shiro權限管理

時間 2019-11-18

標籤 shiro 權限管理简体版

原文原文鏈接

1.記錄一下使用shiro作權限管理的過程，在此以前須要瞭解一下RBAC權限管理的模型，本人以前寫了一個半成品，有錯誤的那些類能夠刪除掉。項目地址：https://gitee.com/bruceT/sshcss

2.有關shiro的maven依賴前端

<!--shiro所需的jar包 version:1.2.2-->
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-core</artifactId>
			<version>${shiro.version}</version>
		</dependency>
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-web</artifactId>
			<version>${shiro.version}</version>
		</dependency>
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-spring</artifactId>
			<version>${shiro.version}</version>
		</dependency>
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-ehcache</artifactId>
			<version>${shiro.version}</version>
		</dependency>

3.首先先貼有關權限的實體代碼java

@Entity
@Table(name="sys_user")
@ExcelTarget("user")
public class SysUser {

	@Id
	@GeneratedValue(strategy = GenerationType.IDENTITY)
	private Integer id;
	
	@Column(length = 16)
	private String name;
	
	@Column(length = 16)
	@Excel(name = "用戶名", width=25, orderNum = "1", needMerge = true)
	private String username;
	
	@Column(length = 16)
	@Excel(name = "密碼", orderNum = "2", needMerge = true)
	private String password;
	
	/** 刪除標記:0.未刪除(默認) 1.已刪除 */
	@Column(name = "delete_flag",length = 2, columnDefinition = "INT default 0")
	private Integer deleteFlag = 0;
	
	@ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "sys_user_role", joinColumns = { 
 @JoinColumn(name = "user_id") }, inverseJoinColumns = {@JoinColumn(name = "role_id") })
	private Set<SysRole> roles; // 一個用戶具備多個角色

	@Transient
	public Set<String> getRoleName(){
		Set<SysRole> roles = getRoles();
		Set<String> set = new HashSet<String>();
		Iterator<SysRole> it = roles.iterator();
		while(it.hasNext()){
			SysRole role = it.next();
			set.add(role.getRoleName());
		}
        return set;
	}
//省略get、set的方法
}

@Entity
@Table(name = "sys_role")
public class SysRole {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    
    @Column(name="role_name")
    private String roleName;
    
    @Column(name="role_description")
    private String roleDescription;
    
	@ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(name = "sys_role_permission", 
joinColumns = { @JoinColumn(name = "role_id") }, inverseJoinColumns = {
            @JoinColumn(name = "permission_id") })
    private Set<SysPermission> permissions; // 一個角色對應多個權限
    
    @ManyToMany
    @JoinTable(name = "sys_user_role", 
joinColumns = { @JoinColumn(name = "role_id") }, inverseJoinColumns = {@JoinColumn(name = "user_id") })
    private Set<SysUser> users; // 一個角色對應多個用戶
    
    @Transient
    public List<String> getPermissionsName() {
        List<String> list = new ArrayList<String>();
        Set<SysPermission> permissions = getPermissions();
        Iterator<SysPermission> it = permissions.iterator();
        while(it.hasNext()){
        	SysPermission permission = it.next();
        	list.add(permission.getPermissionName());
        }
        return list;
    }
//省略get、set方法
}

@Entity
@Table(name = "sys_permission")
public class SysPermission {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    
    @Column(name = "permission_name")
    private String permissionName;
    
    @Column(name = "permission_description")
    private String permissionDescription;
    
    @ManyToMany
    @JoinTable(name = "sys_role_permission", 
joinColumns = { @JoinColumn(name = "permission_id") }, inverseJoinColumns = {
            @JoinColumn(name = "role_id") })
    private Set<SysRole> roles;// 一個權限對應多個角色

