Shiro框架通过自定义的授权认证方法认证用户权限相关的信息并封装给角色------Shiro框架

旧约Alatus

于 2024-06-12 13:05:43 发布

阅读量522

点赞数 11

分类专栏： # Shiro框架 # Spring-Boot框架 JAVA 文章标签： spring boot java 后端 mybatis 安全架构 web安全安全性测试

本文链接：https://blog.csdn.net/2201_75960169/article/details/139622888

版权

JAVA 同时被 3 个专栏收录

541 篇文章 3 订阅

订阅专栏

Spring-Boot框架

191 篇文章 0 订阅

订阅专栏

Shiro框架

17 篇文章 0 订阅

订阅专栏

package com.alatus.shiro.realm;

import com.alatus.shiro.entity.User;
import com.alatus.shiro.service.UserService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.util.ObjectUtils;

import java.util.List;

@Component
public class MyRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
//    自定义授权方法
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
//        获取用户身份信息
        String name = principalCollection.getPrimaryPrincipal().toString();
//        调用业务层提供的用户信息
        User user = userService.getUserInfoByName(name);
//        获取授权角色列表
        List<String> roles = userService.getUserRoleInfo(name);
//        创建对象封装当前用户的角色和权限信息
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        存储角色
        info.addRoles(roles);
//        返回角色信息
        return info;
    }

//    自定义登录认证方法
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//        获取用户身份信息
        String name = authenticationToken.getPrincipal().toString();
//        调用业务层提供的用户信息
        User user = userService.getUserInfoByName(name);
//        非空判断,完成封装
        if(!ObjectUtils.isEmpty(user)){
            AuthenticationInfo info = new SimpleAuthenticationInfo(
                    authenticationToken.getPrincipal(),
                    user.getPwd(),
                    ByteSource.Util.bytes("salt"),
                    authenticationToken.getPrincipal().toString()
            );
            return info;
        }
        return null;
    }
}

package com.alatus.shiro.realm;

import com.alatus.shiro.entity.User;
import com.alatus.shiro.service.UserService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.util.ObjectUtils;

import java.util.List;

@Component
public class MyRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
//    自定义授权方法
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
//        获取用户身份信息
        String name = principalCollection.getPrimaryPrincipal().toString();
//        调用业务层提供的用户信息
        User user = userService.getUserInfoByName(name);
//        获取授权角色列表
        List<String> roles = userService.getUserRoleInfo(name);
//        创建对象封装当前用户的角色和权限信息
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        存储角色
        info.addRoles(roles);
//        返回角色信息
        return info;
    }

//    自定义登录认证方法
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//        获取用户身份信息
        String name = authenticationToken.getPrincipal().toString();
//        调用业务层提供的用户信息
        User user = userService.getUserInfoByName(name);
//        非空判断,完成封装
        if(!ObjectUtils.isEmpty(user)){
            AuthenticationInfo info = new SimpleAuthenticationInfo(
                    authenticationToken.getPrincipal(),
                    user.getPwd(),
                    ByteSource.Util.bytes("salt"),
                    authenticationToken.getPrincipal().toString()
            );
            return info;
        }
        return null;
    }
}

package com.alatus.shiro.service.impl;

import com.alatus.shiro.entity.User;
import com.alatus.shiro.mapper.UserMapper;
import com.alatus.shiro.service.UserService;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class UserServiceImpl implements UserService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public User getUserInfoByName(String name) {
        QueryWrapper<User> wrapper = new QueryWrapper<>();
        wrapper.eq("name",name);
        User user = userMapper.selectOne(wrapper);
        return user;
    }

    @Override
    public List<String> getUserRoleInfo(String principal) {
        return userMapper.getUserRoleInfoMapper(principal);
    }
}

package com.alatus.shiro.service.impl;

import com.alatus.shiro.entity.User;
import com.alatus.shiro.mapper.UserMapper;
import com.alatus.shiro.service.UserService;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class UserServiceImpl implements UserService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public User getUserInfoByName(String name) {
        QueryWrapper<User> wrapper = new QueryWrapper<>();
        wrapper.eq("name",name);
        User user = userMapper.selectOne(wrapper);
        return user;
    }

    @Override
    public List<String> getUserRoleInfo(String principal) {
        return userMapper.getUserRoleInfoMapper(principal);
    }
}

package com.alatus.shiro.mapper;

import com.alatus.shiro.entity.User;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import org.springframework.stereotype.Repository;
import java.util.List;

@Repository
public interface UserMapper extends BaseMapper<User> {
    @Select("SELECT `name` FROM role " +
            "WHERE id IN (" +
            "   SELECT rid FROM role_user " +
            "   WHERE uid = (" +
            "       SELECT id FROM `user` " +
            "       WHERE `name` = #{principal}" +
            "   )" +
            ");")
    List<String> getUserRoleInfoMapper(@Param("principal") String principal);

}
package com.alatus.shiro.mapper;

import com.alatus.shiro.entity.User;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;
import org.springframework.stereotype.Repository;
import java.util.List;

@Repository
public interface UserMapper extends BaseMapper<User> {
@Select("SELECT `name` FROM role " +
"WHERE id IN (" +
" SELECT rid FROM role_user " +
" WHERE uid = (" +
" SELECT id FROM `user` " +
" WHERE `name` = #{principal}" +
" )" +
");")
List<String> getUserRoleInfoMapper(@Param("principal") String principal);

}

package com.alatus.shiro.service;

import com.alatus.shiro.entity.User;

import java.util.List;

public interface UserService {
//    用户登录
    User getUserInfoByName(String name);
//    根据用户查询角色信息
    List<String> getUserRoleInfo(String principal);
}

package com.alatus.shiro.service;

import com.alatus.shiro.entity.User;

import java.util.List;

public interface UserService {
//    用户登录
    User getUserInfoByName(String name);
//    根据用户查询角色信息
    List<String> getUserRoleInfo(String principal);
}