2021-11-25最适合入门的Shiro框架教程（三）（springboot整合Shiro,自定义Realm,MyRealm）

subject调用login方法，将包含用户和密码token传递给SecurityManager

SecurityManager就会调用认证器（Authenticator）进行认证

Authenticator认证器将token传入绑定的Realm，在Realm中进行认证检查；如果认证通过正常执行，认证失败不通过抛出异常。

- RBAC基于角色的访问控制

  ```sql
  -- 用户信息表
  create table tb_users(
  	user_id int primary key auto_increment,
  	username varchar(60) not null unique,
  	password varchar(20) not null,
    password_salt varchar(60)
  );
  
  insert into tb_users(username,password) values('zhangsan','123456');
  insert into tb_users(username,password) values('lisi','123456');
  insert into tb_users(username,password) values('wangwu','123456');
  insert into tb_users(username,password) values('zhaoliu','123456');
  insert into tb_users(username,password) values('chenqi','123456');
  
  -- 角色信息表
  create table tb_roles(
  	role_id int primary key auto_increment,
  	role_name varchar(60) not null
  );
  
  insert into tb_roles(role_name) values('admin');
  insert into tb_roles(role_name) values('cmanager');  -- 仓管
  insert into tb_roles(role_name) values('xmanager');  --  销售
  insert into tb_roles(role_name) values('kmanager');  -- 客服
  insert into tb_roles(role_name) values('zmanager');  -- 行政
  
  -- 权限信息表
  create table tb_permissions(
  	permission_id int primary key auto_increment,		-- 1
  	permission_code varchar(60) not null,						-- sys:c:find
  	permission_name varchar(60)											-- 仓库查询
  );
  insert into tb_permissions(permission_code,permission_name) values('sys:c:save','入库');
  insert into tb_permissions(permission_code,permission_name) values('sys:c:delete','出库');
  insert into tb_permissions(permission_code,permission_name) values('sys:c:update','修改');
  insert into tb_permissions(permission_code,permission_name) values('sys:c:find','查询');
  
  insert into tb_permissions(permission_code,permission_name) values('sys:x:save','新增订单');
  insert into tb_permissions(permission_code,permission_name) values('sys:x:delete','删除订单');
  insert into tb_permissions(permission_code,permission_name) values('sys:x:update','修改订单');
  insert into tb_permissions(permission_code,permission_name) values('sys:x:find','查询订单');
  
  
  insert into tb_permissions(permission_code,permission_name) values('sys:k:save','新增客户');
  insert into tb_permissions(permission_code,permission_name) values('sys:k:delete','删除客户');
  insert into tb_permissions(permission_code,permission_name) values('sys:k:update','修改客户');
  insert into tb_permissions(permission_code,permission_name) values('sys:k:find','查询客户');
  
  -- 用户角色表
  create table tb_urs(
  	uid int not null,
  	rid int not null
  	-- primary key(uid,rid),
  	-- constraint FK_user foreign key(uid) references tb_users(user_id),
  	-- constraint FK_role foreign key(rid) references tb_roles(role_id)
  );
  insert into tb_urs(uid,rid) values(1,1);
  insert into tb_urs(uid,rid) values(1,2);
  insert into tb_urs(uid,rid) values(1,3);
  insert into tb_urs(uid,rid) values(1,4);
  insert into tb_urs(uid,rid) values(1,5);
  
  insert into tb_urs(uid,rid) values(2,2);
  insert into tb_urs(uid,rid) values(3,3);
  insert into tb_urs(uid,rid) values(4,4);
  insert into tb_urs(uid,rid) values(5,5);
  
  -- 角色权限表
  create table tb_rps(
  	rid int not null,
  	pid int not null
  );
  -- 给仓管角色分配权限
  insert into tb_rps(rid,pid) values(2,1);
  insert into tb_rps(rid,pid) values(2,2);
  insert into tb_rps(rid,pid) values(2,3);
  insert into tb_rps(rid,pid) values(2,4);
  -- 给销售角色分配权限
  insert into tb_rps(rid,pid) values(3,4);
  insert into tb_rps(rid,pid) values(3,5);
  insert into tb_rps(rid,pid) values(3,6);
  insert into tb_rps(rid,pid) values(3,7);
  insert into tb_rps(rid,pid) values(3,8);
  insert into tb_rps(rid,pid) values(3,9);
  insert into tb_rps(rid,pid) values(3,10);
  insert into tb_rps(rid,pid) values(3,11);
  insert into tb_rps(rid,pid) values(3,12);
  -- 给客服角色分配权限
  insert into tb_rps(rid,pid) values(4,11);
  insert into tb_rps(rid,pid) values(4,12);
  -- 给行政角色分配权限
  insert into tb_rps(rid,pid) values(5,4);
  insert into tb_rps(rid,pid) values(5,8);
  insert into tb_rps(rid,pid) values(5,12);
  ```

