從零搭建本身的SpringBoot後臺框架(十四)

Hello你們好,本章咱們添加shiro權限保護接口功能 。有問題能夠聯繫我mr_beany@163.com。另求各路大神指點,感謝

一:什麼是shiro

Shiro是一個Java平臺的開源權限框架,用於認證和訪問受權。具體來講,知足對以下元素的支持:java

  • 用戶,角色,權限(僅僅是操做權限,數據權限必須與業務需求緊密結合),資源(url)。
  • 用戶分配角色,角色定義權限。
  • 訪問受權時支持角色或者權限,而且支持多級的權限定義。

簡單來講shiro是經過本身的配置,來保證接口只能被指定的角色或權限訪問,保證了接口的安全。git

二:添加shiro依賴

<dependency>
   <groupId>org.apache.shiro</groupId>
   <artifactId>shiro-spring-boot-web-starter</artifactId>
   <version>1.4.0-RC2</version>
</dependency>複製代碼

三:建立權限,角色,用戶角色權限關係表等數據庫表

1:修改原有userInfogithub

添加password(用戶密碼,通過加密以後的),salt(加密鹽值)web

修改以後結構爲下圖spring


其中password數據爲123456加密以後生成的sql

2:添加角色表數據庫

CREATE TABLE `sys_role` (
  `id` varchar(36) NOT NULL COMMENT '角色名稱',
  `role_name` varchar(255) DEFAULT NULL COMMENT '角色名稱,用於顯示',
  `role_desc` varchar(255) DEFAULT NULL COMMENT '角色描述',
  `role_value` varchar(255) DEFAULT NULL COMMENT '角色值,用於權限判斷',
  `create_time` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
  `update_time` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
  `is_disable` int(1) DEFAULT NULL COMMENT '是否禁用',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='角色表';複製代碼

3:添加用戶角色關係表apache

CREATE TABLE `user_role` (
  `id` varchar(36) NOT NULL,
  `user_id` varchar(36) DEFAULT NULL COMMENT '用戶ID',
  `role_id` varchar(36) DEFAULT NULL COMMENT '角色id',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='用戶角色關係表';
複製代碼

4:添加權限表安全

CREATE TABLE `sys_perm` (
  `id` varchar(36) NOT NULL,
  `perm_name` varchar(255) DEFAULT NULL COMMENT '權限名稱',
  `perm_desc` varchar(255) DEFAULT NULL COMMENT '權限描述',
  `perm_value` varchar(255) DEFAULT NULL COMMENT '權限值',
  `create_time` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
  `update_time` datetime DEFAULT NULL ON UPDATE CURRENT_TIMESTAMP,
  `is_disable` int(1) DEFAULT NULL COMMENT '是否禁用',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;複製代碼

5:添加角色權限表bash

CREATE TABLE `role_perm` (
  `id` varchar(36) NOT NULL,
  `perm_id` varchar(32) DEFAULT NULL COMMENT '權限id',
  `role_id` varchar(32) DEFAULT NULL COMMENT '角色id',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='角色權限表';複製代碼

表關係大體爲下圖,一個用戶對應多個角色,一個角色對用多個權限

原諒我辣雞的畫圖


四:利用代碼生成器生成四張新表的mapper,dao,service和controller

你們直接生成就能夠,因爲代碼過多,這裏不作展現,詳情能夠去碼雲上參考

五:添加查詢角色和權限的方法

UserRoleMapper.xml

<!--根據用戶id查詢該用戶全部角色-->
<select id="getRolesByUserId" resultType="string" parameterType="string">
  select sr.role_value
  from user_role ur
  left join sys_role sr on ur.role_id = sr.id
  where ur.user_id = #{userId,jdbcType=VARCHAR}
  and sr.is_disable = 0
</select>複製代碼

