SpringBoot 整合Shiro

深碍√TFBOYSˉ_ 2021-12-05 18:39 486阅读 0赞

### 一、Shiro是什么？ ###

Apache Shiro是一个功能强大、灵活的，开源的安全框架。它可以干净利落地处理身份验证、授权、企业会话管理和加密。

Apache Shiro的首要目标是易于使用和理解。安全通常很复杂，甚至让人感到很痛苦，但是Shiro却不是这样子的。一个好的安全框架应该屏蔽复杂性，向外暴露简单、直观的API，来简化开发人员实现应用程序安全所花费的时间和精力。

Shiro能做什么呢？

*  验证用户身份
 *  用户访问权限控制，比如：1、判断用户是否分配了一定的安全角色。2、判断用户是否被授予完成某个操作的权限
 *  在非 web 或 EJB 容器的环境下可以任意使用Session API
 *  可以响应认证、访问控制，或者 Session 生命周期中发生的事件
 *  可将一个或以上用户安全数据源数据组合成一个复合的用户 “view”(视图)
 *  支持单点登录(SSO)功能
 *  支持提供“Remember Me”服务，获取用户关联信息而无需登录  
    …

###  二、快速上手 ###

1.配置pom依赖

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <modelVersion>4.0.0</modelVersion>
        <parent>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-parent</artifactId>
            <version>2.1.6.RELEASE</version>
            <relativePath/> 
        </parent>
        <groupId>com.chen</groupId>
        <artifactId>shirotest</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <name>shirotest</name>
        <description>Demo project for Spring Boot</description>
    
        <properties>
            <java.version>1.8</java.version>
        </properties>
    
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-web</artifactId>
            </dependency>
    
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-test</artifactId>
                <scope>test</scope>
            </dependency>
            
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.4.0</version>
            </dependency>
            
            <dependency>
                <groupId>com.alibaba</groupId>
                <artifactId>druid</artifactId>
                <version>1.0.9</version>
            </dependency>
            <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
            </dependency>
            <dependency>
                <groupId>org.mybatis.spring.boot</groupId>
                <artifactId>mybatis-spring-boot-starter</artifactId>
                <version>2.0.1</version>
            </dependency>
            
            <dependency>
                <groupId>org.projectlombok</groupId>
                <artifactId>lombok</artifactId>
            </dependency>
        </dependencies>
    
        <build>
            <plugins>
                <plugin>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-maven-plugin</artifactId>
                </plugin>
            </plugins>
        </build>
    
    </project>

2.设置application.properties

#配置数据源
    spring.datasource.url=jdbc:mysql://localhost:3306/test?serverTimezone=CTT&useUnicode=true&characterEncoding=utf-8&allowMultiQueries=true
    spring.datasource.username=root
    spring.datasource.password=123456
    
    #配置druid连接池
    spring.datasource.type=com.alibaba.druid.pool.DruidDataSource

3.配置Shiro

package com.chen.shiro;
    
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.springframework.beans.factory.annotation.Qualifier;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    @Configuration
    public class ShiroConfig {
    
        @Bean
        public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager) {
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            //设置安全管理器
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            //设置过滤器
            Map<String, String> filterMap = new LinkedHashMap<String, String>();
            //排除掉不需要进行认证的接口
            filterMap.put("/login", "anon");
            //设置需要授权的接口
            filterMap.put("/add", "perms[add]");
            //设置需要认证的接口
            filterMap.put("/*", "authc");
            //跳转接口
            shiroFilterFactoryBean.setLoginUrl("/toLogin");
            //授权提示接口
            shiroFilterFactoryBean.setUnauthorizedUrl("/unAuth");
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
            return shiroFilterFactoryBean;
        }
    
        @Bean(name = "securityManager")
        public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            securityManager.setRealm(userRealm);
            return securityManager;
        }
    
        @Bean(name = "userRealm")
        public UserRealm getRealm() {
            return new UserRealm();
        }
    
    }

4.设置Realm

package com.chen.shiro;
    
    import com.chen.bean.User;
    import com.chen.service.UserService;
    import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.beans.factory.annotation.Autowired;
    
    public class UserRealm extends AuthorizingRealm {
    
        @Autowired
        UserService userService;
    
        /*
        执行授权逻辑
         */
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
            //System.out.println("执行授权逻辑");
            //给资源进行授权
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
            //添加资源授权字符串
            info.addStringPermission("add");
            return null;
        }
    
        /*
        执行认证逻辑
         */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
            //System.out.println("执行认证逻辑");
            UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
            User user = userService.findByName(token.getUsername());
            if (user == null) {
                return null;//用户名不存在
            }
            return new SimpleAuthenticationInfo("", user.getPassword(), "");
        }
    }

5.设置User类

package com.chen.bean;
    
    import lombok.AllArgsConstructor;
    import lombok.Data;
    import lombok.NoArgsConstructor;
    
    @Data
    @AllArgsConstructor
    @NoArgsConstructor
    public class User {
        int id;
        String username;
        String password;
    }

6.设置mapper接口

package com.chen.mapper;
    
    import com.chen.bean.User;
    import org.apache.ibatis.annotations.Mapper;
    import org.apache.ibatis.annotations.Select;
    
    @Mapper
    public interface UserMapper {
    
        @Select("SELECT * FROM `user` WHERE username=#{name}")
        public User findByName(String name);
    }

7.编写Service

package com.chen.service;
    
    import com.chen.bean.User;
    import com.chen.mapper.UserMapper;
    import org.springframework.stereotype.Service;
    
    import javax.annotation.Resource;
    
    @Service
    public class UserService {
    
        @Resource
        private UserMapper userMapper;
    
        public User findByName(String name) {
           return userMapper.findByName(name);
        }
    
    }

8.编写Controller

package com.chen.controller;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.UnknownAccountException;
    
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.web.bind.annotation.*;
    
    
    @RestController
    public class Usercontroller {
    
        @RequestMapping("/add")
        public String add() {
            return "user/add";
        }
    
        @RequestMapping("/update")
        public String update() {
            return "user/update";
        }
    
        @PostMapping("/login")
        public String login(String name, String password) {
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(name, password);
            System.out.println("token:" + token.toString());
            try {
                subject.login(token);
                return "登录成功";
            } catch (UnknownAccountException e) {
                return "用户名不存在";
            } catch (IncorrectCredentialsException e) {
                return "密码不正确";
            }
        }
    
        @ResponseBody
        @RequestMapping("/unAuth")
        public String unAuth() {
            return "未授权";
        }
    }

9.在启动类中将mapper接口进行映射

package com.chen;
    
    import org.mybatis.spring.annotation.MapperScan;
    import org.springframework.boot.SpringApplication;
    import org.springframework.boot.autoconfigure.SpringBootApplication;
    
    @MapperScan("com.chen.mapper")
    @SpringBootApplication
    public class ShirotestApplication {
    
        public static void main(String[] args) {
            SpringApplication.run(ShirotestApplication.class, args);
        }
    
    }