SpringBoot集成Shiro的3种方式

/**
* 自定义的Realm 实现授权和认证
*/
public class UserRealm extends AuthorizingRealm {
//此处注意下面自动装载可能为空，是在shrio配置类中配置
private UserMapper userMapper;
private RoleMapper roleMapper;
@Autowired
private void setUserMapper(UserMapper userMapper) {
this.userMapper = userMapper;
}
@Autowired
private void setRoleMapper(RoleMapper roleMapper) {
this.roleMapper = roleMapper;
}
/**
* 授权
*
* @param principals
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
User user = (User) SecurityUtils.getSubject().getPrincipal();
Set<String> roles = new HashSet<>();
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
List<String> role = roleMapper.findRoleByUser(user.getUserName());
role.stream().forEach(s -> {
roles.add(s);
});
info.setRoles(roles);

/**
*  如果需要在页面中使用 shiro:hasPermission=”guest”
*  需要在shrio中配置 shiroDialect，并加上下面这句
*/
//info.addStringPermissions(role);
return info;
}

/**
* 认证
*
* @param token
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken usertoken = (UsernamePasswordToken) token;
User user = userMapper.selectByUserName(usertoken.getUsername());
if (user == null) {
throw new AccountException(“用户名不存在”);
}
if (!user.getPassWord().equals(new String((char[]) usertoken.getCredentials()))) {
throw new AccountException(“密码不正确”);
}
return new SimpleAuthenticationInfo(user, usertoken.getPrincipal(), getName());
}
}

@Configuration
public class ShrioConfig {
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
// 必须设置 SecurityManager
shiroFilterFactoryBean.setSecurityManager(securityManager);
// setLoginUrl 如果不设置值，默认会自动寻找Web工程根目录下的”/login.jsp”页面 或 “/login” 映射
shiroFilterFactoryBean.setLoginUrl(“/”);
// 设置无权限时跳转的 url;
shiroFilterFactoryBean.setUnauthorizedUrl(“/403”);
// 设置拦截器
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
//游客，开发权限
filterChainDefinitionMap.put(“/errorPage”, “anon”);
//用户，需要角色权限 “user”   //管理员，需要角色权限 “admin”
        //注意：此处是第一种配置，是直接在这里写死的权限和路径信息
       filterChainDefinitionMap.put(“/user/addUser”, “roles[admin]”);
        filterChainDefinitionMap.put(“/user/selectUser”, “roles[guest]”);
 //注意下面 是第二种方式，和上面只能配置一个
//        filterChainDefinitionMap.put(“/user/addUser”, “authc”);
//        filterChainDefinitionMap.put(“/user/selectUser”, “authc”);

//开放登陆/退出接口
filterChainDefinitionMap.put(“/login”, “anon”);
filterChainDefinitionMap.put(“/logout”, “anon”);
//其余接口一律拦截
//主要这行代码必须放在所有权限设置的最后，不然会导致所有 url 都被拦截
filterChainDefinitionMap.put(“/**”, “authc”);

shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
System.out.println(“Shiro拦截器工厂类注入成功”);
return shiroFilterFactoryBean;
}

/**
* 注入 securityManager
*/
@Bean
public SecurityManager securityManager() {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
// 设置realm.
securityManager.setRealm(customRealm());
return securityManager;
}

/**
* ShiroDialect，为了在thymeleaf里使用shiro的标签的bean
*
* @return
*/
@Bean
public ShiroDialect shiroDialect() {
return new ShiroDialect();
}

/**
* 处理未授权的时候跳转问题
*
* @return
*/
@Bean
public HandlerExceptionResolver solver() {
HandlerExceptionResolver handlerExceptionResolver = new MyExceptionResolver();
return handlerExceptionResolver;
}

/**
* 开启shiro aop注解支持.  必需
* 使用代理方式;所以需要开启代码支持;否则@RequiresRoles等注解无法生效
*
* @param securityManager
* @return
*/
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}

@Bean
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
advisorAutoProxyCreator.setProxyTargetClass(true);
return advisorAutoProxyCreator;
}

/**
* 自定义身份认证 realm;
* <p>
* 必须写这个类，并加上 @Bean 注解，目的是注入 CustomRealm，
* 否则会影响 CustomRealm类 中其他类的依赖注入
*/
@Bean
public UserRealm customRealm() {
return new UserRealm();
}
}

/**
* 未授权跳转页面
* @return
*/
@RequestMapping(“/403”)
public String error403() {
return “403”;
}

/**
* 用户中心
* @param request
* @return
*/

@RequestMapping(“/home”)
public String selectInformation(HttpServletRequest request) {
return “index”;
}

/**
* 登出
* @param request
* @return
*/
@RequestMapping(“/loginOut”)
public String loginOut(HttpServletRequest request) {
SecurityUtils.getSubject().logout();
return “redirect:/”;
}

/**
* 处理登陆逻辑
* @param request
* @return
*/
@RequestMapping(value = “/login”, method = RequestMethod.POST)
public String toLogin(HttpServletRequest request) {
String userName = request.getParameter(“userName”);
String passwd = request.getParameter(“password”);
UsernamePasswordToken token = new UsernamePasswordToken(userName, passwd);
Subject subject = SecurityUtils.getSubject();
try {
subject.login(token);
return “redirect:/home”;
} catch (Exception e) {
request.getSession().setAttribute(“msg”, “登陆失败，用户名或密码不正确”);
return “redirect:/errorPage”;
}
}

<h1><a th:href=”@{/user/addUser}” >添加用户 -admin权限</a></h1>
<h1><a th:href=”@{/user/selectUser}”>用户列表–guest权限</a></h1>

<!–<h1><a th:href=”@{/user/addUser}” shiro:hasPermission=”admin”>添加用户 -admin权限</a></h1>–>
<!–<h1><a th:href=”@{/user/selectUser}” shiro:hasPermission=”guest”>用户列表&#45;&#45;guest权限</a></h1>–>