springboot thymeleaf和shiro 整合第二篇配置权限和认证

蔚落 2022-05-25 08:44 334阅读 0赞

package com.ruiguang.config;  
  
  
  
  
import org.apache.shiro.authc.AuthenticationException;  
import org.apache.shiro.authc.AuthenticationInfo;  
import org.apache.shiro.authc.AuthenticationToken;  
import org.apache.shiro.authc.SimpleAuthenticationInfo;  
import org.apache.shiro.authz.AuthorizationInfo;  
import org.apache.shiro.authz.SimpleAuthorizationInfo;  
import org.apache.shiro.realm.AuthorizingRealm;  
import org.apache.shiro.subject.PrincipalCollection;  
import org.apache.shiro.util.ByteSource;  
  
  
import com.ruiguang.dao.UserDao;  
import com.ruiguang.entity.SysPermission;  
import com.ruiguang.entity.SysRole;  
import com.ruiguang.entity.UserInfo;  
  
  
  
  
import javax.annotation.Resource;  
  
  
public class MyShiroRealm extends AuthorizingRealm \{  
    @Resource  
    private UserDao userInfoService;  
    //z 授权  
    @Override  
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) \{  
        System.out.println("权限配置-->MyShiroRealm.doGetAuthorizationInfo()");  
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();  
        UserInfo userInfo  = (UserInfo)principals.getPrimaryPrincipal();  
        for(SysRole role:userInfo.getRoleList())\{  
            authorizationInfo.addRole(role.getRole());  
            for(SysPermission p:role.getPermissions())\{  
                authorizationInfo.addStringPermission(p.getPermission());  
            \}  
        \}  
        return authorizationInfo;  
    \}  
  
  
    //认证 c  
    /\*主要是用来进行身份认证的，也就是说验证用户输入的账号和密码是否正确。\*/  
    @Override  
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)  
            throws AuthenticationException \{  
    //1.账/密码 2.获取角色   
        System.out.println("MyShiroRealm.doGetAuthenticationInfo()");  
        //获取用户的输入的账号.  
        String username = (String)token.getPrincipal();  
        System.out.println("获取用户的输入的账号---->>>"+username);  
        System.out.println("token.getCredentials()---->>>"+token.getCredentials().toString());  
        //通过username从数据库中查找 User对象，如果找到，没找到.  
        //实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法  
        UserInfo userInfo = userInfoService.findByUsername(username);  
        System.out.println("----->>userInfo.getName()="+userInfo.getName());  
        System.out.println("----->>userInfo.getCredentialsSalt()="+userInfo.getCredentialsSalt());  
        System.out.println("----->>userInfo.getPassword()="+userInfo.getPassword());  
        System.out.println("----->>userInfo.getSalt()="+userInfo.getSalt());  
        System.out.println("----->>userInfo.getUsername()="+userInfo.getUsername());  
        if(userInfo == null)\{  
            return null;  
        \}  
        //此处使用的是user对象，不是username  
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(  
                userInfo, //用户名  
                userInfo.getPassword(), //密码  
                ByteSource.Util.bytes(userInfo.getCredentialsSalt()),//salt=username+salt  
                getName()  //realm name  
        );  
        System.out.println("authenticationInfo.getCredentials()--->>"+authenticationInfo.getCredentials().toString());  
        System.out.println("authenticationInfo.getPrincipals()--->>"+authenticationInfo.getPrincipals().toString());  
        System.out.println("authenticationInfo.getCredentialsSalt()--->>"+authenticationInfo.getCredentialsSalt().getClass().getName());  
        System.out.println("authenticationInfo.getCredentialsSalt().toHex()--->>"+authenticationInfo.getCredentialsSalt().toHex());  
        return authenticationInfo;  
    \}  
  
  
\}