SSM整合Shiro安全框架

傷城~ 2024-03-17 17:01 23阅读 0赞

**目录**

1.搭建一个SSM框架

2.ssm整合shiro(前后端不分离)

2.1---认证功能

2.2---授权功能

--------------------

## 1.搭建一个SSM框架 ##

首先我们新建一个wep工程

![362facf1ef704387a259f395131af1e7.png][]

然后引入相关的依赖

<dependencies>
            <dependency>
                <groupId>junit</groupId>
                <artifactId>junit</artifactId>
                <version>3.8.1</version>
                <scope>test</scope>
            </dependency>
            
            <dependency>
                <groupId>org.crazycake</groupId>
                <artifactId>shiro-redis</artifactId>
                <version>2.4.6</version>
            </dependency>
    
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>fastjson</artifactId>
                <version>1.2.62</version>
            </dependency>
            
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
                <version>8.0.31</version>
            </dependency>
    
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.7.0</version>
            </dependency>
    
            
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-webmvc</artifactId>
                <version>5.2.15.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-jdbc</artifactId>
                <version>5.2.15.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-tx</artifactId>
                <version>5.2.15.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-aspects</artifactId>
                <version>5.2.15.RELEASE</version>
            </dependency>
    
            
            <dependency>
                <groupId>org.mybatis</groupId>
                <artifactId>mybatis</artifactId>
                <version>3.5.9</version>
            </dependency>
            <dependency>
                <groupId>org.mybatis</groupId>
                <artifactId>mybatis-spring</artifactId>
                <version>2.0.7</version>
            </dependency>
    
            
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>1.18.28</version>
            </dependency>
            
            <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>2.15.2</version>
            </dependency>
            
            <dependency>
                <groupId>javax.servlet</groupId>
                <artifactId>javax.servlet-api</artifactId>
                <version>3.1.0</version>
            </dependency>
    
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid</artifactId>
                <version>1.2.8</version>
            </dependency>
    
        </dependencies>

接着我们spring配置文件

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xmlns:context="http://www.springframework.org/schema/context"
           xmlns:mvc="http://www.springframework.org/schema/mvc"
           xmlns:tx="http://www.springframework.org/schema/tx"
           xsi:schemaLocation="http://www.springframework.org/schema/beans
           http://www.springframework.org/schema/beans/spring-beans.xsd
           http://www.springframework.org/schema/context
           https://www.springframework.org/schema/context/spring-context.xsd
           http://www.springframework.org/schema/mvc
           https://www.springframework.org/schema/mvc/spring-mvc.xsd
           http://www.springframework.org/schema/tx
           http://www.springframework.org/schema/tx/spring-tx.xsd">
        
        <context:component-scan base-package="com.cgm"/>
        
        <mvc:annotation-driven/>
        
        <mvc:default-servlet-handler/>
        
        <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
            <property name="prefix" value="/WEB-INF/views/"/>
            <property name="suffix" value=".jsp"/>
        </bean>
        
        <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource">
            <property name="username" value="root"/>
            <property name="password" value="123456"/>
            <property name="driverClassName" value="com.mysql.cj.jdbc.Driver"/>
            <property name="url" value="jdbc:mysql://localhost:3306/shiro?serverTimezone=Asia/Shanghai"/>
        </bean>
    
        
        <bean id="sessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
            <property name="dataSource" ref="dataSource"/>
            
            <property name="mapperLocations" value="classpath:mapper/*.xml"/>
        </bean>
    
        
        <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
            <property name="sqlSessionFactoryBeanName" value="sessionFactory"/>
            
            <property name="basePackage" value="com.cgm.dao"/>
        </bean>
        
        <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
            <property name="dataSource" ref="dataSource"/>
        </bean>
        
        <tx:annotation-driven/>
    </beans

最后我们配置 web.xml

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
             version="4.0">
        
        <servlet>
            <servlet-name>springmvc</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
            <init-param>
                <param-name>contextConfigLocation</param-name>
                <param-value>classpath:spring.xml</param-value>
            </init-param>
            
            <load-on-startup>1</load-on-startup>
        </servlet>
        <servlet-mapping>
            <servlet-name>springmvc</servlet-name>
            <url-pattern>/</url-pattern>
        </servlet-mapping>
    </web-app>

这样我们就将SSM框架简单搭建起来了

### 2.ssm整合shiro(前后端不分离) ###

基本效果如下

![97b3e28e1fa740b0ad120693e901660e.png][]

### 2.1---认证功能 ###

所需数据库资源如下：

![dd3250fb53d7497fbc1a9d66b780b745.png][]

/*
     Navicat Premium Data Transfer
    
     Source Server         : 实训
     Source Server Type    : MySQL
     Source Server Version : 80032
     Source Host           : localhost:3306
     Source Schema         : shiro
    
