shiro授权+注解式开发

shiro授权和注解式开发

1、shiro授权角色、权限

2、Shiro的注解式开发

ShiroUserMapper.xml

 <select id="getRolesByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
   select r.roleid from t_shiro_user u,t_shiro_user_role ur,t_shiro_role r
     where u.userid = ur.userid and ur.roleid = r.roleid
     and u.userid = #{userid}
 </select>
 <select id="getPersByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
   select p.permission from t_shiro_user u,t_shiro_user_role ur,t_shiro_role_permission rp,t_shiro_permission p
   where u.userid = ur.userid and ur.roleid = rp.roleid and rp.perid = p.perid
   and u.userid = #{userid}
 </select>

ShiroUserService

 /**
      * 查询角色
      * @param userid
      * @return
      */
     Set<String> getRolesByUserId(Integer userid);

     /**
      * 查询角色权限
      * @param userid
      * @return
      */
     Set<String> getPersByUserId(Integer userid);

service实现类

 @Override
    public Set<String> getRolesByUserId(Integer userid) {
        return shiroUserMapper.getRolesByUserId(userid);
    }

    @Override
    public Set<String> getPersByUserId(Integer userid) {
        return shiroUserMapper.getPersByUserId(userid);
    }

重写自定义realm中的授权方法

  /*
         授权的方法
          */
     @Override
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
         String uname = principalCollection.getPrimaryPrincipal().toString();
         ShiroUser shiroUser = this.shiroUserService.queryByName(uname);
         Set<String> perids = this.shiroUserService.getPersByUserId(shiroUser.getUserid());
         Set<String> roleIds = this.shiroUserService.getRolesByUserId(shiroUser.getUserid());
         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
         info.setRoles(roleIds);
         info.setStringPermissions(perids);
         return info;

     }

注解式开发

@RequiresUser:表示当前Subject已经身份验证或者通过记住我登录的

@RequiresGuest:表示当前Subject没有身份验证或者通过记住我登录过，即是游客身份

@RequiresRoles(value = {"admin","user"},logical = Logical.AND):表示当前Subject需要角色admin和user

@RequiresPermissions(value = {"user:delete","user:b"},logical = Logical.OR):表示当前Subject需要权限user:delete或者user:b

Controller层

 @RequiresUser
 @ResponseBody
 @RequestMapping("/passUser")
     public String passUser(){

     return "身份认证成功，能够访问！！！";
     }

     @RequiresRoles(value = {"2","3"}, logical = Logical.OR) //value：不同或者多个的角色，logical：value值的拼接方式可以是AND或者OR
     @ResponseBody
     @RequestMapping("/passRole")
     public String passRole(){

         return "角色认证成功，能够访问！！！";
     }

     @RequiresPermissions(value = {"user:update","user:create"}, logical = Logical.OR)
     @ResponseBody
     @RequestMapping("/passPer")
     public String passPer(){

         return "权限认证成功，能够访问！！！";
     }

springmvc-servlet.xml

 <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
       depends-on="lifecycleBeanPostProcessor">
     <property name="proxyTargetClass" value="true"></property>
 </bean>
 <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
     <property name="securityManager" ref="securityManager"/>
 </bean>

 <bean id="exceptionResolver" class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
     <property name="exceptionMappings">
         <props>
             <prop key="org.apache.shiro.authz.UnauthorizedException">
                 unauthorized
             </prop>
         </props>
     </property>
     <property name="defaultErrorView" value="unauthorized"/>
 </bean>

在main.jsp中添加

 <ul>
     shiro注解
     <li>
         <a href="${pageContext.request.contextPath}/passUser">用户认证</a>
     </li>
     <li>
         <a href="${pageContext.request.contextPath}/passRole">角色</a>
     </li>
     <li>
         <a href="${pageContext.request.contextPath}/passPer">权限认证</a>
     </li>
 </ul>

用户zs身份认证，未认证。登录即可访问

用户ls角色认证，不同角色有不同的访问权限，即使zs登录也不可以访问此页面

权限认证结果图同上，
  从代码来看
             @RequiresPermissions(value = {"user:update","user:create"}, logical = Logical.OR)
    @ResponseBody
    @RequestMapping("/passPer")
    public String passPer(){

        return "权限认证成功，能够访问！！！";
    }

拥有  "user:update","user:create"  这两个权限的即可访问此页面。从顶部的图中可以看出那些用户对应了哪些权限。

谢谢观看！！！