//省略get、set的方法

}

4.配置realm實例，實際的認證和受權都是由Realm實例來完成的，我使用了一個本身寫的session工具類，登錄成功以後，把當前登錄的用戶信息放到session中。能夠本身去查看一下這個工具類，在這裏就不貼代碼了。git

public class MyRealm extends AuthorizingRealm implements Serializable {
	
    private static final long serialVersionUID = 1L;
    
    @Autowired
    private ISysUserDao userDao;
      
     /**
      * 權限認證，爲當前登陸的Subject授予角色和權限
      */
     @Override  
     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    	//獲取當前登陸輸入的用戶名
    	String loginName = (String)super.getAvailablePrincipal(principalCollection);
    	//到數據庫查是否有此對象
    	SysUser user = userDao.findByUsername(loginName);
    	if(user != null) {
    		//權限信息對象info,用來存放查出的用戶的全部的角色（role）及權限（permission）
    		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    		//用戶的角色集合
    		info.setRoles(user.getRoleName());
    		//用戶的角色對應的全部權限，若是隻使用角色定義訪問權限
    		Set<SysRole> roles = user.getRoles();
    		Iterator<SysRole> it = roles.iterator();
    		System.out.print("用戶具備的角色:");
    		while(it.hasNext()){
    			SysRole role = it.next();
    			info.addStringPermissions(role.getPermissionsName());
    			System.out.print(role.getRoleName() + " ");
    		}
    		System.out.println();
    		return info;
    	}
        return null;  
     }
     
     /**
      * 登錄認證  
      */
     @Override  
     protected AuthenticationInfo doGetAuthenticationInfo(  
             AuthenticationToken authenticationToken) throws AuthenticationException {  
    	 
    	//UsernamePasswordToken對象用來存放提交的登陸信息
    	UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
    	//查出是否有此用戶
    	SysUser user = userDao.findByUsername(token.getUsername());
    	if(user != null) {
    		//登錄成功,把用戶的信息放到session中
    		HttpSessionUtil.put(SysConstant.LOGIN_USER, user);
    		return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(),getName());
    	}
    	return null;
     }
      
}

5.編寫shiro的配置文件(spring-shiro.xml)，讓spring去管理shiroweb

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
       xmlns:context="http://www.springframework.org/schema/context"  
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd  
            http://www.springframework.org/schema/context 
http://www.springframework.org/schema/context/spring-context-4.0.xsd">  
      
        <!-- 1.配置要掃描的包 -->  
        <context:component-scan base-package="com.wzxy.nc"></context:component-scan>  
          
        <!--2.配置CacheManager實例：管理Shiro相關緩存操做  -->  
        <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">   
            <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"></property>  
        </bean>  
          
        <!--3.配置realm實例，實際的認證和受權都是由Realm實例來完成的！  -->  
        <bean id="myRealm" class="com.wzxy.nc.realm.MyRealm"></bean>
      
        <!-- 4.配置 SecurityManager 實例. SecurityManager 是 Shiro 最核心的組件 -->  
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
            <property name="cacheManager" ref="cacheManager"/>  
            <property name="realm" ref="myRealm"/>  
        </bean>  
          
        <!--5.配置bean的後置處理器來自動調用Shiro中的bean的init和destroy方法。  -->  
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>  
          
          
        <!--6.配置使shiro註解起做用的bean，須要放在 lifecycleBeanPostProcessor後面 -->  
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"></bean>      
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">  
            <property name="securityManager" ref="securityManager"></property>  
        </bean>  
          
        <!--  
            7.配置哪些頁面須要被攔截，以及訪問這些頁面所需的權限 。  
                                   該bean中的id 屬性值必須和 web.xml 文件中配置的 filter 的 filter-name 值一致  
        -->  
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
            <property name="securityManager" ref="securityManager"></property>  
          
