SpringBoot+Shiro+DB （二）

之前我们完成了Spring+Shiro的最基本配置搭建，现在我们再增加上DB，毕竟没有哪个系统会将用户、角色、权限等信息硬编码到代码里。DB选用myslq。

数据库准备

脚本如下。依然是两个用户：admin和guest。admin拥有角色admin以及权限permission1、permission2；guest拥有角色guest以及权限permission1、permission2。

create table test.shiro_user (
       id int auto_increment primary key,
       username varchar(50),
       password varchar(50)
);

create table test.shiro_role (
       id int auto_increment primary key,
       role varchar(50)
);

create table test.shiro_permission (
       id int auto_increment primary key,
       permission varchar(50)
);

create table test.shiro_user_r_role (
       userid int,
       roleid int
);

create table test.shiro_user_r_permission (
       userid int,
       permissionid int
);

insert into test.shiro_user(id, username, password) values (1, 'admin', 'admin');
insert into test.shiro_user(id, username, password) values (2, 'guest', 'guest');

insert into test.shiro_role(id, role) values (1, 'admin');
insert into test.shiro_role(id, role) values (2, 'guest');

insert into test.shiro_permission(id, permission) values (1, 'permission1');
insert into test.shiro_permission(id, permission) values (2, 'permission2');
insert into test.shiro_permission(id, permission) values (3, 'permission3');
insert into test.shiro_permission(id, permission) values (4, 'permission4');

insert into test.shiro_user_r_role(userid, roleid) values (1, 1);
insert into test.shiro_user_r_role(userid, roleid) values (2, 2);

insert into test.shiro_user_r_permission(userid, permissionid) values (1, 1);
insert into test.shiro_user_r_permission(userid, permissionid) values (1, 2);
insert into test.shiro_user_r_permission(userid, permissionid) values (2, 3);
insert into test.shiro_user_r_permission(userid, permissionid) values (2, 4);

pom依赖

再之前的基础上又增加了spring-jdbc和mysql的数据库驱动，因为要连接数据库嘛

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<dependency>
      <groupId>mysql</groupId>
      <artifactId>mysql-connector-java</artifactId>
</dependency>

application.properties

增加连接数据库的相关配置

spring.datasource.driver-class-name=com.mysql.jdbc.Driver
spring.datasource.url=jdbc:mysql://192.168.2.12:3306/test?characterEncoding=utf8
spring.datasource.username=root
spring.datasource.password=onceas

Dao和Service

dao和service就没什么好说的了，Controller不用动

@Repository
public class LoginDao {

    private final JdbcTemplate jdbcTemplate;

    @Autowired
    public LoginDao(JdbcTemplate jdbcTemplate) {
        this.jdbcTemplate = jdbcTemplate;
    }

    public List<User> getUserByUsername(String username) {
        String sql = "select id, username, password from shiro_user where username=?";
        return jdbcTemplate.query(sql, new Object[]{username}, new BeanPropertyRowMapper<User>(User.class));
    }

    public List<String> getRoleByUsername(String username) {
        String sql = "select role from shiro_role A " +
                "join shiro_user_r_role B on A.id = B.roleid " +
                "join shiro_user C on B.userid = C.id " +
                "where C.username=?";
        return jdbcTemplate.queryForList(sql, new Object[]{username}, String.class);
    }

    public List<String> getPermissionByUsername(String username) {
        String sql = "select permission from shiro_permission A " +
                "join shiro_user_r_permission B on A.id = B.permissionid " +
                "join shiro_user C on B.userid = C.id " +
                "where C.username=?";
        return jdbcTemplate.queryForList(sql, new Object[]{username}, String.class);
    }
}

@Service
public class LoginService {

    private final LoginDao loginDao;

    @Autowired
    public LoginService(LoginDao loginDao) {
        this.loginDao = loginDao;
    }

    public List<User> getUserByUsername(String username) {
        return loginDao.getUserByUsername(username);
    }

    public List<String> getRoleByUsername(String username) {
        return loginDao.getRoleByUsername(username);
    }

    public List<String> getPermissionByUsername(String username) {
        return loginDao.getPermissionByUsername(username);
    }
}

修改Realm

调整Realm，用户验证和授权改为从数据库中获取数据

public class PropertiesRealm extends AuthorizingRealm {

    private final LoginService loginService;

    @Autowired
    public PropertiesRealm(LoginService loginService) {
        this.loginService = loginService;
    }

    // 用户认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        if (authenticationToken instanceof UsernamePasswordToken) {
            UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
            String username = token.getUsername();
            String password = new String(token.getPassword());
            List<User> users = loginService.getUserByUsername(username);
            if (users == null || users.size() != 1) {
                throw new AuthenticationException("用户名或密码错误");
            }
            User user = users.get(0);
            if (!user.getPassword().equals(password)) {
                throw new AuthenticationException("用户名或密码错误");
            }
            return new SimpleAuthenticationInfo(username, password, getName());
        } else if (authenticationToken instanceof RememberMeAuthenticationToken) {
            RememberMeAuthenticationToken token = (RememberMeAuthenticationToken) authenticationToken;
            // TODO: 2018/10/24
            return null;
        } else if (authenticationToken instanceof HostAuthenticationToken) {
            HostAuthenticationToken token = (HostAuthenticationToken) authenticationToken;
            // TODO: 2018/10/24
            return null;
        } else {
            throw new AuthenticationException("未知的AuthenticationToken类型");
        }
    }

    // 用户授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String username = (String) principalCollection.getPrimaryPrincipal();
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.addRoles(loginService.getRoleByUsername(username));
        simpleAuthorizationInfo.addStringPermissions(loginService.getPermissionByUsername(username));
        return simpleAuthorizationInfo;
    }
}

调整SpringApplication

因为修改后的realm需要LoginService的支持，所以相应的调整SpringApplication，其他地方不变。

@Bean
public PropertiesRealm propertiesRealm(LoginService loginService) {
    return new PropertiesRealm(loginService);
}