Springboot 集成 Shrio

r囧r小猫 2022-05-21 08:15 165阅读 0赞

# Springboot 集成 shrio #

*  Springboot 集成 shrio
    
     *  1 缘起
     *  2 所用到的技术
     *  3 开干
        
         *  3.1 导入依赖
         *  3.2 配置 yml
         *  3.3 HTML 页面
         *  3.4 实体类 （通过jpa 自动生成表结构）
         *  3.5 关于 shiro 的配置
         *  3.6 Controller
         *  3.7 余下的内容
     *  4 结束

## 1 缘起 ##

> 因为最近对 shiro 比较感兴趣， 也在网上看了很多教程 ， 感觉网上写的 shiro 教程，要么太简单, 简单到 你不知道 shiro 为你做了什么，也有些很复杂， 让人一看就想睡觉。本文的目的是 通过尽可能少的代码，让你学习 shiro，并且将 shiro 整合到项目中。

## 2 所用到的技术 ##

> Jpa + Shiro + thymeleaf

## 3 开干 ##

### 3.1 导入依赖 ###

<dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>net.sourceforge.nekohtml</groupId>
        <artifactId>nekohtml</artifactId>
        <version>1.9.22</version>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.4.0</version>
    </dependency>
    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <scope>runtime</scope>
    </dependency>
    
    <dependency>
        <groupId>org.apache.commons</groupId>
        <artifactId>commons-lang3</artifactId>
    </dependency>

### 3.2 配置 yml ###

spring:
        datasource:
          url: jdbc:mysql://localhost:3306/test
          username: root
          password: 123456
          driver-class-name: com.mysql.jdbc.Driver
    
        jpa:
          database: mysql
          show-sql: true
          hibernate:
            ddl-auto: update
            naming:
              strategy: org.hibernate.cfg.DefaultComponentSafeNamingStrategy
          properties:
             hibernate:
                dialect: org.hibernate.dialect.MySQL5Dialect
    
        thymeleaf:
           cache: false
           mode: LEGACYHTML5

### 3.3 HTML 页面 ###

> 多个 页面

<!DOCTYPE html>
    <html lang="en">
    <head>
        <meta charset="UTF-8">
        <title>Login</title>
    </head>
    <body>
    错误信息：<h4 th:text="${msg}"></h4>
    <form action="login" method="post">
        <p>账号：<input type="text" name="username" value="admin"/></p>
        <p>密码：<input type="text" name="password" value="123456"/></p>
        <p><input type="submit" value="登录"/></p>
    </form>
    </body>
    </html>

### 3.4 实体类 （通过jpa 自动生成表结构） ###

--------------------

***SysPermission***

package org.study.entity;
    
    
    import lombok.Data;
    import lombok.Getter;
    import lombok.Setter;
    
    import javax.persistence.*;
    import java.util.List;
    
    /** * Created by jun on 2018/6/20. */
    @Getter
    @Setter
    @Entity
    public class SysPermission { 
    
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Integer id;
    
        /** * 权限名称 */
        private String name;
    
        /** * 资源类型，[menu|button] */
        @Column(columnDefinition="enum('menu','button')")
        private String resourceType;
    
        /** * 资源路径 */
        private String url;
    
        /** * 权限字符串,menu例子：role:*，button例子：role:create,role:update,role:delete,role:view */
        private String permission;
    
        /** * 父编号 */
        private Long parentId;
    
        /** * 父编号列表 */
        private String parentIds;
    
        /** * 是否可用 */
        private Boolean available = Boolean.FALSE;
    
        @ManyToMany
        @JoinTable(name="SysRolePermission",joinColumns={
       @JoinColumn(name="permissionId")},inverseJoinColumns={
       @JoinColumn(name="roleId")})
        private List<SysRole> roles;
    
    }

--------------------

***SysRole***

package org.study.entity;
    
    import lombok.Data;
    import lombok.Getter;
    import lombok.Setter;
    
    import javax.persistence.*;
    import javax.persistence.Entity;
    import java.util.List;
    
    /** * Created by jun on 2018/6/20. */
    @Getter
    @Setter
    @Entity
    public class SysRole { 
    
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Integer id;
    
        /** * 角色标识程序中判断使用,如"admin",这个是唯一的: */
        private String role;
    
        /** * 角色描述,UI界面显示使用 */
        private String description;
    
        /** * 是否可用,如果不可用将不会添加给用户 */
        private Boolean available = Boolean.FALSE;
    
        //角色 -- 权限关系：多对多关系;
        @ManyToMany(fetch= FetchType.EAGER)
        @JoinTable(name="SysRolePermission",joinColumns={
       @JoinColumn(name="roleId")},inverseJoinColumns={
       @JoinColumn(name="permissionId")})
        private List<SysPermission> permissions;
    
