springboot_shiro_redis整合(一)-shiro-权限控制

springboot_shiro_redis整合(一)-shiro-权限控制

---

目录

---

---

内容

---

一、前言

  目前常用的安全框架为spring security、shiro等，关于二者之间的比较，有兴趣的小伙伴自行查阅相关文档这里不再讲述。这里，我们选择相对轻巧且功能能满足我们项目需要的shiro框架。

  shiro框架默认基于cookie-session来管理安全信息，而当前前后端分离、微服务、分布式广泛应用的情况下，显然不太适用。通过参考查询相关文档，其中之一的解决方案是用redis来替换。下面我们就来讲述shiro配置和shiro整合redis。

二、shiro整合redis

1、分析

  之前基于cookie-session，用户(subject)通过认证后，信息存入session,身份标志sessionID存入cookie,返回客户端。每次客户端访问服务端，需要通过cookie携带该身份标志，shiro验证通过，然后执行后续操作。

• 改造
  • 封装shiro工具类
  • realm
  • 整合redis配置
  • 身份标志获取

2、pom.xml 导入依赖

<properties>
	<shiro.version>1.4.0</shiro.version>
	<kaptcha.version>0.0.9</kaptcha.version>
</properties>
<dependencies>
	<dependency>
		<groupId>com.ihrm</groupId>
		<artifactId>ihrm-common</artifactId>
		<version>1.0.0-SNAPSHOT</version>
	</dependency>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-core</artifactId>
		<version>${shiro.version}</version>
	</dependency>
	<dependency>
		<groupId>org.apache.shiro</groupId>
		<artifactId>shiro-spring</artifactId>
		<version>${shiro.version}</version>
	</dependency>
<!--        <dependency>-->
<!--            <groupId>org.apache.shiro</groupId>-->
<!--            <artifactId>shiro-ehcache</artifactId>-->
<!--            <version>${shiro.version}</version>-->
<!--        </dependency>-->
	<dependency>
		<groupId>com.github.axet</groupId>
		<artifactId>kaptcha</artifactId>
		<version>${kaptcha.version}</version>
	</dependency>
	<dependency>
		<groupId>org.crazycake</groupId>
		<artifactId>shiro-redis</artifactId>
		<version>3.1.0</version>
	</dependency>
</dependencies>

• 解析：
  • shiro-core：shiro核心
  • shiro-spring： 用于spring整合shiro
  • shiro-redis： 第三方shiro整合redis
  • kapcha ：第三方验证码生成

2、相关具体类

2.1、封装ShiroUtils 工具类

package com.ihrm.modules.sys.shiro;

import com.ihrm.common.exception.RRException;
import com.ihrm.modules.sys.entity.UserEntity;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;

/**
 * Shiro工具类
 */
public class ShiroUtils {
	/**  加密算法 */
	public final static String hashAlgorithmName = "md5";
	/**  循环次数 */
	public final static int hashIterations = 16;

	public static String md5(String password, String salt) {
		return new SimpleHash(hashAlgorithmName, password, salt, hashIterations).toString();
	}

	public static Session getSession() {
		return SecurityUtils.getSubject().getSession();
	}

	public static Subject getSubject() {
		return SecurityUtils.getSubject();
	}

	public static UserEntity getUserEntity() {
		return (UserEntity) SecurityUtils.getSubject().getPrincipal();
	}

	public static String getId() {
		return getUserEntity().getId();
	}

	public static void setSessionAttribute(Object key, Object value) {
		getSession().setAttribute(key, value);
	}

	public static Object getSessionAttribute(Object key) {
		return getSession().getAttribute(key);
	}

	public static boolean isLogin() {
		return SecurityUtils.getSubject().getPrincipal() != null;
	}

	public static void logout() {
		SecurityUtils.getSubject().logout();
	}

	public static String getKaptcha(String key) {
		Object kaptcha = getSessionAttribute(key);
		if(kaptcha == null){
			throw new RRException("验证码已失效");
		}
		getSession().removeAttribute(key);
		return kaptcha.toString();
	}

}

2.2、UserRealm 自定义realm

package com.ihrm.modules.sys.shiro;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.ihrm.common.utils.Constant;
import com.ihrm.modules.sys.dao.PermissionDao;
import com.ihrm.modules.sys.dao.UserDao;
import com.ihrm.modules.sys.entity.PermissionEntity;
import com.ihrm.modules.sys.entity.UserEntity;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;

import java.util.*;

/**
 * 认证
 */
@Component
public class UserRealm extends AuthorizingRealm {
	@Autowired
	private UserDao sysUserDao;
	@Autowired
	private PermissionDao permissionDao;

	/**
	 * 授权(验证权限时调用)
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		UserEntity user = (UserEntity)principals.getPrimaryPrincipal();
		String userId = user.getId();

		List<String> permsList;

