ssm整合shiro

一.SSM整合 

1.创建一个maven的web工程

（1）导入ssm 整合的pom依赖

<dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>4.11</version>
      <scope>test</scope>
    </dependency>

    <!--shiro-->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>1.9.0</version>
    </dependency>

    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aspects</artifactId>
      <version>5.2.9.RELEASE</version>
    </dependency>
    <!--spring-webmvc-->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-webmvc</artifactId>
      <version>5.2.15.RELEASE</version>
    </dependency>

    <!--mybatis依赖-->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis</artifactId>
      <version>3.5.6</version>
    </dependency>

    <!--mybatis和spring整合的依赖-->
    <dependency>
      <groupId>org.mybatis</groupId>
      <artifactId>mybatis-spring</artifactId>
      <version>2.0.6</version>
    </dependency>

    <!--mysql驱动-->
    <dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
      <version>8.0.28</version>
    </dependency>

    <!--druid连接池依赖-->
    <dependency>
      <groupId>com.alibaba</groupId>
      <artifactId>druid</artifactId>
      <version>1.2.1</version>
    </dependency>

    <!--lombok依赖-->
    <dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <version>1.18.24</version>
    </dependency>
    <!--jackson java对象转换为json对象 @ResponseBody-->
    <dependency>
      <groupId>com.fasterxml.jackson.core</groupId>
      <artifactId>jackson-databind</artifactId>
      <version>2.13.2.2</version>
    </dependency>

    <dependency>
      <groupId>com.alibaba</groupId>
      <artifactId>fastjson</artifactId>
      <version>1.2.78</version>
    </dependency>
    <!--servlet-api依赖-->
    <dependency>
      <groupId>javax.servlet</groupId>
      <artifactId>javax.servlet-api</artifactId>
      <version>4.0.1</version>
    </dependency>

    <!--    spring连接mysql的中间jar包-->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-jdbc</artifactId>
      <version>5.2.15.RELEASE</version>
    </dependency>

    <!--    快速生成mybaits框架的jar包-->
    <dependency>
      <groupId>org.mybatis.generator</groupId>
      <artifactId>mybatis-generator-core</artifactId>
      <version>1.4.0</version>
    </dependency>

    <!--    日志文件-->
    <!--    <dependency>-->
    <!--      <groupId>org.slf4j</groupId>-->
    <!--      <artifactId>slf4j-log4j12</artifactId>-->
    <!--      <version>1.7.30</version>-->
    <!--    </dependency>-->

    <!--    分页操作-->
    <dependency>
      <groupId>com.github.pagehelper</groupId>
      <artifactId>pagehelper</artifactId>
      <version>5.3.0</version>
    </dependency>

    <!--    oss远程仓库依赖-->
    <dependency>
      <groupId>com.aliyun.oss</groupId>
      <artifactId>aliyun-sdk-oss</artifactId>
      <version>3.13.0</version>
    </dependency>
    <!--    文件上传依赖-->
    <dependency>
      <groupId>commons-fileupload</groupId>
      <artifactId>commons-fileupload</artifactId>
      <version>1.4</version>
    </dependency>



    <!--logback日志-->
    <dependency>
      <groupId>org.logback-extensions</groupId>
      <!--logback监听器在该依赖中。该依赖中包含slf4j-api、logback-classic、logback-core三个依赖-->
      <artifactId>logback-ext-spring</artifactId>
      <version>0.1.4</version>
    </dependency>


    <dependency>
      <groupId>com.alibaba</groupId>
      <artifactId>easyexcel</artifactId>
      <version>3.0.5</version>
    </dependency>

    <dependency>
      <groupId>xml-apis</groupId>
      <artifactId>xml-apis</artifactId>
      <version>1.4.01</version>
    </dependency>


    <!--   加入spring的切面依赖-->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-aspects</artifactId>
      <version>5.2.9.RELEASE</version>
    </dependency>
    <!--  加入spring的事务依赖-->
    <dependency>
      <groupId>org.springframework</groupId>
      <artifactId>spring-tx</artifactId>
      <version>5.2.15.RELEASE</version>
    </dependency>

(2) spring配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:tx="http://www.springframework.org/schema/tx"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context https://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/mvc https://www.springframework.org/schema/mvc/spring-mvc.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd">

    <!--包扫描-->
    <context:component-scan base-package="com.wt"/>
    <!--开启注解-->
    <mvc:annotation-driven/>
    <!--静态资源的放行-->
    <mvc:default-servlet-handler/>


    <!-- 启动Shrio的注解 -->
    <bean id="lifecycleBeanPostProcessor"
          class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    <bean
            class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
            depends-on="lifecycleBeanPostProcessor" />
    <bean
            class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    </bean>