        // 用户 - 角色关系定义;
        @ManyToMany
        @JoinTable(name="SysUserRole",joinColumns={
       @JoinColumn(name="roleId")},inverseJoinColumns={
       @JoinColumn(name="uid")})
        private List<SysUser> userInfos;// 一个角色对应多个用户
    
        public SysRole() {
        }
    }

--------------------

***SysUser***

package org.study.entity;
    
    import lombok.Getter;
    import lombok.Setter;
    
    import javax.persistence.*;
    import java.util.List;
    
    /** * Created by jun on 2018/6/20. */
    @Getter
    @Setter
    @Entity
    public class SysUser { 
    
        @Id
        @GeneratedValue(strategy = GenerationType.IDENTITY)
        private Integer uid;
    
        /** * 帐号 */
        @Column(unique =true)
        private String username;
    
        /** * 名称（昵称或者真实姓名，不同系统不同定义） */
        private String name;
    
        /** * 密码 */
        private String password;
    
        /** * 加密密码的盐 */
        private String salt;
    
        /** * 用户状态,0:创建未认证（比如没有激活，没有输入验证码等等）--等待验证的用户 , 1:正常状态,2：用户被锁定. */
        private byte state;
    
        @ManyToMany(fetch= FetchType.EAGER)//立即从数据库中进行加载数据;
        @JoinTable(name = "SysUserRole", joinColumns = { @JoinColumn(name = "uid") }, inverseJoinColumns ={
       @JoinColumn(name = "roleId") })
        private List<SysRole> roleList;// 一个用户具有多个角色
    }

### 3.5 关于 shiro 的配置 ###

> CredenttiaMatcher

package org.study.config;
    
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authc.credential.SimpleCredentialsMatcher;
    
    /** * 自定义密码匹配器 * * Created by jun on 2018/6/28. */
    public class CredenttiaMatcher extends SimpleCredentialsMatcher { 
    
        /** * 自定义 匹配规则 * * token 包含用户输入的 用户名 和密码 * * info 用户认证时候传入的信息 （SimpleAuthenticationInfo ） * @param token * @param info * @return */
        @Override
        public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
            UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
            String password = new String(usernamePasswordToken.getPassword());
            String dbPassword = (String) info.getCredentials();
            return this.equals(password, dbPassword);
        }
    }

> MyShiroRealm

package org.study.config;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.apache.shiro.util.ByteSource;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Component;
    import org.study.entity.SysPermission;
    import org.study.entity.SysRole;
    import org.study.entity.SysUser;
    import org.study.service.SysUserService;
    
    /** * Created by jun on 2018/6/21. */
    @Component
    public class MyShiroRealm extends AuthorizingRealm { 
    
        @Autowired
        SysUserService sysUserService;
    
        /** * 用户授权，每次需要权限判断的时候调用 * * @param principals * @return */
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            System.out.println("权限配置-->MyShiroRealm.doGetAuthorizationInfo()");
            SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
            SysUser sysUser = (SysUser) principals.getPrimaryPrincipal();
            for (SysRole role : sysUser.getRoleList()) {
                authorizationInfo.addRole(role.getRole());
                for (SysPermission p : role.getPermissions()) {
                    authorizationInfo.addStringPermission(p.getPermission());
                }
            }
            return authorizationInfo;
        }
    
        /** * 用户认证方法 * * @param token * @return * @throws AuthenticationException */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            //获取用户的输入的账号.
            String username = (String) token.getPrincipal();
            System.out.println(token.getCredentials());
            //通过username从数据库中查找 User对象，如果找到，没找到.
            //实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法
            SysUser sysUser = sysUserService.findByUsername(username);
            System.out.println("----->>userInfo=" + username);
    
            if (sysUser == null) {
                return null;
            }
    
            SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                    sysUser,// 用户
                    sysUser.getPassword(), //密码
                    getName()  //realm name
            );
    
            return authenticationInfo;
        }
    }

> ShiroConfig

package org.study.config;
    
    
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.web.servlet.handler.SimpleMappingExceptionResolver;
    
    import java.util.LinkedHashMap;
    import java.util.Map;
    import java.util.Properties;
    
    /** * Created by jun on 2018/6/21. */
    @Configuration
    public class ShiroConfig { 
    
        @Bean
        public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
            System.out.println("ShiroConfiguration.shirFilter()");
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            //拦截器.
            Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
            // 配置不会被拦截的链接 顺序判断
            filterChainDefinitionMap.put("/static/**", "anon");
            //配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
            filterChainDefinitionMap.put("/logout", "logout");
            //:这是一个坑呢，一不小心代码就不好使了;
            //
            filterChainDefinitionMap.put("/**", "authc");
            // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
            shiroFilterFactoryBean.setLoginUrl("/login");
            // 登录成功后要跳转的链接
            shiroFilterFactoryBean.setSuccessUrl("/index");
    