UserRoleMapper.java

List<String> getRolesByUserId(String userId);複製代碼

RolePermMapper.xml

<select id="getPermsByUserId" resultType="string" parameterType="string">
  select distinct
      p.perm_value
  from
      sys_perm p,
      role_perm rp,
      user_role ur
  where
      p.id = rp.perm_id
      and ur.role_id = rp.role_id
      and ur.user_id = #{userId,jdbcType=VARCHAR}
      and p.is_disable = 0
</select>複製代碼

說明,這裏查詢出該用戶對應的全部權限,因爲角色與權限是多對多的關係,因此查詢出的用戶的權限可能會有重複,須要distinct去重。

RolePermMapper.java

List<String> getPermsByUserId(String userId);複製代碼

修改userInfo實體類爲以下

package com.example.demo.model;

import javax.persistence.Column;
import javax.persistence.Id;
import javax.persistence.Transient;
import java.util.HashSet;
import java.util.Set;

/**
 * @author 張瑤
 * @Description:
 * @time 2018/4/18 11:55
 */
public class UserInfo {

    /**
     * 主鍵
     */
    @Id
    private String id;

    /**
     * 用戶名
     */
    @Column(name = "user_name")
    private String userName;

    private String password;

    /**
     * 加密鹽值
     */
    private String salt;

    /**
     * 用戶全部角色值,用於shiro作角色權限的判斷
     */
    @Transient
    private Set<String> roles;

    /**
     * 用戶全部權限值,用於shiro作資源權限的判斷
     */
    @Transient
    private Set<String> perms;



    public String getId() {
        return id;
    }

    public void setId(String id) {
        this.id = id;
    }

    public String getUserName() {
        return userName;
    }

    public void setUserName(String userName) {
        this.userName = userName;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    public Set<String> getRoles() {
        return roles;
    }

    public void setRoles(Set<String> roles) {
        this.roles = roles;
    }

    public Set<String> getPerms() {
        return perms;
    }

    public void setPerms(Set<String> perms) {
        this.perms = perms;
    }

    public String getSalt() {
        return salt;
    }

    public void setSalt(String salt) {
        this.salt = salt;
    }
}
複製代碼

六:自定義Realm

建立core→shiro→CustomRealm.java

1:登陸認證明現

在Shiro中,最終是經過Realm來獲取應用程序中的用戶、角色及權限信息的。一般狀況下,在Realm中會直接從咱們的數據源中獲取Shiro須要的驗證信息。能夠說,Realm是專用於安全框架的DAO.
Shiro的認證過程最終會交由Realm執行,這時會調用Realm的getAuthenticationInfo(token)方法。

該方法主要執行如下操做:

  • 檢查提交的進行認證的令牌信息
  • 根據令牌信息從數據源(一般爲數據庫)中獲取用戶信息
  • 對用戶信息進行匹配驗證。
  • 驗證經過將返回一個封裝了用戶信息的AuthenticationInfo實例。
  • 驗證失敗則拋出AuthenticationException異常信息。

而在咱們的應用程序中要作的就是自定義一個Realm類,繼承AuthorizingRealm抽象類,重載doGetAuthenticationInfo(),重寫獲取用戶信息的方法。

2:連接權限的實現

重載doGetAuthorizationInfo(),來定義如何獲取用戶的角色和權限的邏輯,給shiro作權限判斷

完整代碼以下

package com.example.demo.core.shiro;


import com.example.demo.model.UserInfo;
import com.example.demo.service.RolePermService;
import com.example.demo.service.UserInfoService;
import com.example.demo.service.UserRoleService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;
import java.util.List;
import java.util.Set;

/**
 * 自定義如何查詢用戶信息,如何查詢用戶的角色和權限,如何校驗密碼等邏輯
 */
public class CustomRealm extends AuthorizingRealm {

    @Autowired
    private UserInfoService userService;
    @Autowired
    private UserRoleService userRoleService;
    @Autowired
    private RolePermService rolePermService;

