SpringBoot2 整合 Shiro 基于URL的权限校验

概念模型

用户与角色之间是一对一关联,角色与资源之间是多对多关联(关联关系用中间表来维护)

Resource里面存储着系统的url路径

模型字段都很简单,SQL及Model类就不再贴出来了.

---

1.引入依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.3.2</version>
</dependency>

添加这一个依赖就够用了,它会依赖core和web

 

---

我写的shiro类有这些

CheckLoginFilter  登录认证过滤器

CheckPermissionsFilter 权限校验过滤器

ShiroConfig 配置类(核心)

ShiroLifecycleBeanPostProcessorConfig shiro生命周期管理

ShiroPermissionResolver 生成Permission实例(关键)

ShiroWildcardPermission Permission的子孙类,判断权限通过与否(关键)

UserRealm 提供身份认证和授权(核心)

要使用自定义的鉴权方式,需要写  PermissionResolver  和  WildcardPermission 的子类

注:所有的Service类.就不贴出来了,功能很简单

1.首先看一下UserRealm

doGetAuthorizationInfo 和 doGetAuthenticationInfo方法必须要求实现

这里为了url权限校验的需要,覆盖了isPermitted方法(这不是必须的)

package com.web.shiro;

import com.web.constant.Constant;
import com.web.constant.ErrorCode;
import com.web.dto.AuthorizationRoleInfoDTO;
import com.web.entity.Role;
import com.web.entity.User;
import com.web.exception.PolarisException;
import com.web.service.RoleService;
import com.web.service.UserService;
import org.apache.commons.collections4.CollectionUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.Permission;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.MemorySessionDAO;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.SimplePrincipalCollection;
import org.apache.shiro.subject.support.DefaultSubjectContext;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Lazy;

import java.io.Serializable;
import java.util.Collection;
import java.util.HashSet;

/**
 * Realm 充当了 Shiro 与应用安全数据间的“桥梁”或者“连接器”
 *
 * @author 
 * @date 2019/07/09 10:43
 */
public class UserRealm extends AuthorizingRealm {
    @Autowired
    @Lazy
    private UserService userService;
    @Autowired
    @Lazy
    private RoleService roleService;
    @Autowired
    @Lazy
    private MemorySessionDAO sessionDAO;

    /**
     * 授权
     *
     * @param principal principal
     * @return 用户权限信息集合
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal) {
        User user = (User) principal.getPrimaryPrincipal();
        SimpleAuthorizationInfo info = (SimpleAuthorizationInfo) SecurityUtils.getSubject()
                .getSession().getAttribute(Constant.AUTHORIZATION_INFO);
        if (info != null) {
            return info;
        }

        info = new SimpleAuthorizationInfo();
        AuthorizationRoleInfoDTO roleInfo = roleService.getAuthorizationRoleInfoDTOByUsername(user.getUsername());
        if (roleInfo == null) {
            return info;
        }

        info.