Apache Shiro JdbcRealm with JavaConfig and Spring Boot

Question

我正在尝试配置我的Spring Boot应用程序以使用Apache Shiro作为其安全框架。我有一个PropertiesRealm工作的一切，现在我试图让它与JdbcRealm和Spring Boot的内置H2数据库一起工作。下面是我在pom.xml中的依赖项:

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.2.3</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.2.3</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.2.3</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
    <groupId>com.h2database</groupId>
    <artifactId>h2</artifactId>
</dependency>

我schema.sql

:

create table if not exists users (
  username varchar(256),
  password varchar(256),
  enabled boolean
);
create table if not exists user_roles (
  username varchar(256),
  role_name varchar(256)
);

我data.sql

:

insert into users (username, password, enabled) values ('user', '04f8996da763b7a969b1028ee3007569eaf3a635486ddab211d512c85b9df8fb', true);
insert into user_roles (username, role_name) values ('user', 'guest');

和我的WebSecurityConfig.java类配置一切:

package security;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.crypto.hash.Sha256Hash;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.filter.authc.AnonymousFilter;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.apache.shiro.web.filter.authc.LogoutFilter;
import org.apache.shiro.web.filter.authc.UserFilter;
import org.apache.shiro.web.filter.authz.RolesAuthorizationFilter;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.h2.server.web.WebServlet;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.context.embedded.ServletRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import javax.servlet.Filter;
import javax.sql.DataSource;
import java.util.HashMap;
import java.util.Map;
@Configuration
public class WebSecurityConfig {
    @Bean(name = "shiroFilter")
    public ShiroFilterFactoryBean shiroFilter() {
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
        Map<String, String> filterChainDefinitionMapping = new HashMap<>();
        filterChainDefinitionMapping.put("/api/health", "authc,roles[guest],ssl[8443]");
        filterChainDefinitionMapping.put("/login", "authc");
        filterChainDefinitionMapping.put("/logout", "logout");
        shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMapping);
        shiroFilter.setSecurityManager(securityManager());
        shiroFilter.setLoginUrl("/login");
        Map<String, Filter> filters = new HashMap<>();
        filters.put("anon", new AnonymousFilter());
        filters.put("authc", new FormAuthenticationFilter());
        LogoutFilter logoutFilter = new LogoutFilter();
        logoutFilter.setRedirectUrl("/login?logout");
        filters.put("logout", logoutFilter);
        filters.put("roles", new RolesAuthorizationFilter());
        filters.put("user", new UserFilter());
        shiroFilter.setFilters(filters);
        return shiroFilter;
    }
    @Bean(name = "securityManager")
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(jdbcRealm());
        return securityManager;
    }
    @Autowired
    private DataSource dataSource;
    @Bean(name = "realm")
    @DependsOn("lifecycleBeanPostProcessor")
    public JdbcRealm jdbcRealm() {
        JdbcRealm realm = new JdbcRealm();
        HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
        credentialsMatcher.setHashAlgorithmName(Sha256Hash.ALGORITHM_NAME);
        realm.setCredentialsMatcher(credentialsMatcher);
        realm.setDataSource(dataSource);
        realm.init();
        return realm;
    }
    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }
    @Bean
    public ServletRegistrationBean h2servletRegistration() {
        ServletRegistrationBean registration = new ServletRegistrationBean(new WebServlet());
        registration.addUrlMappings("/console/*");
        return registration;
    }
}

我在日志中没有看到任何错误。我试着在我的应用程序中添加以下内容来打开日志记录。属性，但是没有多大帮助。

logging.level.org.apache.shiro=debug

谢谢,马特

Answer 1

有几个问题正在发生。

<标题> LifecycleBeanPostProcessor h1> 个问题是由于LifecycleBeanPostProcessor是在你的配置类中定义的。由于它是BeanPostProcessor，因此必须对其进行初始化，以便处理所有其他bean。此外，WebSecurityConfig的剩余部分需要急切地初始化，因为它可能会影响LifecycleBeanPostProcessor。

问题是自动连接功能还不可用，因为它也是BeanPostProcessor(即AutowiredAnnotationBeanPostProcessor)。这意味着DataSource为空。

因为它是空的，JdbcRealm将抛出一个NullPointerException。这又被AbstractAuthenticator捕获并作为AuthenticationException重新抛出。DefaultWebSecurityManager(实际上是它的父DefaultSecurityManager)然后捕获它，调用onFailedLogin，删除"记住我"cookie。

解决LifecycleBeanPostProcessor

最简单的解决方案是确保使用静态方法定义任何与基础设施相关的bean。这告诉Spring它不需要初始化整个配置类(即WebSecurityConfig)。再次

@Bean
public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
    return new LifecycleBeanPostProcessor();
}

或者，您也可以在它们自己的配置中隔离与基础设施相关的bean。

<标题> ShiroFilterFactoryBean h1> 不知道ShiroFilterFactoryBean也实现了BeanPostProcessor。ObjectFactory同时实现BeanPostProcessor是一个非常有趣的例子。

问题是这阻止了数据的加载。SQL，这意味着应用程序在表中没有任何用户，因此身份验证将失败。

问题是数据。sql是通过DataSourceInitializedEvent加载的。然而，由于DataSource的急于初始化(它是BeanPostProcessor的依赖项)，DataSourceInitializedEvent不能被触发。这就是您在日志中看到以下内容的原因:

无法发送事件来完成数据源初始化(ApplicationEventMulticaster未初始化)

确保数据。sql负荷

我看到有几个选项可以让插入语句加载。

data.sql -> schema.sql

最简单的选择是移动数据的内容。SQL到schema.sql。这一模式。SQL仍然是加载的，因为它不需要触发事件来处理它。数据。sql需要一个事件，以便在JPA初始化模式时可以使用相同的机制来加载数据。

修复排序

不幸的是，您不能简单地将ShiroFilterFactoryBean的定义设置为静态，因为它依赖于其他bean定义。幸运的是，在这个实例中确实不需要BeanPostProcessor。这意味着您可以更改代码以返回从等式中删除BeanPostProcessor的工厂bean的结果:

@Bean(name = "shiroFilter")
public AbstractShiroFilter shiroFilter() throws Exception {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    Map<String, String> filterChainDefinitionMapping = new HashMap<>();
    filterChainDefinitionMapping.put("/api/health", "authc,roles[guest],ssl[8443]");
    filterChainDefinitionMapping.put("/login", "authc");
    filterChainDefinitionMapping.put("/logout", "logout");
    shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMapping);
    shiroFilter.setSecurityManager(securityManager());
    shiroFilter.setLoginUrl("/login");
    Map<String, Filter> filters = new HashMap<>();
    filters.put("anon", new AnonymousFilter());
    filters.put("authc", new FormAuthenticationFilter());
    LogoutFilter logoutFilter = new LogoutFilter();
    logoutFilter.setRedirectUrl("/login?logout");
    filters.put("logout", logoutFilter);
    filters.put("roles", new RolesAuthorizationFilter());
    filters.put("user", new UserFilter());
    shiroFilter.setFilters(filters);
    return (AbstractShiroFilter) shiroFilter.getObject();
}

插入用户

在data中找到的插入语句。SQL错误。它需要包含enabled列。例如:

insert into users values ('admin', '22f256eca1f336a97eef2b260773cb0d81d900c208ff26e94410d292d605fed8',true);