如何在我的项目中实现 Grails 的 Shiro 安全

问题描述

我是 Grails 的新手并且使用了一些 Shiro 安全性.我制作了一个带有登录页面的小网站，如果登录成功，它会将我重定向到另一个登录页面.

i m new to Grails and using some Shiro security.I have made a little site with login page and if login successful it redirects me to another loggedin page.

现在我想实现Shiro Security.我已经在新的 Grails 项目上运行了该插件和 Shiro 的快速启动应用程序.

now i want to implement Shiro Security. I have run that plugin and quick start app of Shiro on new Grails Project.

我想要实现的是如何使用快速启动文件和代码在我自己的页面上实现我的安全性.请指导.一点.我应该从那个快速开始使用哪些文件以及我应该进行哪些更改.?

what i want to achieve is that how can i implement my security on my own pages using the Quick Start Files and code. Please guide. a little. which files should i use from that quick start and what changing should i made. ?

等待一些积极的回应:)

waiting for some positive response :)

推荐答案

让我们先从一个全新的应用开始:

let's first start with a fresh app:

grails create-app ShiroDemo

现在安装 shiroby，将其添加到 BuildConfig.groovy 的插件部分:

now install shiroby adding it to the plugins section of BuildConfig.groovy:

插件{编译 ":shiro:1.1.4"}

plugins { compile ":shiro:1.1.4"}

我们需要身份验证控制器和通配符域:

we need the auth controller and the wildcard-realm:

grails create-auth-controller
grails create-wildcard-realm

现在让我们在 bootstrap.groovy 中创建一个具有所需角色和权限的虚拟用户:

now let's create a dummy user with the needed role and permissions in bootstrap.groovy:

import org.apache.shiro.crypto.hash.Sha256Hash
class BootStrap {
    def init = { servletContext ->
        def roleUser = new ShiroRole(name:'USER')
        roleUser.addToPermissions('auth:*')
        roleUser.addToPermissions('controller:action')
        roleUser.save(flush:true, failOnError: true)
        def testUser = new ShiroUser(username:'kermit',passwordHash:new Sha256Hash("password").toHex())
        testUser.addToRoles(roleUser)
        testUser.save(flush:true, failOnError: true)
    }
    def destroy = {
    }
}

查看 role.User.addToPermissions 行.您可以在此处授予控制器和操作的权限.如果角色缺少权限，用户将被重定向到访问被拒绝页面.您会在 shiro 插件页面上找到有关如何指定权限的详细说明:http://www.grails.org/plugin/shiro您必须为应用程序的其余功能添加更多权限.您也可以直接向用户添加这些权限 - 有时对于测试或如果您不想为某些特殊内容设置新角色很有用.

Take a look at the role.User.addToPermissions lines. Here you grant permissions to your controllers and actions. If the role is missing a permission, a user will be redirected to the access denied page. You'll find a good description of how to specify permissions on the shiro plugin page: http://www.grails.org/plugin/shiroYou'll have to add more permissions for the rest of your application functionality.You can add those permission also directly to the user - sometimes useful for testing or if you don't want to setup a new role for something special.

顺便说一句:确保使用 sha256hash 而不是 sha1hash，它不适用于当前的 shiro 版本.

btw: make sure to use the sha256hash and not the sha1hash which will not work with the current shiro version.

我们要做的最后一件事是创建 /conf/SecurityFilters.groovy 类:

last thing we have to do is create the /conf/SecurityFilters.groovy class:

class SecurityFilters {
    def filters = {
        all(uri: "/**") {
            before = {
                // Ignore direct views (e.g. the default main index page).
                if (!controllerName) return true

                // Access control by convention.
                accessControl()
            }
        }
    }
}

这将为所有控制器安装访问控制，但不会为直接视图(我们的索引页面)安装访问控制.

This will install access control for all controllers but not direct views (our index page).

现在尝试运行您的项目:

Now give it a try and run your project:

grails run-app

希望有帮助！

这篇关于如何在我的项目中实现 Grails 的 Shiro 安全的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！