shiro授权-SSM

一、授权

先到数据库写好sql语句
查询身份

select ur.roleid from t_shiro_user u,t_shiro_user_role ur where  u.userid=ur.userid and u.username='zdm'

查询权限

select perid from t_shiro_user u,
t_shiro_user_role ur,
t_shiro_role_permission sp 
where u.userid=ur.userid
and ur.roleid=sp.roleid
and u.username='ls'

usermapper.xml添加

<select id="selectRoleByUserName" resultType="java.lang.String" parameterType="java.lang.String" >
    select ur.roleid from t_shiro_user u,t_shiro_user_role ur where  u.userid=ur.userid and u.username= #{userName}
  </select>

  <select id="selectPerByUserName" resultType="java.lang.String" parameterType="java.lang.String" >
    select perid from t_shiro_user u,
    t_shiro_user_role ur,
    t_shiro_role_permission sp
    where u.userid=ur.userid
    and ur.roleid=sp.roleid
    and u.username=#{userName}
  </select>

usermapper

//     角色
    Set<String> selectRoleByUserName(String userName);
//      权限
    Set<String> selectPerByUserName(String userName);

userbizipml

@Override
    public Set<String> selectRoleByUserName(String userName) {
        return userMapper.selectRoleByUserName(userName);
    }

    @Override
    public Set<String> selectPerByUserName(String userName) {
        return userMapper.selectPerByUserName(userName);
    }

修改一下shiro.xml的东西

  /user/login=anon
                /user/updatePwd.jsp=authc
                /admin/*.jsp=roles[4]
                /user/teacher.jsp=perms[2]

重写授权的方法

/**
     * 授权
     * @param princi
     * @return
     * 替代lweb-shiro.ini
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection princi) {

        System.out.println("授权方法。。。。。。。");
        //拿到登录的用户名
        String userName = princi.getPrimaryPrincipal().toString();
        //根据用户名查询用户
        User user = userbiz.queryByName(userName);
        //查询角色
        Set<String> roles = userbiz.selectRoleByUserName(userName);
        //查询权限
        Set<String> pers = userbiz.selectPerByUserName(userName);

        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        info.setRoles(roles);
        info.setStringPermissions(pers);
        return info;
    }

运行结果：
我们使用zdm登录，管理员的身份

然后我们再用zs登录：普通用户

二、注解式开发

常用注解介绍

@RequiresAuthenthentication:表示当前Subject已经通过login进行身份验证;即 Subject.isAuthenticated()返回 true
@RequiresUser:表示当前Subject已经身份验证或者通过记住我登录的
@RequiresGuest:表示当前Subject没有身份验证或者通过记住我登录过，即是游客身份
@RequiresRoles(value = {“admin”,“user”},logical = Logical.AND):表示当前Subject需要角色admin和user
@RequiresPermissions(value = {“user:delete”,“user:b”},logical = Logical.OR):表示当前Subject需要权限user:delete或者user:b

注解的使用

package com.yzp.controller;

import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.authz.annotation.RequiresUser;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.HttpServletRequest;

/**
 * @author易泽鹏
 * @site 16670388677
 * @company
 * @create  2022-08-26 18:40
 */
@RequestMapping("/shiro")
@Controller
public class ShiroController {

    //RequiresUser是代表当前方法只有登录后才能访问
//    RequiresUser等价与applicationContext-shiro.xml中的/user/updatePwd.jsp=authc配置
    @RequiresUser
    @RequestMapping("/passUser")
    public  String passUser(HttpServletRequest request){
        System.out.println("身份认证通过。。。。。。");
        return "admin/addUser";
    }

//    RequiresRoles是当前方法只有具备指定的角色才能访问
//    RequiresRoles等价于/admin/*.jsp=roles[4]配置
    @RequiresRoles(value = {"1","4"},logical = Logical.AND)
    @RequestMapping("/passRole")
    public String passRole(HttpServletRequest request){
        System.out.println("角色认证通过。。。。。");
        return "admin/addUser";
    }

    @RequiresPermissions(value = {"2"},logical = Logical.AND)
    @RequestMapping("/permission")
    public String permission(HttpServletRequest request){
        System.out.println("权限认证通过。。。。。。");
        return "admin/addUser";
    }

}

spring-mvc.xml配置

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
      depends-on="lifecycleBeanPostProcessor">
    <property name="proxyTargetClass" value="true"></property>
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager"/>
</bean>

<bean id="exceptionResolver" class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
    <property name="exceptionMappings">
        <props>
            <prop key="org.apache.shiro.authz.UnauthorizedException">
                unauthorized
            </prop>
        </props>
    </property>
    <property name="defaultErrorView" value="unauthorized"/>
</bean>

运行结果：
没登录他会报错

使用zdm登录

角色认证结果：
我们用zs登录，因为zs只有普通用户的权限所有无法访问

我们使用zdm登录即可访问因为只有zdm符合角色1和角色4


permission
权限方法运行结果
只有拥有新增用户权限的才能访问
zdm登录可以访问

zs登录没有资格