shiro权限控制原理及权限分隔符使用

我会带着你远行 2024-05-08 07:22 156阅读 0赞

## AuthorizingRealm ##

AuthorizingRealm是shiro控制登录认证和鉴权的关键类。这个类集成了AuthenticatingRealm，提供了两个抽象方法：

protected abstract AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals);

protected abstract AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException;

通常这两个抽象方法需要我们自己去实现，也就是自定义Realm类，如：

public class UserRealm extends AuthorizingRealm

具体的实现方法网上有很多，这里就不贴代码了。重点介绍一下doGetAuthorizationInfo，该方法主要干的就一件事，就是把当前用户的角色和权限信息添加进AuthorizationInfo实例中，以便后续鉴权时使用。如下示例代码：

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
            SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
            String accountId = JwtUtil.getClaim(principalCollection.toString(), CommonConstant.ACCOUNT);
            // 查询用户角色
            List<Role> roleLists = roleMapper.findRoleByAccountId(Integer.parseInt(accountId));
            for (Role role : roleLists) {
                if (role != null) {
                    // 添加角色
                    simpleAuthorizationInfo.addRole(role.getRoleName());
                    // 根据用户角色查询权限
                    List<Permission> permissions = permissionMapper.findSubPermissionByRole(role);
                    for (Permission permission : permissions) {
                        if (permission != null) {
                            // 添加权限
                            simpleAuthorizationInfo.addStringPermission(permission.getPermissionCode());
                        }
                    }
                }
            }
            return simpleAuthorizationInfo;
        }

## 鉴权原理 ##

仍然还是在AuthorizingRealm类中有如下三个方法用来鉴权，最后一个方法属于具体的鉴权实现。第一个属于自定义PermissionResolver，这个本篇暂不做介绍。主要介绍第二个默认的鉴权处理方法。

public boolean isPermitted(PrincipalCollection principals, String permission) {
            Permission p = getPermissionResolver().resolvePermission(permission);
            return isPermitted(principals, p);
        }
    
        public boolean isPermitted(PrincipalCollection principals, Permission permission) {
            AuthorizationInfo info = getAuthorizationInfo(principals);
            return isPermitted(permission, info);
        }
    
        //visibility changed from private to protected per SHIRO-332
        protected boolean isPermitted(Permission permission, AuthorizationInfo info) {
            Collection<Permission> perms = getPermissions(info);
            if (perms != null && !perms.isEmpty()) {
                for (Permission perm : perms) {
                    if (perm.implies(permission)) {
                        return true;
                    }
                }
            }
            return false;
        }

从方法里边可以看出，首先就是根据登录用户身份从AuthorizationInfo中取出用户的角色权限信息，具体实现如下：

//visibility changed from private to protected per SHIRO-332
        protected Collection<Permission> getPermissions(AuthorizationInfo info) {
            Set<Permission> permissions = new HashSet<Permission>();
    
            if (info != null) {
                Collection<Permission> perms = info.getObjectPermissions();
                if (!CollectionUtils.isEmpty(perms)) {
                    permissions.addAll(perms);
                }
                perms = resolvePermissions(info.getStringPermissions());
                if (!CollectionUtils.isEmpty(perms)) {
                    permissions.addAll(perms);
                }
    
                perms = resolveRolePermissions(info.getRoles());
                if (!CollectionUtils.isEmpty(perms)) {
                    permissions.addAll(perms);
                }
            }
    
            if (permissions.isEmpty()) {
                return Collections.emptySet();
            } else {
                return Collections.unmodifiableSet(permissions);
            }
        }
    
        private Collection<Permission> resolvePermissions(Collection<String> stringPerms) {
            Collection<Permission> perms = Collections.emptySet();
            PermissionResolver resolver = getPermissionResolver();
            if (resolver != null && !CollectionUtils.isEmpty(stringPerms)) {
                perms = new LinkedHashSet<Permission>(stringPerms.size());
                for (String strPermission : stringPerms) {
                    if (StringUtils.clean(strPermission) != null) {
                        Permission permission = resolver.resolvePermission(strPermission);
                        perms.add(permission);
                    }
                }
            }
            return perms;
        }

关注一下代码最后的这两句：

Permission permission = resolver.resolvePermission(strPermission);
    perms.add(permission);

第一句的resolver默认处理类是：

WildcardPermissionResolver

然后resolvePermission方法实现为：

public Permission resolvePermission(String permissionString) {
            return new WildcardPermission(permissionString, caseSensitive);
        }

