Shiro简单案例学习

项目搭建

项目整体框架

 核心部分讲解

1、 主要依赖

 <dependencies>
        <!--        导入数据源-->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.12</version>
        </dependency>
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.1.0</version>
        </dependency>
        <!--        lombok-->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <optional>true</optional>
        </dependency>
        <!--        shiro-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.5.3</version>
        </dependency>
        <!--        thymeleaf-->
        <dependency>
            <groupId>org.thymeleaf</groupId>
            <artifactId>thymeleaf-spring5</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-java8time</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

2、先自定义核心组件Realm（主要是用来认证和授权的）

public class UserRealm extends AuthorizingRealm {
    @Autowired
    UserService userService;
    @Override
    //授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("开始授权");
        final SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        info.addStringPermission("user:add");
        //得到当前登入的对象
        final Subject subject = SecurityUtils.getSubject();
        //得到user对象
        final User user = (User) subject.getPrincipal();
        //设置当前用户权限
        info.addStringPermission(user.getPerms());
        info.addRole("admin");
        return info;
    }

    @Override
    //认证
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("开始认证");
//        String name="root";
//        String password="123456";
        final UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        final User user = userService.getUserByName(token.getUsername());
        if(user==null){
            return null;
        }
        //密码认证，shiro做
        return new SimpleAuthenticationInfo(user,user.getPwd(),"");
    }
}

3、配置Shiro

(这里配置的三个Bean在项目启动的时候就已经注入到Spring大容器中了)

@Configuration
public class ShiroConfig {
    @Bean
         //第三步 ShiroFilterFactoryBean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
        final ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(securityManager);
        //添加内置过滤器
        /**
         * anon 无需认证即可访问
         * authc 需要认证才可访问
         * user 记住我
         * perms 拥有对某个资源的权限才能访问
         * roles  拥有某个角色权限才可以访问
         */
        Map<String, String> filterMap=new LinkedHashMap<>();
       filterMap.put("/user/add","authc");
       filterMap.put("/user/update","authc");
       //授权
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","roles[admin]");
        bean.setFilterChainDefinitionMap(filterMap);
        //设置登入的请求
        bean.setLoginUrl("/toLogin");
        //设置未授权请求
        bean.setUnauthorizedUrl("/unauth");
        return bean;
    }

         //第二步 DefaultWebSecurityManage
    @Bean(name = "securityManager")
     public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("getUserRealm") UserRealm realm){
         final DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
         //关联realm
         securityManager.setRealm(realm);
         return securityManager;
     }

        //第一步 创建realm 对象 自定义类UserRealm
    @Bean
    public UserRealm getUserRealm(){
           return new UserRealm();
       }
}

在这里Shiro主要配置了三个Bean:

1、首先需要提供一个Realm的实例。（前面一步已经做了）

2、需要配置一个DefaultWebSecutityManage，再DefaultWebSecutityManage配置Realm。

3、配置一个ShiroFilterFactoryBean，在ShiroFilterFactoryBean中配置路径拦截规则。

4、配置登录和测试接口。

filterMap中配置了路径拦截规则，注意要有序。

4、配置登入controller

（登入接口中有玄机）

@Controller
public class MyController {
    @RequestMapping({"/","/index"})
    public String toIndex(Model model){
        model.addAttribute("msg","hello,shiro");
        return "index";
    }
    @RequestMapping("/user/add")
    public String add(){
        return "user/add";
    }
    @RequestMapping("/user/update")
    public String update(){
        return "user/update";
    }
    @RequestMapping("/toLogin")
    public String toLogin(){

        return "login";
    }
    @RequestMapping("/login")
    public String login(String username,String password,Model model){
        //获取当前用户
        final Subject subject = SecurityUtils.getSubject();
        //封住用户的登入数据
        final UsernamePasswordToken token = new UsernamePasswordToken(username, password);

        try {
            subject.login(token);//执行登录方法，如果没有异常就ok  
            return "index";
        } catch (UnknownAccountException e) {//用户名不存在
          model.addAttribute("msg","用户名不存在");
          return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密码错误");
            return "login";
        }
    }
    @RequestMapping("/unauth")
    @ResponseBody
    public String Unauthorized(){
        return "未授权页面";
    }
}

subject.login(token);//执行登录方法，如果没有异常就ok，这里登录会进入到shiro配置中认证那一块的代码

这里只展示出部分代码，具体源代码可以参考 https://gitee.com/liujun1681/shiro-test