SpringBoot(23)Shiro的授权

1.设置权限

参考shiro的快速入门

	1.filterMap.put("/user/add","perms[user:add]");
    2.filterMap.put("/user/update","perms[user:update]");

 @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        /**
         * 添加shiro的内置过滤器:
         * anon:无需认证
         * authc:必须要认证
         * user:必须拥有记住我功能
         * perms: 拥有对某个资源权限才能访问
         * role:拥有某个角色权限才能访问
         *
         */

        Map<String, String> filterMap = new LinkedHashMap<>();
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","perms[user:update]");
        filterMap.put("/user/*","authc");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);

        //设置请求登录
        shiroFilterFactoryBean.setLoginUrl("/tologin");

        return  shiroFilterFactoryBean;
    }

2.加入无权限的页面

1.无权限请求路径

    @RequestMapping("/unauth")
    @ResponseBody
    public String unauth(){
        return "未经授权无法访问";
    }

2.添加无权限页面

 1.shiroFilterFactoryBean.setUnauthorizedUrl("/unauth");

  @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        /**
         * 添加shiro的内置过滤器:
         * anon:无需认证
         * authc:必须要认证
         * user:必须拥有记住我功能
         * perms: 拥有对某个资源权限才能访问
         * role:拥有某个角色权限才能访问
         *
         */

        Map<String, String> filterMap = new LinkedHashMap<>();
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","perms[user:update]");
        filterMap.put("/user/*","authc");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);

        //设置请求登录
        shiroFilterFactoryBean.setLoginUrl("/tologin");
        shiroFilterFactoryBean.setUnauthorizedUrl("/unauth");

        return  shiroFilterFactoryBean;
    }

3.授权
当前用户在授权的方法中获取不了，只能在认证中获取，可以在认证时将用户传入

认证时将用户传入
return new SimpleAuthenticationInfo(user,user.getPwd(),"");
通过suject将用户取出
User currentUser = (User) subject.getPrincipal();

  @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("授权");
        //获取令牌
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //拿到当前用户
        Subject subject = SecurityUtils.getSubject();
        User currentUser = (User) subject.getPrincipal();
        //授权：从数据库中获取权限信息并设置上去
        info.addStringPermission(currentUser.getPerms());
        return info;

    }