shiro权限（一）基础篇基于SSJ框架

shiro权限（一）基础篇基于SSJ框架

一.导入依赖

    <!-- shiro的支持包 -->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-all</artifactId>
      <version>1.4.0</version>
      <type>pom</type>
    </dependency>
    <!-- shiro与Spring的集成包 -->
    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>1.4.0</version>
    </dependency>

二.shiro所用实体类

（1）realm 数据源类

定义一个数据源类 继承AuthorizingRealm 覆写AuthorizationInfo 授权方法以及AuthenticationInfo认证（登陆）方法

package cn.ydsat.aisell.realm;

import cn.ydsat.aisell.common.MD5Util;
import cn.ydsat.aisell.common.UserContext;
import cn.ydsat.aisell.domain.Employee;
import cn.ydsat.aisell.service.IEmployeeService;
import cn.ydsat.aisell.service.IPermissionService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;
import java.util.Set;

public class YdsatRealm extends AuthorizingRealm {
    @Autowired
    private IEmployeeService employeeService;
    @Autowired
    private IPermissionService permissionService;
    @Override //设置账户权限
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        Employee employee = UserContext.getSession();//获取登录的账号信息
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //根据登录账户查出其对应权限
        Set<String> permissionByloginusers = permissionService.findPermissionByloginuser(employee);
        //授权
        info.setStringPermissions(permissionByloginusers);
        return info;
    }
//    -----------------------shiro权限登录判断--------------------------------
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String username = (String)token.getPrincipal();//获取登录用户名字
        Employee employee = employeeService.findOneByname(username);
        if(employee == null){
            return null;
        }
        ByteSource salt = ByteSource.Util.bytes(MD5Util.SALT);
        return new SimpleAuthenticationInfo(employee,employee.getPassword(),salt,getName());
    }

}

查询全选sqly语句(基于jpa)

    //自定义查询语句，查询出登陆对象的权限
    @Query("select distinct p.sn from Employee e join e.roles r join r.permissions p where e=?1")
    Set<String> findPermissionByloginuser(Employee employee);
    
--------------------------------------------------
employee类中配置与角色的关系  多对多
    @ManyToMany
    @JoinTable(name="employee_role",
            joinColumns = @JoinColumn(name="employee_id"),
            inverseJoinColumns = @JoinColumn(name="role_id"))
    private Set<Role> roles = new HashSet<>();
role角色类中配置与资源(permission)的关系 多对多
    @ManyToMany
    @JoinTable(name="role_permission",
            joinColumns = @JoinColumn(name="role_id"),
            inverseJoinColumns = @JoinColumn(name="permission_id"))
    private List<Permission> permissions = new ArrayList<>();
    
    
如果还要用到动态菜单 则可以在permission类中配置菜单(menu)的关系
    //外键。菜单栏  多对一
    @ManyToOne(fetch = FetchType.LAZY)
    @JoinColumn(name = "menu_id")
    private Menu menu;
    
   //动态查询菜单
    @Query("select distinct m from Employee e join e.roles r join r.permissions p join p.menu m where e=?1")
    List<Menu> findMenuByLoginUser(Employee loginUser);

（2）自定义过滤器，过滤哪些资源（放行）

anon 代码直接放行

authc 需要认证才能浏览使用

logout 则为shiro为我们写好的，退出认证 （调用此接口 即可实现退出认证状态）

package cn.ydsat.aisell.realm;

import cn.ydsat.aisell.domain.Permission;
import cn.ydsat.aisell.service.IPermissionService;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
//-自定义过滤器--
public class Powerfiltershiro {
    @Autowired
    private IPermissionService permissionService;
    
    public Map<String,String>NewpowerMap(){
        List<Permission> permissions = permissionService.findAll();
        Map<String, String> map = new LinkedHashMap<>();
        map.put("/images/**", "anon");
        map.put("/plugins/**", "anon");
        map.put("/login", "anon");
        map.put("/randomCode", "anon");
        map.put("/logout", "logout");
        for (Permission permission : permissions) {
            map.put(permission.getUrl(), "Perms[" + permission.getSn() + "]");
        }
        map.put("/**", "authc");
        return map;
    }
}

（3）判断请求标准

继承PermissionsAuthorizationFilter 覆盖底层方法判断是否是ajax请求还是普通请求

package cn.ydsat.aisell.realm;

import org.apache.shiro.util.StringUtils;
import org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
/*
覆盖底层方法判断是否是ajax请求还是普通请求
* */
public class PermissionFilter extends PermissionsAuthorizationFilter {
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws IOException {
        HttpServletRequest req = ((HttpServletRequest) request);
        HttpServletResponse resp = ((HttpServletResponse) response);
        resp.setContentType("text/json;charset=UTF-8");
        //通过请求头信息来判断它是ajax请求还是普通请求
        String header = req.getHeader("X-Requested-With");
        if (StringUtils.hasText(header)) {//如果header有值，就证明是ajax请求
            resp.getWriter().print("{\"success\":false,\"msg\":\"对不起,您的权限不足！\"}");
            return false;
        }else{//如果是普通请求依然走之前的业务逻辑
            return super.onAccessDenied(request, response);
        }