    /**
     * 告訴shiro如何根據獲取到的用戶信息中的密碼和鹽值來校驗密碼
     */
    {
        //設置用於匹配密碼的CredentialsMatcher
        HashedCredentialsMatcher hashMatcher = new HashedCredentialsMatcher();
        hashMatcher.setHashAlgorithmName("md5");
        hashMatcher.setStoredCredentialsHexEncoded(true);
        //加密的次數
        hashMatcher.setHashIterations(1024);
        this.setCredentialsMatcher(hashMatcher);
    }


    /**
     *  定義如何獲取用戶的角色和權限的邏輯,給shiro作權限判斷
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        if (principals == null) {
            throw new AuthorizationException("PrincipalCollection method argument cannot be null.");
        }
        UserInfo user = (UserInfo) getAvailablePrincipal(principals);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.setRoles(user.getRoles());
        info.setStringPermissions(user.getPerms());
        return info;
    }

    /**
     * 定義如何獲取用戶信息的業務邏輯,給shiro作登陸
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        String username = upToken.getUsername();
        if (username == null) {
            throw new AccountException("Null usernames are not allowed by this realm.");
        }
        UserInfo userDB = userService.selectBy("userName",username);
        if (userDB == null) {
            throw new UnknownAccountException("No account found for admin [" + username + "]");
        }
        //查詢用戶的角色和權限存到SimpleAuthenticationInfo中,這樣在其它地方
        //SecurityUtils.getSubject().getPrincipal()就能拿出用戶的全部信息,包括角色和權限
        List<String> roleList = userRoleService.getRolesByUserId(userDB.getId());
        List<String> permList = rolePermService.getPermsByUserId(userDB.getId());
        Set<String> roles = new HashSet(roleList);
        Set<String> perms = new HashSet(permList);
        userDB.setRoles(roles);
        userDB.setPerms(perms);

        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(userDB, userDB.getPassword(), getName());
        info.setCredentialsSalt(ByteSource.Util.bytes(userDB.getSalt()));
        return info;

    }

}複製代碼

七:添加shiro配置

建立core→configurer→ShiroConfigurer

package com.example.demo.core.configurer;

import com.example.demo.core.shiro.CustomRealm;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.annotation.Resource;

@Configuration
public class ShiroConfigurer {

    /**
     * 注入自定義的realm,告訴shiro如何獲取用戶信息來作登陸或權限控制
     */
    @Bean
    public Realm realm() {
        return new CustomRealm();
    }

    @Bean
    public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        /**
         * setUsePrefix(false)用於解決一個奇怪的bug。在引入spring aop的狀況下。
         * 在@Controller註解的類的方法中加入@RequiresRole註解,會致使該方法沒法映射請求,致使返回404。
         * 加入這項配置能解決這個bug
         */
        creator.setUsePrefix(true);
        return creator;
    }

    /**
     * 這裏統一作鑑權,即判斷哪些請求路徑須要用戶登陸,哪些請求路徑不須要用戶登陸
     * @return
     */
    @Bean
    public ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition chain = new DefaultShiroFilterChainDefinition();
        chain.addPathDefinition( "/userInfo/selectById", "authc, roles[admin]");
        chain.addPathDefinition( "/logout", "anon");
        chain.addPathDefinition( "/userInfo/selectAll", "anon");
        chain.addPathDefinition( "/userInfo/login", "anon");
        chain.addPathDefinition( "/**", "authc");
        return chain;
    }
}
複製代碼

shiro提供和多個默認的過濾器,咱們能夠用這些過濾器來配置控制指定url的權限:

