SpringBoot整合shiro安全框架实现登录及权限管理

SpringBoot整合shiro安全框架实现登录及权限管理

这里用了MD5加密

ShiroConfig

@Configuration
public class ShiroConfig {
    //ShiroFilterFactoryBean
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(defaultWebSecurityManager);
        //添加Shiro内置过滤器
        //anon: 无需认证就能访问
        //authc: 认证了才能访问
        //user: 必须拥有记住我功能才能访问
        //perms: 拥有对某个资源的权限才能访问
        //role: 拥有某个角色权限才能访问
        /*filterMap.put("/user/add","authc");
        filterMap.put("/user/update","authc");*/

        Map<String,String> filterMap=new LinkedHashMap<>();
        //授权
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","perms[user:update]");
        filterMap.put("/user/*","perms[user:*]");
        //设置拦截的请求
        filterMap.put("/user/*","authc");
        //未授权页面
        bean.setUnauthorizedUrl("/noauth");
        bean.setFilterChainDefinitionMap(filterMap);//设置一个过滤器的链
        bean.setLoginUrl("/login");

        return bean;
    }
    //DefaulWebSecurityManager
    @Bean(name = "securityManager")
    public DefaultWebSecurityManager getdefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm){
        DefaultWebSecurityManager SecurityManager = new DefaultWebSecurityManager();
        //关联userRealm
        SecurityManager.setRealm(userRealm);
        return SecurityManager;
    }

    //创建Realmd对象需要自定义类
    @Bean(name = "userRealm")
    public UserRealm userRealm(){
        return new UserRealm();
    }
   
    //整合ShiroDialect  用来整合Shiro Thymeleaf
    @Bean
    public ShiroDialect getShiroDialect(){
        return new ShiroDialect();
    }
}

UserRealm

public class UserRealm extends AuthorizingRealm {
    @Autowired
    Userservice userservice;

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //SimpleAuthorizationInfo
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        //拿到当前登录的这个对象
        Subject subject = SecurityUtils.getSubject();
        User currentUser = (User) subject.getPrincipal();//拿到user对象
        if (currentUser.getPerms()==null){//判断是否有权限，如果没有权限或者权限为空则返回null
            return null;
        }
        //设置当前用户的权限，从数据库中查询
        info.addStringPermission(currentUser.getPerms());
        return info;
    }
    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        UsernamePasswordToken userToken= (UsernamePasswordToken) token;
        //连接真实的数据库
        User user = userservice.queryUserbyname(userToken.getUsername());
        if (user==null){//如果user等于null说明这个人查不到
            return null;//就抛出这个UnknownAccountException异常
        }
        //把登录用户塞进shiro的session shiro有自己独立的session~这也是为什么shiro可以脱离web使用
        //登录成功后让登录按钮消失
        Subject subject = SecurityUtils.getSubject();
        Session session = subject.getSession();
        session.setAttribute("loginUser",user);

        //密码认证shiro做
        return  new SimpleAuthenticationInfo(user,user.getPwd(),"");
    }
}

UserMapper

@Repository
@Mapper
public interface UserMapper {
    public User queryUserbyname(String name);
    int insertUser(@Param("username") String username,@Param("password") String password);
}

Mycontroller

@Controller
public class Mycontroller {
    @Autowired
    private Userservice us;
    @RequestMapping({"/","/index"})
    public String toIndex(Model model){
        model.addAttribute("msg","Hello,Shiro");
        return "index";
    }
    @RequestMapping("/login")
    public String tologin(){
        return "login";
    }
    @RequestMapping("/user/add")
    public String toadd(){

        return "user/add";
    }
    @RequestMapping("/user/update")
    public String toupd(){
        return "user/update";
    }

    @RequestMapping("/tologin")
    public String login(String username,String password,Model model){
        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();
        //封装用户的登录数据
        UsernamePasswordToken token = new UsernamePasswordToken(username,MDd5.GetMD5Code(password));
        try {
            subject.login(token);//执行登录方法，如果没有异常就说明登陆成功了
            return "index";
        }catch (UnknownAccountException e){
            model.addAttribute("msg","用户名错误");
            return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密码不正确");
            return "login";
        }
    }
    @RequestMapping("/noauth")
    @ResponseBody
    public String unauthorized(){
        return "未经授权无法访问此页面";
    }

    //跳转到注册页面
    @RequestMapping("/toRegister")
    public String register(){
        return "register";
    }

