【shiro】shiro 学习笔记4-初识shiro授权

权限架构一般分为两个模块：认证与授权，前面三篇主要讲的就是认证的内容，现在开始授权

环境：

pom.xml

    <dependencies>

        <!-- shiro -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.2.4</version>
        </dependency>

        <!--日志问题的解决-->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
            <version>1.7.15</version>
        </dependency>

        <!--日志-->
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.2</version>
        </dependency>

        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>

    </dependencies>

目录结构：

代码：

log4j.properties

log4j.rootLogger=DEBUG, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%5p [%t] - %m%n

shiro-realm-authz.ini

[main]
#注入自定义realm给securityManager
myRealm = xyz.mrwood.study.realm.MyRealm
securityManager.realms = $myRealm

MyRealm.java

package xyz.mrwood.study.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import java.util.Arrays;
import java.util.HashMap;

/**
 * Created by Administrator on 2016/2/18.
 */
public class MyRealm extends AuthorizingRealm {

//    授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        这里应该从数据库获得权限
        info.addStringPermissions(Arrays.asList("user:create", "user:update"));
        return info;
    }

//    认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        String principal = (String) token.getPrincipal();

        //        模拟数据库
        HashMap<String, Object> users = new HashMap<>();
        users.put("kiwi", "123456");
        users.put("fly", "123");

        if (users.containsKey(principal)) {

            return new SimpleAuthenticationInfo(principal, users.get("kiwi").toString(), getName());
        }

        return null;
    }

}

AuthzTest.java

package xyz.mrwood.study.authorization;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.junit.Test;

/**
 * Created by Administrator on 2016/2/18.
 */
public class AuthzTest {

    @Test
    public void testCustomAuthz(){

//        构建SecurityManager环境
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro-realm-authz.ini");
        SecurityManager securityManager = factory.getInstance();
        SecurityUtils.setSecurityManager(securityManager);

//        认证
        AuthenticationToken token = new UsernamePasswordToken("kiwi", "123456");
        Subject subject = SecurityUtils.getSubject();

        try {
            subject.login(token);
        } catch (AuthenticationException e) {
            System.out.println("帐号或密码错误！");
        }

        System.out.println("认证：" + subject.isAuthenticated());

//        授权
        if (subject.isAuthenticated()){

            /*
            is开头的是判断资源，
            has开头的是角色，
            check开头的不返回boolean,如果没有权限就拖异常
             */

            System.out.println("用户修改权限：" + subject.isPermitted("user:update:1"));
            try {
                subject.checkPermission("user:create");
            } catch (AuthorizationException e) {
                System.out.println("权限不足！");
            }
            System.out.println("用户创建权限：" );
        }
    }
}

总结：

1. 在shiro中realm其实就相当于数据源
2. 在授权中有基于角色也有基于资源的