		//系统管理员，拥有最高权限
		if(StringUtils.equals(userId,Constant.SUPER_ADMIN)){
			List<PermissionEntity> menuList = permissionDao.selectList(null);
			permsList = new ArrayList<>(menuList.size());
			for(PermissionEntity menu : menuList){
				permsList.add(menu.getPerms());
			}
		}else{
			permsList = permissionDao.queryBtnsByUserId(userId);
		}

		//用户权限列表
		Set<String> permsSet = new HashSet<>();
		for(String perms : permsList){
			if(StringUtils.isBlank(perms)){
				continue;
			}
			permsSet.addAll(Arrays.asList(perms.trim().split(",")));
		}

		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		info.setStringPermissions(permsSet);
		return info;
	}

	/**
	 * 认证(登录时调用)
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(
			AuthenticationToken authcToken) throws AuthenticationException {
		UsernamePasswordToken token = (UsernamePasswordToken)authcToken;

		//查询用户信息
		UserEntity user = sysUserDao.selectOne(new QueryWrapper<UserEntity>().eq("mobile", token.getUsername()));
		//账号不存在
		if(user == null) {
			throw new UnknownAccountException("账号或密码不正确");
		}

		//账号锁定
		if(user.getEnableState() == 0){
			throw new LockedAccountException("账号已引用,请联系管理员");
		}

		SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPassword(), ByteSource.Util.bytes(user.getMobile()), getName());
		return info;
	}

	@Override
	public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
		HashedCredentialsMatcher shaCredentialsMatcher = new HashedCredentialsMatcher();
		shaCredentialsMatcher.setHashAlgorithmName(ShiroUtils.hashAlgorithmName);
		shaCredentialsMatcher.setHashIterations(ShiroUtils.hashIterations);
		super.setCredentialsMatcher(shaCredentialsMatcher);
	}

	/**
	 * 清除当前用户的权限认证缓存
	 *
	 * @param principals 权限信息 身份集合
	 */
	@Override
	public void clearCache(PrincipalCollection principals) {
		super.clearCache(principals);
	}
}

2.3、ShiroConfig 配置类

package com.ihrm.common.config;

import com.ihrm.modules.sys.shiro.CustomSessionManager;
import com.ihrm.modules.sys.shiro.UserRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.codec.Base64;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.session.mgt.ServletContainerSessionManager;
import org.crazycake.shiro.RedisCacheManager;
import org.crazycake.shiro.RedisManager;
import org.crazycake.shiro.RedisSessionDAO;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;
import java.util.Map;


/**
 * Shiro的配置文件
 */
@Configuration
public class ShiroConfig {

	@Value("${spring.redis.host}")
	private String host;

	@Value("${spring.redis.port}")
	private int port;

	@Value("${spring.redis.password}")
	private String password;

	@Value("${spring.redis.timeout}")
	private int timeout;

//	@Bean(name = "redisSessionDAO")
//	public RedisSessionDAO sessionDAO() {
//		return new RedisSessionDAO();
//	}

	@Bean
	public RedisManager redisManager() {
		RedisManager redisManager = new RedisManager();
//        redisManager.setHost(host);
//        redisManager.setTimeout(timeout);
//        if (StringUtils.isNotBlank(password))
//            redisManager.setPassword(password);

		return redisManager;
	}

	@Bean
	public RedisCacheManager redisCacheManager() {
		RedisCacheManager cacheManager = new RedisCacheManager();
		cacheManager.setRedisManager(redisManager());
		return cacheManager;
	}

	@Bean
	public RedisSessionDAO redisSessionDAO() {
		RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
		redisSessionDAO.setRedisManager(redisManager());
		return redisSessionDAO;
	}

	/**
	 * 单机环境，session交给shiro管理
	 * 会话管理器
	 */
	@Bean("sessionManager")
	@ConditionalOnProperty(prefix = "ihrm", name = "cluster", havingValue = "false")
	public DefaultWebSessionManager sessionManager(
			@Value("${ihrm.globalSessionTimeout:3600}") long globalSessionTimeout) {
		CustomSessionManager sessionManager = new CustomSessionManager();
		// redis session
		sessionManager.setSessionDAO(redisSessionDAO());
		sessionManager.setSessionValidationSchedulerEnabled(true);
		// 禁用重写url
		// sessionManager.setSessionIdUrlRewritingEnabled(false);
		// 禁用session 放在cookie
		// sessionManager.setSessionIdCookieEnabled(false);
		sessionManager.setSessionValidationInterval(globalSessionTimeout * 1000);
		// 会话过期时间，单位：毫秒(在无操作时开始计时)--->一分钟,用于测试
		sessionManager.setGlobalSessionTimeout(globalSessionTimeout * 1000);

