13、SpringBoot------整合shiro

开发工具：STS

前言：

　　shiro,一套简单灵活的安全权限管理框架。

把所有对外暴露的服务API都看作是一种资源，那么shiro就是负责控制哪些可以获得资源，哪些不能获取。

一个比较不错的教程：https://www.w3cschool.cn/shiro/

一个简单的小实例：

1.引入依赖

 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>

     <groupId>com.xm</groupId>
     <artifactId>springboot_rbac</artifactId>
     <version>0.0.1-SNAPSHOT</version>
     <packaging>jar</packaging>

     <name>springboot_rbac</name>
     <description>This is a Web about springcloud</description>

     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
         <version>1.5.15.RELEASE</version>
         <relativePath/> <!-- lookup parent from repository -->
     </parent>

     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <java.version>1.8</java.version>
     </properties>

     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>

         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.2.2</version>
        </dependency>
        <!-- 配置shiro注解，需要用到aop -->
        <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-aop</artifactId>
         </dependency>
     </dependencies>

     <build>
         <plugins>
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
             </plugin>
         </plugins>
     </build>

 </project>

2.配置文件application.yml

 spring.aop.proxy-target-class=true

3.realm

 package com.xm.shiro.rbac;

 import java.util.HashMap;
 import java.util.Map;

 import org.apache.shiro.authc.AccountException;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
 import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;

 public class MyRealm extends AuthorizingRealm {

     String getRoles() {
         System.out.println("查找权限！");
         return "sun";
     }

     /**
      * 角色、权限认证
      */
     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
         SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
         //添加角色
         info.addRole(getRoles());
         //添加权限
         //info.addStringPermission("hello");
         return info;
     }

     /**
      * 身份认证
      */
     @Override
     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

         UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
         String password = new String(usernamePasswordToken.getPassword());
         if(usernamePasswordToken.getUsername().equals("admin") && password.equals("123456")) {
             Map<String, Object> user = new HashMap<>();
             user.put("username", "admin");
             user.put("password", "123456");
             return new SimpleAuthenticationInfo(user, user.get("password").toString(), this.getName());
         } else {
             throw new AccountException("帐号或密码不正确！");
         }
     }
 }

4.配置shiro

 package com.xm.shiro.rbac;

 import java.util.LinkedHashMap;
 import java.util.Map;

 import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
 import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
 import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.apache.shiro.mgt.SecurityManager;

 @Configuration
 public class ShiroConfig {

     @Bean
     public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

         // 必须设置 SecurityManager
         shiroFilterFactoryBean.setSecurityManager(securityManager);

         // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
         shiroFilterFactoryBean.setLoginUrl("/login");

         // 拦截器.
         Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
         // 配置不会被拦截的链接 顺序判断
         filterChainDefinitionMap.put("/static/**", "anon");
         filterChainDefinitionMap.put("/doLogin/**", "anon");

         // <!-- 过滤链定义，从上向下顺序执行，一般将 /**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
         // <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
         filterChainDefinitionMap.put("/**", "authc");

         shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
         System.out.println("Shiro拦截器工厂类注入成功");
         return shiroFilterFactoryBean;
     }

     /**
      * 注入MyRealm
      * @return
      */
     @Bean
     public SecurityManager securityManager() {
         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
         // 设置realm.
         securityManager.setRealm(myShiroRealm());
         return securityManager;
     }

     /**
      * 配置注解
      * @param securityManager
      * @return
      */
     @Bean
     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
         AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor
             = new AuthorizationAttributeSourceAdvisor();
         authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
         return authorizationAttributeSourceAdvisor;
     }

     public MyRealm myShiroRealm() {
         return new MyRealm();
     }

 }

5.controller

注解：

常用的就这两种

（1）@RequiresPermissions("hello") =>是否具有hello权限

（2）@@RequiresRoles("sun")=>是否有sun角色

 package com.xm.shiro.controller;

 import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.IncorrectCredentialsException;
 import org.apache.shiro.authc.UsernamePasswordToken;
 import org.apache.shiro.authz.annotation.RequiresPermissions;
 import org.apache.shiro.subject.Subject;
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;

 @RestController
 public class UserController {

     @RequiresPermissions("hello")
     @GetMapping("/hello")
     public String hello() {
         return "Hello Shiro!";
     }

     @GetMapping("/login")
     public String login() {
         return "权限管理";
     }

     @GetMapping("/doLogin/{username}/{password}")
     public String doLogin(@PathVariable("username") String username,@PathVariable("password") String password) {
         UsernamePasswordToken token = new UsernamePasswordToken(username, password);
         Subject currentUser = SecurityUtils.getSubject();
         try {
             currentUser.login(token);
             //此步将 调用realm的认证方法
         } catch(IncorrectCredentialsException e){
             //这最好把 所有的 异常类型都背会
             return "密码错误";
         } catch (AuthenticationException e) {
             return "登录失败";
         }        

         currentUser.hasRole("sun");
         currentUser.hasRole("sun");
         currentUser.hasRole("sun");
         currentUser.hasRole("sun");
         return token.getPrincipal()+":登录成功";
     }

     @GetMapping("/logout")
     public String logout() {
         Subject currentUser = SecurityUtils.getSubject();
         currentUser.logout();
         return "退出登录";
     }

     @GetMapping("/noUnauthorized")
     public String error() {
         return  "无权限";
     }

 }