最新 springBoot整合shiro（10分钟教程）

淩亂°似流年 2023-06-23 03:00 231阅读 0赞

# 1. 按照惯例先上两张shiro的机制图 #

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70]  
看图比较复杂，在上 一个简化的图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70 1]

# 2.添加依赖 #

<dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>1.3.2</version>
            </dependency>
            
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-core</artifactId>
                <version>1.3.2</version>
            </dependency>

# 3.创建项目中的login方法 #

@Controller
    @RequestMapping("/admin")
    public class LoginController { 
        /**
         * 登录验证方法
         * @param username 账号
         * @param password 密码
         * @return
         */
        @RequestMapping("/accountlogin")
        public String login(@RequestParam(required = false ,name="username") String username,@RequestParam(required = false ,name="password") String password){ 
            try { 
            	//shiro第二张图，用户主体是subject
            	//将用户存放到 UsernamePasswordToken中
                Subject subject = SecurityUtils.getSubject();
                UsernamePasswordToken uptoken = new UsernamePasswordToken(username,password);
                subject.login(uptoken);
                return "forward:/artice/articleList";
            } catch (AuthenticationException e) { 
                return  "forward:/admin/falseLogin";
            }
        }
     }

# 4. 用户登陆后创建用户的认证授权方法 #

import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.beans.factory.annotation.Autowired;
    
    import javax.management.relation.Role;
    import java.util.Set;
    
    public class CustomRealm extends AuthorizingRealm { 
    
        @Autowired
        private AdminServiceImpl adminService;
        public void serName(String name){ 
            super.setName("customRealm");
        }
    
        /**
         * 用户授权方法
         * @param principalCollection
         * @return
         */
        @Override
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 
        	//获取用户登录已经认证过的对象
            WxAdmin primaryPrincipal = (WxAdmin) principalCollection.getPrimaryPrincipal();
            //开始构造用户的权限与角色
            SimpleAuthorizationInfo userInfo = new SimpleAuthorizationInfo();
            //添加角色 这里自己查询数据库 我这里写死了
            userInfo.addRole("admin");
            //添加权限 这里自己查询数据库 我这里写死了
            userInfo.addStringPermission("all");
            return userInfo;
        }
    
        /**
         * 用户认证方法
         * @param authenticationToken
         * @return
         * @throws AuthenticationException
         */
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { 
            //获取登陆的upToken
            UsernamePasswordToken upToken =  (UsernamePasswordToken)authenticationToken;
            //获取账号密码
            String username = upToken.getUsername();
            String password = new String(upToken.getPassword());
            //查询数据库
            WxAdmin wxAdmin = adminService.selectUserAccount(username);
            if(wxAdmin!= null &&wxAdmin.getAdminPassword().equals(password)){ 
                return new SimpleAuthenticationInfo(wxAdmin,wxAdmin.getAdminPassword(),this.getName());
            }else{ 
                return null;
            }
    
        }
    }

ps 用户是先在 认证用户 在是 授权

# 4. 创建shiro的用户管理器 #

import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import java.util.LinkedHashMap;
    
    @Configuration
    public class ShiroConfiguration { 
    
        @Bean
        public CustomRealm getRealm(){ 
            return  new CustomRealm();
        }
        //配置管理器
        @Bean
        public SecurityManager getSecurityManager(CustomRealm realm){ 
            DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
            securityManager.setRealm(realm);
            return  securityManager;
        }
        //开启配置过滤器
        @Bean
        public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){ 
            //1.创建过滤工厂
            ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
            //2.设置安全管理器
            shiroFilterFactoryBean.setSecurityManager(securityManager);
            //3.通用配置
            shiroFilterFactoryBean.setLoginUrl("/admin/falseLogin");//设置登录页面
            shiroFilterFactoryBean.setUnauthorizedUrl("/admin/falseLogin");//授权失败跳转页面
            //4.设置过滤器
            LinkedHashMap<String, String> filterMap = new LinkedHashMap<>();
            filterMap.put("/artice/**","authc");//authc含义看下方的图
            filterMap.put("/commodity/**","authc");
            filterMap.put("/common/**","authc");
            filterMap.put("/gather/**","authc");
            filterMap.put("/new/**","authc");
            filterMap.put("/tools/**","authc");
    
            shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
            return shiroFilterFactoryBean;
    
        }
        //配置shiro的注解支持
        @Bean
        public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){ 
            AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
            authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
            return authorizationAttributeSourceAdvisor;
        }
    
    }

ps 附一张权限图  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70 2]

# 5. 注解开发 #

**@RequiresPermissions(“all”)//用户的权限  
@RequiresRoles(“admin”)//用户所具有的角色**

//测试用例
        @RequestMapping("/demo1")
        @RequiresPermissions("all")//用户所具有的权限
        public String demo1(){ 
                return  "success";
        }
         //测试用例
        @RequestMapping("/demo2")
        @RequiresRoles("admin")//用户所具有的权限
        public String demo2(){ 
                return  "success";
        }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20191217111105228.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191217111145414.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191217112209897.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM1MzQ5OTgy,size_16,color_FFFFFF,t_70