SpringBoot：整合Shiro（集成了mybatis）

亦凉 2022-12-31 10:29 57阅读 0赞

**Shiro三大核心：  
1、Subject：代表当前用户  
2、SecurityManager：shiro核心管理器  
3、realm：类似data层，用于认证授权**  
![三大核心][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70]

![内部构造][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 1]

# 一、pom #

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.4.1</version>
            <relativePath/> 
        </parent>
        <groupId>site.kexing</groupId>
        <artifactId>shiro-springboot</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>shiro-springboot</name>
        <description>Demo project for Spring Boot</description>
    
        <properties>
            <java.version>11</java.version>
        </properties>
    
        <dependencies>
            
            <dependency>
                <groupId>com.github.theborakompanioni</groupId>
                <artifactId>thymeleaf-extras-shiro</artifactId>
                <version>2.0.0</version>
            </dependency>
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.7.0</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
    
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
                <scope>runtime</scope>
            </dependency>
            <dependency>
                <groupId>org.mybatis.spring.boot</groupId>
                <artifactId>mybatis-spring-boot-starter</artifactId>
                <version>2.1.3</version>
            </dependency>
            
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>1.18.12</version>
                <scope>provided</scope>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    
    </project>

# 二、ShiroConfig（重点） #

@Configuration
    public class ShiroConfig { 
        //3、ShiroFilterFactoryBean
        @Bean
        public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Autowired DefaultWebSecurityManager defaultWebSecurityManager){ 
            ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
            //设置安全管理器
            bean.setSecurityManager(defaultWebSecurityManager);
    
            //添加shiro的内置过滤器
            /** * anon：无需认证即可访问 * authc：必须认证才能访问 * user：必须拥有记住我功能才能用 * perms：拥有对某个资源的权限才能访问 * role：拥有某个角色权限才能访问 */
            Map<String, String> filterMap = new LinkedHashMap<>();
            //必须认证才能访问
    // filterMap.put("/user/adduser","authc");
    // filterMap.put("/user/updateuser","authc");
            filterMap.put("/user/adduser","perms[user:add]");
            filterMap.put("/user/updateuser","perms[user:update]");
            filterMap.put("/user/**","perms[user]");
            bean.setFilterChainDefinitionMap(filterMap);
    
            //设置未登录时跳到登录页面
            bean.setLoginUrl("/tologin");
            //未经授权无法访问
            bean.setUnauthorizedUrl("/unauth");
    
            return bean;
        }
    
        //2、DefaultWebSecurityManager
        @Bean
        public DefaultWebSecurityManager getDefaultWebSecurityManager(@Autowired UserRealm userRealm){ 
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            //关联userRealm
            securityManager.setRealm(userRealm);
            return securityManager;
        }
    
        //1、创建UserRealm 需自定义类
        @Bean
        public UserRealm getUserRealm(){ 
            return new UserRealm();
        }
    
        //shiro整合thymeleaf
        @Bean
        public ShiroDialect getShiroDialect(){ 
            return new ShiroDialect();
        }
    }

# 三、自定义realm继承AuthorizingRealm（重点） #

public class UserRealm extends AuthorizingRealm { 
        @Autowired
        UserMapper userMapper;
    
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 
            System.out.println("AuthorizationInfo->执行了授权");
            //SimpleAuthorizationInfo
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //获取当前登录的对象
            Subject subject = SecurityUtils.getSubject();
            User currentUser = (User) subject.getPrincipal();
            //授权
            info.addStringPermission(currentUser.getPerms());
            System.out.println("当前用户授权完毕");
            return info;
        }
    
        //认证
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { 
            System.out.println("AuthenticationInfo->执行了认证");
            UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
            System.out.println("realm:"+token);
            User user = userMapper.selectUserByName(token.getUsername());
            if(user == null){ 
                return null;
            }
            System.out.println("认证中");
            //密码认证
            return new SimpleAuthenticationInfo(user,user.getPwd(),"");
        }
    }

# 四、登录controller #

@Controller
    public class LoginController { 
        @RequestMapping("/login")
        public String login(String username, String password, Model model){ 
            //获取当前用户
            Subject subject = SecurityUtils.getSubject();
            //封装用户的登录数据
            UsernamePasswordToken token = new UsernamePasswordToken(username,password);
            System.out.println("controller:"+token);
            try { 
                //执行登录方法
                System.out.println("登录方法执行前");
                subject.login(token);
                System.out.println("执行了登录");
                return "index";
            }catch (UnknownAccountException u){ 
                //用户不存在
                model.addAttribute("msg","用户名不存在");
                return "login";
            }catch (IncorrectCredentialsException i){ 
                //用户不存在
                model.addAttribute("msg","密码不正确");
                return "login";
            }
    
        }
    }

# 五、跳转路由 #

@Controller
    public class RouterController { 
        @RequestMapping({ "/","toindex"})
        public String toIndex(Model model){ 
            model.addAttribute("msg","hello shiro");
            return "index";
        }
    
        @RequestMapping("/user/adduser")
        public String toAddUser(){ 
            return "/user/addUser";
        }
    
        @RequestMapping("/user/updateuser")
        public String toUpdateUser(){ 
            return "/user/updateUser";
        }
    
        @RequestMapping("/tologin")
        public String toLogin(){ 
            return "login";
        }
    
        @ResponseBody
        @RequestMapping("/unauth")
        public String unauth(){ 
            return "未经授权无法访问";
        }
        
    }

# 六、实体、mapper #

**User：**

@Data
    @AllArgsConstructor
    @NoArgsConstructor
    public class User { 
        private int id;
        private String uname;
        private String pwd;
        private String perms;
    }

**mapper：**

<select id="selectUserByName" parameterType="string" resultType="user">
            select * from user where uname = #{ uname}
        </select>

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70]: /images/20221120/369dcefcedba4985ae0b6c5d36bb2cbc.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzQzNDQyMzM1_size_16_color_FFFFFF_t_70 1]: /images/20221120/1150d5d1afa44fa2ae8db27cbbed8cea.png