Spring-shiro-Boot-10 shiro项目中的权限控制实例

以user模块来实现shiro中的权限控制。

一、用户列表展示-----前端进行permissions权限控制

(1) 前端：获取用户当前权限

function checkPermission() {
	var pers = [];
	$.ajax({
		type : 'get',
		url : '/permissions/owns',
		contentType : "application/json; charset=utf-8",
		async : false,
		success : function(data) {
			pers = data;
			$("[permission]").each(function() {
				var per = $(this).attr("permission");
				if ($.inArray(per, data) < 0) {
					$(this).hide();
				}
			});
		}
	});
	
	return pers;
}

（2）前端：判断当前权限

var edit = buttonEdit(href, "sys:user:add", pers);

function buttonEdit(href, permission, pers){
	if(permission != ""){
		if ($.inArray(permission, pers) < 0) {
			return "";
		}
	}
	...
}

二、用户新增-----后端进行permissions权限控制

（1）准备好用户参数、权限参数等，发起表单提交。【POST】

            var formdata = $("#form").serializeObject();
		    formdata.roleIds = getCheckedRoleIds();


			$.ajax({
				type : 'post',
				url : '/users',
				contentType: "application/json; charset=utf-8",  
				data : JSON.stringify(formdata),
				success : function(data) {
					layer.msg("添加成功", {shift: -1, time: 1000}, function(){
                        location.href = "userList.html";
                    });
				}
			});

（2）转换为Dto

//#######UserDto######### 

public class UserDto extends User {

	private static final long serialVersionUID = -184009306207076712L;

	private List<Long> roleIds;

	public List<Long> getRoleIds() {
		return roleIds;
	}

	public void setRoleIds(List<Long> roleIds) {
		this.roleIds = roleIds;
	}

}

//#######User #########

public class User extends BaseEntity<Long> {

	private static final long serialVersionUID = -6525908145032868837L;

	private String username;
	private String password;
	@JsonIgnore
	private String salt;
	private String nickname;
	private String headImgUrl;
	private String phone;
	private String telephone;
	private String email;
	@JsonFormat(pattern = "yyyy-MM-dd")
	private Date birthday;
	private Integer sex;
	private Integer status;	
   
    public interface Status {
		int DISABLED = 0;
		int VALID = 1;
		int LOCKED = 2;
	}

}

(3)获取参数，进行权限验证

    @LogAnnotation
	@PostMapping
	@ApiOperation(value = "保存用户")
	@RequiresPermissions("sys:user:add")
	public User saveUser(@RequestBody UserDto userDto) {
		User u = userService.getUser(userDto.getUsername());
		if (u != null) {
			throw new IllegalArgumentException(userDto.getUsername() + "已存在");
		}

		return userService.saveUser(userDto);
	}

参数传递没什么好说的，重点看权限验证，也就是

@RequiresPermissions("sys:user:add")

这里想说一下shiro的授权方式：一共有三种。一种是编程式。一种是注解式。一种是标签式。无论是哪一种方式，相应的Realm实现Authorizer 都会进行判断。

//编程式
Subject subject = SecurityUtils.getSubject(); 
if(subject.hasRole(“admin”)) 
{ //有权限 } 
else 
{ //无权限 }



//注解式
@RequiresRoles("admin") 
public void hello() 
{ //有权限 }



//标签式
<shiro:hasRole name="admin"> 
<!— 有权限—> 
</shiro:hasRole>

（4）shiro权限控制

主要做以下几点，获取当前用户的角色和权限；将其放入session；将其放入authorizationInfo；

具体代码如下：

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		log.debug("权限配置");

		SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
		User user = UserUtil.getCurrentUser();
		//获取当前用户对应的角色ids
		List<Role> roles = SpringUtil.getBean(RoleDao.class).listByUserId(user.getId());
		//获取当前用户对应的角色names
		Set<String> roleNames = roles.stream().map(Role::getName).collect(Collectors.toSet());
		
        //一、authorizationInfo设置角色
		authorizationInfo.setRoles(roleNames);
		//获取当前用户对应的权限permissions
		List<Permission> permissionList = SpringUtil.getBean(PermissionDao.class).listByUserId(user.getId());
		//为当前用户设置权限，放到session中
		UserUtil.setPermissionSession(permissionList);
		Set<String> permissions = permissionList.stream().filter(p -> !StringUtils.isEmpty(p.getPermission()))
				.map(Permission::getPermission).collect(Collectors.toSet());
		
        
        //二、authorizationInfo设置权限
		authorizationInfo.setStringPermissions(permissions);

		return authorizationInfo;

	}