Spring集成Shiro需要引入下面三个jar包,当然也要Spring的依赖这就不放了
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
如果看不懂,先去看明白这篇文章的案例:shiro加密。
Spring Boot整合Shiro最关键的是配置Shiro拦截器、Realm、权限验证、角色验证的注解,下面是Spring Boot整合Shiro的配置类,其中MyRealm是我自定义的Realm。
/**
* Spring Boot整合Shiro的配置类
*/
@Configuration
public class ShiroConfiguration {
/**
* 将自己的验证方式加入容器
*
* @return
*/
@Bean
public MyRealm myShiroRealm() {
MyRealm myRealm = new MyRealm();
return myRealm;
}
/**
* 权限管理,配置Realm的管理认证
*
* @return
*/
@Bean
public DefaultWebSecurityManager securityManager() {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(myShiroRealm());
return securityManager;
}
/**
* Filter工厂,设置对应的过滤条件和跳转条件
*
* @param securityManager
* @return
*/
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
Map<String, String> map = new HashMap<>();
//登录、注册、错误页不需要登录验证
map.put("/login", "anon");
map.put("/register", "anon");
map.put("/error", "anon");
//登出
map.put("/logout", "logout");
//对其他所有请求进行登录验证
map.put("/**", "authc");
//登录的url
shiroFilterFactoryBean.setLoginUrl("/login");
//首页的url
shiroFilterFactoryBean.setSuccessUrl("/index");
//错误页面的url,认证不通过跳转
shiroFilterFactoryBean.setUnauthorizedUrl("/error");
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
return shiroFilterFactoryBean;
}
@Bean(name = "lifecycleBeanPostProcessor")
public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
return new LifecycleBeanPostProcessor();
}
/**
* 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
* 配置以下两个bean(DefaultAdvisorAutoProxyCreator(可选)和AuthorizationAttributeSourceAdvisor)即可实现此功能
*
* @return
*/
@Bean
@DependsOn({"lifecycleBeanPostProcessor"})
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
advisorAutoProxyCreator.setProxyTargetClass(true);
return advisorAutoProxyCreator;
}
/**
* 加入注解的使用,不加入这个注解不生效
*
* @param securityManager
* @return
*/
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
}
控制器:
@RestController
public class Test {
@Autowired
private UserService userService;
/**
* 登录验证接口
*
* @param user
* @return
*/
@GetMapping(value = "/login", params = {"username", "password"})
public Object test(Users user) {
try {
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
subject.login(token);
subject.checkRoles("member");
return "认证结果:" + subject.isAuthenticated();
} catch (Exception e) {
return "认证失败,错误信息为:" + e;
}
}
/**
* 注册接口
*
* @param user
* @return
*/
@GetMapping(value = "/register", params = {"username", "password"})
public Object register(Users user) {
try {
userService.register(user);//注册
return this.test(user);//注册成功就去登录
} catch (Exception e) {
return "认证失败,错误信息为:" + e;
}
}
/**
* 登出
*
* @return
*/
@GetMapping("/logout")
public Object logout() {
try {
Subject subject = SecurityUtils.getSubject();
subject.logout();
return "登出成功";
} catch (Exception e) {
return "登出失败,失败原因:" + e;
}
}
/**
* 首页
*
* @return
*/
@GetMapping("/index")
public Object index() {
return "你好";
}
/**
* 复读方法,需要有user:save权限才可以访问(注解验证)
*
* @param word
* @return
*/
@RequiresPermissions(value = {"user:save"})
@GetMapping("/test/again")
public Object again(String word) {
return word;
}
/**
* 复读方法2,admin角色或superAdminRole角色才可以访问(注解验证)
*
* @param word
* @return
*/
@GetMapping("/test/again2")
@RequiresRoles(value = {"superAdminRole", "admin"}, logical = Logical.OR)
public Object again2(String word) {
return word;
}
/**
* 复读方法3,需要有user:save权限才可以访问(代码验证)
*
* @param word
* @return
*/
@GetMapping("/test/again3")
public Object again3(String word) {
try {
Subject subject = SecurityUtils.getSubject();
subject.checkPermission("user:save");
return word;
} catch (Exception e) {
return e;
}
}
/**
* 错误页面
*
* @return
*/
@GetMapping("error")
public Object error() {
return "错误";
}
}