Spring Boot 2.x+shiro前后端分离实战-shiro核心配置 实战篇 （十一）

自定义 Realm

public class CustomRealm extends AuthorizingRealm {

    @Autowired
    private RedisUtil redis;


    /**
     * 设置支持令牌校验
     */
    @Override
    public boolean supports(AuthenticationToken token) {
        return token instanceof CustomPasswordToken;
    }

    /**
     * 主要业务：
     * 系统业务出现要验证用户的角色权限的时候，就会调用这个方法
     * 来获取该用户所拥有的角色/权限
     * 这个用户授权的方法我们可以缓存起来不用每次都调用这个方法。
     * 后续的课程我们会结合 redis 实现它
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        String accessToken = (String) SecurityUtils.getSubject().getPrincipal();
        String userId = (String) redis.get(accessToken);
        authorizationInfo.addRoles(getRolesByUserId(userId));
        authorizationInfo.addStringPermissions(getPermissionByUserId(userId));
        return authorizationInfo;

    }

    /**
     * 主要业务：
     * 当业务代码调用 subject.login(customPasswordToken); 方法后
     * 就会自动调用这个方法 验证用户名/密码
     * 这里我们改造成 验证 token 是否有效 已经自定义了 shiro 验证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        CustomPasswordToken token = (CustomPasswordToken) authenticationToken;
        SimpleAuthenticationInfo simpleAuthenticationInfo = new
                SimpleAuthenticationInfo(token.getPrincipal(), token.getCredentials(), getName());
        return simpleAuthenticationInfo;
    }

    /**
     * 获取用户的角色
     * 这里先用伪代码代替
     * 后面我们讲到权限管理系统后 再从 DB 读取
     *
     * @param userId
     * @return java.util.List<String>
     * @throws
     * @Author: djy
     * @UpdateUser:
     * @Version: 0.0.1
     */
    private List<String> getRolesByUserId(String userId) {
        List<String> roles = new ArrayList<>();
        if (userId.equals("9a26f5f1-cbd2-473d-82db-1d6dcf4598f8")) {
            roles.add("admin");
        } else {
            roles.add("test");
        }
        return roles;
    }

    /**
     * 获取用户的权限
     * 这里先用伪代码代替
     * 后面我们讲到权限管理系统后 再从 DB 读取
     *
     * @param userId
     * @return java.util.List<String>
     * @throws
     * @Author: djy
     * @UpdateUser:
     * @Version: 0.0.1
     */
    private List<String> getPermissionByUserId(String userId) {
        List<String> permissions = new ArrayList<>();
        /**
         * 只有是 admin 用户才拥有所有权限
         */
        if (userId.equals("9a26f5f1-cbd2-473d-82db-1d6dcf4598f8")) {
            permissions.add("*");
        } else {
            permissions.add("sys:user:edit");
            permissions.add("sys:user:list");
        }
        return permissions;
    }
}

shiro核心配置

@Configuration
public class ShiroConfig {

    /**
     * 自定义密码 校验
     */
    @Bean
    public CustomHashedCredentialsMatcher hashedCredentialsMatcher() {
        return new CustomHashedCredentialsMatcher();
    }

    /**
     * 自定义域
     */
    @Bean
    public CustomRealm customRealm() {
        CustomRealm customRealm = new CustomRealm();
        customRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return customRealm;
    }

    /**
     * 安全管理
     */
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    /**
     * shiro过滤器，配置拦截哪些请求
     *
     * @param securityManager
     * @return
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //自定义拦截器限制并发人数,参考博客：
        LinkedHashMap<String, Filter> filtersMap = new LinkedHashMap<>();
        //用来校验token
        filtersMap.put("token", new CustomAccessControlFilter());
        shiroFilterFactoryBean.setFilters(filtersMap);
        Map<String, String> map = new LinkedHashMap<>();
        map.put("/api/user/login", "anon");
        //放开swagger-ui地址
        map.put("/swagger/**", "anon");
        map.put("/v2/api-docs", "anon");
        map.put("/swagger-ui.html", "anon");
        map.put("/swagger-resources/**", "anon");
        map.put("/webjars/**", "anon");
        map.put("/favicon.ico", "anon");
        map.put("/captcha.jpg", "anon");
        map.put("/csrf", "anon");
        map.put("/**", "token,authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        return shiroFilterFactoryBean;
    }

    /**
     * 开启shiro aop注解支持.
     * 使用代理方式;所以需要开启代码支持;
     *
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

    @Bean
    @ConditionalOnMissingBean
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }