Shiro认证和授权使用

shiro配置和使用

shiro一般用于用户的认证和授权，那么直入主题吧，这里主要用一个小例子讲解shiro的使用流程：

1.先加载shiro的相关依赖

   <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.5.3</version>
        </dependency>

        <dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
        </dependency>

2.创建Realm类，主要编写授权和认证逻辑

/**
 * 自定义Realm
 */
public class UserRealm extends AuthorizingRealm {


    @Autowired
    private UserService userService;

    @Autowired
    private AuthMapper authMapper; //用户权限映射关系

    /**
     *  执行授权逻辑
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行授权逻辑");
        //获取当前用户权限
        Subject subject = SecurityUtils.getSubject();
        User user=(User)subject.getPrincipal();
        //获取查询用户的当前权限，这里我是关联了用户表和权限表的，具体能获取到用户所对应的权限编码即可
        String authId = user.getAuthId();
        List<Auth>  Auths=authMapper.selectList(new QueryWrapper<Auth>().eq("auth_id",authId));
        //权限设置
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        for (Auth auth : Auths) {
            //给获取到的权限授权
            info.addStringPermission(auth.getAuthCode());
        }
        return info;
    }

    /**
     *  执行认证逻辑
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    //对登录用户执行认证功能
        System.out.println("执行认证逻辑");
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        User user = userService.findByUsername(token.getUsername());
        if(user != null){
            return new SimpleAuthenticationInfo(user,user.getPassword(),getName());
        }
        return null;
    }
}

3.创建shiro的核心配置类ShiroConfig

/**
 * shiro配置类,核心是三个类
 * 1.ShiroFilterFactoryBean
 * 2.DefaultWebSecurityManager
 * 3.Realm
 */
@Configuration
public class ShiroConfig {

    /**
     * 创建ShiroFilterFactoryBean
     */
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("SecurityManager") DefaultWebSecurityManager securityManager){
        //设置安全管理器
        ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);

        /**
         * 添加shiro内置过滤器
         * 常用过滤器：
         * anon:无需认证(登录)即可访问
         * authc:必须认证才可以访问
         * user:如果使用rememberMe的功能可以直接访问
         * perms:该资源必须获得资源权限才能使用
         * role:该资源必须得到用户角色权限才能访问
         */
        //用户验证
        Map<String,String> filterMap=new HashMap<String,String>();
        
        //设置权限资源，这里只做了权限的添加，如果需要对资源进行拦截的话可自行编写，如:
        //filterMap.put("/user/test1","authc"); //左边为资源路径，右边为过滤器
		// filterMap.put("user/test3","anon");//放行*/
		
        filterMap.put("/user/askmessage","perms[user:admin]");
        filterMap.put("/admin","perms[user:askmessage]");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
        //未认证跳转界面
       //    shiroFilterFactoryBean.setLoginUrl("/user/tologin");

        //未授权跳转界面
        shiroFilterFactoryBean.setUnauthorizedUrl("/user/renzhen");


        return shiroFilterFactoryBean;
    }



    /**
     * 创建DefaultWebSecurityManager
     */
    @Bean(name = "SecurityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("UserRealm") UserRealm userRealm){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //关联realm
        securityManager.setRealm(userRealm);
        return securityManager;
    }

    /**
     * 创建Realm
     */
    @Bean(name = "UserRealm")
    public UserRealm getRealm(){
        return new UserRealm();
    }



    @Bean(name = "shiroDialect")
    public ShiroDialect shiroDialect(){
        return new ShiroDialect();
    }

}

4.shiro的配置大概是这样子了，登录用户的时候Controller调用一下即可

	Subject subject = SecurityUtils.getSubject();
 	UsernamePasswordToken token=new UsernamePasswordToken(username, MD5Utils.code(password));
	subject.login(token);

（备注：这里做个演示）

public String login(@RequestParam String username,@RequestParam String password, Model model){
        Subject subject = SecurityUtils.getSubject();
        //封装用户数据
        UsernamePasswordToken token=new UsernamePasswordToken(username,password);
        try {
            subject.login(token);
            return "redirect:/user/index";
        } catch (AuthenticationException e) {
            e.printStackTrace();
            model.addAttribute("msg","账号错误");
            return "login";
        }
    }

权限的限制要调用有关权限的资源才能生效，而认证的话只要是启动项目即可自动调用！前端也可更具自己设置的权限码来隐藏或者限制用户的权限操作(权限必须先登录获取用户的token才能使用)