Shiro RolesAuthorizationFilter在shiro.ini中的应用

Question

我一直在使用JdbcRealm进行shiro身份验证和授权，它一直运行得很好。我的shiro.ini看起来是这样的：

[main]
authc = org.apache.shiro.web.filter.authc.PassThruAuthenticationFilter
logout = org.apache.shiro.web.filter.authc.LogoutFilter
authc.loginUrl = /login.xhtml
authc.successUrl = /index.xhtml
logout.redirectUrl = /login.xhtml

jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.authenticationQuery = select password from useraccount where active = true and username LIKE ?
jdbcRealm.userRolesQuery = select rolename from role where id in(select roleid from userrole where useraccountid = (select id from useraccount where username LIKE ?) and active = true) and active = true

ds = org.postgresql.jdbc2.optional.SimpleDataSource
ds.serverName = dbhost:5432
ds.user = db_user
ds.password = db_pass
ds.databaseName = db_name
jdbcRealm.dataSource = $ds
#.
#.
#.
jdbcRealm.credentialsMatcher = $passwordMatcher

[users]

[urls]
#.
#.
#.
/admin** = authc, roles[Admin]

/activity.xhtml = authc
/item.xhtml = authc, roles[Branch]
/unauthorized.xhtml = authc

当用户角色说‘分支’试图访问一个用于'Admin‘的url时，用户被安全地重定向到’/unAuthized.xhtml‘。

但是，当我决定将身份验证移到Active时，情况发生了变化；shiro.ini如下所示：

jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.userRolesQuery = select rolename from role where id in(select roleid from userrole where useraccountid = (select id from useraccount where username LIKE ?) and active = true) and active = true
jdbcRealm.dataSource = $ds

ADRealm = org.apache.shiro.realm.activedirectory.ActiveDirectoryRealm
ADRealm.url = ldap://xxx.xxx.xxx.xxx:389
ADRealm.searchBase = "OU=Company Name,DC=domain,DC=local"
ADRealm.systemUsername= myuser
ADRealm.systemPassword= mypass
ADRealm.principalSuffix= @domain.local

securityManager.realms = $jdbcRealm,$ADRealm

身份验证是正常的，但是尝试访问“未经授权的url”会导致错误中断：

[org.apache.shiro.authz.AuthorizationException: LDAP naming error while attempting to retrieve authorization for user [myusername]

如何使授权像以前一样安全地重定向到未经授权的url，而不破坏它？我甚至试过这个：

authz = org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
authz.unauthorizedUrl = /unauthorized.xhtml

但没有成功。

编辑-简而言之，我们如何配置shiro.ini返回http响应401/3 -(未经授权/禁止)在必要的情况下？

Answer 1

如果您试图在401 s中重用您的403页，那么您的/unauthorized.xhtml = authc配置就会阻止它。

您可能可以使用：/unauthorized.xhtml = anon (假设此页面不需要用户上下文)