一、maven的导入
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.6.0</version>
</dependency>
二、自定义reaml
Shiro提供了一个类AuthorizingRealm,需要重写2个方法,
doGetAuthenticationInfo()获取用户身份信息,
doGetAuthorizationInfo()获取用户权限信息。
@Component
public class CustomRealm extends AuthorizingRealm {
@Resource
private RoleService roleService;
@Resource
private ResourceService resourceService;
@Resource
private UserService userService;
/**
* 使用登录名字获取用户和用户的权限(可以自己细分,可以是角色,可以是资源代码看系统的设计)
* 具体可以参看 SimpleAuthorizationInfo extends AuthorizationInfo
*
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
CustomVO customVO = (CustomVO) principalCollection.getPrimaryPrincipal();
String userId = customVO.getUserId();
List<RoleEntity> roles = roleService.getRoles(userId);
Set<String> rolePermission = new HashSet();
for (RoleEntity roleEntity : roles) {
rolePermission.add(roleEntity.getRoleCode());
}
//角色权限
simpleAuthorizationInfo.addRoles(rolePermission);
List<ResourceEntity> resourceEntities = resourceService.getResources(userId);
Set<String> resourcePermission = new HashSet<>();
for (ResourceEntity resourceEntity : resourceEntities) {
resourcePermission.add(resourceEntity.getResourceCode());
}
//资源代码权限
simpleAuthorizationInfo.addStringPermissions(resourcePermission);
return simpleAuthorizationInfo;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
String userName = usernamePasswordToken.getUsername();
UserEntity userEntity = userService.getUser(userName);
CustomVO customVO = new CustomVO();
customVO.setUserId(userEntity.getUserId());
customVO.setUserName(userEntity.getUsername());
return new SimpleAuthenticationInfo(customVO, userEntity.getPassword(), userEntity.getUsername());
}
}
三、springboot配置shiro
springboot 需要配置shiro2个地方
@Resource
CustomRealm customRealm;
@Bean
public DefaultWebSecurityManager securityManager() {
DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
manager.setRealm(customRealm);
return manager;
}
securityManager 安全管理器,管理所有Subject,可以配合内部安全组件。这儿需要设置重写的AuthorizingRealm。
@Bean
public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager manager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
Map<String, Filter> filterMap = new HashMap<>();
shiroFilterFactoryBean.setFilters(filterMap);
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
filterChainDefinitionMap.put("/login", "anon");
filterChainDefinitionMap.put("/logout", "anon");
filterChainDefinitionMap.put("/**", "authc");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
shiroFilterFactoryBean.setSecurityManager(manager);
return shiroFilterFactoryBean;
}
上面是配置需要拦截的url和放行的url。
三、测试效果
登录效果,就会带上session
访问别的请求 会带上了sessionId,并且请求通过
请求登出接口
再次请求测试接口,虽然还是有sessionId,但是已经没有权限