     Target Server Type    : MySQL
     Target Server Version : 80032
     File Encoding         : 65001
    
     Date: 06/07/2023 11:16:35
    */
    
    SET NAMES utf8mb4;
    SET FOREIGN_KEY_CHECKS = 0;
    
    -- ----------------------------
    -- Table structure for permission
    -- ----------------------------
    DROP TABLE IF EXISTS `permission`;
    CREATE TABLE `permission`  (
      `perid` int(0) NOT NULL AUTO_INCREMENT,
      `pername` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      `percode` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`perid`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 9 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
    
    -- ----------------------------
    -- Records of permission
    -- ----------------------------
    INSERT INTO `permission` VALUES (1, '查询用户信息', 'user:query');
    INSERT INTO `permission` VALUES (2, '修改用户', 'user:update');
    INSERT INTO `permission` VALUES (3, '删除用户', 'user:delete');
    INSERT INTO `permission` VALUES (4, '添加用户', 'user:insert');
    INSERT INTO `permission` VALUES (5, '导出用户', 'user:export');
    
    -- ----------------------------
    -- Table structure for role
    -- ----------------------------
    DROP TABLE IF EXISTS `role`;
    CREATE TABLE `role`  (
      `roleid` int(0) NOT NULL AUTO_INCREMENT,
      `rolename` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`roleid`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
    
    -- ----------------------------
    -- Records of role
    -- ----------------------------
    INSERT INTO `role` VALUES (1, '仓管管理员');
    INSERT INTO `role` VALUES (2, 'CEO');
    INSERT INTO `role` VALUES (3, '保安');
    
    -- ----------------------------
    -- Table structure for role_permission
    -- ----------------------------
    DROP TABLE IF EXISTS `role_permission`;
    CREATE TABLE `role_permission`  (
      `perid` int(0) NOT NULL,
      `roleid` int(0) NOT NULL,
      PRIMARY KEY (`perid`, `roleid`) USING BTREE
    ) ENGINE = InnoDB CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
    
    -- ----------------------------
    -- Records of role_permission
    -- ----------------------------
    INSERT INTO `role_permission` VALUES (1, 1);
    INSERT INTO `role_permission` VALUES (1, 2);
    INSERT INTO `role_permission` VALUES (1, 3);
    INSERT INTO `role_permission` VALUES (2, 1);
    INSERT INTO `role_permission` VALUES (2, 2);
    INSERT INTO `role_permission` VALUES (3, 1);
    INSERT INTO `role_permission` VALUES (3, 2);
    INSERT INTO `role_permission` VALUES (4, 1);
    INSERT INTO `role_permission` VALUES (5, 3);
    
    -- ----------------------------
    -- Table structure for user
    -- ----------------------------
    DROP TABLE IF EXISTS `user`;
    CREATE TABLE `user`  (
      `userid` int(0) NOT NULL AUTO_INCREMENT,
      `username` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      `userpwd` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      `sex` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      `address` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      `salt` varchar(255) CHARACTER SET utf8mb3 COLLATE utf8mb3_general_ci NULL DEFAULT NULL,
      PRIMARY KEY (`userid`) USING BTREE
    ) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
    
    -- ----------------------------
    -- Records of user
    -- ----------------------------
    INSERT INTO `user` VALUES (1, 'zhangsan', '4b05a8716a430f71c6911d2e9149092f', '男', '武汉', '07f63bbf285e4719bfee1cc2bb81db33');
    INSERT INTO `user` VALUES (2, 'lisi', '99cc11855b41ff3e5f7c0af3c5090a8c', '女', '北京', '2d7e37f019144764ac02aa7220929f93');
    INSERT INTO `user` VALUES (3, 'wangwu', '6d70c027801af4dc892ab340d4bf73b6', '女', '成都', '99f6bf1b540145699e6e5c90480105b0');
    
    -- ----------------------------
    -- Table structure for user_role
    -- ----------------------------
    DROP TABLE IF EXISTS `user_role`;
    CREATE TABLE `user_role`  (
      `userid` int(0) NOT NULL,
      `roleid` int(0) NOT NULL,
      PRIMARY KEY (`userid`, `roleid`) USING BTREE
    ) ENGINE = InnoDB CHARACTER SET = utf8mb3 COLLATE = utf8mb3_general_ci ROW_FORMAT = Dynamic;
    
    -- ----------------------------
    -- Records of user_role
    -- ----------------------------
    INSERT INTO `user_role` VALUES (1, 1);
    INSERT INTO `user_role` VALUES (2, 2);
    INSERT INTO `user_role` VALUES (3, 3);
    
    SET FOREIGN_KEY_CHECKS = 1;

