Shiro--集成springboot（二）

我会带着你远行 2021-08-26 20:20 487阅读 0赞

#### 创建工程，引入依赖 ####

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
      <groupId>org.mybatis.spring.boot</groupId>
      <artifactId>mybatis-spring-boot-starter</artifactId>
      <version>2.0.1</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>1.4.0</version>
    </dependency>

#### 实体类 ####

User：用户实体类

package com.wsl.bean;
    
    import java.util.Set;
    
    public class User { 
        private String id;
        private String userName;
        private String password;
        /** * 用户对应的角色集合 */
        private Set<Role> roles;
        //省略set、get方法等.....
    }

=Role：角色实体类

package com.wsl.bean;
    
    import java.util.Set;
    
    public class Role { 
    
        private String id;
        private String roleName;
        /** * 角色对应权限集合 */
        private Set<Permissions> permissions;
        //省略set、get方法等.....
    }

Permissions：权限实体类：

public class Permissions { 
        private String id;
        private String permissionsName;
        //省略set、get方法等.....
    }

#### Service ####

@Service
    public class LoginServiceImpl implements LoginService { 
    
        @Override
        public User getUserByName(String getMapByName) { 
            //模拟数据库查询，正常情况此处是从数据库或者缓存查询。
            return getMapByName(getMapByName);
        }
    
        /** * 模拟数据库查询 * @param userName * @return */
        private User getMapByName(String userName){ 
            //共添加两个用户，两个用户都是admin一个角色，
            //wsl有query和add权限，zhangsan只有一个query权限
            Permissions permissions1 = new Permissions("1","query");
            Permissions permissions2 = new Permissions("2","add");
            Set<Permissions> permissionsSet = new HashSet<>();
            permissionsSet.add(permissions1);
            permissionsSet.add(permissions2);
            Role role = new Role("1","admin",permissionsSet);
            Set<Role> roleSet = new HashSet<>();
            roleSet.add(role);
            User user = new User("1","wsl","123456",roleSet);
            Map<String ,User> map = new HashMap<>();
            map.put(user.getUserName(), user);
    
            Permissions permissions3 = new Permissions("3","query");
            Set<Permissions> permissionsSet1 = new HashSet<>();
            permissionsSet1.add(permissions3);
            Role role1 = new Role("2","user",permissionsSet1);
            Set<Role> roleSet1 = new HashSet<>();
            roleSet1.add(role1);
            User user1 = new User("2","zhangsan","123456",roleSet1);
            map.put(user1.getUserName(), user1);
            return map.get(userName);
        }
    }

#### Realm ####

public class CustomRealm extends AuthorizingRealm { 
    
        @Autowired
        private LoginService loginService;
    
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 
            //获取登录用户名
            String name = (String) principalCollection.getPrimaryPrincipal();
            //根据用户名去数据库查询用户信息
            User user = loginService.getUserByName(name);
            //添加角色和权限
            SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
            for (Role role : user.getRoles()) { 
                //添加角色
                simpleAuthorizationInfo.addRole(role.getRoleName());
                //添加权限
                for (Permissions permissions : role.getPermissions()) { 
                    simpleAuthorizationInfo.addStringPermission(permissions.getPermissionsName());
                }
            }
            return simpleAuthorizationInfo;
        }
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { 
            //加这一步的目的是在Post请求的时候会先进认证，然后在到请求
            if (authenticationToken.getPrincipal() == null) { 
                return null;
            }
            //获取用户信息
            String name = authenticationToken.getPrincipal().toString();
            User user = loginService.getUserByName(name);
            if (user == null) { 
                //这里返回后会报出对应异常
                return null;
            } else { 
                //这里验证authenticationToken和simpleAuthenticationInfo的信息
                SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(name, user.getPassword().toString(), getName());
                return simpleAuthenticationInfo;
            }
        }
    }

#### 配置类 ####

@Configuration
    public class shiroConfig { 
        //不加这个注解不生效，具体不详
        @Bean
        @ConditionalOnMissingBean
        public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() { 
            DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
            defaultAAP.setProxyTargetClass(true);
            return defaultAAP;
        }
    
        //将自己的验证方式加入容器
        @Bean
        public CustomRealm myShiroRealm() { 
            CustomRealm customRealm = new CustomRealm();
            return customRealm;
        }
    
        //权限管理，配置主要是Realm的管理认证
        @Bean
        public SecurityManager securityManager() { 
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            securityManager.setRealm(myShiroRealm());
            return securityManager;
        }
    
        //Filter工厂，设置对应的过滤条件和跳转条件
        @Bean
        public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) { 
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            Map<String, String> map = new HashMap<>();
            //登出
            map.put("/logout", "logout");
            //对所有用户认证
            map.put("/**", "authc");
            //登录
            shiroFilterFactoryBean.setLoginUrl("/login");
            //首页
            shiroFilterFactoryBean.setSuccessUrl("/index");
            //错误页面，认证不通过跳转
            shiroFilterFactoryBean.setUnauthorizedUrl("/error");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
            return shiroFilterFactoryBean;
        }
    
        //加入注解的使用，不加入这个注解不生效
        @Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { 
            AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
            authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
            return authorizationAttributeSourceAdvisor;
        }
    }

#### Controller ####

@RestController
    public class LoginController { 
    
        @RequestMapping("/login")
        public String login(User user) { 
            //添加用户认证信息
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(
                    user.getUserName(),
                    user.getPassword()
            );
            try { 
                //进行验证，这里可以捕获异常，然后返回对应信息
                subject.login(usernamePasswordToken);
    // subject.checkRole("admin");
    // subject.checkPermissions("query", "add");
            } catch (AuthenticationException e) { 
                e.printStackTrace();
                return "账号或密码错误！";
            } catch (AuthorizationException e) { 
                e.printStackTrace();
                return "没有权限";
            }
            return "login success";
        }
         //注解验角色和权限
        @RequiresRoles("admin")
        @RequiresPermissions("add")
        @RequestMapping("/index")
        public String index() { 
            return "index!";
        }
    }

#### 异常处理 ####

@ControllerAdvice
    @Slf4j
    public class MyExceptionHandler { 
    
        @ExceptionHandler
        @ResponseBody
        public String ErrorHandler(AuthorizationException e) { 
            log.error("没有通过权限验证！", e);
            return "没有通过权限验证！";
        }
    }

#### 测试 ####

打开网页 http://localhost:8080/login?userName=wsl&password=123456

![format_png][]

然后输入index地址：http://localhost:8080/index

![format_png 1][]

换zhangsan账号登录后再访问index
    http://localhost:8080/login?userName=zhangsan&password=123456
    http://localhost:8080/index

![format_png 2][]

[format_png]: /images/20210813/50a34acda3a54e958d787c4cefe08817.png
[format_png 1]: /images/20210813/0b9e86100cc244f29c181c88c53a85b8.png
[format_png 2]: /images/20210813/994457d0458b4af4a3ecb57012c00144.png