shiro 配置

第一步：添加依赖

<!-- 添加 shiro 权限框架 依赖 -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>

第二步： shiro配置类

import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.apache.shiro.mgt.SecurityManager;
import org.springframework.context.annotation.DependsOn;

import java.util.LinkedHashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {
    @Bean
    MyRealm myRealm() {
        return new MyRealm();
    }

    @Bean
    SecurityManager securityManager() {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(myRealm());
        return manager;
    }

    @Bean
    ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(securityManager());
        bean.setLoginUrl("/login");
        bean.setSuccessUrl("/index");
        bean.setUnauthorizedUrl("/unauthorizedurl");
        Map<String, String> map = new LinkedHashMap<>();
        map.put("/login", "anon");//anon表示任意角色都可以访问
        map.put("/lib/**", "anon");//anon表示任意角色都可以访问
        map.put("/**", "authc");//authc表示必须认证后才能访问
        bean.setFilterChainDefinitionMap(map);
        return bean;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
        return new LifecycleBeanPostProcessor();
    }
    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
    
}

第三步：shiro认证授权类

import com.kede.springbootdemo.entity.SysMenu;
import com.kede.springbootdemo.entity.SysRole;
import com.kede.springbootdemo.entity.SysUser;
import com.kede.springbootdemo.service.SysMenuService;
import com.kede.springbootdemo.service.SysRoleService;
import com.kede.springbootdemo.service.SysUserService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.List;

/**
 * shiro 认证授权
 */
public class MyRealm extends AuthorizingRealm {


    @Autowired
    SysUserService sysUserService;
    @Autowired
    SysRoleService sysRoleService;
    @Autowired
    SysMenuService sysMenuService;

    /**
     *授权
     * @param principals
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        System.out.println("授权doGetAuthorizationInfo方法执行");
        String userName = (String) getAvailablePrincipal(principals);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

        List<SysRole> sysRoles = sysRoleService.UserListRole(userName);
        for (SysRole sysRole : sysRoles) {
                info.addRole(sysRole.getName());
            List<SysMenu> sysMenus = sysMenuService.ListMenuRoleId(sysRole.getId());
            for (SysMenu sysMenu : sysMenus) {
                    info.addStringPermission(sysMenu.getPerms());
            }

        }
        return info;
    }

    /**
     * 认证
     * @param token
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("认证doGetAuthenticationInfo方法执行");
        String username = (String) token.getPrincipal();//用户输入的账号
        String password = new String((char[])token.getCredentials()); //用户输入的密码
        SysUser login = sysUserService.Login(username);
        if(login == null || !password.equals(login.getPassword())){
            return null;
        }
        return new SimpleAuthenticationInfo(username,password,getName());
    }

第四步： 登录时调用Subject

@ResponseBody
@PostMapping("/login")
public AjaxMassage LoginTrue(SysUser user){
     AjaxMassage am = new AjaxMassage();
     try {
          Subject sb = SecurityUtils.getSubject();//执行到这步时会去调用 shiro认证的那个方法
          sb.login(new UsernamePasswordToken(user.getUsername(),user.getPassword()));
          System.out.println("登录成功");
          am.setCode(0);
     }catch (AuthenticationException e){
          System.out.println("登录失败'");
          am.setCode(1);
     }
     return am;
}

第五步： shiro注解

//定义要有修改权限才能访问
//@RequiresPermissions("system:menu:index")
//定义该角色才能访问
@RequiresRoles("admin")
@GetMapping("/deptupdate")
public ModelAndView deptupdate(int id){
    ModelAndView mav = new ModelAndView("updatedept");
    Dept byId = deptService.getById(id);
    mav.addObject("dept",byId);
    return mav;
}