1、首先在shiro配置类中增加授权过滤器,注意记得要在authc过滤器的签名
package com.dcy.springbootshiro.config;
import org.apache.commons.collections.map.LinkedMap;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.LinkedHashMap;
import java.util.Map;
/**
* @author dcy
* @date 2019/9/10 11:35
* @description
*/
@Configuration
public class ShiroConfig {
/**
* 创建shiroFilterFactoryBean
*/
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
//设置安全管理器
shiroFilterFactoryBean.setSecurityManager(securityManager);
/**
* 增加shiro内置过滤器
* shiro内置过滤器,可以实现权限相关的lan拦截器
* 常用的过滤器:
* anon:无需认证(登录)可以访问,设置该过滤器,要放在authc的前面
* authc:必须认证才能fwe
* user:如果使用rememberMe的功能可以直接访问
* perms:该资源必须得到权限才可以访问,设置该过滤器,要放在authc的前面
* role该资源必须得到j角色权限才可以访问
*
*/
Map<String ,String> filterMap = new LinkedHashMap<String,String>();
//设置某些页面的拦截
/* filterMap.put("/user/addUser","authc");
filterMap.put("/user/updateUser","authc");*/
//去除某些拦截,注意顺序
filterMap.put("/user/hello","anon");//取消拦截登录页面的请求
filterMap.put("/user/login","anon");//取消拦截登录请求的路径
/**
* 授权过滤器 要放在authc的签名
*/
filterMap.put("/user/addUser","perms[user:addUser]");
//拦截所有页面
filterMap.put("/**","authc");
//修改调整的登录页面
shiroFilterFactoryBean.setLoginUrl("/user/toLogin");
//设置未授权的页面
shiroFilterFactoryBean.setUnauthorizedUrl("noAuth");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
return shiroFilterFactoryBean;
}
/**
* 创建DeafultWebSecuriyManage
*/
@Bean("securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(userRealm);
return securityManager;
}
/**
* 创建realm
*/
@Bean("userRealm")
public UserRealm getRealm(){
return new UserRealm();
}
}
2、在userRealm中处理授权逻辑
package com.dcy.springbootshiro.config;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
/**
* @author dcy
* @date 2019/9/10 11:44
* @description
*/
public class UserRealm extends AuthorizingRealm {
/**
* 执行授权逻辑
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("执行授权逻辑");
//可以给资源进行授权
//SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//可以动态从数据库中获得info.auth
//Subject subject = SecurityUtils.getSubject(); UserInfo = subject .getPricipal()
//添加资源的授权字符串
info.addStringPermission("user:addUser");
return info;
}
/**
*执行认证逻辑
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//假设数据库中的用户名和密码
String name = "admin";
String password = "123";
//编写shiro判断逻辑,判断yo用户名和密码
//1、判断用户名
UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken;
if(!token.getUsername().equals(name)){//用户名不存在
return null;//shiro底层会抛出UnknownAccountException异常
}
//2、判断密码
return new SimpleAuthenticationInfo("",password,"");
}
}
在userRealm中处理授权逻辑,创建一个SimpleAuthorizationInfo对象,进行添加权限。
3、tymeleaf和shiro标签整合使用
1、 导入坐标
<dependency>
<groupId>com.github.theborakompanioni</groupId>
<artifactId>thymeleaf-extras-shiro</artifactId>
<version>2.0.0</version>
</dependency>
2、配置ShiroDialect
在shiro配置类中添加
@Bean
public ShiroDialect getShiroDialect(){
return new ShiroDialect();
}
3、再页面上使用shiro的标签
<!DOCTYPE html>
<html lang="en" xmlns:shiro="http://www.w3.org/1999/xhtml">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<div shiro:hasPermission="user:addUser"> 拥有addUser权限的可以显示
<a href="addUser">增加用户</a>
</div>
<div shiro:hasPermission="user:updateUser"> 拥有updateUser权限的可以显示
<a href="updateUser">更新用户</a>
</div>
</body>
</html>