shiro 权限控制框架 入门级实例（一）加密、登录验证

shiro 权限控制框架 入门级实例 加密、登录验证

 

 

一、控制层

@Controller
public class userAction {

@Autowired
private userService us;

@RequestMapping(value="/login.do",method=RequestMethod.POST)
    public String login(TLogin user, HttpServletRequest request) {
        // 获取subject对象
        Subject subject = SecurityUtils.getSubject();
        // 实例化用户名密码令牌
        UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
        try {
            // 使用subject对象进行登陆
            subject.login(token);
            // 获取session
            Session session = subject.getSession();
            // 输出session
            System.out.println("sessionId:" + session.getId() + ";sessionHost:" + session.getHost() +";sessionTimeout:%s" + session.getTimeout());
            session.setAttribute("info", "session的数据");
//            if (subject.isPermitted("所有权限")) {
// return "success";
// }
//            if (subject.isPermitted("主管权限")) {
// return "success";
// }
//            if (subject.isPermitted("普通权限")) {
// return "success";
// }
            return "success";
        } catch (Exception e) {
            // 验证失败
            e.printStackTrace();
            request.setAttribute("user", user);
            request.setAttribute("errorMsg", "用户名或密码错误");
            return "login";
        }
    }

二、service层

 

public interface userService {
Set<String> selectRoleName(String username);
Set<String> selectPermissionName(String userName);
Map<String,Object> selectUser(String username);
}

 

@Service
@Transactional
public class userServiceImpl implements userService {

@Resource
private userMapper um;

 

@Override
public Set<String> selectRoleName(String username) {
return um.selectRoleName(username);
}

@Override
public Set<String> selectPermissionName(String userName) {
return um.selectPermissionName(userName);
}

@Override
public Map<String,Object> selectUser(String username) {
return um.selectUser(username);
}

}

 

三、dao层

public interface userMapper {

 

        Set<String> selectRoleName(String username);
Set<String> selectPermissionName(String userName);
Map<String,Object> selectUser(String username);

}

 

四、mapper.xml

 

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper  
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"  
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">  
<mapper namespace="com.grs.dao.userMapper">  
      
   <select id="login" parameterType="com.grs.domain.TUser" resultType="java.lang.Integer">
   select * from t_user 
   where 
   username = #{username} 
   and 
   password = #{password}
   </select>
   <!-- 查询角色 -->
   <select id="selectRoleName" parameterType="com.grs.domain.TUsername" resultType="java.lang.String">
   select 
   r.roleName 
   from t_user as u,
   t_role as r,
   t_username as us
   where 
   us.us_id=u.us_id 
   and u.role_id=r.role_id 
   and (us.phonenumber=#{_parameter} or us.e_mail=#{_parameter})
   </select>
   
   <select id="selectPermissionName" parameterType="com.grs.domain.TUsername" resultType="java.lang.String">
    select p.permissionName 
    from t_user u,
    t_role r,
    t_permission p,
    t_username us
    where 
    us.us_id = u.us_id
    and u.role_id=r.role_id 
    and p.role_id=r.role_id 
    and (us.phonenumber=#{_parameter} or us.e_mail=#{_parameter})
   </select>
   
   <select id="selectUser" parameterType="java.lang.String" resultType="java.util.HashMap">
   select * from t_user as u,t_username as us 
   where 
   u.us_id = us.us_id 
   and (us.phonenumber = #{phonenumber} or us.e_mail = #{e_mail})
   </select>

</mapper>  

 

五、spring-mybatis-shiro.xml

 

........

<!-- shiro start -->
    <!-- 自定义realm -->
    <bean id="myRealm" class="com.grs.interceptor.myRealm">
    <property name="credentialsMatcher">
            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                <property name="hashAlgorithmName" value="MD5"></property> <!-- 加密算法的名称 -->
                <property name="hashIterations" value="1024"></property> <!-- 配置加密的次数 -->
            </bean>
        </property>
    </bean>
    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm"/>
    </bean>
    <!-- shiro过滤器 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- shiro的核心安全接口，属性是必须的 -->
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/login.jsp"/>
        <property name="successUrl" value="/index.jsp" />
        <property name="unauthorizedUrl" value="/login.jsp"/>
        <!-- shiro连接约束配置，即过滤链的定义 -->
        <property name="filterChainDefinitions">
            <value>
            /login.jsp = anon
            /insertTUser.do = anon
            </value>
        </property>
    </bean>
    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    <!-- 开启shiro注解 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>
    
    <!-- shiro end -->

........

 

六、web.xml

 <!-- shiro过滤器 -->
  <filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
      <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->
      <param-name>targetFilterLifecycle</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>
  <filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

 

七、bean 

 

public class TUser implements Serializable{


private static final long serialVersionUID = 1L;


private Integer id;
private Integer us_id;
private transient String password;
private int role_id;
private String salt;

....

//省略getter、setter方法

}

 

public class TUsername implements Serializable{


private static final long serialVersionUID = 1L;


private Integer us_id;
private String phonenumber;
private String e_mail;

.....

//省略getter、setter方法

}