spring boot 使用 shiro+redis管理权限

spring boot中比较简单的权限管理选择了使用shiro

然后用shiro-redis管理session，如下：

创建个shiroConfing,里面设置ShiroFilterFactoryBean------SecurityManager------myShiroRealm

然后在securityManager中设置缓存和session管理的方式如定义一个sessionManager指定用redis来操作session

然后开启shiro AOP注解支持。

创建自己的realm继承AuthorizingRealm做登陆跟权限的认证过程。

代码如下

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shirFile(SecurityManager securityManager) {
        log.info("ShiroConfiguration.shirFilter()");
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //拦截器
        Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
        //自定义拦截器
        Map<String, Filter> filters = new LinkedHashMap<String, Filter>();
        filters.put("authc", new MyFormAuthenticationFilter());
        shiroFilterFactoryBean.setFilters(filters);

        // 配置不会被拦截的链接 顺序判断
        filterChainDefinitionMap.put("/static/**", "anon");//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
        filterChainDefinitionMap.put("/logout", "logout");
        //<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
        //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
        filterChainDefinitionMap.put("/**", "authc");
        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/login");
        // 登录成功后要跳转的链接
        shiroFilterFactoryBean.setSuccessUrl("/index");

        //未授权界面;
        shiroFilterFactoryBean.setUnauthorizedUrl("/403");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

    @Bean
    public MyShiroRealm myShiroRealm(){
        MyShiroRealm myShiroRealm = new MyShiroRealm();
        myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return myShiroRealm;
    }

    /**
     * 凭证匹配器
     * （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了
     */
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher(){
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");//散列算法:这里使用MD5算法;
        hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5(""));
        return hashedCredentialsMatcher;
    }

    @Bean
    public SecurityManager securityManager(){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(myShiroRealm());
        // 自定义session管理 使用redis
        securityManager.setSessionManager(sessionManager());
        // 自定义缓存实现 使用redis
        securityManager.setCacheManager(cacheManager());
        return securityManager;
    }

    //自定义sessionManager
    @Bean
    public SessionManager sessionManager() {
        SessionConfig mySessionManager = new SessionConfig();
        mySessionManager.setSessionDAO(redisSessionDAO());
        return mySessionManager;
    }

    /**
     * 配置shiro redisManager
     * 使用的是shiro-redis开源插件
     */
    public RedisManager redisManager() {
        RedisManager redisManager = new RedisManager();
        redisManager.setHost(host+":"+port);
        // redisManager.setExpire(18000);// 配置缓存过期时间
        redisManager.setTimeout(timeout);
        redisManager.setPassword(password);
        return redisManager;
    }

    /**
     * cacheManager 缓存 redis实现
     * 使用的是shiro-redis开源插件
     */
    @Bean
    public RedisCacheManager cacheManager() {
        RedisCacheManager redisCacheManager = new RedisCacheManager();
        redisCacheManager.setRedisManager(redisManager());
        redisCacheManager.setPrincipalIdFieldName("uid");
        return redisCacheManager;
    }

    /**
     * RedisSessionDAO shiro sessionDao层的实现 通过redis
     * <p>
     * 使用的是shiro-redis开源插件
     */
    @Bean
    public RedisSessionDAO redisSessionDAO() {
        RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
        redisSessionDAO.setRedisManager(redisManager());
        return redisSessionDAO;
    }

    /**
     *  开启shiro aop注解支持.
     *  使用代理方式;所以需要开启代码支持;
     * @param securityManager
     * @return
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
        return authorizationAttributeSourceAdvisor;
    }

    @Bean(name="simpleMappingExceptionResolver")
    public SimpleMappingExceptionResolver
    createSimpleMappingExceptionResolver() {
        SimpleMappingExceptionResolver r = new SimpleMappingExceptionResolver();
        Properties mappings = new Properties();
        mappings.setProperty("DatabaseException", "databaseError");//数据库异常处理
        mappings.setProperty("UnauthorizedException","403");
        r.setExceptionMappings(mappings);  // None by default
        r.setDefaultErrorView("error");    // No default
        r.setExceptionAttribute("ex");     // Default is "exception"
        return r;
    }
}

public class MyShiroRealm extends AuthorizingRealm {/**
     * 登陆认证的实现*/
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {//通过username从数据库中查找 User对象，如果找到，没找到.
        //实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法
        UserInfo queryInfo = new UserInfo();
        queryInfo.setUsername((String) token.getPrincipal());
　　　　　//--------------------------------------------------------
        List<SysRole> roleList = new ArrayList<>();
        for (UserInfo info : userInfos) {
            List<SysRole> tmpRoleList = info.getRoleList();
            for (SysRole sysRole : tmpRoleList) {
                sysRole.setPermissions(sysPermissionMapper.selectPermissionByRoleId(sysRole.getId()));
                roleList.add(sysRole);
            }
        }
        userInfo.setRoleList(roleList);