继续往源码里边走，发现如下实现方法：

public WildcardPermission(String wildcardString, boolean caseSensitive) {
            setParts(wildcardString, caseSensitive);
        }
    
    
        protected void setParts(String wildcardString, boolean caseSensitive) {
            wildcardString = StringUtils.clean(wildcardString);
    
            if (wildcardString == null || wildcardString.isEmpty()) {
                throw new IllegalArgumentException("Wildcard string cannot be null or empty. Make sure permission strings are properly formatted.");
            }
    
            if (!caseSensitive) {
                wildcardString = wildcardString.toLowerCase();
            }
    
            List<String> parts = CollectionUtils.asList(wildcardString.split(PART_DIVIDER_TOKEN));
    
            this.parts = new ArrayList<Set<String>>();
            for (String part : parts) {
                Set<String> subparts = CollectionUtils.asSet(part.split(SUBPART_DIVIDER_TOKEN));
    
                if (subparts.isEmpty()) {
                    throw new IllegalArgumentException("Wildcard string cannot contain parts with only dividers. Make sure permission strings are properly formatted.");
                }
                this.parts.add(subparts);
            }
    
            if (this.parts.isEmpty()) {
                throw new IllegalArgumentException("Wildcard string cannot contain only dividers. Make sure permission strings are properly formatted.");
            }
        }

## 权限CODE分隔符 ##

重点关注一下两个split方法，分隔符分别是冒号和逗号，这也就是为什么很多shiro定义的权限编码中间有冒号或者逗号的原因。暂且把冒号前定义的code为资源权限，逗号前定义的为操作权限。通常资源在前，操作在后。故源码也是先用冒号分隔，然后再用逗号分隔，最终把分隔完的字符放在

List<Set<String>>

集合里边备用。

protected static final String PART_DIVIDER_TOKEN = ":";
    protected static final String SUBPART_DIVIDER_TOKEN = ",";

比如我们定义了一个权限的code为system\_manager:user\_manager:list，最后集合放的就是List的size为3，3个Set集合每个各一个元素。【system\_manager ，user\_manager ，list】这三个字符串。

比如我们定义了一个权限的code为system\_manager,user\_manager,list，最后集合放的就是List的size为1，1个Set集合3个元素。【system\_manager ，user\_manager ，list】这三个字符串。

两类分隔符实现的权限判断逻辑也有不同，具体可用文末的DEMO进行测试。

## 权限校验 ##

回到前边截图的 这个方法protected boolean isPermitted(Permission permission, AuthorizationInfo info) 。前边讲了第二个参数用于获取用户拥有的权限并用分隔符分隔。第一个参数就是当我们请求一个接口时，给这个接口定义分访问权限。比如通过注解形式定义的：

@RequiresPermissions("system_manager:user_manager:list")

方法参数明白之后，继续看里边的实现方法：

for (Permission perm : perms) {
        if (perm.implies(permission)) {
            return true;
        }
    }

首先for循环遍历用户拥有的所有权限。然后就是看用户拥有的权限与接口访问定义的权限是否匹配，匹配则证明有权限，可访问该接口。不匹配就表示无权访问。

## 权限校验规则 ##

重点就是这个方法perm.implies(permission)，实现源码如下：

public boolean implies(Permission p) {
            // By default only supports comparisons with other WildcardPermissions
            if (!(p instanceof WildcardPermission)) {
                return false;
            }
    
            WildcardPermission wp = (WildcardPermission) p;
    
            List<Set<String>> otherParts = wp.getParts();
    
            int i = 0;
            for (Set<String> otherPart : otherParts) {
                // If this permission has less parts than the other permission, everything after the number of parts contained
                // in this permission is automatically implied, so return true
                if (getParts().size() - 1 < i) {
                    return true;
                } else {
                    Set<String> part = getParts().get(i);
                    if (!part.contains(WILDCARD_TOKEN) && !part.containsAll(otherPart)) {
                        return false;
                    }
                    i++;
                }
            }
    
            // If this permission has more parts than the other parts, only imply it if all of the other parts are wildcards
            for (; i < getParts().size(); i++) {
                Set<String> part = getParts().get(i);
                if (!part.contains(WILDCARD_TOKEN)) {
                    return false;
                }
            }
    
            return true;
        }

重点关注return结果的地方，第一个return true需要等第二个return false的结果，故先说

### 第二个return false。 ###

看if条件就知道**只有当用户权限不存在\*号且用户权限code中有不包含的接口权限code则返回false无权限**。

这里有点绕，先需要说明一点就是进入这个方法是把用户拥有的每个权限code，都拿来遍历一下，然乎对比接口定义的权限code。然后不管是用户拥有的权限code或者接口定义的权限code都是被split形成一个Set<String>。

