SpringBoot 与 Shiro 的整合

向右看齐 2021-11-09 03:24 274阅读 0赞

#### Spring boot 与 Shiro的整合 ####

##### Shiro核心API #####

> Subject:用户主体(把操作交给SecurityManager)  
> SecurityManager:安全管理器(关联Realm)  
> Realm:shrio连接数据的桥梁

##### github地址(基础的springboot与shiro的整合demo，不喜勿喷，欢迎star，后续更新springboot+shiro+jwt实现前后端分离demo) #####

> [springboot-shiro-v1][] (重要的事情说三遍欢迎star欢迎star欢迎star，找工作用的，谢谢支持啦！)

##### 整合Shiro #####

###### 添加Pom.xml配置信息 ######

<dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-webflux</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-devtools</artifactId>
                <scope>runtime</scope>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <optional>true</optional>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
            <dependency>
                <groupId>io.projectreactor</groupId>
                <artifactId>reactor-test</artifactId>
                <scope>test</scope>
            </dependency>
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.4.0</version>
                <exclusions>
                    <exclusion>
                        <artifactId>slf4j-api</artifactId>
                        <groupId>org.slf4j</groupId>
                    </exclusion>
                </exclusions>
            </dependency>
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-ehcache</artifactId>
                <version>1.4.0</version>
                <exclusions>
                    <exclusion>
                        <artifactId>slf4j-api</artifactId>
                        <groupId>org.slf4j</groupId>
                    </exclusion>
                </exclusions>
            </dependency>
            
            <dependency>
                <groupId>tk.mybatis</groupId>
                <artifactId>mapper-spring-boot-starter</artifactId>
                <version>1.1.7</version>
            </dependency>
            
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-lang3</artifactId>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-jdbc</artifactId>
            </dependency>
            
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-actuator</artifactId>
            </dependency>
            
            <dependency>
                <groupId>org.apache.tomcat</groupId>
                <artifactId>tomcat-jdbc</artifactId>
            </dependency>
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
            </dependency>
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid-spring-boot-starter</artifactId>
                <version>1.1.9</version>
            </dependency>
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.1.43</version>
            </dependency>
        </dependencies>

###### 自定义Realm类 ######

/**
     * @author: xipiker
     * @Date: 2019-8-3
     * @Description: UserRealm
     */
    public class UserRealm extends AuthorizingRealm {
        
        @Autowired
        private springShiroUserService springShiroUserService;
        private Logger log = LoggerFactory.getLogger(this.getClass());
        /**
         * 执行授权逻辑
         * @param principals
         * @return
         */
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        
            System.out.println("执行授权逻辑");
            //给资源进行授权
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //添加授权字符串
            //info.addStringPermission("user:add");
            Subject subject = SecurityUtils.getSubject();
            springShiroUser user = (springShiroUser) subject.getPrincipal();
            springShiroUser user2 = springShiroUserService.findById(user.getId());
    
            info.addStringPermission(user2.getPerms());
    
            return info;
        }
    
        /**
         * 执行认证逻辑
         * @param token
         * @return
         * @throws AuthenticationException
         */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        
            System.out.printf("执行认证逻辑");
            //假设数据库的用户名和密码
    //        String username = "xipiker";
    //        String password = "123456";
    
            //编写shiro判断逻辑，判断用户名密码
            //1.判断用户名
            UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
            springShiroUser springShiroUser = springShiroUserService.findByName(usernamePasswordToken.getUsername());
            if(springShiroUser == null){
        
                //用户名不存在
                return null;
            }
            //2.判断密码
            return new SimpleAuthenticationInfo(springShiroUser, springShiroUser.getPassword(), "");
        }
    }

###### ShiroConfig配置信息相关业务逻辑 ######

/**
     * @author: xipiker
     * @Date: 2019-8-3
     * @Description: ShiroConfig
     */
    @Configuration
    public class ShiroConfig {
        
        /**
         * 创建ShiroFilterFactoryBean
         */
        @Bean
        public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityManager securityManager){
        
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            //设置安全管理器
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            /**
             * Shiro内置过滤器，可以实现权限相关的拦截器
             * 常用过滤器:
             *  anon:无需认证（登录）可以访问
             *  authc:必须认证才可以访问
             *  user:如果使用rememberMe的功能可以直接访问
             *  perms:该资源必须得到资源权限才可以访问
             *  role:该资源必须得到角色权限才可以访问
             */
            Map<String, String> filterMap = new LinkedHashMap<String, String>();
    //        filterMap.put("/add", "authc");
    //        filterMap.put("/update", "authc");
            filterMap.put("/test", "anon");
            //放行login.html
            filterMap.put("/login", "anon");
    
            //授权过滤器
            //注意:当授权拦截后，shiro会自动跳转到未授权页面
            filterMap.put("/add", "perms[user:add]");
            filterMap.put("/update", "perms[user:update]");
    
            filterMap.put("/*", "authc");
            //拦截成功会默认跳转到login.jsp
            //修改默认拦截成功跳转到login.jsp页面
            shiroFilterFactoryBean.setLoginUrl("/toLogin");
            //设置未授权拦截器
            shiroFilterFactoryBean.setUnauthorizedUrl("/noAuth");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
    
            return shiroFilterFactoryBean;
        }
    
        /**
         * 创建DefaultWebSecurityManager
         */
        @Bean(name="securityManager")
        public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            //关联Realm
            securityManager.setRealm(userRealm);
            return securityManager;
        }
    
        /**
         * 创建Realm
         */
        @Bean(name="userRealm")
        public UserRealm getRealm(){
        
            return new UserRealm();
        }
    }

###### 数据库表结构 ######

> 数据表的基本结构图

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70]

###### 实现效果 ######

> 说明：/test为无需权限所有人都可以访问

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70 1]

> 说明：/add为权限配置为\[user:add\]的用户才可以访问

> 说明：/update为权限配置为\[user:update\]的用户才可以访问

> 说明：/toLogin为登录页面  
> 登录用户1，username:xipiker password:123456 拥有权限:\[user:add\]，可以访问/add，但是无权访问/update  
> 登录用户2，username:admin password:admin 拥有权限:\[user:update\]，可以访问/update，但是无权访问/add

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70 2]

[springboot-shiro-v1]: https://github.com/xipiker/springboot-shiro-v1
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70]: /images/20211109/b4ef7673bde64f92b825fe1df7e51446.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70 1]: /images/20211109/652635243bad404b8e7aba3dbffa53cc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzI1MDQwMTU1_size_16_color_FFFFFF_t_70 2]: /images/20211109/3bdfa92e9563430298a145e731b536af.png