Spring boot新闻项目管理——shiro权限管理

1. 导入shiro相关依赖

   <dependency>
       <groupId>org.apache.shiro</groupId>
       <artifactId>shiro-core</artifactId>
       <version>1.3.2</version>
   </dependency>
   <dependency>
       <groupId>org.apache.shiro</groupId>
       <artifactId>shiro-spring</artifactId>
       <version>1.3.2</version>
   </dependency>
   

2. 在po包中添加role、permission类，并更新User类

   po\Role.java

   @Entity
   @Table(name = "t_role")
   public class Role implements Serializable {
       private static final long serialVersionUID = -1003928920961239838L;
       @Id
       private String id;
       private String name;
       private String description;
       @ManyToMany(mappedBy = "roles")
       private Set<User> users = new HashSet<>(0);
       @ManyToMany(fetch = FetchType.EAGER)
       private Set<com.llanero.news.po.Permission> permissions = new HashSet<>(0);
   

   po.Permission.java

   @Entity
   @Table(name = "t_permission")
   public class Permission implements Serializable {
   
       private static final long serialVersionUID = 1486480317310743604L;
       @Id
       @GeneratedValue(strategy = GenerationType.IDENTITY)
       private Long id;
       private String name;
       private String code;
       private String description;
   

   po.User.java中添加下面属性

   @ManyToMany(fetch = FetchType.EAGER)
   private Set<Role> roles = new HashSet<Role>(0);
   

3. 在数据库中插入权限管理测试的数据

   

   

   

4. 自定义realm

   创建realm.NewsRealm类，对登录用户进行判断

   public class NewsRealm extends AuthorizingRealm {
   
       public void setName(String name) {
           setName("newsRealm");
       }
   
       @Autowired
       private UserService userService;
   
       @Override
       protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
           //获取认证的用户数据
           User user = (User) principalCollection.getPrimaryPrincipal();
           //构造认证数据
           SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
           Set<Role> roles = user.getRoles();
           for (Role role : roles) {
               //添加角色信息
               info.addRole(role.getName());
               for (Permission permission : role.getPermissions()) {
                   //添加角色信息
                   info.addStringPermission(permission.getCode());
               }
           }
           return info;
       }
   
       @Override
       protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
           UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken;
           String username = upToken.getUsername();
           String password = new String(upToken.getPassword());
           User user = userService.checkUsers(username, password);
           if (user != null) {
               return new SimpleAuthenticationInfo(user, user.getPassword(), this.getName());
           }
           return null;
       }
   }
   

5. 在根目录定义ShiroConfiguration类，设置过滤器

   @Configuration
   public class ShiroConfiguration {
       //创建realm
       @Bean
       public NewsRealm getRealm(){
           return new NewsRealm();
       }
   
       //创建安全管理器
       @Bean
       public SecurityManager securityManager(NewsRealm realm) {
           //使用默认的安全管理器
           DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(realm);
           //将自定义realm交给安全管理器统一调度
           return securityManager;
       }
   
       //配置shiro过滤器工厂
       @Bean
       public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
           ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
           shiroFilterFactoryBean.setSecurityManager(securityManager);
           //通用配置
           shiroFilterFactoryBean.setLoginUrl("/admin");
           shiroFilterFactoryBean.setUnauthorizedUrl("/admin");
   
   /*        * key: 请求路径
           * value: 过滤器类型
           * */
           Map<String, String> filterMap = new LinkedHashMap<>();
           filterMap.put("/admin/types", "perms[user-types]");
           filterMap.put("/admin/news", "perms[user-news");
           filterMap.put("/admin/tags", "perms[user-tags]");
           filterMap.put("/admin/login", "anon");
           filterMap.put("/admin/**","authc");
           System.out.println(filterMap);
           //设置过滤器
           shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
           return shiroFilterFactoryBean;
       }
   
       //开启shiro注解支持
       @Bean
       public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
           AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
           advisor.setSecurityManager(securityManager);
           return advisor;
       }
   
   }
   

6. 更换web.admin.LoginController中的login()方法

       @PostMapping("/login")
       public String login(@RequestParam String username, @RequestParam String password,
                           HttpSession session, RedirectAttributes attributes) {
           try {
               //构造登录令牌
               UsernamePasswordToken uptoken = new UsernamePasswordToken(username, password);
               //获取subject
               Subject subject = SecurityUtils.getSubject();
               subject.login(uptoken);
               User user = (User) subject.getPrincipal();
               session.setAttribute("user", user);
               return "admin/index";
           } catch (Exception e) {
               attributes.addFlashAttribute("message", "用户名或密码错误");
               return "redirect:/admin";
           }
       }