Spring Boot集成Shiro

Spring集成Shiro需要引入下面三个jar包，当然也要Spring的依赖这就不放了

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>1.4.0</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.0</version>
</dependency>

如果看不懂，先去看明白这篇文章的案例：shiro加密。

Spring Boot整合Shiro最关键的是配置Shiro拦截器、Realm、权限验证、角色验证的注解，下面是Spring Boot整合Shiro的配置类，其中MyRealm是我自定义的Realm。

/**
 * Spring Boot整合Shiro的配置类
 */
@Configuration
public class ShiroConfiguration {
    /**
     * 将自己的验证方式加入容器
     *
     * @return
     */
    @Bean
    public MyRealm myShiroRealm() {
        MyRealm myRealm = new MyRealm();
        return myRealm;
    }

    /**
     * 权限管理，配置Realm的管理认证
     *
     * @return
     */
    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(myShiroRealm());
        return securityManager;
    }

    /**
     * Filter工厂，设置对应的过滤条件和跳转条件
     *
     * @param securityManager
     * @return
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        Map<String, String> map = new HashMap<>();
        //登录、注册、错误页不需要登录验证
        map.put("/login", "anon");
        map.put("/register", "anon");
        map.put("/error", "anon");
        //登出
        map.put("/logout", "logout");
        //对其他所有请求进行登录验证
        map.put("/**", "authc");
        //登录的url
        shiroFilterFactoryBean.setLoginUrl("/login");
        //首页的url
        shiroFilterFactoryBean.setSuccessUrl("/index");
        //错误页面的url，认证不通过跳转
        shiroFilterFactoryBean.setUnauthorizedUrl("/error");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        return shiroFilterFactoryBean;
    }

    @Bean(name = "lifecycleBeanPostProcessor")
    public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    /**
     * 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
     * 配置以下两个bean(DefaultAdvisorAutoProxyCreator(可选)和AuthorizationAttributeSourceAdvisor)即可实现此功能
     *
     * @return
     */
    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    /**
     * 加入注解的使用，不加入这个注解不生效
     *
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
}

控制器：

@RestController
public class Test {
    @Autowired
    private UserService userService;

    /**
     * 登录验证接口
     *
     * @param user
     * @return
     */
    @GetMapping(value = "/login", params = {"username", "password"})
    public Object test(Users user) {
        try {
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
            subject.login(token);
            subject.checkRoles("member");
            return "认证结果：" + subject.isAuthenticated();
        } catch (Exception e) {
            return "认证失败，错误信息为：" + e;
        }
    }

    /**
     * 注册接口
     *
     * @param user
     * @return
     */
    @GetMapping(value = "/register", params = {"username", "password"})
    public Object register(Users user) {
        try {
            userService.register(user);//注册
            return this.test(user);//注册成功就去登录
        } catch (Exception e) {
            return "认证失败，错误信息为：" + e;
        }
    }

    /**
     * 登出
     *
     * @return
     */
    @GetMapping("/logout")
    public Object logout() {
        try {
            Subject subject = SecurityUtils.getSubject();
            subject.logout();
            return "登出成功";
        } catch (Exception e) {
            return "登出失败，失败原因：" + e;
        }
    }

    /**
     * 首页
     *
     * @return
     */
    @GetMapping("/index")
    public Object index() {
        return "你好";
    }

    /**
     * 复读方法，需要有user:save权限才可以访问（注解验证）
     *
     * @param word
     * @return
     */
    @RequiresPermissions(value = {"user:save"})
    @GetMapping("/test/again")
    public Object again(String word) {
        return word;
    }

    /**
     * 复读方法2，admin角色或superAdminRole角色才可以访问（注解验证）
     *
     * @param word
     * @return
     */
    @GetMapping("/test/again2")
    @RequiresRoles(value = {"superAdminRole", "admin"}, logical = Logical.OR)
    public Object again2(String word) {
        return word;
    }

    /**
     * 复读方法3，需要有user:save权限才可以访问（代码验证）
     *
     * @param word
     * @return
     */
    @GetMapping("/test/again3")
    public Object again3(String word) {
        try {
            Subject subject = SecurityUtils.getSubject();
            subject.checkPermission("user:save");
            return word;
        } catch (Exception e) {
            return e;
        }
    }

    /**
     * 错误页面
     *
     * @return
     */
    @GetMapping("error")
    public Object error() {
        return "错误";
    }
}