springboot+shiro+mybatis+Thymeleaf实现用户权限管理

一.pom依赖

 <?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.1.3.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.fzc</groupId>
<artifactId>shiro</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>shiro</name>
<description>Demo project for Spring Boot</description>

<properties>
    <java.version>1.8</java.version>
</properties>

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-jdbc</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.mybatis.spring.boot</groupId>
        <artifactId>mybatis-spring-boot-starter</artifactId>
        <version>2.0.0</version>
    </dependency>

    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <!--<dependency>-->
        <!--<groupId>org.apache.shiro</groupId>-->
        <!--<artifactId>shiro-spring</artifactId>-->
        <!--<version>1.3.2</version>-->
    <!--</dependency>-->


</dependencies>

<build>
    <plugins>
        <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
        </plugin>
    </plugins>
</build>

   </project>

二.application.properties

spring.datasource.url = jdbc:mysql://localhost:3306/shiro?useUnicode=true&characterEncoding=UTF-8&zeroDateTimeBehavior=convertToNull&allowMultiQueries=true&serverTimezone=Asia/Shanghai
spring.datasource.username = root
spring.datasource.password =  root
spring.datasource.driverClassName = com.mysql.jdbc.Driver
spring.thymeleaf.cache = false

mybatis.typeAliasesPackage=com.fzc.shiro.model
mybatis.mapper-locations= classpath*:mapper/*.xml

三.controller

@Controller
public class UserController {
    private UserService userService;

    @RequestMapping("/hello")
    public String hello(){
        System.out.println("Hello World");
        return "index";
    }
    @RequestMapping("/add")
    public String toAdd(){
        return "/user/add";
    }
    @RequestMapping("/update")
    public String toUpdate(){
        return "/user/update";
    }

    @RequestMapping("/tologin")
    public String toLogin(){
        return "/login";
    }

    @RequestMapping("/login")
    public String login(String name, String password, Model model){
        //获取subject
        Subject subject = SecurityUtils.getSubject();
        //封装用户数据
        UsernamePasswordToken token = new UsernamePasswordToken(name,password);
        //执行登录方法
        try {
            //登录成功
            subject.login(token);
            return "redirect:/hello";
        }catch (UnknownAccountException e){
            //登录失败
//            e.printStackTrace();
            model.addAttribute("msg","用户名不存在");
            return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密码错误");
            return "login";
        }


    }
    @RequestMapping("/userlist")
    @ResponseBody
    public List<User> getUserList(){
        return userService.getUserList();
    }
}

四.service

@Service
public class UserService {
    @Autowired
    private UserMapper userMapper;

    public User findByName(String name){
        return  userMapper.findByName(name);
    }

    public List<User> getUserList(){
        return userMapper.getUserList();
    }
}

.五.shiro配置
1.ShiroConfig

	@Configuration
	public class ShiroConfig {
	    //创建shirofilterFactoryBean
	    @Bean
	    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("defaultWebSecurityManager") DefaultWebSecurityManager securityManager){
	        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
	        //设置安全管理器
	        shiroFilterFactoryBean.setSecurityManager(securityManager);
	        //添加shiro内置过滤器
	        /**
	         * anon:无需认证
	         * authc:必须认证
	         * user:如果使用rememberMe可以访问
	         * perms:必须得到权限才能访问
	         * role:必须得到角色权限
	         */
	        Map<String,String> filterMap = new LinkedHashMap<>();
	//        filterMap.put("/add","authc");
	        filterMap.put("/update","authc");
	        filterMap.put("/getlist","anon");
	//        filterMap.put("/hello","anon");
	//        filterMap.put("/*","authc");
	
	        shiroFilterFactoryBean.setLoginUrl("/tologin");
	        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
	        return shiroFilterFactoryBean;
	    }
	
	    //创建DefaultWebSecurityManagerBean
	    @Bean(name="defaultWebSecurityManager")
	    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userShiroConfig") UserShiroConfig userRealm){
	        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
	        securityManager.setRealm(userRealm);
	        return securityManager;
	    }
	
	    //创建realm
	    @Bean(name="userShiroConfig")
	    public UserShiroConfig getRealm(){
	        return new UserShiroConfig();
	    }
	}

2.自定义shiroRealm

	/**
	 * 自定义realm
	 */
	
	public class shiroRealm extends AuthorizingRealm {
	
	    private UserService userService;
	
	    /**
	     * 执行授权逻辑
	     * @param principalCollection
	     * @return
	     */
	    @Override
	    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
	        return null;
	    }
	
	    /**
	     * 执行认证逻辑
	     * @param authenticationToken
	     * @return
	     * @throws AuthenticationException
	     */
	    @Override
	    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
	        System.out.println("执行认证逻辑");
	        UsernamePasswordToken token =(UsernamePasswordToken)authenticationToken;
	        User user= userService.findByName(token.getUsername());
	        if (user == null){
	            return null;
	        }
	        return new SimpleAuthenticationInfo("",user.getPassword(),"");
	    }
	}

至此结束!