Shiro请求授权实现中

1.修改数据库添加权限字段，pojo也添加perms字段

2.添加授权的路径和访问需要的权限

@Configuration
public class ShiroConfig {
    /*三步走，倒着写,将它们交给Spring管理*/
    //ShiroFilterFactoryBean:3
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        factoryBean.setSecurityManager(securityManager);
        //添加Shiro内置拦截器 拦截请求
        /*
        *
            anon:无需认证就可以访问，
            authc:必须认证了 才能让问
            user:必须拥有 记住我功能才能用
            perms:拥有对某个资源的权限才能访间:
            role:拥有某 个角色权限才能访问
            filterMap.put("/user/add","authc");//支持通配符
        * */
        Map<String, String> filterMap = new LinkedHashMap<>();
        //授权，正常的情况下，没有授权会跳到未授权的页面
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","perms[user:update]");
        //对/user/*下的资源进行认证
        filterMap.put("/user/*","authc");
        factoryBean.setFilterChainDefinitionMap(filterMap);

        //设置登录请求
        factoryBean.setLoginUrl("/toLogin");
        //这只未授权页面
        factoryBean.setUnauthorizedUrl("/unauthor");

        return factoryBean;
    }
    //DefaultWebSecurityManager:2  @Bean(name = "securityManager")给bean取别名
    @Bean(name = "securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联Realm
        securityManager.setRealm(userRealm);
        return securityManager;
    }
    //创建realm对象，需要自定义类：1，
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }
}

3.进行授权

//自定义UserRealm 需要extends AuthorizingRealm
public class UserRealm extends AuthorizingRealm {
    @Autowired
    UserServiceImpl userService;
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了=>授权 doGetAuthorizationInfo");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

        //拿到当前登录的这个对象
        Subject subject = SecurityUtils.getSubject();
        User currentUser = (User)subject.getPrincipal();//从认证中拿到user
        //设置当前用户权限 权限放在数据库中
        info.addStringPermission(currentUser.getPerms());
        //返回info
        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了=>认证 doGetAuthorizationInfo");
        //用户名 密码 数据库中获取
       /* String name = "root";
        String password = "root";*/

        UsernamePasswordToken userToken = (UsernamePasswordToken)authenticationToken;//强制转换成登录的UsernamePasswordToken
       /* if (!userToken.getUsername().equals(name)){
            return null;//抛出分常 UnknownAccountException
        }*/
        //连接真实数据库
        User user = userService.queryUserByName(userToken.getUsername());
        if (user == null) {
            return null;
        }
        //可以加密 MD5 MD5盐值加密
        //密码认证
        return new SimpleAuthenticationInfo(user,user.getPwd(),"");
    }
}