Shiro学习笔记六(自定义Reaml-使用数据库设置 user roles permissions)

1.工程目录

pom文件还和以前设置的一样就是添加了一个数据库驱动，

 <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>3.8.1</version>
      <scope>test</scope>
    </dependency>

    <!-- 添加servlet支持 -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>3.1.0</version>
    </dependency>

    <dependency>
        <groupId>javax.servlet.jsp</groupId>
        <artifactId>javax.servlet.jsp-api</artifactId>
        <version>2.3.1</version>
    </dependency>

    <!-- 添加jstl支持 -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>

    <!-- 添加日志支持 -->
    <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
    </dependency>

    <dependency>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
        <version>1.2</version>
    </dependency>

    <!-- 添加shiro支持 -->
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.2.4</version>
    </dependency>

    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-web</artifactId>
        <version>1.2.4</version>
    </dependency>

    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>1.7.12</version>
    </dependency>

    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <version>5.1.37</version>
    </dependency>

  </dependencies>

shiro.ini中的配置

[main]
authc.loginUrl=/login
roles.unauthorizedUrl=/unauthorized.jsp
perms.unauthorizedUrl=/unauthorized.jsp

myRealm=com.zuoyan.shiro.realm.MyRealm
securityManager.realms=$myRealm

[urls]
/login=anon
/admin*=authc
/student=roles[teacher]
/teacher=perms["user:create"]

简单的解释说明一下Realm，这个我解释不清楚，就引用了别人博客上面的

对于什么是Realm，我使用过之后，个人总结一下：shiro要进行身份验证，就要从realm中获取相应的身份信息来进行验证，简单来说，我们可以自行定义realm，在realm中，从数据库获取身份信息，然后和 用户输入的身份信息进行匹配。这一切都由我们自己来定义。

下面就贴出我们自定义realm 的代码

 package com.zuoyan.shiro.realm;

 import java.sql.Connection;

 import org.apache.shiro.authc.AuthenticationException;
 import org.apache.shiro.authc.AuthenticationInfo;
 import org.apache.shiro.authc.AuthenticationToken;
 import org.apache.shiro.authc.SimpleAuthenticationInfo;
 import org.apache.shiro.authz.AuthorizationInfo;
 import org.apache.shiro.authz.SimpleAuthorizationInfo;
 import org.apache.shiro.realm.AuthorizingRealm;
 import org.apache.shiro.subject.PrincipalCollection;

 import com.zuoyan.shiro.dao.UserDao;
 import com.zuoyan.shiro.entity.User;
 import com.zuoyan.shiro.utils.DbUtil;

 public class MyRealm extends AuthorizingRealm{

     private UserDao userDao=new UserDao();
     private DbUtil dbUtil=new DbUtil();

     /*
      * 用于授权
      */
     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
         String userName=(String)principals.getPrimaryPrincipal();
         SimpleAuthorizationInfo authorizationInfo=new SimpleAuthorizationInfo();
         Connection con=null;
         try{
             con=dbUtil.getCon();
             authorizationInfo.setRoles(userDao.getRoles(con,userName));
             authorizationInfo.setStringPermissions(userDao.getPermissions(con,userName));
         }catch(Exception e){
             e.printStackTrace();
         }finally{
             try {
                 dbUtil.closeCon(con);
             } catch (Exception e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
         }
         return authorizationInfo;
     }

     /*
      * 用于认证
      */

     @Override
     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
         String userName=(String)token.getPrincipal();
         Connection con=null;
         try{
             con=dbUtil.getCon();
             User user=userDao.getByUserName(con, userName);
             if(user!=null){
                 AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUserName(),user.getPassword(),"xx");
                 return authcInfo;
             }else{
                 return null;
             }
         }catch(Exception e){
             e.printStackTrace();
         }finally{
             try {
                 dbUtil.closeCon(con);
             } catch (Exception e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
         }
         return null;
     }

 }

AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUserName(),user.getPassword(),"xx");
对于这句话，我一开始的理解就是 先查出来标准的账号密码在自定义中的Realm中进行比对，但是正确的是这里设置的是标准的账号密码
比对应该是在下一步

UserDao的就是在数据库中进行查找

 package com.zuoyan.shiro.dao;

 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.util.HashSet;
 import java.util.Set;

 import com.zuoyan.shiro.entity.User;

 public class UserDao {

     public User getByUserName(Connection con,String userName)throws Exception{
         User resultUser=null;
         String sql="select * from t_user where userName=?";
         PreparedStatement pstmt=con.prepareStatement(sql);
         pstmt.setString(1, userName);
         ResultSet rs=pstmt.executeQuery();
         if(rs.next()){
             resultUser=new User();
             resultUser.setId(rs.getInt("id"));
             resultUser.setUserName(rs.getString("userName"));
             resultUser.setPassword(rs.getString("password"));
         }
         return resultUser;
     }

     public Set<String> getRoles(Connection con, String userName) throws Exception{
         Set<String> roles=new HashSet<String>();
         String sql="select * from t_user u,t_roles r where u.roleId=r.id and u.userName=?";
         PreparedStatement pstmt=con.prepareStatement(sql);
         pstmt.setString(1, userName);
         ResultSet rs=pstmt.executeQuery();
         while(rs.next()){
             roles.add(rs.getString("roleName"));
         }
         return roles;
     }

     public Set<String> getPermissions(Connection con, String userName)throws Exception {
         Set<String> permissions=new HashSet<String>();
         String sql="select * from t_user u,t_roles r,t_permission p where u.roleId=r.id and p.roleId=r.id and u.userName=?";
         PreparedStatement pstmt=con.prepareStatement(sql);
         pstmt.setString(1, userName);
         ResultSet rs=pstmt.executeQuery();
         while(rs.next()){
             permissions.add(rs.getString("permissionName"));
         }
         return permissions;
     }
 }