            <!--①配置登錄頁面  -->  
            <property name="loginUrl" value="/login.jsp"></property>  
            <property name="successUrl" value="/WEB-INF/pages/common/main.jsp"></property>  
            <property name="unauthorizedUrl" value="/unauthorize.jsp"></property>  
            <!--②配置須要被攔截的資源 以及訪問權限 -->  
            <property name="filterChainDefinitions">  
                <value>  
                    <!-- anon: 表示匿名的, 即任何人均可以訪問 -->
			        /js/** = anon
			        /css/**  = anon
			        /layer/**  = anon
			        /layui/**  = anon
			        /Uimaker/**  = anon
			        /User_login* = anon
			        
                    /login.jsp=anon 
                    /User_logout=logout  
                      
                    <!--③設置訪問具體資源的權限  -->  
                    /admin.jsp=roles[admin]  
                    /user.jsp=roles[user]  
                      
                    <!-- authc 表示必須通過認證以後才能夠訪問的頁面 -->  
                    /**=authc  
                </value>  
            </property>  
        </bean>  
    </beans>

6.在web.xml配置shiro的過濾器spring

<!-- shiro 核心配置文件 -->
	<filter>
		<filter-name>shiroFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
		<init-param>
			<param-name>targetFilterLifecycle</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>
	<filter-mapping>
		<filter-name>shiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

7.在userController編寫登錄的邏輯，在這裏我使用的是struts2。拋出異常的話其實不用那麼詳細，否則可能會有用戶惡意攻擊。在這裏僅供學習使用。數據庫

/**
	 * shiro 登錄
	 * @return
	 */
	public String login(){
		SysUser sessionUser = HttpSessionUtil.getCurrentUser();
		// 說明用戶已經登錄過了
		if(sessionUser != null){
    		super.setForwardPage("/WEB-INF/pages/common/main.jsp");   		
    		return SUCCESS;
		}
		
		if(user == null){
			return "relogin";
		}
		
		String username = user.getUsername();
		UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(),user.getPassword());
		//獲取當前的Subject
		Subject currentUser = SecurityUtils.getSubject();
        try {
            currentUser.login(token);  
        }catch(UnknownAccountException uae){  
            return toLoginPage("未知帳戶");
        }catch(IncorrectCredentialsException ice){  
			return toLoginPage("密碼不正確");
        }catch(LockedAccountException lae){  
            return toLoginPage("帳戶已鎖定");
        }catch(ExcessiveAttemptsException eae){   
            return toLoginPage("用戶名或密碼錯誤次數過多");
        }catch(AuthenticationException ae){  
            //經過處理Shiro的運行時AuthenticationException
//就能夠控制用戶登陸失敗或密碼錯誤時的情景   
            ae.printStackTrace();  
            return toLoginPage("用戶名或密碼不正確");
        }
        
        //驗證是否登陸成功  
        if(currentUser.isAuthenticated()){  
            logger.info("用戶[" + username + "]登陸認證經過
(這裏能夠進行一些認證經過後的一些系統參數初始化操做)");
    		super.setForwardPage("/WEB-INF/pages/common/main.jsp");   		
    		return SUCCESS;
        }else {
        	token.clear();
            return toLoginPage(LOGIN_ERROR);
        }	
	}

8.在前端的菜單欄配置一下權限標籤，測試一下不一樣的用戶登錄是否能夠看見不一樣的菜單欄。喜歡的能夠點個贊，或者star一下項目。apache

<shiro:hasRole name="admin">
    <dd>
      <div class="title">
        <span><img src="Uimaker/images/leftico01.png" /></span>基礎信息管理
      </div>
      <ul class="menuson">
      	<li><cite></cite><a href="College_list" target="rightFrame">學院信息</a><i></i></li>
        <li><cite></cite><a href="User_list" target="rightFrame">用戶信息</a><i></i></li>
        <li><cite></cite><a href="Role_list" target="rightFrame">角色信息</a><i></i></li>
        <!-- <li><cite></cite><a href="Permission_list" target="rightFrame">權限信息</a><i></i></li> -->
      </ul>
    </dd>
    </shiro:hasRole>

相關標籤/搜索

每日一句

每一个你不满意的现在，都有一个你没有努力的曾经。