    <!--spring的配置-->
    <!--数据源配置-->
    <bean id="ds" class="com.alibaba.druid.pool.DruidDataSource">
        <!--驱动名称-->
        <property name="driverClassName" value="com.mysql.cj.jdbc.Driver"/>
        <property name="url" value="jdbc:mysql://localhost:3306/shirossm?serverTimezone=Asia/Shanghai"/>
        <property name="username" value="root"/>
        <property name="password" value="root"/>
        <!--初始化连接池的个数-->
        <property name="initialSize" value="5"/>
        <!--至少的个数-->
        <property name="minIdle" value="5"/>
        <!--最多的个数-->
        <property name="maxActive" value="10"/>
        <!--最长等待时间单位毫秒-->
        <property name="maxWait" value="3000"/>
    </bean>

    <!--sqlSessionFactory 整合mybatis-->
    <bean id="sessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
        <property name="dataSource" ref="ds"/>
<!--        设置mybatis映射文件的路径-->
        <property name="mapperLocations" value="classpath:mapper/*.xml"/>

    </bean>

<!--    为dao接口生成代理实现类-->
    <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
        <!--为com.wt.dao包下的接口生成代理实现类-->
        <property name="basePackage" value="com.wt.dao"/>
    </bean>

    <!--事务管理-->
    <bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
        <property name="dataSource" ref="ds"/>
    </bean>
    <!--开启事务管理-->
    <tx:annotation-driven transaction-manager="transactionManager"/>


    <!--整合shiro的配置内容-->
    <!--①SecurityManager-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="realm"/>
    </bean>
    <!--创建自定义realm类对象-->
    <bean id="realm" class="com.wt.realm.MyRealmt">
        <property name="credentialsMatcher" ref="credentialsMatcher"/>
    </bean>

    <!--创建密码匹配器-->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="MD5"/>
        <property name="hashIterations" value="1024"/>
    </bean>

    <!--shiro过滤工厂: 设置过滤的规则-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <!--如果没有登录，跳转的路径-->
        <property name="loginUrl" value="/login.jsp"/>
        <!--没有权限，跳转的路径-->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>

        <property name="filterChainDefinitions">
            <value>
                /dl=anon
                /login=anon
                /**=authc
            </value>
        </property>

        <property name="filters">
            <map>
                <entry key="authc">
<!--                    自定义过滤器所在路径-->
                    <bean class="com.wt.filter.LoginFilter" />
                </entry>
            </map>
        </property>
    </bean>



</beans>

(3) web.xml配置文件 

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">

  <!--shiro过滤器的代理-->
  <filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>


  <servlet>
    <servlet-name>spring</servlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    <init-param>
      <param-name>contextConfigLocation</param-name>
      <param-value>classpath:springmvc.xml</param-value>
    </init-param>
    <!--当tomcat启动时创建DipatcherServlet 默认当访问controller路径时创建-->
    <load-on-startup>1</load-on-startup>
  </servlet>

  <servlet-mapping>
    <servlet-name>spring</servlet-name>
    <url-pattern>/</url-pattern>
  </servlet-mapping>
</web-app>

2.整合shiro

(1)导入自定义realm类对象

package com.wt.realm;


import com.wt.entity.User;
import com.wt.service.UserServicet;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.List;


public class MyRealmt extends AuthorizingRealm {
    @Autowired
    private UserServicet userServicet;


    //进行权限校验时会执行该方法
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        User primaryPrincipal = (User) principalCollection.getPrimaryPrincipal();
        //根据账号查询该用户具有哪些权限
        List<String> list = userServicet.finByPermissionByUsername(primaryPrincipal.getUserid());
        System.out.println("=============="+list);
        if (list!=null&&list.size()>0){
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            info.addStringPermissions(list);
            return info;
        }
        return null;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //1.根据token获取账号
        String username = (String) authenticationToken.getPrincipal();
        //2.根据账号查询用户信息
        User user = userServicet.findByLogin(username);
        if (user!=null){
            //从数据库中获取的密码
            ByteSource byteSource = ByteSource.Util.bytes(user.getSalt());  //获取盐
            SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user,user.getUserpwd(),byteSource,this.getName());
            return info;
        }
        return null;
    }
}

 springmvc配置文件中建立该文件的映射文件

(2)修改controller层

@PostMapping("/login")
    public String login(String username,String password){
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token=new UsernamePasswordToken(username,password);
        try {
            subject.login(token);
            //登录成功进入成功页面，并与成功页面的权限按钮对比，拥有的权限显示，未拥有的不显示
            return "redirect:/success.jsp";
        }catch (Exception e){
            return "redirect:/login.jsp";
        }
    }

(3)service层

package com.wt.service.impl;

import com.wt.dao.UserMapper;
import com.wt.entity.User;
import com.wt.service.UserServicet;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

/**
 * @Author wt
 * @Date 2022/8/5 0:20
 * @PackageName:com.wt.service.impl
 * @ClassName: UserServicetImpl
 * @Description: TODO
 * @Version 1.0
 */
@Service
public class UserServicetImpl implements UserServicet {
    @Autowired
    private UserMapper userMapper;


