SpringBoot之Shiro整合登陆验证、角色验证和权限验证

首先要感谢这篇文章的博主，参考文章http://www.ityouknow.com/springboot/2017/06/26/springboot-shiro.html

以下就要开始我的表演啦（我还是一个菜鸟，大佬请绕道）

这一次我是用SpringBoot搭建，推荐大家学习Shiro的时候，从开始的shiro.ini配置文件开始学习起，废话不多说，先看数据表结构。

再看看我的pom.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
 <modelVersion>4.0.0</modelVersion>

 <groupId>com.xiaobin</groupId>
 <artifactId>SpringbootShiro</artifactId>
 <version>0.0.1-SNAPSHOT</version>
 <packaging>war</packaging>

 <name>SpringbootShiro</name>
 <description>Demo project for Spring Boot</description>

 <parent>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-parent</artifactId>
  <version>1.5.9.RELEASE</version>
  <relativePath /> <!-- lookup parent from repository -->
 </parent>

 <properties>
  <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
  <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
  <java.version>1.8</java.version>
 </properties>

 <dependencies>
  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-web</artifactId>
  </dependency>

  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-tomcat</artifactId>
   <scope>provided</scope>
  </dependency>
  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-test</artifactId>
   <scope>test</scope>
  </dependency>
  
  <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId>spring-boot-starter-thymeleaf</artifactId>
  </dependency>
  <dependency>
   <groupId>net.sourceforge.nekohtml</groupId>
   <artifactId>nekohtml</artifactId>
   <version>1.9.22</version>
  </dependency>
  <dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-spring</artifactId>
   <version>1.4.0</version>
  </dependency>
  <dependency>
   <groupId>mysql</groupId>
   <artifactId>mysql-connector-java</artifactId>
   <scope>runtime</scope>
  </dependency>
  <dependency>
   <groupId>org.projectlombok</groupId>
   <artifactId>lombok</artifactId>
  </dependency>
  <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.1.1</version>
        </dependency>
 </dependencies>

 <build>
  <plugins>
   <plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
   </plugin>
  </plugins>
 </build>


</project>

这里的模版是用的thymeleaf,需要在src/main/resources/templates创建六个页面，如下图：

页面内容很简单，都是一些文字提示，没有具体的操作内容，除了login.html有一个form提交表单。

再来看看我的application.yml配置文件

spring:
  datasource:
    driver-class-name: com.mysql.jdbc.Driver
    url: jdbc:mysql://localhost:3306/shiro?useUnicode=true&characterEncoding=utf-8&useSSL=false
    username: root
    password: 
  thymeleaf: 
       cache: false
       mode: LEGACYHTML5
mybatis:
  mapper-locations: classpath:mapper/*.xml

在然后就是dao层和service层的东西就贴个图吧（嘻嘻，偷懒）

配置shiro的重中之重来啦，打起精神。

首先需要自己配置一个集成org.apache.shiro.realm.AuthorizingRealm类，主要是来验证登陆和权限

public class MyShiroRealm extends AuthorizingRealm {

 @Autowired
 private UserDaoService userDaoService;
 @Autowired
 private RoleDaoService roleDaoService;
 @Autowired
 private PermissionDaoService permissionDaoService;
 
 
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  // 能进入到这里，表示账号已经通过验证了
  String username = (String) principals.getPrimaryPrincipal();
  User user = userDaoService.selectByNameUser(username);
  //先把所拥有的角色给获取
  Set<String> roleString = roleDaoService.selectByUserIdString(user.getUserId());
  //查询该用户所拥有的角色
  List<Role> roleList = roleDaoService.selectByUserIdRoles(user.getUserId());
  //查询所有角色所拥有的权限
  Set<String> perms = new HashSet<>();
  for(Role role : roleList) {
   Set<String> permString = permissionDaoService.selectByRoleIdPermissionString(role.getRoleId());
   perms.addAll(permString);
  }
  
  // 授权对象
  SimpleAuthorizationInfo s = new SimpleAuthorizationInfo();
  // 把通过DAO获取到的角色和权限放进去
  s.setStringPermissions(perms);
  s.setRoles(roleString);
  return s;
 }

