1.4 Shiro授权管理之注解实现

最新推荐文章于 2024-07-04 13:16:43 发布

一鸭一鸭唷

最新推荐文章于 2024-07-04 13:16:43 发布

阅读量130

点赞数

分类专栏： # Shiro 文章标签： shiro java

本文链接：https://blog.csdn.net/weixin_44707283/article/details/115353220

版权

Shiro 专栏收录该内容

6 篇文章 0 订阅

订阅专栏

1.使用注解的方式使用权限，我们需要AOP的支持

    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aspects</artifactId>
      <version>5.2.13.RELEASE</version>
    </dependency>

2.在SpringMVC的配置文件中添加Shiro的注解支持

    <!--开启Shiro的注解-->
    <aop:config proxy-target-class="true"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

SpringMVC全部代码

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:aop="http://www.springframework.org/schema/aop"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context https://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc https://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/aop https://www.springframework.org/schema/aop/spring-aop.xsd">

    <!--添加扫描路径-->
    <context:component-scan base-package="com.biao.controller" use-default-filters="false">
        <context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
    </context:component-scan>

    <!--开启注解-->
    <mvc:annotation-driven></mvc:annotation-driven>

    <!--开启Shiro的注解-->
    <aop:config proxy-target-class="true"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>
</beans>

3.在自定义的MyRealm给登录成功的用户授权

    /**
     * 授权方法
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        User user=(User) principalCollection.getPrimaryPrincipal();
        System.out.println("-->"+user.getUsername());
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRole("admin");
        info.addRole("root");
        return info;
    }

4.注解方式的使用

我们在需要对用户请求的权限进行校验的方法头部添加对应的注解即可

package com.biao.controller;

import org.apache.shiro.authz.annotation.Logical;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/order")
public class OrderController {

    @RequiresRoles(value = {"admin"},logical = Logical.AND)
    @RequestMapping("/query")
    public String query(){
        return "query";
    }

    @RequiresRoles(value = {"root","root1"},logical = Logical.AND)
    @RequestMapping("/add")
    public String add(){
        return "add";
    }

    @RequiresRoles(value = {"admin","root1"},logical = Logical.OR)
    @RequestMapping("/delete")
    public String delete(){
        return "delete";
    }

    @RequestMapping("/update")
    public String update(){
        return "update";
    }
}

在这里插入图片描述
没有访问权限的请求，提交后会提示没有权限的报错

5.自定义未授权错误的页面

当用户提交的请求没有权限的时候，系统会默认的提示是500错误，这种效果体验肯定是不好的，这是我们可以自定义一个用户容易接受的错误页面。

5.1 自定义页面

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
    <h2>你没有访问当前请求的权限！请联系系统管理员</h2>
</body>
</html>

5.2 再在SpringMVC配置文件配置

    <!--配置SpringMVC 的全局异常处理器-->
    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="exceptionMappings">
            <props>
                <prop key="org.apache.shiro.authz.UnauthorizedException">redirect:/unauthorized.jsp</prop>
            </props>
        </property>
    </bean>

配置文件全部代码

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:aop="http://www.springframework.org/schema/aop"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context https://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc https://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/aop https://www.springframework.org/schema/aop/spring-aop.xsd">

    <!--添加扫描路径-->
    <context:component-scan base-package="com.biao.controller" use-default-filters="false">
        <context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
    </context:component-scan>

    <!--开启注解-->
    <mvc:annotation-driven></mvc:annotation-driven>

    <!--开启Shiro的注解-->
    <aop:config proxy-target-class="true"/>
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

    <!--配置SpringMVC 的全局异常处理器-->
    <bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
        <property name="exceptionMappings">
            <props>
                <prop key="org.apache.shiro.authz.UnauthorizedException">redirect:/unauthorized.jsp</prop>
            </props>
        </property>
    </bean>
</beans>