Shiro进行认证需要用户信息：

        根据用户名查询用户信息

Shiro进行授权管理需要当前用户的角色和权限

        根据用户名查询当前角色的角色列表

        根据用户名查询当前用户的权限列表

创建UserBean

import lombok.Data;

@Data
public class User {
    private Integer userId;
    private String userName;
    private String userPwd;
    private String pwdSalt;

}

//创建Dao
public interface UserDao {
    public User queryUserByUsername(String username) throws  Exception;
}

//mapper




    
        
        
        
        
    

    
        select * from tb_users
        where username=#{username}
    


 
1.2.3根据用户名查询当前角色的角色列表 
//roledao
public interface RoleDao {
    public Set queryRoleNameByUserName(String username);
}
//



    
        SELECT tb_roles.role_name FROM tb_users
        INNER JOIN tb_urs on tb_users.user_id = tb_urs.uid
        INNER JOIN tb_roles ON tb_urs.rid = tb_roles.role_id
        where tb_users.username=#{username}
    

//dao
public interface PermissionDao {
    public Set queryPermissionByUserName(String username) throws Exception;
}
//mapper



    
        SELECT tb_permissions.permission_code FROM tb_users
        INNER JOIN tb_urs on tb_users.user_id = tb_urs.uid
        INNER JOIN tb_roles ON tb_urs.rid = tb_roles.role_id
        INNER JOIN tb_rps on tb_urs.rid = tb_rps.rid
        inner join tb_permissions on tb_rps.pid = tb_permissions.permission_id
        where tb_users.username=#{username}
    

导入依赖

```xml

    org.apache.shiro
    shiro-spring
    1.4.1


    com.github.theborakompanioni
    thymeleaf-extras-shiro
    2.0.0

```

配置Shiro-基于Java配置方式

import at.pollux.thymeleaf.shiro.dialect.ShiroDialect;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;


import java.util.HashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroDialect getShiroDialect(){
        return new ShiroDialect();
    }
    @Bean
    public MyRealm getMyRealm(){
        MyRealm myRealm = new MyRealm();
        return myRealm;
    }
    //SecurityManager要完成验证，需要realm
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManage(MyRealm myRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(myRealm);
        return securityManager;
    }
    @Bean
    public ShiroFilterFactoryBean shiroFilter(DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean filter = new ShiroFilterFactoryBean();
        filter.setSecurityManager(securityManager);
        //设置拦截规则
        // anon匿名用户可访问
        //authc 认证用户可以访问
        //user 认证用户可以访问
        //perms 对应权限可以访问
        //role 对应的角色可以访问

        Map filterMap=new HashMap<>();
        filterMap.put("/","anon");
        filterMap.put("/login.html","anon");
        filterMap.put("/index.html","anon");
        filterMap.put("/user/login","anon");
        filterMap.put("/user/regist","anon");
        filterMap.put("/static/**","anon");
        filterMap.put("/**","authc");
        filter.setFilterChainDefinitionMap(filterMap);
        filter.setLoginUrl("/login.html");
        filter.setUnauthorizedUrl("/login.html");

        return filter;
    }
}

自定义Realm

import com.qfedu.shiro3.beans.User;
import com.qfedu.shiro3.dao.PermissionDao;
import com.qfedu.shiro3.dao.RoleDao;
import com.qfedu.shiro3.dao.UserDao;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import javax.annotation.Resource;
import java.util.Set;

public class MyRealm extends AuthorizingRealm {
    @Resource
    private UserDao userDao;
    @Resource
    private RoleDao roleDao;
    @Resource
    private PermissionDao permissionDao;
    @Override
    public String getName() {
        return "myRealm";
    }

    //获取授权数据:将当前用户的角色及权限查询出来

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String username = (String) principalCollection.iterator().next();
        //查询用户角色和权限列表
        Set roleName = roleDao.queryRoleNameByUserName(username);
        Set ps = permissionDao.queryPermissionByUserName(username);
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.setRoles(roleName);
        info.setStringPermissions(ps);

        return info;
    }
        //获取认证数据

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //authenticationToken 就是传递suject。login（token）
        UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
        String username=token.getUsername();
        User user = userDao.queryUserByUsername(username);
        if (user==null){
            return null;
        }
        AuthenticationInfo info = new SimpleAuthenticationInfo(username,user.getUserPwd(),getName());
        return info;
    }
}

SpringBoot项目集成了web容器(Tomcat),所以SpringBoot应用是可以打包成jar直接运行的

nohup java -jar  shiro4.jar