    @PostMapping("/register")
    public String toregister(@RequestParam("username") String username, @RequestParam("password")String password, Model model){


        int i=us.insertUser(username,  MDd5.GetMD5Code(password));
        if (i==0){
           model.addAttribute("msg","注册失败");
           return  null;
        }else {
            return "redirect:/index";
        }
    }
    @RequestMapping("/logout")
    public String logout(HttpSession session){
        session.invalidate();
        return "redirect:/index.html";
    }
}

User 智力使用了LomBok插件

@Data
@AllArgsConstructor
@NoArgsConstructor
public class User {
    private Integer id;
    private String name;
    private String pwd;
    private String perms;
}

Userservice

public interface Userservice {
    public User queryUserbyname(String name);
    int insertUser(String name,String pwd);
}

UserserviceImpl

@Service
public class UserserviceImpl implements Userservice{
    @Autowired
    private UserMapper userMapper;
    @Override
    public User queryUserbyname(String name) {
        return userMapper.queryUserbyname(name);
    }

    @Override
    public int insertUser(String name,String pwd) {

        return userMapper.insertUser(name,pwd);
    }
}

xml文件

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.aaa.mapper.UserMapper">

    <select id="queryUserbyname" resultType="User" parameterType="String">
       select * from new.user where name=#{name}
    </select>
    <insert id="insertUser" parameterType="String">
        insert into new.user(name,pwd) values(#{username},#{password})
    </insert>
</mapper>

index.html

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<div th:if="${session.loginUser==null}">
    <a th:href="@{/login}">登录</a>
</div>

<h1>首页</h1>
<div>
    <a th:href="@{/toRegister}">注册</a>
</div>
//判断session是否为空，如果不为空则显示退出按钮否则不显示
<div th:if="${session.loginUser!=null}">
    <a th:href="@{/logout}">退出</a>
</div>

<div th:text="${msg}"></div>
//判断是否有user:add这个权限
 <div shiro:hasPermission="user:add">
     <a th:href="@{/user/add}">add</a>
 </div>
 //判断是否有user:update这个权限
<div shiro:hasPermission="user:update">
    <a th:href="@{/user/update}">update</a>
</div>
</body>
</html>

注册

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
    <meta name="description" content="">
    <meta name="author" content="">
    <!-- Bootstrap core CSS -->
    <link th:href="@{/css/bootstrap.min.css}" rel="stylesheet">
    <!-- Custom styles for this template -->
    <link th:href="@{/css/signin.css}" rel="stylesheet">
    <title>注册</title>
</head>
<body>
<form class="form-signin" th:action="@{/register}" method="post">
    <h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
    <label class="sr-only">Username</label>
    <input type="text" class="form-control" name="username"/>
    <label class="sr-only">Password</label>
    <input type="password" name="password" class="form-control" placeholder="Password" required="">
    <div class="checkbox mb-3">
    </div>
    <button class="btn btn-lg btn-primary btn-block" type="submit">注册</button>
    <p class="mt-5 mb-3 text-muted">© 2017-2018</p>
    <a class="btn btn-sm">中文</a>
    <a class="btn btn-sm">English</a>
</form>
</body>
</html>

登录

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
	<head>
		<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
		<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
		<meta name="description" content="">
		<meta name="author" content="">
		<title>Signin Template for Bootstrap</title>
		<!-- Bootstrap core CSS -->
		<link th:href="@{/css/bootstrap.min.css}" rel="stylesheet">
		<!-- Custom styles for this template -->
		<link th:href="@{/css/signin.css}" rel="stylesheet">
	</head>

	<body class="text-center">
		<form class="form-signin" th:action="@{/tologin}" method="post">
			<img class="mb-4" th:src="@{/img/bootstrap-solid.svg}" alt="" width="72" height="72">
			<p th:text="${msg}" style="color: red"></p>
			<h1 class="h3 mb-3 font-weight-normal">Please sign in</h1>
			<label class="sr-only">Username</label>
			<input type="text" class="form-control" name="username"/>
			<label class="sr-only">Password</label>
			<input type="password" name="password" class="form-control" placeholder="Password" required="">
			<div class="checkbox mb-3">
				<label>
          <input type="checkbox" value="remember-me"> Remember me
        </label>
			</div>
			<button class="btn btn-lg btn-primary btn-block" type="submit">Sign in</button>
			<p class="mt-5 mb-3 text-muted">© 2017-2018</p>
			<a class="btn btn-sm">中文</a>
			<a class="btn btn-sm">English</a>
		</form>

	</body>

</html>

这是根据B站上面狂神说的视频做下来的，并在此基础上加了MD5加密