spring boot中使用shiro权限管理框架

分手后的思念是犯贱 2022-01-22 10:25 210阅读 0赞

使用idea创建spring boot工程

勾选web里的web依赖

我们在pom.xml里自己导入shiro的依赖

具体依赖如下:

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.5.RELEASE</version>
            <relativePath/> 
        </parent>
        <groupId>com.liy</groupId>
        <artifactId>shiro</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>shiro</name>
        <description>Demo project for Spring Boot</description>
    
        <properties>
            <java.version>1.8</java.version>
        </properties>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-web</artifactId>
                <version>1.4.0</version>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.4.0</version>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    </project>

然后我们写个自定义realm类 , 去验证一下就行了 ,我们这要测试shiro使用成功就行了 ,就进行下验证就行了

MyRealm

package com.liy.realm;
    
    import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    
    public class MyRealm extends AuthorizingRealm {
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            return null;
        }
    
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            String principal = (String) token.getPrincipal();
            if (!"liy".equals(principal)){
                throw new UnknownAccountException("账号不存在");
            }
    
            return new SimpleAuthenticationInfo(principal,"123",getName());
        }
    }

原先在ssm框架里整合shiro是在spring配置文件中去配置 ,而现在我们在spring boot中就写个shiro的配置类 ,

把原先要在spring容器里配置的shiro所需要的bean ,在shiro配置类配置即可

ShiroConfig

package com.liy;
    
    import com.liy.realm.MyRealm;
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    @Configuration
    public class ShiroConfig {
        @Bean
        MyRealm myRealm(){
            return  new MyRealm();
        }
    
        @Bean
        SecurityManager securityManager(){
            DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
            manager.setRealm(myRealm());
            return manager;
        }
    
        @Bean
        ShiroFilterFactoryBean shiroFilterFactoryBean(){
            ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
            bean.setSecurityManager(securityManager());
            bean.setLoginUrl("/login");
            bean.setSuccessUrl("/index");
            bean.setUnauthorizedUrl("/unauthorized");
    
            Map<String, String> map = new LinkedHashMap<>();
            map.put("/doLogin","anon");
            map.put("/**","authc");
            bean.setFilterChainDefinitionMap(map);
            return bean;
        }
    }

然后写个controller类定义几个基本的请求接口

package com.liy.controller;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    @RestController
    public class HelloController {
    
        @GetMapping("/hello")
        public String hello(){
            return "hello";
        }
    
    
        @PostMapping("/doLogin")
        public void doLogin(String name ,String password){
            Subject subject = SecurityUtils.getSubject();
            try {
                subject.login(new UsernamePasswordToken(name,password));
                System.out.println("登陆成功");
            }catch (AuthenticationException e){
    
                System.out.println("登陆失败");
            }
    
        }
    
        @GetMapping("/login")
        public String login(){
            return "please login";
        }
    
    }

然后你可以测试先不登录 ,直接请求去访问 /hello ,看看会不会被跳到 /login里, 看到/login返回的"please login" 让你去登陆

然后去访问 /doLogin 去输入name = liy , password=123 ,登陆后,看看后台控制台是否打印登陆成功

记得这里是post请求

使用postman这个浏览器插件 ,可以发送不同的请求方式