SpringMVC+Shiro权限管理

女爷i 2022-01-16 16:53 342阅读 0赞

[2019独角兽企业重金招聘Python工程师标准>>> ][2019_Python_] ![hot3.png][]

博文目录

1.  [权限的简单描述][Link 1]
2.  [实例表结构及内容及POJO][Link 1]
3.  [Shiro-pom.xml][Link 1]
4.  [Shiro-web.xml][Link 1]
5.  [Shiro-MyShiro-权限认证,登录认证层][Link 1]
6.  [Shiro-applicationContext-shiro.xml][Link 1]
7.  [HomeController][Link 1]
8.  [三个JSP文件][Link 1]

**什么是权限呢**？举个简单的例子：  
我有一个论坛，注册的用户分为normal用户，manager用户。  
对论坛的帖子的操作有这些：  
添加，删除，更新，查看，回复  
我们规定：  
normal用户只能：添加，查看，回复  
manager用户可以：删除，更新  
  
normal，manager对应的是角色（role）  
添加，删除，更新等对应的是权限（permission）  
  
我们采用下面的逻辑创建权限表结构（不是绝对的，根据需要修改）  
  
一个用户可以有多种角色（normal,manager,admin等等）  
一个角色可以有多个用户（user1,user2,user3等等）  
一个角色可以有多个权限（save,update,delete,query等等）  
一个权限只属于一个角色（delete只属于manager角色）

![02094227_vqyB.png][]

我们创建四张表：  
**t\_user**用户表:设置了3个用户  
\-------------------------------  
id + username + password  
\---+----------------+----------  
1 + tom + 000000  
2 + jack + 000000  
3 + rose + 000000  
\---------------------------------  
**t\_role**角色表：设置3个角色  
\--------------  
id + rolename  
\---+----------  
1 + admin  
2 + manager  
3 + normal  
\--------------  
**t\_user\_role**用户角色表：tom是admin和normal角色，jack是manager和normal角色，rose是normal角色  
\---------------------  
user\_id + role\_id  
\-----------+-----------  
1 + 1  
1 + 3  
2 + 2  
2 + 3  
3 + 3  
\---------------------  
**t\_permission**权限表：admin角色可以删除，manager角色可以添加和更新，normal角色可以查看  
\-----------------------------------  
id + permissionname + role\_id  
\----+------------------------+-----------  
1 + add + 2  
2 + del + 1  
3 + update + 2  
4 + query + 3  
\-----------------------------------

package com.cn.pojo;
    import java.util.HashSet;
    import java.util.List;
    import java.util.Set;
    import javax.persistence.Entity;
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.JoinColumn;
    import javax.persistence.JoinTable;
    import javax.persistence.ManyToMany;
    import javax.persistence.Table;
    import javax.persistence.Transient;
    import org.hibernate.validator.constraints.NotEmpty;
    @Entity
    @Table(name="t_user")
    public class User {
    private Integer id;
    @NotEmpty(message="用户名不能为空")
    private String username;
    @NotEmpty(message="密码不能为空")
    private String password;
    private List<Role> roleList;//一个用户具有多个角色
    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
    return id;
    }
    public void setId(Integer id) {
    this.id = id;
    }
    public String getUsername() {
    return username;
    }
    public void setUsername(String username) {
    this.username = username;
    }
    public String getPassword() {
    return password;
    }
    public void setPassword(String password) {
    this.password = password;
    }
    @ManyToMany
    @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="user_id")},inverseJoinColumns={@JoinColumn(name="role_id")})
    public List<Role> getRoleList() {
    return roleList;
    }
    public void setRoleList(List<Role> roleList) {
    this.roleList = roleList;
    }
    @Transient
    public Set<String> getRolesName(){
    List<Role> roles=getRoleList();
    Set<String> set=new HashSet<String>();
    for (Role role : roles) {
    set.add(role.getRolename());
    }
    return set;
    }
    }

