Shiro-权限认证(授权)-编程式授权

权限认证

权限认证也就是访问控制，即在应用中控制谁能访问哪些资源

权限认证核心要素

• 权限 : 即操作资源的权利，比如访问某个页面，以及对某个模块的数据的添加，修改，删除，查看的权利
• 角色 : 是权限的集合，一种角色可以包含多种权限
• 用户 : 在 Shiro 中，代表访问系统的用户，即Subject

授权方式

• 编程式授权
  • 基于角色的访问控制
  • 基于权限的访问控制
• 注解式授权
• Jsp 标签授权

编程式授权实现

抽取公共代码生成 ShiroUtil

package com.zhen.common;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;

public class ShiroUtil {

    public static Subject login(String configFile,String userName,String password){
        //读取配置文件,初始化SecurityManager工厂
        Factory<SecurityManager> factory = new IniSecurityManagerFactory(configFile);
        //获取securityManager实例
        SecurityManager securityManager = factory.getInstance();
        //把securityManager绑定到SecurityUtils
        SecurityUtils.setSecurityManager(securityManager);
        //获取当前用户
        Subject currentUser = SecurityUtils.getSubject();
        //创建token令牌，用户名／密码
        UsernamePasswordToken token = new UsernamePasswordToken(userName, password);
        try {
            //身份认证
            currentUser.login(token);
            System.out.println("身份认证成功!");
        } catch (AuthenticationException e) {
            e.printStackTrace();
            System.out.println("身份认证失败!");
        }

        return currentUser;
    }

}

　　

基于角色的访问控制

• 新建 shiro_role.ini文件,两个用户，两种角色

  [users]
  zhen=123,role1,role2
  jack=jack,role1

• 新建测试类

  package com.zhen.shiro;
  
  import java.util.ArrayList;
  import java.util.List;
  import org.apache.shiro.subject.Subject;
  import org.junit.Test;
  import com.zhen.common.ShiroUtil;
  import junit.framework.TestCase;
  
  //基于角色的
  public class RoleTest extends TestCase {
  
      @Test
      public void testHasRole(){
          String configFile = "classpath:shiro_role.ini";
          String userName = "jack";
          String password = "jack";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          if (currentUser.hasRole("role2")) {
              System.out.println(userName+"有 role2 权限");
          }else{
              System.out.println(userName+"没有 role2 权限");
          }
          currentUser.logout();
      }
  
      @Test
      public void testHasRoles(){
          String configFile = "classpath:shiro_role.ini";
          String userName = "jack";
          String password = "jack";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          List<String> roles = new ArrayList<String>();
          roles.add("role1");
          roles.add("role2");
  
          //返回一个boolean数组
          boolean[] results = currentUser.hasRoles(roles);
          for (int i = 0; i < results.length; i++) {
              if(results[i]){
                  System.out.println(userName+"有 "+roles.get(i)+" 权限");
              }else{
                  System.out.println(userName+"没有 "+roles.get(i)+" 权限");
              }
          }
          currentUser.logout();
      }
  
      @Test
      public void testHasAllRoles(){
          String configFile = "classpath:shiro_role.ini";
          String userName = "zhen";
          String password = "123";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          List<String> roles = new ArrayList<String>();
          roles.add("role1");
          roles.add("role2");
  
          //是否拥有所有权限
          boolean result = currentUser.hasAllRoles(roles);
          if(result){
              System.out.println(userName+"有 所有权限");
          }else{
              System.out.println(userName+"没有 所有权限");
          }
          currentUser.logout();
      }
  
      @Test
      public void testCheckRoles(){
          //check 没有返回值，没有该权限的话就会抛异常
          String configFile = "classpath:shiro_role.ini";
          String userName = "jack";
          String password = "jack";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          List<String> roles = new ArrayList<String>();
          roles.add("role1");
          roles.add("role2");
          currentUser.checkRole(roles.get(1));
          currentUser.logout();
      }
  
  }

基于权限的访问控制

• 新建 Shiro_permission.ini文件，内容如下：

  [users]
  zhen=123,role1,role2
  jack=jack,role1
  [roles]
  role1=user:select
  role2=user:add,user:update,user:delete

  role1 对应有 user:select 权限
  role2 对应有 user:add , user:update , user:delete 权限

• 新建测试类，代码如下：

  package com.zhen.shiro;
  
  import org.apache.shiro.subject.Subject;
  import org.junit.Test;
  
  import com.zhen.common.ShiroUtil;
  
  import junit.framework.TestCase;
  
  //基于权限的
  public class PermissionTest extends TestCase {
  
      @Test
      public void testIsPermission(){
          String configFile = "classpath:shiro_permission.ini";
          String userName = "zhen";
          String password = "123";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          System.out.println(currentUser.isPermitted("user:add")?"有add权限":"没有add权限");
          System.out.println(currentUser.isPermitted("user:select")?"有select权限":"没有select权限");
          boolean[] results = currentUser.isPermitted("user:add","user:select");
          System.out.println(results[0]?"有add权限":"没有add权限");
          System.out.println(results[1]?"有select权限":"没有select权限");
          System.out.println(currentUser.isPermittedAll("user:add","user:select")?"有user:add&user:select权限":"user:add&user:select权限不全有");
          currentUser.logout();
      }
  
      @Test
      public void testCheckPermission(){
          String configFile = "classpath:shiro_permission.ini";
          String userName = "zhen";
          String password = "123";
          Subject currentUser = ShiroUtil.login(configFile, userName, password);
          currentUser.checkPermission("user:add");
          currentUser.checkPermission("user:select");
          currentUser.checkPermissions("user:add","user:select");
          currentUser.logout();
      }
  
  }