    @Override
    public User findByLogin(String username) {
        System.out.println(username);
        User user = userMapper.findByLogin(username);
        System.out.println(user);

        return user;
    }

    public List<String> finByPermissionByUsername(Integer userid) {
        List<String> list = userMapper.findPermission(userid);
        return list;
    }
}

(4) 配置dao目录下的mapper接口

a. mapper接口

public interface UserMapper {

    List<String> findPermission(Integer userid);


    User findByLogin(String username);
}

b.  mapper对应的查询xml文件

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<!--namespace:命名空间
       可以随便起名，但是后期我们要求命名空间的值必须和所对应的dao相同
-->
<mapper namespace="com.wt.dao.UserMapper">
    <!--查询 根据id查询用户信息
          select标签用于查询的标签
             id:标签的唯一标识
             resultType: 定义返回的类型 把sql查询的结果封装到哪个实体类钟
         #{id}===表示占位符等价于?  这是mybatis框架的语法

    -->


    <select id="findPermission" resultType="java.lang.String">
        select percode from user_role ur join role_permission rp
                    on ur.roleid=rp.roleid
                    join permission p on p.perid=rp.perid
                where ur.userid = #{userid}
    </select>
    <select id="findByLogin" resultType="com.wt.entity.User">
        select * from user where username=#{username}
    </select>
</mapper>

(5) 成功页面success.jsp

<%--
  Created by IntelliJ IDEA.
  User: 莫绝岚
  Date: 2022/8/5
  Time: 9:23
  To change this template use File | Settings | File Templates.
--%>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<%--    登录成功跳转到该页面，用户拥有什么权限则显示哪些选项(name对应数据库中用户所拥有的权限)--%>
    <h1>欢迎<shiro:principal property="username" />来到主页</h1>
<%--    (name对应数据库中用户所拥有的权限，用户拥有的权限需与name的值相同)--%>
    <shiro:hasPermission name="/query">
        <a href="/user/query">查询用户</a>
    </shiro:hasPermission>

    <shiro:hasPermission name="/export">
        <a href="/user/export">导出用户</a>
    </shiro:hasPermission>

    <shiro:hasPermission name="/add">
        <a href="/user/add" name="add">添加用户</a>
    </shiro:hasPermission>

    <shiro:hasPermission name="/update">
        <a href="/user/update" name="update">修改用户</a>
    </shiro:hasPermission>

    <shiro:hasPermission name="/delete">
        <a href="/user/delete" name="delete">删除用户</a>
    </shiro:hasPermission>
</body>
</html>

可以在jsp中获取当前登录者的账号  

 

(6)安全补充 

上面只是在网页中根据不同用户显示不同的菜单，这种方式只能防君子不能防小人。

1. 拦截器---获取请求路径 然后根据你的路径判断当前用户是否具有该权限。

2. spring整合shiro时提供了一个注解：可以加载相应方法上。

(1)启动shiro注解

<!-- 启动Shrio的注解 -->
<bean id="lifecycleBeanPostProcessor"
      class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
<bean
        class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
        depends-on="lifecycleBeanPostProcessor" />
<bean
        class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    <property name="securityManager" ref="securityManager" />
</bean>

(2)使用shiro注解

(7) 全局异常 

 我们实验通过网址跳转到没有权限的页面，发现报错，如果没有该权限，我想我们应该让其跳转到一个没有权限的页面

 这里我们使用全局异常处理的方式返回指定页面

二、ssm整合shiro完成前后端分离

 所谓前后端完全分离:后端响应的都是json数据，而不再是网页。

1. 登录成功或者失败应该返回json数据
2. 当未登录时返回的也是json数据
3. 访问未授权的资源，也要返回json。

1. 登录成功或者失败应该返回json数据

2. 用户未登录时返回的也应是json数据

  (1) 创建一个过滤器，继承登录校验的某个接口

package com.wt.filter;

import com.fasterxml.jackson.databind.ObjectMapper;
import com.wt.util.CommonResult;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.PrintWriter;


public class LoginFilter extends FormAuthenticationFilter {
    //当没有登录时会经过该方法、如果想让他返回json数据必须重写该方法
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        response.setContentType("application/json;charset=utf-8");
        PrintWriter writer = response.getWriter();
        CommonResult result = new CommonResult(5001,"请先登录",null);
        ObjectMapper objectMapper = new ObjectMapper();
        String json = objectMapper.writeValueAsString(result);
        writer.print(json); //响应给客户json数据
        writer.flush();
        writer.close();

        return false;
    }
}

(2) 注册我们的过滤器

在springmvc文件中注册我们的文件

3. 如果没有权限应该返回json数据

 修改全局异常类

package com.wt.erro;

import com.wt.util.CommonResult;
import org.apache.shiro.authz.UnauthorizedException;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.ResponseBody;


@ControllerAdvice
public class MyException {
    @ExceptionHandler(value = UnauthorizedException.class)
    @ResponseBody
    public CommonResult auth(UnauthorizedException e){
        e.printStackTrace();
        return new CommonResult(5002,"权限不足",null);
    }
}