Shiro权限认证

最新推荐文章于 2024-10-15 17:08:42 发布

原创最新推荐文章于 2024-10-15 17:08:42 发布 · 125 阅读

0 ·

CC 4.0 BY-SA版权

Shiro 专栏收录该内容

7 篇文章

订阅专栏

本文介绍如何使用Apache Shiro进行用户认证、角色管理和权限控制。包括配置Maven依赖、创建用户角色及权限、编程式权限检查及注解式授权等实践内容。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

创建一张表 users 加入一条数据

创建一个Maven项目，贴上依赖

<dependencies>
  	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-core</artifactId>
		<version>1.2.4</version>
    </dependency>
    
    <dependency>
		<groupId>org.slf4j</groupId>
		<artifactId>slf4j-log4j12</artifactId>
		<version>1.7.12</version>
	</dependency>
	
	<dependency>
		<groupId>c3p0</groupId>
		<artifactId>c3p0</artifactId>
		<version>0.9.1.2</version>
	</dependency>
	
	<dependency>
		<groupId>commons-logging</groupId>
		<artifactId>commons-logging</artifactId>
		<version>1.2</version>
	</dependency>
	
	<dependency>
		<groupId>mysql</groupId>
		<artifactId>mysql-connector-java</artifactId>
		<version>5.1.37</version>
	</dependency>
	<dependency>
		<groupId>junit</groupId>
		<artifactId>junit</artifactId>
		<version>4.12</version>
	</dependency>
	
  </dependencies>

在 source下创建shiro_role.ini文件创建用户分配角色

[users]
java1234=123456,role1,role2
jack=123,role1

编程式权限：

java代码；

package shiro2;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;

public class ShiroUtil {

	public static Subject login(String configFile,String userName,String password){
		// 读取配置文件，初始化SecurityManager工厂
		Factory<SecurityManager> factory=new IniSecurityManagerFactory(configFile);
		// 获取securityManager实例
		SecurityManager securityManager=factory.getInstance();
		// 把securityManager实例绑定到SecurityUtils
		SecurityUtils.setSecurityManager(securityManager);
		// 得到当前执行的用户
		Subject currentUser=SecurityUtils.getSubject();
		// 创建token令牌，用户名/密码
		UsernamePasswordToken token=new UsernamePasswordToken(userName, password);
		try{
			// 身份认证
			currentUser.login(token);	
			System.out.println("身份认证成功！");
		}catch(AuthenticationException e){
			e.printStackTrace();
			System.out.println("身份认证失败！");
		}
		return currentUser;
	}
}

角色测试类：check时，没有这个角色会报异常，有这个角色正常通过

package shiro2;


import java.util.Arrays;

import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class RoleTest {

	@Test
	public void testHasRole() {
		Subject currentUser=ShiroUtil.login("classpath:shiro_role.ini", "java1234", "123456");
		// Subject currentUser=ShiroUtil.login("classpath:shiro_role.ini", "jack", "123");
		System.out.println(currentUser.hasRole("role1")?"有role1这个角色":"没有role1这个角色");
		boolean []results=currentUser.hasRoles(Arrays.asList("role1","role2","role3"));
		System.out.println(results[0]?"有role1这个角色":"没有role1这个角色");
		System.out.println(results[1]?"有role2这个角色":"没有role2这个角色");
		System.out.println(results[2]?"有role3这个角色":"没有role3这个角色");
		System.out.println(currentUser.hasAllRoles(Arrays.asList("role1","role2"))?"role1,role2这两个角色都有":"role1,role2这个两个角色不全有");
		
		currentUser.logout();
	}

	@Test
	public void testCheckRole() {
		Subject currentUser=ShiroUtil.login("classpath:shiro_role.ini", "java1234", "123456");
		// Subject currentUser=ShiroUtil.login("classpath:shiro_role.ini", "jack", "123");
		currentUser.checkRole("role1");
		currentUser.checkRoles(Arrays.asList("role1","role2"));
		currentUser.checkRoles("role1","role2","role3");
		
		currentUser.logout();
	}
}

创建一个shiro_permission.ini 给用户分配角色分配权限

[users]
java1234=123456,role1,role2
jack=123,role1
[roles]
role1=user:select
role2=user:add,user:update,user:delete

测试权限类：

package shiro2;


import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class PermissionTest {

	@Test
	public void testIsPermitted() {
		Subject currentUser=ShiroUtil.login("classpath:shiro_permission.ini", "java1234", "123456");
		// Subject currentUser=ShiroUtil.login("classpath:shiro_permission.ini", "jack", "123");
		System.out.println(currentUser.isPermitted("user:select")?"有user:select这个权限":"没有user:select这个权限");
		System.out.println(currentUser.isPermitted("user:update")?"有user:update这个权限":"没有user:update这个权限");
		boolean results[]=currentUser.isPermitted("user:select","user:update","user:delete");
		System.out.println(results[0]?"有user:select这个权限":"没有user:select这个权限");
		System.out.println(results[1]?"有user:update这个权限":"没有user:update这个权限");
		System.out.println(results[2]?"有user:delete这个权限":"没有user:delete这个权限");
		System.out.println(currentUser.isPermittedAll("user:select","user:update")?"有user:select,update这两个权限":"user:select,update这两个权限不全有");
		
		currentUser.logout();
	}

	@Test
	public void testCheckPermitted() {
		Subject currentUser=ShiroUtil.login("classpath:shiro_permission.ini", "java1234", "123456");
		// Subject currentUser=ShiroUtil.login("classpath:shiro_permission.ini", "jack", "123");
		currentUser.checkPermission("user:select");
		currentUser.checkPermissions("user:select","user:update","user:delete");
		currentUser.logout();
	}
}

注解式授权：