配置縮寫 對應的過濾器 功能
anon AnonymousFilter 指定url能夠匿名訪問
authc FormAuthenticationFilter 指定url須要form表單登陸,默認會從請求中獲取usernamepassword,rememberMe等參數並嘗試登陸,若是登陸不了就會跳轉到loginUrl配置的路徑。咱們也能夠用這個過濾器作默認的登陸邏輯,可是通常都是咱們本身在控制器寫登陸邏輯的,本身寫的話出錯返回的信息均可以定製。
authcBasic BasicHttpAuthenticationFilter 指定url須要basic登陸
logout LogoutFilter 登出過濾器,配置指定url就能夠實現退出功能,很是方便
noSessionCreation NoSessionCreationFilter 禁止建立會話
perms PermissionsAuthorizationFilter 須要指定權限才能訪問
port PortFilter 須要指定端口才能訪問
rest HttpMethodPermissionFilter 將http請求方法轉化成相應的動詞來構造一個權限字符串
roles RolesAuthorizationFilter 須要指定角色才能訪問
ssl SslFilter 須要https請求才能訪問
user UserFilter 須要已登陸或「記住我」的用戶才能訪問

八:在UserInfoController中添加登陸方法

@PostMapping("/login")
public RetResult<UserInfo> login(String userName, String password) {
    Subject currentUser = SecurityUtils.getSubject();
    //登陸
    try {
        currentUser.login(new UsernamePasswordToken(userName, password));
    }catch (IncorrectCredentialsException i){
        throw new ServiceException("密碼輸入錯誤");
    }
    //從session取出用戶信息
    UserInfo user = (UserInfo) currentUser.getPrincipal();
    return RetResponse.makeOKRsp(user);
}複製代碼

九:數據庫添加權限數據

INSERT INTO `sys_role` VALUES ('1', '財務', '負責發工資', 'cw', '2018-05-26 00:37:52', null, '0');
INSERT INTO `sys_role` VALUES ('2', '人事', '負責員工', 'rs', '2018-05-26 00:38:18', null, '0');
INSERT INTO `user_role` VALUES ('1', '1', '1');
INSERT INTO `user_role` VALUES ('2', '1', '2');
INSERT INTO `sys_perm` VALUES ('1', '建立', '建立權限', 'create', '2018-05-26 00:39:16', null, '0');
INSERT INTO `sys_perm` VALUES ('2', '刪除', '刪除權限', 'delete', '2018-05-26 00:39:39', null, '0');
INSERT INTO `sys_perm` VALUES ('3', '修改', '修改權限', 'update', '2018-05-26 00:39:58', null, '0');
INSERT INTO `sys_perm` VALUES ('4', '查詢', '查詢權限', 'select', '2018-05-26 00:40:16', null, '0');
INSERT INTO `role_perm` VALUES ('1', '1', '1');
INSERT INTO `role_perm` VALUES ('2', '2', '1');
INSERT INTO `role_perm` VALUES ('3', '1', '2');
INSERT INTO `role_perm` VALUES ('4', '2', '2');
INSERT INTO `role_perm` VALUES ('5', '3', '2');
INSERT INTO `role_perm` VALUES ('6', '4', '2');複製代碼

十:添加shiroUtilsController

package com.example.demo.controller;

import com.example.demo.core.ret.ServiceException;
import com.example.demo.model.UserInfo;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authz.UnauthenticatedException;
import org.apache.shiro.authz.UnauthorizedException;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;


@RestController
@RequestMapping("shiroUtils")
public class ShiroUtilsController {

    @GetMapping("/noLogin")
    public void noLogin() {
        throw new UnauthenticatedException();
    }

    @GetMapping("/noAuthorize")
    public void noAuthorize() {
        throw new UnauthorizedException();
    }


    @PostMapping("/getNowUser")
    public UserInfo getNowUser() {
        UserInfo u = (UserInfo) SecurityUtils.getSubject().getPrincipal();
        return u;
    }

}複製代碼

十一:添加錯誤異常碼

package com.example.demo.core.ret;

/**
 * @Description: 響應碼枚舉,參考HTTP狀態碼的語義
 * @author 張瑤
 * @date 2018/4/19 09:42
 */
public enum RetCode {

