01-springboot集成shiro

一、maven的导入

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.6.0</version>
        </dependency>

二、自定义reaml

        Shiro提供了一个类AuthorizingRealm，需要重写2个方法，

        doGetAuthenticationInfo（）获取用户身份信息，

        doGetAuthorizationInfo（）获取用户权限信息。

@Component
public class CustomRealm extends AuthorizingRealm {

    @Resource
    private RoleService roleService;

    @Resource
    private ResourceService resourceService;

    @Resource
    private UserService userService;

    /**
     * 使用登录名字获取用户和用户的权限（可以自己细分，可以是角色，可以是资源代码看系统的设计）
     * 具体可以参看 SimpleAuthorizationInfo extends AuthorizationInfo
     *
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();

        CustomVO customVO = (CustomVO) principalCollection.getPrimaryPrincipal();
        String userId = customVO.getUserId();
        List<RoleEntity> roles = roleService.getRoles(userId);
        Set<String> rolePermission = new HashSet();
        for (RoleEntity roleEntity : roles) {
            rolePermission.add(roleEntity.getRoleCode());
        }

        //角色权限
        simpleAuthorizationInfo.addRoles(rolePermission);

        List<ResourceEntity> resourceEntities = resourceService.getResources(userId);
        Set<String> resourcePermission = new HashSet<>();
        for (ResourceEntity resourceEntity : resourceEntities) {
            resourcePermission.add(resourceEntity.getResourceCode());
        }

        //资源代码权限
        simpleAuthorizationInfo.addStringPermissions(resourcePermission);

        return simpleAuthorizationInfo;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
        String userName = usernamePasswordToken.getUsername();
        UserEntity userEntity = userService.getUser(userName);

        CustomVO customVO = new CustomVO();
        customVO.setUserId(userEntity.getUserId());
        customVO.setUserName(userEntity.getUsername());

        return new SimpleAuthenticationInfo(customVO, userEntity.getPassword(), userEntity.getUsername());
    }
}

三、springboot配置shiro

springboot 需要配置shiro2个地方

    @Resource
    CustomRealm customRealm;

    @Bean
    public DefaultWebSecurityManager securityManager() {
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(customRealm);
        return manager;
    }

securityManager 安全管理器，管理所有Subject，可以配合内部安全组件。这儿需要设置重写的AuthorizingRealm。

     @Bean
    public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager manager) {

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        Map<String, Filter> filterMap = new HashMap<>();
        shiroFilterFactoryBean.setFilters(filterMap);


        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/logout", "anon");
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        shiroFilterFactoryBean.setSecurityManager(manager);
        return shiroFilterFactoryBean;
    }

上面是配置需要拦截的url和放行的url。

三、测试效果

登录效果，就会带上session

 访问别的请求 会带上了sessionId，并且请求通过

   请求登出接口

再次请求测试接口，虽然还是有sessionId，但是已经没有权限