        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                userInfo,//用户名
                userInfo.getPassword(),//密码
                ByteSource.Util.bytes(userInfo.getCredentialsSalt()),//这里是密码+盐
                getName()//realm name
        );
        return authenticationInfo;
    }

    /**
     * 权限验证
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        UserInfo userInfo = (UserInfo) principalCollection.getPrimaryPrincipal();
        for (SysRole sysRole : userInfo.getRoleList()) {
            authorizationInfo.addRole(sysRole.getRole());
            for (SysPermission permission : sysRole.getPermissions()) {
                authorizationInfo.addStringPermission(permission.getPermission());
            }
        }
        return authorizationInfo;
    }

}

登陆Controller

@Controller
public class LoginController {

    @RequestMapping({"/", "/index"})
    public String index() {
        System.out.println("goIndex");
        return "user/index";
    }

    @RequestMapping("/403")
    public String unauthorizedRole() {
        System.out.println("------没有权限-------");
        return "403";
    }

    @GetMapping("/login")
    public String goLoginPage(Model m) {
        System.out.print("goLogin");
        Subject currentUser = SecurityUtils.getSubject();
        if(!currentUser.isAuthenticated()){
            return "login";
        }else{
            return "user/index";
        }
    }

    @PostMapping("/login")
    public String login(@ModelAttribute UserInfo userinfo, HttpServletRequest request, Map<String, Object> map) {// 登录失败从request中获取shiro处理的异常信息。
        // shiroLoginFailure:就是shiro异常类的全类名.
        Subject currentUser = SecurityUtils.getSubject();// 通过Subject对象的isAuthenticated判断该用户是否已经验证
        if (!currentUser.isAuthenticated()) {
            // 如果该用户未验证，得到用户的账号和密码，使用UsernamePasswordToken的方式生成一个该用户的token凭证
            UsernamePasswordToken token = new UsernamePasswordToken(
                    userinfo.getUsername(),
                    userinfo.getPassword());
            // 开启记住我的功能，这里可以通过获取用户的提交的信息，判断是否选择记住我来决定开启或关闭
            token.setRememberMe(true);
            String exception = (String) request.getAttribute("shiroLoginFailure");
            System.out.println("exception=" + exception);
            String msg = "";
            try {
                // 通过Subject对象的login来验证用户的身份
                currentUser.login(token);
                log.info("login in sessionid:"+currentUser.getSession().getId().toString());
                // 如果用户身份验证不通过会抛出相应的异常，可以通过抛出的异常来设置返回给前台的信息
            } catch (UnknownAccountException uae) {
                log.info("===============账号不存在异常=>" + token.getPrincipal());
                msg = "UnknownAccountException -- > 账号不存在：";
            } catch (IncorrectCredentialsException ice) {
                log.info("===============密码错误异常=>" + token.getPrincipal());
                msg = "IncorrectCredentialsException -- > 密码不正确：";
            } catch (LockedAccountException lae) {
                log.info("===============账户被锁定异常=>" + token.getPrincipal());
                msg = "kaptchaValidateFailed -- > 验证码错误";
            } catch (AuthenticationException ae) {
                log.info("===============即验证不通过异常，为前面几个异常的父类=>" + token.getPrincipal());
                msg = "else >> " + exception;
            }
            map.put("msg", msg);
        }
        // 此方法不处理登录成功,由shiro进行处理
        return "login";
    }
}

使登陆成功的用户跳转倒index页

/**
 * 使登陆成功的用户跳转倒index
 */
public class MyFormAuthenticationFilter extends FormAuthenticationFilter {
    @Override
    protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request, ServletResponse response) throws Exception {
        if (!StringUtils.isEmpty(getSuccessUrl())) {
            // getSession(false)：如果当前session为null,则返回null,而不是创建一个新的session
            Session session = subject.getSession(false);
            if (session != null) {
                session.removeAttribute("shiroSavedRequest");
            }
        }
        return super.onLoginSuccess(token, subject, request, response);
//　　　　　或者下面这种方法
//        String successUrl="/index";
//        WebUtils.issueRedirect(request,response,successUrl);
//        System.out.println("登录首页拦截");
//        return false
    }
}

在Controller中用注解进行接口权限控制

@RequiresPermissions("student:add")

使用拦截器进行权限不足时返回的信息处理

@ControllerAdvice
public class ExceptionHandleController  {
    static final Logger log = LoggerFactory.getLogger(ExceptionHandleController.class);

    @ExceptionHandler(UnauthorizedException.class)
    public void handleShiroException(Exception ex,HttpServletRequest request, HttpServletResponse response) {
        log.info(ex.toString());
        WebUtils.sendJson(response,false,"没有权限！"); //该方法返回json 如 {"success":true, "msg":"没有权限"}
//        return "redirect:/error/403";
    }

    @ExceptionHandler(AuthorizationException.class)
    public void AuthorizationException(Exception ex) {
        log.info(ex.toString());
//        return "redirect:/error/401";
    }
}