springboot与shiro整合实现用户授权,只显示有权限的列表

1、首先在shiro配置类中增加授权过滤器，注意记得要在authc过滤器的签名

package com.dcy.springbootshiro.config;

import org.apache.commons.collections.map.LinkedMap;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;
import java.util.Map;

/**
 * @author dcy
 * @date 2019/9/10 11:35
 * @description
 */
@Configuration
public class ShiroConfig {

    /**
     * 创建shiroFilterFactoryBean
     */
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        /**
         * 增加shiro内置过滤器
         * shiro内置过滤器，可以实现权限相关的lan拦截器
         *  常用的过滤器：
         *      anon：无需认证(登录)可以访问，设置该过滤器，要放在authc的前面
         *      authc:必须认证才能fwe
         *      user:如果使用rememberMe的功能可以直接访问
         *      perms：该资源必须得到权限才可以访问，设置该过滤器，要放在authc的前面
         *      role该资源必须得到j角色权限才可以访问
         *
         */

        Map<String ,String> filterMap = new LinkedHashMap<String,String>();
        //设置某些页面的拦截
        /* filterMap.put("/user/addUser","authc");
        filterMap.put("/user/updateUser","authc");*/

        //去除某些拦截，注意顺序
        filterMap.put("/user/hello","anon");//取消拦截登录页面的请求
        filterMap.put("/user/login","anon");//取消拦截登录请求的路径


        /**
         * 授权过滤器 要放在authc的签名
         */
        filterMap.put("/user/addUser","perms[user:addUser]");


        //拦截所有页面
        filterMap.put("/**","authc");


        //修改调整的登录页面
        shiroFilterFactoryBean.setLoginUrl("/user/toLogin");

        //设置未授权的页面
        shiroFilterFactoryBean.setUnauthorizedUrl("noAuth");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);

        return shiroFilterFactoryBean;
    }
    /**
     * 创建DeafultWebSecuriyManage
     */
    @Bean("securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(userRealm);
        return securityManager;
    }
    /**
     * 创建realm
     */
    @Bean("userRealm")
    public UserRealm getRealm(){
        return  new UserRealm();
    }
}

2、在userRealm中处理授权逻辑

package com.dcy.springbootshiro.config;

import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
/**
 * @author dcy
 * @date 2019/9/10 11:44
 * @description
 */
public class UserRealm extends AuthorizingRealm {

    /**
     * 执行授权逻辑
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行授权逻辑");
        //可以给资源进行授权
        //SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //可以动态从数据库中获得info.auth
        //Subject subject = SecurityUtils.getSubject();  UserInfo = subject .getPricipal()
        //添加资源的授权字符串
        info.addStringPermission("user:addUser");
        return info;
    }

    /**
     *执行认证逻辑
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //假设数据库中的用户名和密码
        String name = "admin";
        String password = "123";
        //编写shiro判断逻辑，判断yo用户名和密码
        //1、判断用户名
        UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken;
        if(!token.getUsername().equals(name)){//用户名不存在
            return  null;//shiro底层会抛出UnknownAccountException异常
        }
        //2、判断密码
        return new SimpleAuthenticationInfo("",password,"");
    }

}

在userRealm中处理授权逻辑，创建一个SimpleAuthorizationInfo对象，进行添加权限。

3、tymeleaf和shiro标签整合使用
1、 导入坐标

		<dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
        </dependency>

2、配置ShiroDialect
在shiro配置类中添加

  @Bean
    public ShiroDialect getShiroDialect(){
         return new ShiroDialect();
     }

3、再页面上使用shiro的标签

<!DOCTYPE html>
<html lang="en" xmlns:shiro="http://www.w3.org/1999/xhtml">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>

<div shiro:hasPermission="user:addUser">  拥有addUser权限的可以显示
    <a href="addUser">增加用户</a>
</div>
<div shiro:hasPermission="user:updateUser"> 拥有updateUser权限的可以显示
    <a href="updateUser">更新用户</a>
</div>
</body>
</html>