   // 成功
   SUCCESS(200),

   // 失敗
   FAIL(400),

   // 未認證(簽名錯誤)
   UNAUTHORIZED(401),

   /** 未登陸 */
   UNAUTHEN(4401),

   /** 未受權,拒絕訪問 */
   UNAUTHZ(4403),

   // 服務器內部錯誤
   INTERNAL_SERVER_ERROR(500);

   public int code;

   RetCode(int code) {
      this.code = code;
   }
}複製代碼

十二:添加異常攔截

@Override
	public void configureHandlerExceptionResolvers(List<HandlerExceptionResolver> exceptionResolvers) {
		exceptionResolvers.add(new HandlerExceptionResolver() {
			@Override
			public ModelAndView resolveException(HttpServletRequest request, HttpServletResponse response, Object handler, Exception e) {
				RetResult<Object> result = new RetResult<Object>();
				// 業務失敗的異常,如「帳號或密碼錯誤」
				if (e instanceof ServiceException) {
					result.setCode(RetCode.FAIL).setMsg(e.getMessage()).setData(null);
					LOGGER.info(e.getMessage());
				} else if (e instanceof NoHandlerFoundException) {
					result.setCode(RetCode.NOT_FOUND).setMsg("接口 [" + request.getRequestURI() + "] 不存在");
				} else if (e instanceof UnauthorizedException) {
					result.setCode(RetCode.UNAUTHEN).setMsg("用戶沒有訪問權限").setData(null);
				}else if (e instanceof UnauthenticatedException) {
					result.setCode(RetCode.UNAUTHEN).setMsg("用戶未登陸").setData(null);
				}else if (e instanceof ServletException) {
					result.setCode(RetCode.FAIL).setMsg(e.getMessage());
				} else {
					result.setCode(RetCode.INTERNAL_SERVER_ERROR).setMsg("接口 [" + request.getRequestURI() + "] 內部錯誤,請聯繫管理員");
					String message;
					if (handler instanceof HandlerMethod) {
						HandlerMethod handlerMethod = (HandlerMethod) handler;
						message = String.format("接口 [%s] 出現異常,方法:%s.%s,異常摘要:%s", request.getRequestURI(), handlerMethod.getBean().getClass().getName(), handlerMethod.getMethod()
								.getName(), e.getMessage());
					} else {
						message = e.getMessage();
					}
					LOGGER.error(message, e);
				}
				responseResult(response, result);
				return new ModelAndView();
			}
		});
	}複製代碼

十三:添加shiro路徑配置

application.properties中添加

#shiro配置
#用戶未登陸
shiro.loginUrl=/shiroUtils/noLogin
#用戶沒有權限
shiro.unauthorizedUrl=/shiroUtils/noAuthorize複製代碼

十四:測試

輸入localhost:8080/userInfo/selectAll

咱們能夠看到能夠拿到數據


輸入localhost:8080/userInfo/selectById


而後登錄


再次訪問localhost:8080/userInfo/selectById,咱們能夠看到shiro已經生效


修改用戶訪問權限,從新啓動,從新登錄

chain.addPathDefinition( "/userInfo/selectById", "authc, roles[cw]");複製代碼

再次訪問localhost:8080/userInfo/selectById


十五:優化

優化一:權限不可能一直不變,當咱們須要修改權限時,咱們須要手動修改shiro配置文件,顯然是不合理的,最好的辦法是把權限存儲在數據庫中,修改時修改數據庫

1:建立url資源表並添加數據

CREATE TABLE `sys_permission_init` (
  `id` varchar(255) NOT NULL,
  `url` varchar(255) DEFAULT NULL COMMENT '程序對應url地址',
  `permission_init` varchar(255) DEFAULT NULL COMMENT '對應shiro權限',
  `sort` int(100) DEFAULT NULL COMMENT '排序',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO `sys_permission_init` VALUES ('1', '/userInfo/login', 'anon', '1');
INSERT INTO `sys_permission_init` VALUES ('2', '/userInfo/selectAll', 'anon', '2');
INSERT INTO `sys_permission_init` VALUES ('3', '/logout', 'anon', '3');
INSERT INTO `sys_permission_init` VALUES ('4', '/**', 'authc', '0');
INSERT INTO `sys_permission_init` VALUES ('5', '/userInfo/selectAlla', 'authc, roles[admin]', '6');
INSERT INTO `sys_permission_init` VALUES ('6', '/sysPermissionInit/aaa', 'anon', '5');複製代碼

