hahahahah

dsfsefesfsffsfsfsfsfesfsfsfsfsfsfspackage realm;

 

import java.util.ArrayList;

import java.util.List;

 

import org.apache.commons.lang3.builder.ReflectionToStringBuilder;

import org.apache.commons.lang3.builder.ToStringStyle;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.authz.AuthorizationException;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.session.Session;

import org.apache.shiro.subject.PrincipalCollection;

import org.apache.shiro.subject.Subject;

import org.springframework.beans.factory.annotation.Autowired;

 

import utils.StrUtils;

 

import com.jxzg.mvc.web.entitys.user.Role;

import com.jxzg.mvc.web.entitys.user.RoleRight;

import com.jxzg.mvc.web.entitys.user.User;

import com.jxzg.mvc.web.service.user.IUserManager;

 

public class MyRealm extends AuthorizingRealm {

 

    @Autowired

    private IUserManager userManager;

 

    /**

     * 为当前登录的Subject授予角色和权限

     * @see 经测试:本例中该方法的调用时机为用户登录后,被调用

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        // 获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()

        String currentUsername = (String) super.getAvailablePrincipal(principals);

        List<String> roleList = new ArrayList<String>();

        List<String> permissionList = new ArrayList<String>();

        // 从数据库中获取当前登录用户的详细信息

        User user = userManager.getByUsername(currentUsername);

        if (null != user) {

            // 实体类User中包含有用户角色的实体类信息

            if (null != user.getRole()) {

                // 获取当前登录用户的角色

                Role role = user.getRole();

                roleList.add(role.getName());

                //如果是超级管理员直接赋予所有权限

                if(role.getName().equals("admin")){

                    permissionList.add("user");

                    permissionList.add("school");

                }

                

                else{

                    // 实体类Role中包含有角色权限的实体类信息

                    if (null != role.getRights() && role.getRights().size() > 0) {

                        // 获取权限

                        for (RoleRight pmss : role.getRights()) {

                            if(pmss.isFlag()){

                                if (!StrUtils.isNullOrEmpty(pmss.getRight())) {

                                    permissionList.add(pmss.getRight().getName());

                                }

                            }

                        }

                    }

                }

            }

        } else {

            throw new AuthorizationException();

        }

        // 为当前用户设置角色和权限

        SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();

        simpleAuthorInfo.addRoles(roleList);

        simpleAuthorInfo.addStringPermissions(permissionList);

        return simpleAuthorInfo;

    }

 

    /**

     * 验证当前登录的Subject

     * @see 经测试:本例中该方法的调用时机为LoginController.login()方法中执行Subject.login()时

     */

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(

            AuthenticationToken authcToken) throws AuthenticationException {

        // 获取基于用户名和密码的令牌

        // 实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的

        // 两个token的引用都是一样的

        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;

        System.out.println("验证当前Subject时获取到token为"

                + ReflectionToStringBuilder.toString(token,

                        ToStringStyle.MULTI_LINE_STYLE));

        User user = userManager.getByUsername(token.getUsername());

        if (null != user) {

            AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(

                    user.getUserName(), user.getPass(), user.getNickName());

            this.setSession("currentUser", user);

            return authcInfo;

        } else {

            return null;

        }

    }

 

    /**

     * 将一些数据放到ShiroSession中,以便于其它地方使用

     * @see 比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到

     */

    private void setSession(Object key, Object value) {

        Subject currentUser = SecurityUtils.getSubject();

        if (null != currentUser) {

            Session session = currentUser.getSession();

            if (null != session) {

                session.setAttribute(key, value);

            }

        }

    }

 

}