shiro：入门程序（一）

SpringMVC项目

1：pom引入相关依赖

    <dependencies>
        <!--测试依赖-->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.11</version>
            <scope>test</scope>
        </dependency>

        <!--lombok-->
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.18.10</version>
        </dependency>

        <!--Spring依赖-->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>5.1.9.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>javax.servlet.jsp</groupId>
            <artifactId>jsp-api</artifactId>
            <version>2.2</version>
        </dependency>

        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jstl</artifactId>
            <version>1.2</version>
        </dependency>

        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>2.5</version>
        </dependency>

        <!--shiro核心包依赖-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.4.0</version>
        </dependency>
        
        <!--shiro web包依赖-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>1.4.0</version>
        </dependency>

    </dependencies>

    <!--maven 静态资源管理，主要是为了导出mapper-->
    <build>
        <resources>
            <resource>
                <directory>src/main/java</directory>
                <includes>
                    <include>**/*.properties</include>
                    <include>**/*.xml</include>
                    <include>**/*.ini</include>
                </includes>
                <filtering>false</filtering>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <includes>
                    <include>**/*.properties</include>
                    <include>**/*.xml</include>
                    <include>**/*.ini</include>
                </includes>
                <filtering>false</filtering>
            </resource>
        </resources>
    </build>

2：安装ini插件

3：创建shiro默认配置文件

resources\shiro.ini

#定义用户信息
#格式：用户名=密码，角色1，角色2，......
[users]
zhangsan=123,admin
lisi=456,manager
wangwu=789,seller

#角色及其权限信息
[roles]
#管理员 所有权限
admin=*
#经理 查询和添加权限 user:query：随意其名称 只是一个名词而已
manager:user:query,user:addUser
#销售 查询权限
seller:user:query
[main]
#没有身份认证时的跳转地址（自定义）
shiro.loginUrl= /user/login
#角色权限校验不通过时的跳转地址
shiro.unauthorizedUrl = /user/error
#登出后的跳转地址
shiro.redirectUrl = /user/login
[urls]
#不拦截
/user/login = anon
/getuser = anon
/getrole = anon
#删除用户 要登录而且角色必须是管理员和经理
/user/delUser = authc,roles["admin","manager"]
#查询用户 要登录而且必须有user:query的权限
/user/getallUsers = authc,perms["user:query"]
#登出
/user/logout = logout

4：构建controller(模拟登陆操作)

com\shiro\controller\LoginController.java

package com.shiro.controller;

import com.shiro.vo.UserVo;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
@RequestMapping("/user")
public class LoginController {

    /*跳转登录界面*/
    @GetMapping("/login")
    public String login(){
        System.out.println("goto login page");
        return "login";
    }

    /*登录请求*/
    @PostMapping("/login")
    public String loginLogic(UserVo userVo){
        System.out.println("login logic");
        //获取subject
        Subject subject = SecurityUtils.getSubject();
        //获取令牌
        UsernamePasswordToken token = new UsernamePasswordToken(userVo.getUsername(), userVo.getPassword());
        //身份认证
        subject.login(token);
        System.out.println("登录状态为：" + subject.getPrincipal());
        return "login"; //登录成功
    }

    /*查询用户*/
    @GetMapping("/getallUsers")
    public String getAllUsers(){
        System.out.println("得到所有用户");
        return "main";
    }

    /*添加用户*/
    @PostMapping("/addUser")
    public String addUser(){
        System.out.println("插入一个用户");
        return "main";
    }

    /*删除用户*/
    @GetMapping("/delUser")
    public String delUser(){
        System.out.println("删除一个用户");
        return "main";
    }

    /*无权限页面，通过shiro.ini进行跳转*/
    @GetMapping("/error")
    public String userError(){
        System.out.println("没有权限访问的跳转页面");
        return "user_error";
    }
}

5：构建SpringMVC配置文件

resources\springmvc-servlet.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        https://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
        https://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/mvc
        https://www.springframework.org/schema/mvc/spring-mvc.xsd">

    <!-- 自动扫描包，让指定包下的注解生效,由IOC容器统一管理 -->
    <context:component-scan base-package="com.shiro.controller"/>

    <!-- 让Spring MVC不处理静态资源 -->
    <mvc:default-servlet-handler />

    <!--annotation-driven配置帮助我们完成处理器映射器和处理器适配器-->
    <mvc:annotation-driven />

    <!--视图解析器:DispatcherServlet给他的ModelAndView-->
    <bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">
        <!--前缀-->
        <property name="prefix" value="/WEB-INF/jsp/"/>
        <!--后缀-->
        <property name="suffix" value=".jsp"/>
    </bean>
    
</beans>

6：配置web.xml 支持shiro

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">

    <!--
    在启动时初始化shiro环境 将securityManager托管到SecurityUtils工具类中
    -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!--加载shiro.ini默认配置-->
    <listener>
        <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
    </listener>

    <!--1.注册DispatcherServlet-->
    <servlet>
        <servlet-name>springmvc</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <!--关联一个springmvc的配置文件:【servlet-name】-servlet.xml-->
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:springmvc-servlet.xml</param-value>
        </init-param>
        <!--启动级别-1-->
        <load-on-startup>1</load-on-startup>
    </servlet>

    <!--/ 匹配所有的请求；（不包括.jsp）-->
    <!--/* 匹配所有的请求；（包括.jsp）-->
    <servlet-mapping>
        <servlet-name>springmvc</servlet-name>
        <url-pattern>/</url-pattern>
    </servlet-mapping>

</web-app>

7：构建相关页面

shiro标签说明：

<shiro:guest> ：表示游客

<shiro:notAuthenticated> ：表示没有登陆

<shiro:authenticated>：已经登陆了

<shiro:hasRole name="admin"> ：角色是admin的

<shiro:hasAnyRoles name="admin,manager">：角色是admin或者manager的

<shiro:lacksRole name="admin">：角色不是admin的

<shiro:hasPermission name="user:query"> :权限是user:query的

<shiro:lacksPermission name="user:query"> :权限不是user:query的

WEB-INF\jsp\login.jsp（shiro标签）

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
<shiro:guest>
    欢迎您 游客~~~
</shiro:guest>
<br />
<shiro:notAuthenticated>
    请登录：
    <form action="/user/login" method="post">
        username:<input type="text" name="username"><br />
        password:<input type="text" name="password"><br />
        <button type="submit">登录</button>
    </form>
</shiro:notAuthenticated>
<br />
<shiro:authenticated>
    你已经登录 欢迎你：<shiro:principal /> <a href="/user/logout">退出</a>
</shiro:authenticated>
<br />
<shiro:hasRole name="admin">
    我是admin角色（zhangsan）：
    <a href="/user/getallUsers">查询用户</a>
    <a href="/user/addUser">添加用户</a>
    <a href="/user/delUser">删除用户</a>
</shiro:hasRole>
<br />
<shiro:hasRole name="manager">
    我是manager角色（lisi）：
    <a href="/user/getallUsers">查询用户</a>
    <a href="/user/addUser">添加用户</a>
</shiro:hasRole>
<br />
<shiro:hasPermission name="user:query">
    我是user:query权限（zhangsan、lisi、wangwu)：
    <a href="/user/getallUsers">查询用户</a>
</shiro:hasPermission>

</body>
</html>

WEB-INF\jsp\user_error.jsp

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<html>
<head>
    <title>Title</title>
</head>
<body>
	权限不足
</body>
</html>

8：测试访问：