		return sessionManager;
	}

	/**
	 * 集群环境，session交给spring-session管理
	 */
	@Bean
	@ConditionalOnProperty(prefix = "ihrm", name = "cluster", havingValue = "true")
	public ServletContainerSessionManager servletContainerSessionManager() {
		return new ServletContainerSessionManager();
	}


	private SimpleCookie rememberMeCookie() {
		// 设置 cookie 名称，对应 login.html 页面的 <input type="checkbox" name="rememberMe"/>
		SimpleCookie cookie = new SimpleCookie("rememberMe");
		// 设置 cookie 的过期时间，单位为秒 一个月
		cookie.setMaxAge(3600 * 30);
		return cookie;
	}


	private CookieRememberMeManager rememberMeManager() {
		CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
		cookieRememberMeManager.setCookie(rememberMeCookie());
		// rememberMe cookie 加密的密钥
		cookieRememberMeManager.setCipherKey(Base64.decode("4AvVhmFLUs0KTA3Kprsdag=="));
		return cookieRememberMeManager;
	}


	@Bean("securityManager")
	public SecurityManager securityManager(UserRealm userRealm, SessionManager sessionManager) {
		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
//		securityManager.setCacheManager(new EhCacheManager());
		securityManager.setCacheManager(redisCacheManager());
		securityManager.setRealm(userRealm);
		securityManager.setSessionManager(sessionManager);
		securityManager.setRememberMeManager(rememberMeManager());

		return securityManager;
	}

	@Bean("shiroFilter")
	public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
		ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
		shiroFilter.setSecurityManager(securityManager);
		shiroFilter.setLoginUrl("/login");
		shiroFilter.setUnauthorizedUrl("/");
		// shiroFilter.setSuccessUrl("/index.html");

		//自定义过滤器
//        Map<String, Filter> filterMap1 = new LinkedHashMap<>();
//
//        filterMap1.put("user",new MyUserFilter());
//        shiroFilter.setFilters(filterMap1);

		Map<String, String> filterMap = new LinkedHashMap<>();
		filterMap.put("/swagger/**", "anon");
//		filterMap.put("/v2/api-docs", "anon");
		filterMap.put("/swagger-ui.html", "anon");
		filterMap.put("/webjars/**", "anon");
		filterMap.put("/swagger-resources/**", "anon");
		filterMap.put("/doc.html", "anon");

		filterMap.put("/statics/**", "anon");
		filterMap.put("/favicon.ico", "anon");
		filterMap.put("/sys/captcha", "anon");
		filterMap.put("/sys/login", "anon");
//        filterMap.put("/sys/getInfo", "anon");
		filterMap.put("/**", "authc");
		shiroFilter.setFilterChainDefinitionMap(filterMap);

		return shiroFilter;
	}

	@Bean("lifecycleBeanPostProcessor")
	public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
		return new LifecycleBeanPostProcessor();
	}

	@Bean
	public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
		AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
		advisor.setSecurityManager(securityManager);
		return advisor;
	}

	@Bean
	public HashedCredentialsMatcher hashedCredentialsMatcher() {
		HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
		credentialsMatcher.setHashAlgorithmName("MD5"); //加密方式
		credentialsMatcher.setHashIterations(16);//散列次数
		return credentialsMatcher;

	}
}

2.4、CustomSessionManager 身份标志获取

package com.ihrm.modules.sys.shiro;

import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.Serializable;

public class CustomSessionManager extends DefaultWebSessionManager {
	/**
	 * 获取请求头中key为“Authorization”的value == sessionId
	 */
	private static final Logger log = LoggerFactory.getLogger(CustomSessionManager.class);
	private static final String TOKEN = "Authorization";

	private static final String REFERENCED_SESSION_ID_SOURCE = "header";

	/**
	 * @Description shiro框架 自定义session获取方式<br/>
	 * 可自定义session获取规则。这里采用ajax请求头 Authorization 携带sessionId的方式
	 */
	@Override
	protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
		String id = WebUtils.toHttp(request).getHeader(TOKEN);
		if (StringUtils.isBlank(id)) {
			id = WebUtils.toHttp(request).getParameter(TOKEN);
		}
		// 如果请求头中有 Authorization 则其值为sessionId
		if (StringUtils.isNotBlank(id)) {
			log.info("请求头中获取");
			request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, REFERENCED_SESSION_ID_SOURCE);
			request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, id);
			request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
			return id;
		} else {
			log.info("默认方式获取sessionId");
			return super.getSessionId(request, response);
		}

	}
}

后记 ：

本项目为参考某马视频开发，相关视频及配套资料可自行度娘或者联系本人。上面为自己编写的开发文档，持续更新。欢迎交流，本人QQ:806797785

后端JAVA源代码地址:https://gitee.com/gaogzhen/ihrm-parent    // 后端项目
前端项目源代码地址：https://gitee.com/gaogzhen/ihrm-vue    // 前端后台管理系统