Shiro

Springboot和Shiro 的整合简单实例

Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码和会话管理。使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。
三个核心组件：Subject, SecurityManager 和 Realms.

简单实例

Model:用户名密码的登录验证和关联数据库动态授权。

@Data
public class User {
    private  int id;
    private  String username;
    private  String password;
    //权限
    private  String perms;
}

Shiro配置类：

@Configuration
public class ShiroConfig {
    /**
     * 创建ShiroFilterFactoryBean
     */
    @Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(securityManager);
//添加Shiro内置过滤器
    /**
     * Shiro内置过滤器，可以实现权限相关的拦截器
     * 常用的过滤器：
     * anon：无需认证（登录）可以访问
     * authc:必须认证才可以访问
     * user:如果使用remenberMe的功能可以直接访问
     * perms:该资源必须得到资源权限才可以访问
     * role:该资源必须得到角色的权限才可以访问
     */
    Map<String,String> filterMap=new LinkedHashMap<String,String>();
//    filterMap.put("/add","authc");
//    filterMap.put("/update","authc");
        filterMap.put("/testThymeleaf","anon");
        filterMap.put("/tologin","anon");
        filterMap.put("/login","anon");
        filterMap.put("/add","perms[user:add]");
        filterMap.put("/update","perms[user:update]");
        filterMap.put("/*","authc");
    shiroFilterFactoryBean.setLoginUrl("/toLogin");
    shiroFilterFactoryBean.setUnauthorizedUrl("/noAuth");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
    return shiroFilterFactoryBean;
}

    /**
     * 创建DefaultWebSecurityManager
     */
    @Bean(name="securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm){
DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
    securityManager.setRealm(userRealm);
    return securityManager;
}
    /**
     * 创建Realm
     */
    @Bean(name="userRealm")
    public UserRealm getRealm(){
        return new UserRealm();
    }

    @Bean
    public ShiroDialect getShiroDialect(){
        return new ShiroDialect();
    }

}

UserRealm :主要用来执行授权和认证操作的

public class UserRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
    /**
     *执行授权逻辑
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
       System.out.println("认证");
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
       // info.addStringPermission("user:add");
     Subject subject = SecurityUtils.getSubject();
     User user=(User)subject.getPrincipal();
     User pUser=(User)userService.findUserById(user.getId());
     info.addStringPermission(user.getPerms());
        return info;
    }

    /**
     *执行认证逻辑
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行");
        UsernamePasswordToken token=(UsernamePasswordToken)authenticationToken;
        User user=userService.findUser(token.getUsername());
        System.out.println("准备认证");
        if(user==null){
            System.out.println("用户不存在");
            return null;
        }
        System.out.println("用户密码认证");
        return new SimpleAuthenticationInfo(user,user.getPassword(),"");
    }
}

控制层进行登录操作的判断，对过滤器跳转到的网页进行指定

@Controller
public class UserController {
    @RequestMapping("/hello")
    @ResponseBody
    public String hello(){
        System.out.println("Hello");
        return "ok";
    }

    @RequestMapping("/testThymeleaf")
    public String testThymeleaf(Model model){
        model.addAttribute("name","shiro学习中。。。");
        return "test";
    }
    @RequestMapping("/add")
    public String add(){
        System.out.println("add");
        return "/user/add";
    }
    @RequestMapping("/update")
    public String update(){
        System.out.println("update");
        return "/user/update";
    }
    @RequestMapping("/toLogin")
    public String toLogin(){
        return "login";
    }
    @RequestMapping("/login")
    public String login(String userName,String password,Model model){
        Subject currentUser= SecurityUtils.getSubject();
        UsernamePasswordToken token=new UsernamePasswordToken(userName,password);
        try {
            currentUser.login(token);
        }catch(UnknownAccountException ue){
            model.addAttribute("msg","该账号未注册");
            return "login";
        }catch(IncorrectCredentialsException ie){
            model.addAttribute("msg","密码不正确");
            return "login";
        }
        return "redirect:/testThymeleaf";
    }
    @RequestMapping("/noAuth")
    public String noAuth(Model model){
    return "noAuth";
    }