            //未授权界面;
            shiroFilterFactoryBean.setUnauthorizedUrl("/403");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
            return shiroFilterFactoryBean;
        }
    
        /** * 采用自定义密码比对器 * @return */
        @Bean
        public MyShiroRealm myShiroRealm(){
            MyShiroRealm myShiroRealm = new MyShiroRealm();
            myShiroRealm.setCredentialsMatcher(new CredenttiaMatcher());
            return myShiroRealm;
        }
    
        @Bean
        public SecurityManager securityManager(){
            DefaultWebSecurityManager securityManager =  new DefaultWebSecurityManager();
            securityManager.setRealm(myShiroRealm());
            return securityManager;
        }
    
        /** * 开启shiro aop注解支持. * 使用代理方式;所以需要开启代码支持; * @param securityManager * @return */
        @Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
            AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
            authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
            return authorizationAttributeSourceAdvisor;
        }
    
        @Bean(name="simpleMappingExceptionResolver")
        public SimpleMappingExceptionResolver createSimpleMappingExceptionResolver() {
            SimpleMappingExceptionResolver r = new SimpleMappingExceptionResolver();
            Properties mappings = new Properties();
            mappings.setProperty("DatabaseException", "databaseError");//数据库异常处理
            mappings.setProperty("UnauthorizedException","403");
            r.setExceptionMappings(mappings);  // None by default
            r.setDefaultErrorView("error");    // No default
            r.setExceptionAttribute("ex");     // Default is "exception"
            //r.setWarnLogCategory("example.MvcLogger"); // No default
            return r;
        }
    }

### 3.6 Controller ###

> HomeController

package org.study.controller;
    
    import lombok.extern.slf4j.Slf4j;
    import org.apache.commons.lang3.StringUtils;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.study.entity.SysUser;
    import org.study.service.SysUserService;
    import org.study.util.MD5Util;
    
    import javax.servlet.http.HttpServletRequest;
    import java.util.Map;
    
    @Slf4j
    @Controller
    public class HomeController {
    
        @Autowired
        SysUserService sysUserService;
    
        @RequestMapping({
       "/","/index"})
        public String index(){
            return"/index";
        }
    
        @RequestMapping("login")
        public String login(HttpServletRequest request, Map<String, Object> map) throws Exception{
            String username = request.getParameter("username");
            String passwordInput = request.getParameter("password");
    
            try {
                if (StringUtils.isNotBlank(username) && StringUtils.isNotBlank(passwordInput)) {
    
                    SysUser user = sysUserService.findByUsername(username);
    
                    if (user != null) {
                        // TODO 这里简单的使用了 salt + md5
                        String encodePassword = MD5Util.encode(user.getSalt() + passwordInput);
    
                        AuthenticationToken token = new UsernamePasswordToken(username, encodePassword);
                        SecurityUtils.getSubject().login(token);
                    }
    
                    return "index";
                }
            } catch (Exception e) {
                // TODO 这里可以根据不同的异常 获取不同的登录失败的原因
                log.error("登录失败");
            }
    
            return "login";
        }
    
        @RequestMapping("403")
        public String unauthorizedRole(){
            System.out.println("------没有权限-------");
            return "403";
        }
    }

> UserInfoController

package org.study.controller;
    
    import org.apache.shiro.authz.annotation.RequiresPermissions;
    import org.apache.shiro.authz.annotation.RequiresRoles;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    @Controller
    @RequestMapping("/userInfo")
    public class UserInfoController { 
    
        /** * 用户查询. * @return */
        @RequestMapping("/userList")
        @RequiresPermissions("userInfo:view")//权限管理;
        public String userInfo(){
            return "userInfo";
        }
    
        /** * 用户添加; * @return */
        @RequestMapping("/userAdd")
        @RequiresRoles("admin")
        public String userInfoAdd(){
            return "userInfoAdd";
        }
    
        /** * 用户删除; * @return */
        @RequestMapping("/userDel")
        @RequiresPermissions("userInfo:del")
        public String userDel(){
            return "userInfoDel";
        }
    }

### 3.7 余下的内容 ###

> 剩下的内容就比较简单了，无非就是一些 dao service。。 这里贴一个关键的

package org.study.dao;
    
    import org.springframework.data.jpa.repository.JpaRepository;
    import org.study.entity.SysUser;
    
    /** * Created by jun on 2018/6/21. */
    public interface SysUserDao extends JpaRepository<SysUser, Integer> { 
    
        SysUser findByUsername(String userame);
    }

## 4 结束 ##

> 搞完收工，如果你喜欢博主的文章的话麻烦点一下关注，如果发现博主文章的错误的话 麻烦指出， 谢谢大家。