**假设当前传递进方法的用户权限code为：system\_manager:user\_manager:create，而接口权限code为system\_manager:user\_manager:list，则回触发第二个return false。**

### 怎么才会触发返回第一个return true呢？ ###

看源码知道当用户权限code分隔后的长度小于接口定义访问权限的code就会触发。什么意思呢？就是当用户权限code长度小于等于接口定义权限code长度，则先走第二个return false的判断，如果始终没有被return false，则会触发return true。比如：

用户权限code定义为：**system\_manager:user\_manager，而接口权限code为system\_manager:user\_manager:list，则回触发第一个return true。**

### 第三个return false ###

当用户权限code中不存在\*号则返回无权限。比如用户权限code定义为：**system\_manager:user\_manager:list:check，而接口权限code为system\_manager:user\_manager:list，则会触发第三个return false。**

### 当上边三个都没返回就返回第四个return true ###

## 权限CODE判断的工具类 ##

下边为自己写的一个接口权限code和用户权限code比对的工具类，可以方便的让用户判断某些权限校验的异常场景，而不用在SHIRO源码里边DEBUG。

public class RealmTest {
        protected static final String WILDCARD_TOKEN = "*";
        protected static final String PART_DIVIDER_TOKEN = ":";
        protected static final String SUBPART_DIVIDER_TOKEN = ",";
        public static void main(String[] args) {
            System.out.println(implies());
        }
    
        public static boolean implies() {
            //定义接口权限code
            List<Set<String>> httpParts = setParts("system_manager:role_manager:list");
            //定义用户权限code
            String userParts = "system_manager:role_manager:list:check";
            int i = 0;
            for (Set<String> otherPart : httpParts) {
                // If this permission has less parts than the other permission, everything after the number of parts contained
                // in this permission is automatically implied, so return true
                if (getParts(userParts).size() - 1 < i) {
                    System.out.println("返回第一个true");
                    return true;
                } else {
                    Set<String> part = getParts(userParts).get(i);
                    if (!part.contains(WILDCARD_TOKEN) && !part.containsAll(otherPart)) {
                        System.out.println("返回第二个fasle");
                        return false;
                    }
                    i++;
                }
            }
    
            // If this permission has more parts than the other parts, only imply it if all of the other parts are wildcards
            for (; i < getParts(userParts).size(); i++) {
                Set<String> part = getParts(userParts).get(i);
                if (!part.contains(WILDCARD_TOKEN)) {
                    System.out.println("返回第三个fasle");
                    return false;
                }
            }
            System.out.println("返回第四个true");
            return true;
        }
    
        private static List<Set<String>> getParts(String wildcardString){
            /*Set<String> userCodeSet1 = new HashSet<>();
            Set<String> userCodeSet2 = new HashSet<>();
            Set<String> userCodeSet3 = new HashSet<>();
            Set<String> userCodeSet4 = new HashSet<>();
            userCodeSet1.add("system_manager");
            userCodeSet2.add("role_manager");
            userCodeSet3.add("list");
            userCodeSet4.add("aaa");
    
            List<Set<String>> parts = new ArrayList<>();
            parts.add(userCodeSet1);
            parts.add(userCodeSet2);
            parts.add(userCodeSet3);
            parts.add(userCodeSet4);*/
            return setParts(wildcardString);
        }
    
    
        protected  static List<Set<String>>  setParts(String wildcardString) {
            List<Set<String>> parts2 = new ArrayList<>();
            wildcardString = StringUtils.clean(wildcardString);
    
            if (wildcardString == null || wildcardString.isEmpty()) {
                throw new IllegalArgumentException("Wildcard string cannot be null or empty. Make sure permission strings are properly formatted.");
            }
    
            List<String> parts = CollectionUtils.asList(wildcardString.split(PART_DIVIDER_TOKEN));
    
            parts2 = new ArrayList<Set<String>>();
            for (String part : parts) {
                Set<String> subparts = CollectionUtils.asSet(part.split(SUBPART_DIVIDER_TOKEN));
    
                if (subparts.isEmpty()) {
                    throw new IllegalArgumentException("Wildcard string cannot contain parts with only dividers. Make sure permission strings are properly formatted.");
                }
                parts2.add(subparts);
            }
    
            if (parts2.isEmpty()) {
                throw new IllegalArgumentException("Wildcard string cannot contain only dividers. Make sure permission strings are properly formatted.");
            }
            return parts2;
        }
    }