一书的作者，您可以免费获取here。

在本书中，我以编程方式编写了所有 Shiro 组件，而无需 shiro.ini 文件。

我使用 CDI 事件来生成 FilterChainResolver：

@Produces
public FilterChainResolver getFilterChainResolver() {
    FilterChainResolver filterChainResolver = null;
    if (filterChainResolver == null) {
        FormAuthenticationFilter authc = new FormAuthenticationFilter();
        AnonymousFilter anon = new AnonymousFilter();
        UserFilter user = new UserFilter();

        authc.setLoginUrl(WebPages.LOGIN_URL);
        user.setLoginUrl(WebPages.LOGIN_URL);

        FilterChainManager fcMan = new DefaultFilterChainManager();
        fcMan.addFilter("authc", authc);
        fcMan.addFilter("anon", anon);
        fcMan.addFilter("user", user);

        fcMan.createChain("/index.html", "anon");
        fcMan.createChain("/css/**", "anon");
        fcMan.createChain("/api/**", "anon");
        fcMan.createChain(WebPages.LOGIN_URL, "authc");
        fcMan.createChain("/**", "user");

        PathMatchingFilterChainResolver resolver = new PathMatchingFilterChainResolver();
        resolver.setFilterChainManager(fcMan);
        filterChainResolver = resolver;
    }
    return filterChainResolver;
}

接下来，我们将 FilterChainResolver 注入：

@WebListener
public class ShiroListener extends EnvironmentLoaderListener {

    @Inject
    WebSecurityManager securityManager;

    @Inject
    FilterChainResolver filterChainResolver;

    @Override
    protected WebEnvironment createEnvironment(ServletContext sc) {
        DefaultWebEnvironment webEnvironment = (DefaultWebEnvironment) super.createEnvironment(sc);

        webEnvironment.setSecurityManager(securityManager);
        webEnvironment.setFilterChainResolver(filterChainResolver);

        return webEnvironment;
    }
    ...
}

现在，FilterChainResolver 被应用，一切都会如愿以偿。