這裏咱們須要讓'/**'始終在最後,因此須要添加sort進行排序

2:根據工具生成mapper,dao,service,controller並添加咱們須要的查詢方法

SysPermissionInitMapper.xml

<sql id="Base_Column_List">
  id, url, permission_init, sort
</sql>

<select id="selectAllOrderBySort" resultMap="BaseResultMap">
  SELECT
  <include refid="Base_Column_List"/>
  from sys_permission_init
  order by sort desc
</select>複製代碼

SysPermissionInitMapper.java

List<SysPermissionInit> selectAllOrderBySort();複製代碼

3:修改ShiroConfigurer.java

修改後以下

package com.example.demo.core.configurer;

import com.example.demo.core.shiro.CustomRealm;
import com.example.demo.model.SysPermissionInit;
import com.example.demo.service.SysPermissionInitService;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.annotation.Resource;
import java.util.List;

@Configuration
public class ShiroConfigurer {

    @Resource
    private SysPermissionInitService sysPermissionInitService;

    /**
     * 注入自定義的realm,告訴shiro如何獲取用戶信息來作登陸或權限控制
     */
    @Bean
    public Realm realm() {
        return new CustomRealm();
    }

    @Bean
    public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();
        /**
         * setUsePrefix(false)用於解決一個奇怪的bug。在引入spring aop的狀況下。
         * 在@Controller註解的類的方法中加入@RequiresRole註解,會致使該方法沒法映射請求,致使返回404。
         * 加入這項配置能解決這個bug
         */
        creator.setUsePrefix(true);
        return creator;
    }

    /**
     * 這裏統一作鑑權,即判斷哪些請求路徑須要用戶登陸,哪些請求路徑不須要用戶登陸
     * @return
     */
    @Bean
    public ShiroFilterChainDefinition shiroFilterChainDefinition() {
        DefaultShiroFilterChainDefinition chain = new DefaultShiroFilterChainDefinition();
        List<SysPermissionInit> list = sysPermissionInitService.selectAllOrderBySort();
        for(int i = 0,length = list.size();i<length;i++){
            SysPermissionInit sysPermissionInit = list.get(i);
            chain.addPathDefinition(sysPermissionInit.getUrl(), sysPermissionInit.getPermissionInit());
        }
        return chain;
    }
}複製代碼

4:測試

輸入localhost:8080/userInfo/selectById


而後登錄

再次訪問localhost:8080/userInfo/selectById,咱們能夠看到shiro已經生效


修改數據庫用戶訪問權限,從新啓動,從新登錄

UPDATE sys_permission_init
SET permission_init = 'authc, roles[cw]'
WHERE
	id = 5複製代碼

再次訪問localhost:8080/userInfo/selectById

優化二:每次當咱們修改權限信息時,都須要重啓服務器,這顯然也是不合理的

1:建立shiroService

package com.example.demo.service;

import java.util.Map;

/**
 * shiro 動態更新權限
 */
public interface ShiroService {

    Map<String, String> loadFilterChainDefinitions();

    /**
     * 動態修改權限
     */
    void updatePermission();
}複製代碼

2:建立shiroServiceImpl

package com.example.demo.service.impl;

import com.example.demo.model.SysPermissionInit;
import com.example.demo.service.ShiroService;
import com.example.demo.service.SysPermissionInitService;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.filter.mgt.DefaultFilterChainManager;
import org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver;
import org.apache.shiro.web.servlet.AbstractShiroFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.HashMap;
import java.util.List;
import java.util.Map;