 @Override
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  // TODO Auto-generated method stub
  //获取登陆的用户名和密码
  UsernamePasswordToken t = (UsernamePasswordToken) token;
  String username = token.getPrincipal().toString();
  String password = new String(t.getPassword());
  //从数据库中获取登陆的用户
  User user = userDaoService.selectByNameUser(username);
  if(null==user) {
   System.out.println("没找到此用户");
   throw new AuthenticationException();
  }
  //把用户输入的密码进行md5和盐加密一起运算两次
  String encodedPassword = new SimpleHash("md5", password, user.getSalt(), 2).toString();
  if (!user.getPassword().equals(encodedPassword)) {
   System.out.println("密码错误");
   throw new AuthenticationException();
  }
  // 认证信息里存放账号密码, getName() 是当前Realm的继承方法,通常返回当前类名 :databaseRealm
  SimpleAuthenticationInfo a = new SimpleAuthenticationInfo(username, password, getName());
  return a;
 }

}

然后再试shiro的全局配置啦，Apache Shiro 核心通过 Filter 来实现

@Configuration
public class ShiroConfig {
 @Bean
 public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
  ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  shiroFilterFactoryBean.setSecurityManager(securityManager);
  // 拦截器
  Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
  // 配置不会被拦截的链接 顺序判断
  filterChainDefinitionMap.put("/static/**", "anon");
  filterChainDefinitionMap.put("/index", "anon");
  // 配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
  filterChainDefinitionMap.put("/logout", "logout");
  // <!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
  // <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
  //这里可以手动加入角色和权限
  // filterChainDefinitionMap.put("/userinfo","roles[admin],perms[userList]");
  // filterChainDefinitionMap.put("/userAdd","roles[userManger]");
  filterChainDefinitionMap.put("/**", "authc");
  // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
  shiroFilterFactoryBean.setLoginUrl("/login");
  // 登录成功后要跳转的链接
  shiroFilterFactoryBean.setSuccessUrl("/index");

  //没有授权就会跳转到403.html  这里我的好像没有效，我用的是MyException来捕捉没有权限的异常
  shiroFilterFactoryBean.setUnauthorizedUrl("/403");
  shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
  return shiroFilterFactoryBean;
 }

 //自定义Realm拦截处理，这个类很重要
 @Bean
 public MyShiroRealm myShiroRealm() {
  MyShiroRealm myShiroRealm = new MyShiroRealm();
  return myShiroRealm;
 }

 @Bean
 public SecurityManager securityManager() {
  DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  securityManager.setRealm(myShiroRealm());
  return securityManager;
 }

 /**
     *  开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
     * 配置以下两个bean(DefaultAdvisorAutoProxyCreator和AuthorizationAttributeSourceAdvisor)即可实现此功能
     * @return
     */
    @Bean
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }
  
    /**
     * 开启aop注解支持
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }
}

shiro配置基本就完结啦现在我们添加Controller来测试一下

@Controller
public class IndexController {
 
 @RequestMapping({"/","/index"})
 public String index() {
  return "index";
 }
 
 /**
  * 页面login.html中form表单action的提交地址
  * 不处理登陆验证，假如还是跳转到/login.html就是用户或者密码错误
  * @param map
  * @return
  */
 @RequestMapping("login")
 public String login(){
  return "login";
 }
 
 /**
  * 没有权限就会跳转到403.html
  * @return
  */
 @RequestMapping("/403")
 public String unauthorizedRole() {
  return "403";
 }
}

还有一个Controller是对其它三个页面的跳转，主要是使用@RequiresRoles和@RequiresPermissions两个注解

@Controller
public class UserController {

 
 /**
  * 访问用户列表页面
  * @return
  */
 @RequestMapping("/userlist")
 @RequiresPermissions("userList")//我的用户并没有userList这个权限，所以访问不了 
 public String userlist() {
  return "userInfo";
 }
 
 /**
  * 访问用户增加页面
  * @return
  */
 @RequestMapping("/useradd")
 @RequiresRoles("admin")//我的用户并没有admin这个角色，所以访问不了
 public String useradd() {
  return "userAdd";
 }
 /**
  * 访问用户删除页面
  * @return
  */
 @RequestMapping("/userdelete")
 public String userdelete() {
  return "userDelete";
 }
}

结果图

码云地址：https://gitee.com/MyXiaoXiaoBin/SpringBootShiro

每天都有一个小目标，让自己不在那么迷茫