Authorization
New content in ShiroUserMapper.xml
<select id="getRolesByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
select r.roleid from t_shiro_user u,t_shiro_user_role ur,t_shiro_role r
where u.userid = ur.userid and ur.roleid = r.roleid
and u.userid = #{userid}
</select>
<select id="getPersByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
select p.permission from t_shiro_user u,t_shiro_user_role ur,t_shiro_role_permission rp,t_shiro_permission p
where u.userid = ur.userid and ur.roleid = rp.roleid and rp.perid = p.perid
and u.userid = #{userid}
</select>
Service layer
package com.xieminglu.ssm.service;
import com.xieminglu.ssm.model.ShiroUser;
import org.springframework.data.repository.query.Param;
import java.util.Set;
/**
* @author 迷鹿小女子
* @site www.baidu.com
* @company xxx公司
* @create 2019-11-03 22:05
*/
public interface ShiroUserService {
ShiroUser queryByName(String uname);
public Set<String> getRolesByUserId(Integer userid);
public Set<String> getPersByUserId(Integer userid);
}
package com.xieminglu.ssm.service.impl;
import com.xieminglu.ssm.mapper.ShiroUserMapper;
import com.xieminglu.ssm.model.ShiroUser;
import com.xieminglu.ssm.service.ShiroUserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import java.util.Set;
/**
* @author 迷鹿小女子
* @site www.baidu.com
* @company xxx公司
* @create 2019-11-04 11:08
*/
@Service("shiroUserService")
public class ShiroUserServiceImpl implements ShiroUserService {
@Autowired
private ShiroUserMapper shiroUserMapper;
@Override
public ShiroUser queryByName(String uname) {
return shiroUserMapper.queryByName(uname);
}
@Override
public Set<String> getRolesByUserId(Integer userid) {
return shiroUserMapper.getRolesByUserId(userid);
}
@Override
public Set<String> getPersByUserId(Integer userid) {
return shiroUserMapper.getPersByUserId(userid);
}
}
Rewrite the authorization method in the custom realm
/*
* 授权
* */
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
String uname=principalCollection.getPrimaryPrincipal().toString();
ShiroUser shiroUser = this.shiroUserService.queryByName(uname);
Set<String> perids = this.shiroUserService.getPersByUserId(shiroUser.getUserid());
Set<String> roleids = this.shiroUserService.getRolesByUserId(shiroUser.getUserid());
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
info.setRoles(roleids);
info.setStringPermissions(perids);
return info;
}
Annotated development
Introduction to common annotations
@RequiresAuthenthentication: indicates that the current subject has been authenticated through login; that is, Subject.isAuthenticated() returns true
@RequiresUser: indicates that the current subject has been authenticated or has passed the remember me login
@RequiresGuest: indicates that the current subject has no authentication or passed the remember I have logged in as a guest
@RequiresRoles(value = {"admin","user"},logical = Logical.AND): that the current Subject requires the roles admin and user
@RequiresPermissions(value = {"user:delete", "User:b"},logical = Logical.OR): Indicates that the current Subject needs permission user:delete or user:b
Annotated use of
Controller layer
@RequiresUser
@ResponseBody
@RequestMapping("/passUser")
public String passUser(HttpServletRequest req) {
return ",身份认证成功,能够访问!!!";
}
@RequiresRoles(value = {"2"},logical = Logical.AND)
@ResponseBody
@RequestMapping("/passRole")
public String passRole(HttpServletRequest req) {
return ",角色认证成功,能够访问!!!";
}
@RequiresPermissions(value = {"user:update","user:load"},logical = Logical.AND)
@ResponseBody
@RequestMapping("/passPer")
public String passPer(HttpServletRequest req) {
return ",权限认证成功,能够访问!!!";
}
Springmvc.xml
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
depends-on="lifecycleBeanPostProcessor">
<property name="proxyTargetClass" value="true"></property>
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
<bean id="exceptionResolver" class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
<property name="exceptionMappings">
<props>
<prop key="org.apache.shiro.authz.UnauthorizedException">
unauthorized
</prop>
</props>
</property>
<property name="defaultErrorView" value="unauthorized"/>
</bean>
Jsp test code
<ul>
shiro注解
<li>
<a href="${pageContext.request.contextPath}/passUser">用户认证</a>
</li>
<li>
<a href="${pageContext.request.contextPath}/passRole">角色</a>
</li>
<li>
<a href="${pageContext.request.contextPath}/passPer">权限认证</a>
</li>
</ul>