package com.cn.pojo;
    import java.util.ArrayList;
    import java.util.List;
    import javax.persistence.Entity;
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.JoinColumn;
    import javax.persistence.JoinTable;
    import javax.persistence.ManyToMany;
    import javax.persistence.OneToMany;
    import javax.persistence.Table;
    import javax.persistence.Transient;
    @Entity
    @Table(name="t_role")
    public class Role {
    private Integer id;
    private String rolename;
    private List<Permission> permissionList;//一个角色对应多个权限
    private List<User> userList;//一个角色对应多个用户
    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
    return id;
    }
    public void setId(Integer id) {
    this.id = id;
    }
    public String getRolename() {
    return rolename;
    }
    public void setRolename(String rolename) {
    this.rolename = rolename;
    }
    @OneToMany(mappedBy="role")
    public List<Permission> getPermissionList() {
    return permissionList;
    }
    public void setPermissionList(List<Permission> permissionList) {
    this.permissionList = permissionList;
    }
    @ManyToMany
    @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="role_id")},inverseJoinColumns={@JoinColumn(name="user_id")})
    public List<User> getUserList() {
    return userList;
    }
    public void setUserList(List<User> userList) {
    this.userList = userList;
    }
    @Transient
    public List<String> getPermissionsName(){
    List<String> list=new ArrayList<String>();
    List<Permission> perlist=getPermissionList();
    for (Permission per : perlist) {
    list.add(per.getPermissionname());
    }
    return list;
    }
    }

package com.cn.pojo;
    import javax.persistence.Entity;
    import javax.persistence.GeneratedValue;
    import javax.persistence.GenerationType;
    import javax.persistence.Id;
    import javax.persistence.JoinColumn;
    import javax.persistence.ManyToOne;
    import javax.persistence.Table;
    @Entity
    @Table(name="t_permission")
    public class Permission {
    private Integer id;
    private String permissionname;
    private Role role;//一个权限对应一个角色
    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
    return id;
    }
    public void setId(Integer id) {
    this.id = id;
    }
    public String getPermissionname() {
    return permissionname;
    }
    public void setPermissionname(String permissionname) {
    this.permissionname = permissionname;
    }
    @ManyToOne
    @JoinColumn(name="role_id")
    public Role getRole() {
    return role;
    }
    public void setRole(Role role) {
    this.role = role;
    }
    }

使用SHIRO的步骤：  
1，导入jar  
2，配置web.xml  
3，建立dbRelm  
4，在Spring中配置  
  
**pom.xml中配置如下：**

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
      <modelVersion>4.0.0</modelVersion>
      <groupId>com.hyx</groupId>
      <artifactId>springmvc</artifactId>
      <packaging>war</packaging>
      <version>0.0.1-SNAPSHOT</version>
      <name>springmvc Maven Webapp</name>
      <url>http://maven.apache.org</url>
      <dependencies>
        <dependency>
          <groupId>junit</groupId>
          <artifactId>junit</artifactId>
          <version>3.8.1</version>
          <scope>test</scope>
        </dependency>
        
        <dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-webmvc</artifactId>
    <version>3.2.4.RELEASE</version>
    </dependency>
        
        <dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-jdbc</artifactId>
    <version>3.2.4.RELEASE</version>
    </dependency>
    <dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-orm</artifactId>
    <version>3.2.4.RELEASE</version>
    </dependency>
    
        
        <dependency>
    <groupId>org.hibernate</groupId>
    <artifactId>hibernate-core</artifactId>
    <version>4.2.5.Final</version>
    </dependency>
    <dependency>
    <groupId>org.hibernate</groupId>
    <artifactId>hibernate-ehcache</artifactId>
    <version>4.2.5.Final</version>
    </dependency>
    <dependency>
    <groupId>net.sf.ehcache</groupId>
    <artifactId>ehcache</artifactId>
    <version>2.7.2</version>
    </dependency>
    <dependency>
    <groupId>commons-dbcp</groupId>
    <artifactId>commons-dbcp</artifactId>
    <version>1.4</version>
    </dependency>
        <dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>5.1.26</version>
    </dependency>
    
    <dependency>
    <groupId>javax.inject</groupId>
    <artifactId>javax.inject</artifactId>
    <version>1</version>
    </dependency>        
    
    
    <dependency>
    <groupId>org.hibernate</groupId>
    <artifactId>hibernate-validator</artifactId>
    <version>5.0.1.Final</version>
    </dependency>
        
        <dependency>
    <groupId>org.codehaus.jackson</groupId>
    <artifactId>jackson-mapper-asl</artifactId>
    <version>1.9.13</version>
    </dependency>        
        
        <dependency>
    <groupId>javax.servlet</groupId>
    <artifactId>jstl</artifactId>
    <version>1.2</version>
    </dependency>
    
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>servlet-api</artifactId>
      <version>2.5</version>
    </dependency>
      