(1)引入依赖

<dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-spring</artifactId>
          <version>1.7.0</version>
        </dependency>

(2)修改spring配置文件

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
               <property name="realm" ref="myRealm"/>
        </bean>
        <bean id="myRealm" class="com.ykq.realm.MyRealm">
             <property name="credentialsMatcher" ref="credentialsMatcher"/>
        </bean>
        
        <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
             <property name="hashAlgorithmName" value="MD5"/>
             <property name="hashIterations" value="1024"/>
        </bean>
    
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
             <property name="securityManager" ref="securityManager"/>
             
             <property name="loginUrl" value="/login.jsp"/>
             
             <property name="filterChainDefinitions">
                  <value>
                       /login=anon
                       /**=authc
                  </value>
             </property>
        </bean>

(3)修改web.xml文件

<filter>
            <filter-name>shiroFilter</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        </filter>
        <filter-mapping>
            <filter-name>shiroFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>

(4)修改login.jsp

<%--
      Created by IntelliJ IDEA.
      User: 18193
      Date: 2023/7/6
      Time: 16:04
      To change this template use File | Settings | File Templates.
    --%>
    <%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <html>
    <head>
        <title>用户登录</title>
        <style>
            body {
                font-family: Arial, sans-serif;
                background-color: #f4f4f4;
            }
    
            .container {
                max-width: 400px;
                margin: 0 auto;
                padding: 20px;
                background-color: #fff;
                border-radius: 5px;
                box-shadow: 0 0 10px rgba(0, 0, 0, 0.1);
            }
    
            .container h2 {
                text-align: center;
            }
    
            .form-group {
                margin-bottom: 20px;
            }
    
            .form-group label {
                display: block;
                font-weight: bold;
            }
    
            .form-group input[type="text"],
            .form-group input[type="password"] {
                width: 100%;
                padding: 8px;
                border: 1px solid #ccc;
                border-radius: 4px;
            }
    
            .form-group input[type="submit"] {
                width: 100%;
                padding: 8px;
                border: none;
                border-radius: 4px;
                background-color: #4caf50;
                color: #fff;
                cursor: pointer;
            }
    
            .form-group input[type="submit"]:hover {
                background-color: #45a049;
            }
        </style>
    </head>
    <body>
    <div class="container">
        <h2>用户登录</h2>
        <form action="/login" method="POST">
            <div class="form-group">
                <label for="username">账号</label>
                <input type="text" id="username" name="username" placeholder="请输入账号" required>
            </div>
            <div class="form-group">
                <label for="password">密码</label>
                <input type="password" id="password" name="password" placeholder="请输入密码" required>
            </div>
            <div class="form-group">
                <input type="submit" value="登录">
            </div>
        </form>
    </div>
    </body>
    </html>

(5)controller

package com.cgm.controller;
    
    import com.cgm.vo.LoginVo;
    import com.cgm.vo.Result;
    import lombok.extern.slf4j.Slf4j;
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.ResponseBody;
    
    import java.net.PasswordAuthentication;
    
    /**
     * @Title: loginController
     * @Package com.cgm.controller
     * @Author 常小明
     * @Date 2023/7/6 16:17
     * @program
     */
    @Controller
    //@Slf4j
    public class loginController {
        @PostMapping("/login")
        @ResponseBody
        public String login(LoginVo loginVo) {
           if (loginVo==null){
               return new Result(500,"请登录",null);
           }
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(loginVo.getUsername(), loginVo.getPassword());
             try {
                subject.login(token);
                return "success"; //经过视图解析器 /WEB-INF/views/success.jsp
            }catch (Exception e){
                e.printStackTrace();
                return "redirect:/login.jsp";
            }
        }
       
    }

(6)MyRealm修改

public class MyRealm extends AuthorizingRealm {
        @Autowired
        private UserService userService;
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            return null;
        }
    
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            //1.获取登录账号
            String username = token.getPrincipal().toString();
            //2.根据账号获取用户信息
            User user= userService.selectByUsername(username);
            if(user!=null){
                ByteSource salt=ByteSource.Util.bytes(user.getSalt());
                SimpleAuthenticationInfo info=new SimpleAuthenticationInfo(user,user.getUserpwd(),salt,this.getName());
                return info;
            }
    
            return null;
        }
    }

(7) UserService的代码

@Service
    public class UserServiceImpl implements UserService {
        @Autowired
        private UserDao userDao;
        public User selectByUsername(String username) {
            User user = userDao.findByUsername(username);
            return user;
        }
    }

(8)dao方法和映射代码

public interface UserDao {
        User findByUsername(String username);
    }

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
            "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    
    <mapper namespace="com.cgm.dao.UserDao">
    
        <select id="findByUsername" resultType="com.cgm.entity.User">
                select * from user where username=#{username}
        </select>
    </mapper>

