how to implement Shiro Security of Grails in my Project
i m new to Grails and using some Shiro security. I have made a little site with login page and if login successful it redirects me to another loggedin page.
now i want to implement Shiro Security. I have run that plugin and quick start app of Shiro on new Grails Project.
what i want to achieve is that how can i implement my security on my own pages using the Quick Start Files and code开发者_StackOverflow中文版. Please guide. a little. which files should i use from that quick start and what changing should i made. ?
waiting for some positive response :)
let's first start with a fresh app:
grails create-app ShiroDemo
now install shiroby adding it to the plugins section of BuildConfig.groovy:
plugins { compile ":shiro:1.1.4" }
we need the auth controller and the wildcard-realm:
grails create-auth-controller
grails create-wildcard-realm
now let's create a dummy user with the needed role and permissions in bootstrap.groovy
:
import org.apache.shiro.crypto.hash.Sha256Hash
class BootStrap {
def init = { servletContext ->
def roleUser = new ShiroRole(name:'USER')
roleUser.addToPermissions('auth:*')
roleUser.addToPermissions('controller:action')
roleUser.save(flush:true, failOnError: true)
def testUser = new ShiroUser(username:'kermit',passwordHash:new Sha256Hash("password").toHex())
testUser.addToRoles(roleUser)
testUser.save(flush:true, failOnError: true)
}
def destroy = {
}
}
Take a look at the role.User.addToPermissions
lines. Here you grant permissions to your controllers and actions. If the role is missing a permission, a user will be redirected to the access denied page. You'll find a good description of how to specify permissions on the shiro plugin page: http://www.grails.org/plugin/shiro
You'll have to add more permissions for the rest of your application functionality.
You can add those permission also directly to the user - sometimes useful for testing or if you don't want to setup a new role for something special.
btw: make sure to use the sha256hash and not the sha1hash which will not work with the current shiro version.
last thing we have to do is create the /conf/SecurityFilters.groovy
class:
class SecurityFilters {
def filters = {
all(uri: "/**") {
before = {
// Ignore direct views (e.g. the default main index page).
if (!controllerName) return true
// Access control by convention.
accessControl()
}
}
}
}
This will install access control for all controllers but not direct views (our index page).
Now give it a try and run your project:
grails run-app
hope that helps!
精彩评论