        <dependency>  
          <groupId>org.apache.shiro</groupId>  
          <artifactId>shiro-core</artifactId>  
          <version>1.2.2</version>  
        </dependency>  
        <dependency>  
          <groupId>org.apache.shiro</groupId>  
          <artifactId>shiro-web</artifactId>  
          <version>1.2.2</version>  
        </dependency>  
        <dependency>  
          <groupId>org.apache.shiro</groupId>  
          <artifactId>shiro-spring</artifactId>  
          <version>1.2.2</version>  
        </dependency> 
      </dependencies>
      
      <build>
        <finalName>springmvc</finalName>
        
        <plugins>
        <plugin>
      <groupId>org.mortbay.jetty</groupId>
      <artifactId>jetty-maven-plugin</artifactId>
      <configuration>
        <scanIntervalSeconds>10</scanIntervalSeconds>
        <webApp>
          <contextPath>/</contextPath>
        </webApp>
        
        <connectors>
           <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
              <port>80</port>
              <maxIdleTime>60000</maxIdleTime>
           </connector>
        </connectors>
      </configuration>
    </plugin>
        </plugins>
      </build>
    </project>

**web.xml中的配置：**

<?xml version="1.0" encoding="UTF-8" ?>
    <web-app version="2.5" 
    xmlns="http://java.sun.com/xml/ns/javaee" 
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee 
    http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
      <display-name>Archetype Created Web Application</display-name>
      
      
      <filter>
      <filter-name>opensessioninview</filter-name>
      <filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilter</filter-class>
      </filter>
      <filter-mapping>
      <filter-name>opensessioninview</filter-name>
      <url-pattern>/*</url-pattern>
      </filter-mapping>
      
      
      <servlet>
      <servlet-name>springmvc</servlet-name>
      <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
      <load-on-startup>1</load-on-startup>
      </servlet>
      <servlet-mapping>
      <servlet-name>springmvc</servlet-name>
      
      <url-pattern>/</url-pattern>
      </servlet-mapping>
      
      
      <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>classpath:applicationContext*.xml</param-value>
      </context-param>
      <listener>
    <listener-class>
    org.springframework.web.context.ContextLoaderListener
    </listener-class>
      </listener>
      
        
      <filter>  
        <filter-name>shiroFilter</filter-name>  
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
      </filter>  
      <filter-mapping>  
        <filter-name>shiroFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
      </filter-mapping>
      
    </web-app>

package com.cn.service;
    import java.util.List;
    import javax.inject.Inject;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.stereotype.Service;
    import org.springframework.transaction.annotation.Transactional;
    import com.cn.pojo.Role;
    import com.cn.pojo.User;
    @Service
    @Transactional
    public class MyShiro extends AuthorizingRealm{
    @Inject
    private UserService userService;
    /**
     * 权限认证
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    //获取登录时输入的用户名
    String loginName=(String) principalCollection.fromRealm(getName()).iterator().next();
    //到数据库查是否有此对象
    User user=userService.findByName(loginName);
    if(user!=null){
    //权限信息对象info,用来存放查出的用户的所有的角色（role）及权限（permission）
    SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
    //用户的角色集合
    info.setRoles(user.getRolesName());
    //用户的角色对应的所有权限，如果只使用角色定义访问权限，下面的四行可以不要
    List<Role> roleList=user.getRoleList();
    for (Role role : roleList) {
    info.addStringPermissions(role.getPermissionsName());
    }
    return info;
    }
    return null;
    }
    /**
     * 登录认证;
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
    AuthenticationToken authenticationToken) throws AuthenticationException {
    //UsernamePasswordToken对象用来存放提交的登录信息
    UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
    //查出是否有此用户
    User user=userService.findByName(token.getUsername());
    if(user!=null){
    //若存在，将此用户存放到登录认证info中
    return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
    }
    return null;
    }
    }

在spring的配置文件中配置，为了区别spring原配置和shiro我们将shiro的配置独立出来。

**applicationContext-shiro.xml**

<?xml version="1.0" encoding="UTF-8" ?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:aop="http://www.springframework.org/schema/aop"
           xmlns:tx="http://www.springframework.org/schema/tx"
           xmlns:context="http://www.springframework.org/schema/context"
           xsi:schemaLocation="
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">
    
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
            
            <property name="realm" ref="myShiro"/>  
            
            <property name="cacheManager" ref="cacheManager"/>  
        </bean>
        
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> 
         
            <property name="securityManager" ref="securityManager"/> 
             
            <property name="loginUrl" value="/login"/>  
            
            <property name="successUrl" value="/user"/>  
            
            <property name="unauthorizedUrl" value="/403"/>  
            
            <property name="filterChainDefinitions">  
                <value>  
                
                /static/**=anon
                
                /user=perms[user:query]
                