@Service
public class ShiroServiceImpl implements ShiroService {

    @Autowired
    ShiroFilterFactoryBean shiroFilterFactoryBean;

    @Autowired
    SysPermissionInitService sysPermissionInitService;

    /**
     * 初始化權限
     */
    @Override
    public Map<String, String> loadFilterChainDefinitions() {
        // 權限控制map.從數據庫獲取
        Map<String, String> filterChainDefinitionMap = new HashMap<>();
        List<SysPermissionInit> list = sysPermissionInitService.selectAllOrderBySort();
        for (SysPermissionInit sysPermissionInit : list) {
            filterChainDefinitionMap.put(sysPermissionInit.getUrl(),
                    sysPermissionInit.getPermissionInit());
        }
        return filterChainDefinitionMap;
    }


    /**
     * 從新加載權限
     */
    @Override
    public void updatePermission() {
        synchronized (shiroFilterFactoryBean) {
            AbstractShiroFilter shiroFilter = null;
            try {
                shiroFilter = (AbstractShiroFilter) shiroFilterFactoryBean
                        .getObject();
            } catch (Exception e) {
                throw new RuntimeException("get ShiroFilter from shiroFilterFactoryBean error!");
            }
            PathMatchingFilterChainResolver filterChainResolver = (PathMatchingFilterChainResolver) shiroFilter
                    .getFilterChainResolver();
            DefaultFilterChainManager manager = (DefaultFilterChainManager) filterChainResolver
                    .getFilterChainManager();
            // 清空老的權限控制
            manager.getFilterChains().clear();
            shiroFilterFactoryBean.getFilterChainDefinitionMap().clear();
            shiroFilterFactoryBean.setFilterChainDefinitionMap(loadFilterChainDefinitions());
            // 從新構建生成
            Map<String, String> chains = shiroFilterFactoryBean.getFilterChainDefinitionMap();
            for (Map.Entry<String, String> entry : chains.entrySet()) {
                String url = entry.getKey();
                String chainDefinition = entry.getValue().trim().replace(" ", "");
                manager.createChain(url, chainDefinition);
            }
            System.out.println("更新權限成功!!");
        }
    }
}複製代碼

3:修改shiroUtilsController

添加以下代碼

/**
 * @Description: 從新加載shiro權限
 * @throws Exception
 */
@PostMapping("/updatePermission")
public void updatePermission() throws Exception {
    shiroService.updatePermission();
}複製代碼

4:測試

輸入localhost:8080/userInfo/selectById


修改權限

UPDATE sys_permission_init
SET permission_init = 'authc, roles[cw1]'
WHERE
id = 5複製代碼

輸入localhost:8080/shiroUtils/updatePermission  從新加載權限

注意:此刻咱們並無修改程序任何一個地方,也沒有重啓服務器

輸入localhost:8080/userInfo/selectById


成功!


補充:生成加密以後的用戶密碼

文件在core→utils→test.java

public static void main(String []ages ){
    //加密方式
    String hashAlgorithmName = "md5";
    //原密碼
    String credentials = "123456";
    //加密次數
    int hashIterations = 1024;
    //加密鹽值,你們能夠用生成字符串的方法
    String hash = "wxKYXuTPST5SG0jMQzVPsg==";
    ByteSource credentialsSalt = ByteSource.Util.bytes(hash);
    String password = new SimpleHash(hashAlgorithmName, credentials, credentialsSalt, hashIterations).toHex();
    System.out.println(password);
}複製代碼


項目地址

碼雲地址: gitee.com/beany/mySpr…

GitHub地址: github.com/MyBeany/myS…

寫文章不易,如對您有幫助,請幫忙點下star

結尾

添加shiro權限保護接口功能已完成,後續功能接下來陸續更新,有問題能夠聯繫我mr_beany@163.com。另求各路大神指點,感謝你們。

相關文章
相關標籤/搜索