/**

• 自定义的Realm 实现授权和认证 / public class UserRealm extends AuthorizingRealm { //此处注意下面自动装载可能为空，是在shrio配置类中配置 private UserMapper userMapper; private RoleMapper roleMapper; @Autowired private void setUserMapper(UserMapper userMapper) { this.userMapper = userMapper; } @Autowired private void setRoleMapper(RoleMapper roleMapper) { this.roleMapper = roleMapper; } /*
• 授权
• @param principals * @return */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { User user = (User) SecurityUtils.getSubject().getPrincipal(); Set<String> roles = new HashSet<>(); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); List<String> role = roleMapper.findRoleByUser(user.getUserName()); role.stream().forEach(s -> { roles.add(s); }); info.setRoles(roles);

/** *  如果需要在页面中使用 shiro:hasPermission="guest" *  需要在shrio中配置 shiroDialect，并加上下面这句 */ //info.addStringPermissions(role); return info; }

/**

• 认证
• @param token * @return * @throws AuthenticationException */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { UsernamePasswordToken usertoken = (UsernamePasswordToken) token; User user = userMapper.selectByUserName(usertoken.getUsername()); if (user == null) { throw new AccountException("用户名不存在"); } if (!user.getPassWord().equals(new String((char[]) usertoken.getCredentials()))) { throw new AccountException("密码不正确"); } return new SimpleAuthenticationInfo(user, usertoken.getPrincipal(), getName()); } }

@Configuration public class ShrioConfig { @Bean public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) { ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); // 必须设置 SecurityManager shiroFilterFactoryBean.setSecurityManager(securityManager); // setLoginUrl 如果不设置值，默认会自动寻找Web工程根目录下的"/login.jsp"页面 或 "/login" 映射 shiroFilterFactoryBean.setLoginUrl("/"); // 设置无权限时跳转的 url; shiroFilterFactoryBean.setUnauthorizedUrl("/403"); // 设置拦截器 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>(); //游客，开发权限 filterChainDefinitionMap.put("/errorPage", "anon"); //用户，需要角色权限 “user”   //管理员，需要角色权限 “admin”         //注意：此处是第一种配置，是直接在这里写死的权限和路径信息        filterChainDefinitionMap.put("/user/addUser", "roles[admin]");         filterChainDefinitionMap.put("/user/selectUser", "roles[guest]");  //注意下面 是第二种方式，和上面只能配置一个 //        filterChainDefinitionMap.put("/user/addUser", "authc"); //        filterChainDefinitionMap.put("/user/selectUser", "authc");

//开放登陆/退出接口 filterChainDefinitionMap.put("/login", "anon"); filterChainDefinitionMap.put("/logout", "anon"); //其余接口一律拦截 //主要这行代码必须放在所有权限设置的最后，不然会导致所有 url 都被拦截 filterChainDefinitionMap.put("/**", "authc");

shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); System.out.println("Shiro拦截器工厂类注入成功"); return shiroFilterFactoryBean; }

/**

• 注入 securityManager */ @Bean public SecurityManager securityManager() { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); // 设置realm. securityManager.setRealm(customRealm()); return securityManager; }

/**

• ShiroDialect，为了在thymeleaf里使用shiro的标签的bean
• @return */ @Bean public ShiroDialect shiroDialect() { return new ShiroDialect(); }

/**

• 处理未授权的时候跳转问题
• @return */ @Bean public HandlerExceptionResolver solver() { HandlerExceptionResolver handlerExceptionResolver = new MyExceptionResolver(); return handlerExceptionResolver; }

/**

• 开启shiro aop注解支持.  必需
• 使用代理方式;所以需要开启代码支持;否则@RequiresRoles等注解无法生效
• @param securityManager * @return */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor(); authorizationAttributeSourceAdvisor.setSecurityManager(securityManager); return authorizationAttributeSourceAdvisor; }

@Bean public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator(); advisorAutoProxyCreator.setProxyTargetClass(true); return advisorAutoProxyCreator; }

/**

• 自定义身份认证 realm;
• <p> * 必须写这个类，并加上 @Bean 注解，目的是注入 CustomRealm，
• 否则会影响 CustomRealm类 中其他类的依赖注入 */ @Bean public UserRealm customRealm() { return new UserRealm(); } }

/**

• 未授权跳转页面
• @return */ @RequestMapping("/403") public String error403() { return "403"; }

/**

• 用户中心
• @param request * @return */

@RequestMapping("/home") public String selectInformation(HttpServletRequest request) { return "index"; }

/**

• 登出
• @param request * @return */ @RequestMapping("/loginOut") public String loginOut(HttpServletRequest request) { SecurityUtils.getSubject().logout(); return "redirect:/"; }

/**

• 处理登陆逻辑
• @param request * @return */ @RequestMapping(value = "/login", method = RequestMethod.POST) public String toLogin(HttpServletRequest request) { String userName = request.getParameter("userName"); String passwd = request.getParameter("password"); UsernamePasswordToken token = new UsernamePasswordToken(userName, passwd); Subject subject = SecurityUtils.getSubject(); try { subject.login(token); return "redirect:/home"; } catch (Exception e) { request.getSession().setAttribute("msg", "登陆失败，用户名或密码不正确"); return "redirect:/errorPage"; } }

<h1><a th:href="@{/user/addUser}" >添加用户 -admin权限</a></h1> <h1><a th:href="@{/user/selectUser}">用户列表--guest权限</a></h1>

<!--<h1><a th:href="@{/user/addUser}" shiro:hasPermission="admin">添加用户 -admin权限</a></h1>--> <!--<h1><a th:href="@{/user/selectUser}" shiro:hasPermission="guest">用户列表&#45;&#45;guest权限</a></h1>-->