shiro权限管理

最新推荐文章于 2022-10-19 15:27:05 发布

原创最新推荐文章于 2022-10-19 15:27:05 发布 · 160 阅读

0 ·

CC 4.0 BY-SA版权

shiro 专栏收录该内容

1 篇文章

订阅专栏

所需要的依赖

        <dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		<!-- 导入thymeleaf依赖 -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-thymeleaf</artifactId>
		</dependency>

		<!--spring与shiro的整合依赖 -->
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-spring</artifactId>
			<version>1.4.0</version>
		</dependency>

		<!-- mybatis的相关依赖 -->
		<!-- 数据库连接池 -->
		<dependency>
			<groupId>com.alibaba</groupId>
			<artifactId>druid</artifactId>
			<version>1.0.9</version>
		</dependency>
		<!-- mysql的驱动程序 -->
		<dependency>
			<groupId>mysql</groupId>
			<artifactId>mysql-connector-java</artifactId>
		</dependency>
		<!--mybatis和spring boot整合依赖  -->
		<dependency>
			<groupId>org.mybatis.spring.boot</groupId>
			<artifactId>mybatis-spring-boot-starter</artifactId>
			<version>1.1.1</version>
		</dependency>
		<!--mybatis 分页插件 -->
		<dependency>
			<groupId>com.github.pagehelper</groupId>
			<artifactId>pagehelper</artifactId>
			<version>4.1.4</version>
		</dependency>

config配置

package com.shiro.shiroconfig;
import java.util.LinkedHashMap;
import java.util.Map;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfig {

	/**
	 * 创建ShiroFilterFactoryBean
	 */
	@Bean
	public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityManager securityManager) {
		ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean() ;
		//设置安全管理器
		shiroFilterFactoryBean.setSecurityManager(securityManager);
		//添加shiro内置过滤器
		/**
		 * shiro内置过滤器，可以实现权限相关的拦截器
		 *  	常用的拦截器
		 *  	anon:无需认证（登录）就可以访问
		 *  	authc:必须认证才可以访问(登录)
		 *  	user:如果使用remeberMe的功能才可以直接访问
		 *  	perms:该资源必须得到资源权限才可以访问
		 *  	role:该资源必须得到角色权限才可以访问
		 */
		Map<String,String> filterMap=new LinkedHashMap<String,String>();
		//filterMap.put("/add","authc");
		filterMap.put("/update", "authc");
		filterMap.put("/user/*", "authc");//通配符的方式设置
		filterMap.put("/welcome", "anon");
		filterMap.put("/loginPage", "anon");
		filterMap.put("/login", "anon");
		/**
		 * 资源授权过滤器
		 * 
		 * 指定：add资源必须要有有user:add的权限
		 */
		filterMap.put("/add", "perms[user:add]");
		
		
		
		//修改跳转的登录界面，默认是login.jsp
		shiroFilterFactoryBean.setLoginUrl("/login");
		//设置未授权的提示界面
		shiroFilterFactoryBean.setUnauthorizedUrl("/noAuth");
		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
		return shiroFilterFactoryBean;
	}
	
	
	/**
	 * 创建DefaultWebSecurityManager
	 */
	@Bean(name="securityManager")
	public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm) {
		DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
		securityManager.setRealm(userRealm);
		return securityManager;
	}
	
	
	/**
	 * 创建Realm
	 */
	@Bean(name="userRealm")
	public UserRealm getRealm() {
		return new UserRealm();
	}
}

Realm配置

package com.shiro.shiroconfig;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;

import com.shiro.model.Login;
import com.shiro.service.UserService;
import com.shiro.uitl.ServiceRsObjModel;

/**
 * 
 *
 */
public class UserRealm extends AuthorizingRealm {

	@Autowired
	UserService userService;
	
	/**
	 * 执行授权逻辑
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		System.out.println("执行授权逻辑");
		//给资源进行授权
		SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
		//添加资源授权字符串
		Subject subject=SecurityUtils.getSubject();
		Login login=(Login) subject.getPrincipal();
		if(login!=null) {
			info.addStringPermission(login.getPerms());//该参数可以改成list集合，设置权限类表
		}
		return info;
	}

	/**
	 * 执行一些认证的逻辑
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		System.out.println("执行一些认证的逻辑");
		/**
		 * 判断用户名和密码是否正确
		 */
		UsernamePasswordToken tokenInfo=(UsernamePasswordToken)token;
		String loginName=tokenInfo.getUsername();
		Login login=new Login();
		login.setLoginname(loginName);
		ServiceRsObjModel<Login> loginResult=userService.userLogin(login);
		if(loginResult.isSuccess()) {
			if(loginResult.getRsData()==null) {
				return null;
				//shiro底层会抛出UnKnowAccountException
			}
			//判断密码
			return new SimpleAuthenticationInfo(loginResult.getRsData(),loginResult.getRsData().getPassword(),"");
		}else {
			return new SimpleAuthenticationInfo(loginResult.getRsData(),"","");
		}
	}

}

测试

package com.shiro.controller;


import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

import com.shiro.model.LoginModel;
import com.shiro.uitl.MD5;

@Controller
public class TestController {

	@RequestMapping("/hello")
	public String hello(Model model) {
		model.addAttribute("name", "hello ,xuwenchan");
		return "index";
	}
	@RequestMapping("/add")
	public String add() {
		return "add";
	}
	@RequestMapping("/update")
	public String update() {
		return "update";
	}
	
	@RequestMapping("/login")
	public String login(LoginModel model) {
		/**
		 * 使用shiro编写认证操作
		 */
		//1，获取Subject
		Subject subject=SecurityUtils.getSubject();
		//2 封装用户数据
		UsernamePasswordToken token=new UsernamePasswordToken(model.getLoginName(),MD5.parseMD5(model.getPwd()));
		//3 执行登录方法
		try {
			subject.login(token);//只要调用login方法就会调用认证逻辑UserRealm
			return "redirect:hello";
		}catch(UnknownAccountException e) {
			return "login";
		}catch(IncorrectCredentialsException e) {
			return "login";
		}
	}
	
	@RequestMapping("/welcome")
	public String welcome() {
		return "welcome";
	}
	
	@RequestMapping("noAuth")
	public String noAuth() {
		return "noAuth";
	}
	
	@RequestMapping("/loginPage")
	public String loginPage() {
		return "login";
	}
	
}