springboot整合shiro的使用

实现登录的拦截和授权的管理

数据库：

添加依赖spring整合shiro的依赖：

<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>

自定义Realm：

package leane.shiro.springbootshiro.shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;

import leane.shiro.springbootshiro.entity.User;
import leane.shiro.springbootshiro.service.UserService;

/**
 * 自定义Realm
 * @author xing
 *
 */
public class UserRealm extends AuthorizingRealm{

	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		System.out.println("执行授权逻辑");
		
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		//获取当前登录用户
		Subject subject = SecurityUtils.getSubject();
		User user = (User)subject.getPrincipal();
		System.err.println(user.getPerms());
		info.addStringPermission(user.getPerms());
		
		return info;
	}

	
	@Autowired
	private UserService userService;
	
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0) throws AuthenticationException {
		//arg0控制器层传入的用户名和密码封装的token
		UsernamePasswordToken token = (UsernamePasswordToken)arg0;
		//调用业务层方法：根据用户名获取用户信息
		User user = userService.getUserByUsername(token.getUsername());		
		if(user == null) {
			//用户名不存在，返回null,shiro底层会抛出UnknownAccountException异常
			return null;
		}
		
		/**
		 * 判断密码
		 * 	第一个参数：需要返回的数据
		 * 	第二个参数：数据库中的密码，shiro会自动判断
		 *  第三个参数：shiro的名字
		 */
		return new SimpleAuthenticationInfo(user,user.getPassword(),"");
	}

	
}

创建shiro配置类：

package leane.shiro.springbootshiro.shiro;


import java.util.LinkedHashMap;
import java.util.Map;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;


@Configuration
public class ShiroConfig {
	@Bean
	public ShiroFilterFactoryBean getShiroFilterFactoryBean() {
		ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
		shiroFilterFactoryBean.setSecurityManager(getDefaultWebSecurityManager());
		
		/**
		 * 添加shiro内置过滤器
		 * 	常用过滤器
		 * 		anon:无需认证（登录）可以访问
		 * 		authc:必须认证才可以访问
		 * 		user:如果使用rememberMe的功能才可以访问
		 * 		perms:该资源必须得到资源权限才可以访问
		 * 		role:该资源必须得到角色权限才可以访问
		 */
		Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
		//设置无需登录就可以访问的请求路径
		filterChainDefinitionMap.put("/login", "anon");
		filterChainDefinitionMap.put("/toLogin", "anon");
		
		//授权拦截器，当授权拦截后，shiro会自动跳转到未授权页面
		filterChainDefinitionMap.put("/user/add", "perms[user:add]");
		filterChainDefinitionMap.put("/user/update", "perms[user:update]");
		
		//设置必须登录认证才可以访问的请求路径
		filterChainDefinitionMap.put("/**", "authc");
		
		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
		
		//修改跳转的页面
		shiroFilterFactoryBean.setLoginUrl("/toLogin");
		//设置未授权提示页面
		shiroFilterFactoryBean.setUnauthorizedUrl("/noAuth");
		
		return shiroFilterFactoryBean;
	}
	
	@Bean
	public DefaultWebSecurityManager getDefaultWebSecurityManager() {
		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
		securityManager.setRealm(getRealm());
		return securityManager;
	}

	@Bean
	public UserRealm getRealm() {
		return new UserRealm();
	}
}

控制器层：

package leane.shiro.springbootshiro.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class UserController {

	@RequestMapping("toLogin")
	public String toLogin() {
		return "login";
	}
	
	@RequestMapping("login")
	public String login(String username,String password,Model model) {
		
		//1.获取Subject
		Subject subject = SecurityUtils.getSubject();
		
		//2.封装用户数据
		UsernamePasswordToken token = new UsernamePasswordToken(username, password);
		
		//3.执行登录方法
		try {
			subject.login(token);
			//登录成功重定向到主页
			return "redirect:/index";
		} catch (UnknownAccountException e) {
			//用户名不存在
			model.addAttribute("msg", "用户名不存在");
			return "login";
		} catch (IncorrectCredentialsException e) {
			//用户名不存在
			model.addAttribute("msg", "密码错误");
			return "login";
		}
	}
	
	@RequestMapping("noAuth")
	public String noAuth() {
		return "noAuth";
	}
	
	@RequestMapping("index")
	public String index(Model model) {
		model.addAttribute("name", "test");
		return "index";
	}
	
	@RequestMapping("user/add")
	public String toAdd() {
		return "add";
	}
	
	@RequestMapping("user/update")
	public String toUpdate() {
		return "update";
	}
}

 

thymeleaf整合shiro(不同权限的用户登录，隐藏权限范围外的标签):

1.添加thymeleaf整合shiro依赖：

<!-- https://mvnrepository.com/artifact/com.github.theborakompanioni/thymeleaf-extras-shiro -->
		<dependency>
			<groupId>com.github.theborakompanioni</groupId>
			<artifactId>thymeleaf-extras-shiro</artifactId>
			<version>2.0.0</version>
		</dependency>

2.在shiro配置类中添加

/**
	 * 配置ShiroDialect,用于Thymeleaf和Shiro标签配合使用
	 */
	@Bean
	public ShiroDialect getShiroDialect() {
		return new ShiroDialect();
	}

 3.在html页面中添加shiro:hasPermission属性

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>主页</title>
</head>
<body>
<h3 th:text="${name}"></h3>
<hr>
<!--如果用户没有user:add，则该标签不现实-->
<div shiro:hasPermission="user:add">
	<a href="/user/add">添加</a>
</div>
<div shiro:hasPermission="user:update">
	<a href="/user/update">修改</a>
</div>
</body>
</html>