                /user/add=roles[manager]
                /user/del/**=roles[admin]
                /user/edit/**=roles[manager]
                  
                    /** = authc
                </value>  
            </property>  
        </bean>
        
        
        <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />  
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /> 
    </beans>

**用于登录，登出，权限跳转的控制：**

package com.cn.controller;
    import javax.validation.Valid;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.validation.BindingResult;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.servlet.mvc.support.RedirectAttributes;
    import com.cn.pojo.User;
    @Controller
    public class HomeController {
    @RequestMapping(value="/login",method=RequestMethod.GET)
    public String loginForm(Model model){
    model.addAttribute("user", new User());
    return "/login";
    }
    @RequestMapping(value="/login",method=RequestMethod.POST)
    public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
    try {
    if(bindingResult.hasErrors()){
    return "/login";
    }
    //使用权限工具进行用户登录，登录成功后跳到shiro配置的successUrl中，与下面的return没什么关系！
    SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
    return "redirect:/user";
    } catch (AuthenticationException e) {
    redirectAttributes.addFlashAttribute("message","用户名或密码错误");
    return "redirect:/login";
    }
    }
    @RequestMapping(value="/logout",method=RequestMethod.GET)  
        public String logout(RedirectAttributes redirectAttributes ){ 
    //使用权限管理工具进行用户的退出，跳出登录，给出提示信息
            SecurityUtils.getSubject().logout();  
            redirectAttributes.addFlashAttribute("message", "您已安全退出");  
            return "redirect:/login";
        } 
    @RequestMapping("/403")
    public String unauthorizedRole(){
    return "/403";
    }
    }

**三个主要的JSP：**  
**login.jsp:**

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
    <%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    <html>
      <head>
        <title>My JSP 'MyJsp.jsp' starting page</title>
      </head>
      
      <body>
      <h1>登录页面----${message }</h1>
      <img alt="" src="/static/img/1.jpg">
      <form:form action="/login" commandName="user" method="post">
      用户名：<form:input path="username"/> <form:errors path="username" cssClass="error"/> <br/>
        密   码：<form:password path="password"/> <form:errors path="password" cssClass="error" /> <br/>
        <form:button name="button">submit</form:button>
      </form:form>
      </body>
    </html>

user.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
    <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
    <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    <html>
      <head>
        <title>用户列表</title>
      </head>
      <body>
    <h1>${message }</h1>
        <h1>用户列表--<a href="/user/add">添加用户</a>---<a href="/logout">退出登录</a>    </h1>
        <h2>权限列表</h2>
        <shiro:authenticated>用户已经登录显示此内容</shiro:authenticated>
        <shiro:hasRole name="manager">manager角色登录显示此内容</shiro:hasRole>
        <shiro:hasRole name="admin">admin角色登录显示此内容</shiro:hasRole>
        <shiro:hasRole name="normal">normal角色登录显示此内容</shiro:hasRole>
        
        <shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**</shiro:hasAnyRoles>
        <shiro:principal/>-显示当前登录用户名
        <shiro:hasPermission name="add">add权限用户显示此内容</shiro:hasPermission>
        <shiro:hasPermission name="user:query">query权限用户显示此内容<shiro:principal/></shiro:hasPermission>
        <shiro:lacksPermission name="user:del"> 不具有user:del权限的用户显示此内容 </shiro:lacksPermission>
        <ul>
        <c:forEach items="${userList }" var="user">
        <li>用户名：${user.username }----密码：${user.password }----<a href="/user/edit/${user.id}">修改用户</a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户</a></li>
        </c:forEach>
        </ul>
        <img alt="" src="/static/img/1.jpg">
        <script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js"></script>
        <script>
        $(function(){
        $(".del").click(function(){
        var id=$(this).attr("ref");
        $.ajax({
        type:"delete",
        url:"/user/del/"+id,
        success:function(e){
        
        }
        });
        });
        });
        </script>
      </body>
    </html>

403.jsp:

转载于:https://my.oschina.net/u/2334022/blog/409008

[2019_Python_]: https://my.oschina.net/u/2663968/blog/3061697
[hot3.png]: /images/20220114/ebefe17fe1c94675ac535a0a9f8515c9.png
[Link 1]: http://www.360doc.com/content/14/0529/10/11298474_381933566.shtml
[02094227_vqyB.png]: /images/20220114/940be43db2f54bd2abb43b692ca98978.png