配置pro.xml?
<dependency>
<groupId>com.github.theborakompanioni</groupId>
<artifactId>thymeleaf-extras-shiro</artifactId>
<version>2.0.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<!--模板thymeleaf包-->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
链接数据库?
spring.datasource.druid.url=jdbc:mysql://localhost:3306/本地数据库
spring.datasource.druid.username=账户
spring.datasource.druid.password=密码
spring.datasource.druid.initial-size=5
spring.datasource.druid.max-active=20
spring.datasource.druid.min-idle=10
spring.datasource.druid.max-wait=10
Config配置文件?
package com.gongyongqin.demo.shiro;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.HashMap;
import java.util.Map;
@Configuration//配置类
public class ShiroConfig {
/**
* 1. 创建ShiroFilterFactoryBean;
*/
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager")DefaultWebSecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
//设置安全管理器
shiroFilterFactoryBean.setSecurityManager(securityManager);
//添加shiro的过滤器
//shiro的内置过滤器:可以实现权限的相关拦截
//常用的过滤器:
//1.anno:无需认证(登陆即可访问)
//2.authc:必须认证才可以访问
//3.user:如果使用remanberMe的功能就可以直接访问
//4.perms:该资源必须得到资源权限才可以访问
//5.role:该资源必须得到角色权限才可以访问
Map filterMap = new HashMap();
//必须登陆才可以访问
//设置哪些页面必须授权后才可以登陆
filterMap.put("/dept/toDept","authc");//部门页面
/*filterMap.put("/power/wel","authc");//欢迎页面
filterMap.put("/tree/goTreeList","authc");//菜单树页面
filterMap.put("/emp/toList","authc");//员工列表页面
filterMap.put("/dept/toDept","authc");//部门列表页面
filterMap.put("/emp/updatePassWord","authc");//更改密码页面
filterMap.put("/bid/toCheckBid","authc");//标初审页面*/
//filterMap.put("/poewr/","authc");//
//filterMap.put("/user/index","authc");//首页
//被拦截后跳转登陆页面
shiroFilterFactoryBean.setLoginUrl("/power/userLogin");
//未授权跳转页面
shiroFilterFactoryBean.setUnauthorizedUrl("/power/userLogin");
//将filterMap中的url和相关权限交给shiro框架管理
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
return shiroFilterFactoryBean;
}
/**
* 2. 创建DefaultWebSecurityManager;
*/
@Bean(name = "securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm) {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
//关联realm
securityManager.setRealm(userRealm);
return securityManager;
}
/**
* 3. 创建Realm;
*/
@Bean(name = "userRealm")
public UserRealm getRealm() {
return new UserRealm();
}
}
Realm配置文件?
从Dao→Service→ServiceImpl→xml?
package com.gongyongqin.demo.shiro;
import com.gongyongqin.demo.service.EmpService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import java.util.List;
import java.util.Map;
public class UserRealm extends AuthorizingRealm {
@Autowired
private EmpService empService;
/**
* 执行授权逻辑
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//获取当前登陆的用户
Subject subject = SecurityUtils.getSubject();
//获取用户名
String usernmae = subject.getPrincipal()+"";
//通过用户名查当前用户
List<Map> maps = empService.selectEmp(usernmae);
//获取当前的权限字符
String roleId = maps.get(0).get("id")+"";
//设置只有是这个字符才可以访问
info.addStringPermission(roleId);
return info;
}
/**
* 执行认证逻辑
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
//编写shiro判断逻辑,判断用户名密码是否正确
UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken;
String username = token.getUsername();
//1.判断用户名
List<Map> mapList = empService.selectEmp(token.getUsername());
if (mapList.size() == 0) {
return null;
} else {
return new SimpleAuthenticationInfo(username, mapList.get(0).get("password"),"");
}
}
}
前台界面编辑?
- 对应关系
<div class="form-bottom">
<form role="form" action="/power/userLogin" method="post" class="login-form" onsubmit="return check()">
<div class="form-group">
<label class="sr-only">账号</label>
<input type="text" name="username" placeholder="用户名" class="form-username form-control" id="username">
</div>
<div class="form-group">
<label class="sr-only">密码</label>
<input type="password" name="password" placeholder="密码" class="form-password form-control" id="password">
</div>
<button type="submit" class="btn">Sign in!</button>
</form>
</div>
- 表单校验
function check(){
var userName = $("#userName").val();
var passWord = $("#passWord").val();
if(userName == "" ){
alert("请将表单填写完整!");
return false;
}
if(passWord == ""){
alert("请将表单填写完整!");
return false;
}
}