Springboot集成Shiro实现登录权限认证

Shiro

Shiro简介

什么是Shiro?

• Apache Shiro 是一个Java的安全（权限）框架
• Shiro可以非常容易的开发出足够好的应用，其不仅可以用在JavaSE环境，也可以用在JavaEE环境
• Shiro可以完成认证，授权，加密，会话管理，Web集成，缓存等

代码

pom.xml

    <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-thymeleaf</artifactId>
            </dependency>
            <dependency>
                <groupId>com.github.theborakompanioni</groupId>
                <artifactId>thymeleaf-extras-shiro</artifactId>
                <version>2.0.0</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring-boot-web-starter</artifactId>
                <version>1.5.2</version>
            </dependency>
            <dependency>
                <groupId>org.mybatis.spring.boot</groupId>
                <artifactId>mybatis-spring-boot-starter</artifactId>
                <version>2.1.1</version>
            </dependency>
            <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
                <version>1.2.17</version>
            </dependency>
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
            </dependency>
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid</artifactId>
                <version>1.1.20</version>
            </dependency>
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
                <version>1.18.10</version>
                <scope>provided</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
                <exclusions>
                    <exclusion>
                        <groupId>org.junit.vintage</groupId>
                        <artifactId>junit-vintage-engine</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
        </dependencies>

ShiroConfig中的配置

    @Configuration
    public class ShiroConfig {
        //创建ShiroFilterFactoryBean
        @Bean
        public ShiroFilterFactoryBean shiroFilterFactoryBean(
                @Qualifier("securityManager") DefaultWebSecurityManager securityManager) {
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            //设置安全管理器
            shiroFilterFactoryBean.setSecurityManager(securityManager);
    
            //添加shiro的内置过滤器
            /*
                anno：无需认证就可以访问
                authc：必须认证了才可以访问
                user：必须拥有记住我的功能才可以用
                perms：拥有对某个资源的权限才能访问
                role：拥有某得角色的权限才能访问
             */
    
            //拦截
            Map<String, String> filterMap = new LinkedHashMap<>();
    
            //授权
            filterMap.put("/user/add", "perms[user:add]");
            filterMap.put("/user/update", "perms[user:update]");
    
            filterMap.put("/user/*", "authc");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
    
            //设置登录的请求
            shiroFilterFactoryBean.setLoginUrl("/toLogin");
            //设置未授权的请求
            shiroFilterFactoryBean.setUnauthorizedUrl("/noauth");
            return shiroFilterFactoryBean;
        }
    
        //创建DefaultWebSecurityManager
        @Bean(name = "securityManager")
        public DefaultWebSecurityManager defaultWebSecurityManager(
                @Qualifier("userRealm") UserRealm userRealm) {
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            //关联UserRealm
            securityManager.setRealm(userRealm);
            return securityManager;
        }
    
        //创建realm对象
        @Bean
        public UserRealm userRealm() {
            return new UserRealm();
        }
    
    
        //整合ShiroDialect：用来整合shiro和thymeleaf
        public ShiroDialect getShiroDialect() {
            return new ShiroDialect();
        }
    }

Realm的配置

    public class UserRealm extends AuthorizingRealm {
    
        @Autowired
        private UserService userService;
    
        //授权
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //拿到当前登录的这个对象
            Subject subject = SecurityUtils.getSubject();
            User currentUser = (User) subject.getPrincipal();
            //设置当前用户的权限
            info.addStringPermission(currentUser.getPerms());
            return info;
        }
    
        //认证
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
            UsernamePasswordToken userToken = (UsernamePasswordToken) authenticationToken;
            //连接数据库
            User user = userService.queryUserByName(userToken.getUsername());
            //用户名认证
            if (user == null) {
                return null;//抛出异常 UnknownAccountException
            }
            //密码认证
            return new SimpleAuthenticationInfo(user, user.getPassword(), "");
        }
    }

Controller层配置

    @Controller
    public class MyController {
    
        @RequestMapping({"/", "index"})
        public String index(Model model) {
            return "index";
        }
    
        @RequestMapping("/user/add")
        public String add() {
            return "user/add";
        }
    
        @RequestMapping("/user/update")
        public String update() {
            return "user/update";
        }
    
        @RequestMapping("/toLogin")
        public String toLogin() {
            return "login";
        }
    
        @RequestMapping("/login")
        public String login(String username, String password, Model model) {
            //获取当前的用户
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token =
                    new UsernamePasswordToken(username, password);
            try {
                //执行登录的方法
                subject.login(token);
                return "index";
            } catch (UnknownAccountException e) {//用户名不存在
                model.addAttribute("msg", "用户名错误");
                return "login";
            } catch (IncorrectCredentialsException e) {//密码不存在
                model.addAttribute("msg", "密码错误");
                return "login";
            }
        }
    
        @RequestMapping("/noauth")
        @ResponseBody
        public String unauthorized() {
            return "未经授权无法访问此页面";
        }
    }