    }
}

（4）MD5加密工具类

package cn.ydsat.aisell.common;

import org.apache.shiro.crypto.hash.SimpleHash;

/*加密类
* */
public class MD5Util {
    //加密方式
    public static final String ALGORITHMNAME = "MD5";
    //盐值
    public static final String SALT = "ydsat";
    //加密次数
    public static final int HASHITERATIONS = 10;

    /**
     * MD5加密
     * @param source
     * @return
     */
    public static String createMd5(String source){
        SimpleHash hash = new SimpleHash(ALGORITHMNAME,source,SALT,HASHITERATIONS);
        return hash.toString();
    }
}

二.配置applicationContext-shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">


    <!--shiro的核心对象已经交给spring管理-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="ydsatRealm"/>
    </bean>

	
    <bean id="ydsatRealm" class="cn.ydsat.aisell.realm.YdsatRealm">
        <property name="credentialsMatcher">
               <!--加密方式以及次数必须和之前通过MD5Util相匹配否则认证不会成功，视为账号异常-->
            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                <!--加密方式-->
                <property name="hashAlgorithmName" value="MD5"/>
                <!--加密次数-->
                <property name="hashIterations" value="10"/>
            </bean>
        </property>
    </bean>


    <!--
        shiro最核心的配置       处理请求的具体方式
        注意：该bean的id对应的值必须要和代理过滤器(web.xml配置中)的名字一致，否则报错
    -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <!--如果没有认证，都跳到loginUrl对应的路径-->
        <property name="loginUrl" value="/login"/>
        <!--<property name="successUrl" value="/main"/>-->
        <!--如果你访问某个资源，没有权限，就跳到unauthorizedUrl对应的路径中-->
        <property name="unauthorizedUrl" value="/s/nopower.jsp"/>
        <property name="filterChainDefinitionMap" ref="powerfilter"/>
        <!--自定义过滤器-->
        <property name="filters">
            <map>
                <!--这里这个key必须是自定义过滤器中定义动态注入编号的名字-->
                <entry key="Perms">
                    <bean class="cn.ydsat.ydsat.realm.PermissionFilter"/>
                </entry>
            </map>
        </property>
<!--        <property name="filterChainDefinitions">
            <value>
                &lt;!&ndash;
                    anon:匿名过滤器，直接放行
                    authc:必须认证通过后，才能放行，否则跳到loginUrl对应的路径中&ndash;&gt;
                /images/**=anon
                /randomCode=anon
                /plugins/**=anon
                /login=anon
                /logout=logout
                /** = authc

            </value>
        </property>-->
    </bean>
     <!--自定义的过滤器，过滤哪些文件以及资源需要放行需要认证-->
    <bean id="powerfilter" factory-bean="powerfiltershiro" factory-method="NewpowerMap"/>
    <bean id="powerfiltershiro" class="cn.ydsat.aisell.realm.Powerfiltershiro"/>
</beans>

配置好shiro的xml后记得在applicationContext.xml中引入

    <!--引入shiro的配置文件-->
    <import resource="classpath:applicationContext-shiro.xml"/>

三.web.xml配置

  <!--
    shiro提供的代理过滤器，它会拦截你所有的请求，但不会做任何的操作，它会把当前的请求，交给第三方bean进行处理
  -->
  <filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    <init-param>
      <param-name>targetFilterLifecycle</param-name>
      <param-value>true</param-value>
    </init-param>
  </filter>

  <filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
  </filter-mapping>

四.编写认证测试（登陆）

    @RequestMapping(value = "/login",method = RequestMethod.POST)
    @ResponseBody
    public AjaxResult login(String username, String password,Model model, HttpServletResponse resp){
        System.out.println(username);
        try {
            UsernamePasswordToken token = new UsernamePasswordToken(username, password);
            Subject subject = SecurityUtils.getSubject();//尝试获取用户信息
            if(!subject.isAuthenticated()){//判断当前用户是否登录 布尔值  取反
                subject.login(token);//认证登陆  会调用之前的数据源类认证方法进行查询比对返回结果
            }
            //将登陆的用户信息存入域对象之中
            Employee employee = ((Employee) subject.getPrincipal());//获取当前用户
            UserContext.setSession(employee);
            return new AjaxResult();

        } catch (UnknownAccountException e) {
            e.printStackTrace();
            return new AjaxResult(false, "账号不存在!!");
        }catch (IncorrectCredentialsException e){
            e.printStackTrace();
            return new AjaxResult(false, "密码错误!!");
        }catch (AuthenticationException e){
            e.printStackTrace();
        }catch (Exception e){
            e.printStackTrace();
        }
        return new AjaxResult(false, "您的错误史无前例！速速检查");
    }

五.认证注销

    /*注销登陆
    * */
    @RequestMapping("/cookieclear")
    public String logout(HttpServletRequest request,HttpServletResponse response) {
        /*要从定向得到shiro的注销方法去*/
        return "redirect:/logout";
    }