(9)测试

![fde1f715394e44e78f927027a59ea9ef.png][]

### 2.2---授权功能 ###

（1）修改myRealm

//授权
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            //获取当前登录者的账号
            User user = (User) principals.getPrimaryPrincipal();
            //调用userSerice中的方法--根据id
           List<String> permissions= userService.selectPermissionByUserid(user.getUserid());
           if(permissions.size()!=0){
               SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
               info.addStringPermissions(permissions);
               return info;
           }
            return null;
        }

(2)PermissionService

@Service
    public class PermissionServiceImpl implements PermissionService {
        @Autowired
        private PermissionDao permissionDao;
        public List<String> selectPermissionByUserid(Integer userid) {
            List<Permission> permissionList= permissionDao.findPermissionByUserid(userid);
            List<String> collect = permissionList.stream().map(item -> item.getPercode()).collect(Collectors.toList());
            return collect;
        }
    }

(3)PermissionDao和映射

List<Permission> findPermissionByUserid(Integer userid);
    }

<select id="findPermissionByUserid" resultType="com.ykq.entity.Permission">
            select p.* from user_role ur join role_permission rp on ur.roleId=rp.roleid
            join permission p on rp.perid=p.perid where ur.userid=#{userId}
        </select>

（4）测试

任何人登录都看到了所有的按钮权限---想不同人登录具有什么权限能够看懂神门按钮。

解决方案:在jsp中使用shiro标签库

![40a0ac6b81184079a46dde0c0c883857.png][]

<%--
      Created by IntelliJ IDEA.
      User: 18193
      Date: 2023/7/6
      Time: 17:05
      To change this template use File | Settings | File Templates.
    --%>
    <%@ page contentType="text/html;charset=UTF-8" language="java" %>
    <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
    <html>
    <head>
        <title>Title</title>
    </head>
    <body>
    登陆成功欢迎来到主页<br>
    <shiro:hasPermission name="user:query"><a href="user/query">查询用户</a><br></shiro:hasPermission>
    <shiro:hasPermission name="user:update"><a href="user/update">修改用户</a><br></shiro:hasPermission>
    <shiro:hasPermission name="user:delete"><a href="user/delete">删除用户</a><br></shiro:hasPermission>
    <shiro:hasPermission name="user:insert"><a href="user/insert">添加用户</a><br></shiro:hasPermission>
    <shiro:hasPermission name="user:export"><a href="user/export">导出用户</a><br></shiro:hasPermission>
    </body>
    </html>

我们虽然在浏览器看到相应的按钮---可是我可以同别的方式能访问后台对应的资源。 shiro提供了注解。---判断该是否具有该注解的权限---才会执行对应的资源方法

package com.cgm.controller;
    
    import org.apache.shiro.authz.annotation.RequiresPermissions;
    import org.springframework.web.bind.annotation.GetMapping;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    /**
     * @Title: UserController
     * @Package com.cgm.controller
     * @Author 常小明
     * @Date 2023/7/6 17:45
     * @program
     */
    @RestController
    @RequestMapping("/user")
    public class UserController {
    
        @GetMapping("/query")
        @RequiresPermissions(value = "user:query")
        public String query(){
            return "user:query------------------------";
        }
    
        @GetMapping("/update")
        @RequiresPermissions(value = "user:update")
        public String update(){
            return "user:update------------------------";
        }
    
        @GetMapping("/delete")
        @RequiresPermissions(value = "user:delete")
        public String delete(){
            return "user:delete------------------------";
        }
    
        @GetMapping("/insert")
        @RequiresPermissions(value = "user:insert")
        public String insert(){
            return "user:insert------------------------";
        }
    
        @GetMapping("/export")
        @RequiresPermissions(value = "user:export")
        public String export(){
            return "user:export------------------------";
        }
    }

发现上面注解不生效-----spring没有开启该注解的驱动---spring配置文件加入如下内容

<bean id="lifecycleBeanPostProcessor"
              class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
        <bean
                class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
                depends-on="lifecycleBeanPostProcessor" />
        <bean
                class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager" />
        </bean>

至此完成，后续会完成前后端分离，请关注后续。

[362facf1ef704387a259f395131af1e7.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/9b91ab5bf2e34c54b95eef5082f11ce0.png
[97b3e28e1fa740b0ad120693e901660e.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/5841c295e8534a23bfb6e1757b9c3e91.png
[dd3250fb53d7497fbc1a9d66b780b745.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/9921857d1ad344b4bf1da592efd54a07.png
[fde1f715394e44e78f927027a59ea9ef.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/729bcdafb77d488d879a26d96f215c2d.png
[40a0ac6b81184079a46dde0c0c883857.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/484e174c019b4f368139ad0eec6b7604.png