1 study plan
1. Authorize in realm
2. Use shiro 's method annotation method to control permissions
n Configure and enable shiro annotation support in the spring file
n Use annotations on Action methods
3. ★Use shiro 's label for permission control
n Introduce shiro 's tag library on the page
n use tags in the page
4. Summarize the access control methods provided by shiro
n URL interception permission control
n Method annotation permission control
n Page label permission control
n -code level permission control ( understand )
5. Authority management
n Initialize permission data
n Add permission function
n Permission paging query
2 Authorize in realm
Implement the authorization method in BOSRealm :
Todo logo, used to remind yourself that there are parts of the code that need to be improved.
In Tasks , you will see unfinished tasks.
3. Permission control using shiro 's method annotation method ( important )
Step 1: Enable shiro annotation support in the spring configuration file
<!-- Enable shiro framework annotation support --> < bean id ="defaultAdvisorAutoProxyCreator" class ="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" > <!-- Cglib must be used to create proxy objects for Action objects- -> < property name ="proxyTargetClass" value ="true" /> </ bean > <!-- Configure the aspect class provided by the shiro framework for creating proxy objects --> < bean class ="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor" />
Knowledge Review: Notification + Entry Point = Aspect
If it is set to false , then it will be the proxy object created by JDK , using the interface implementation, the interface has no implementation method, so when running the program, it will report an error saying that the method cannot be found, so set it to true here , use CGLIB to Create the corresponding proxy object, CGLIB creates the proxy by inheritance.
<property name="proxyTargetClass" value="false"/>
Step 2: Use the shiro annotation on the Action method
Step 3: Configure global exception capture in struts.xml . When the shiro framework throws an insufficient permission exception, jump to the insufficient permission prompt page
4 Use the page label method provided by shiro to control permissions
Step 1: Introduce shiro 's tag library into the jsp page
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
Step 2: Use shiro 's tags to control the display of page elements
5 Summarize the access control methods provided by the shiro framework
l URL interception permission control (based on filters)
l Method annotation permission control (based on proxy technology)
l Page label permission control (implemented by label technology)
l Code-level permission control (based on proxy technology)
6 Rights data management
6.1 Initialize permission data
After the project is launched, if it runs normally, it needs to rely on some basic data support. Permission data belongs to basic data, because the menu of the system is obtained by querying the permission table. Generally, a sql script file is provided to import basic data.
6.2 Add permission data
页面：WEB-INF/pages/admin/function_add.jsp
Step 1: Modify the combobox corresponding to the parent function point in the page , and modify the URL address
Step 2: Create FunctionAction , Service , Dao , query all permissions, and return json
Step 3: Configure struts.xml
Step 4: Bind the event to save the button in the add page, perform verification, and submit the form if the verification passes
Step 5: Create an add method in FunctionAction to add permissions
Service code: (Note: If the non-empty judgment is not performed, the value of ParentFunction is ""empty when the user does not select the drop-down box, this "" cannot be stored in the database, and an exception will occur.)
6.3 Permission paging query
Step 1: Modify the URL address of the datagrid in the page
Step 2: Provide a paging query method in Action (because the attribute-driven page attribute has the same name, so you must manually assign a value to the second page, otherwise you will never get the value)
