shiro

  1. Subject currentUser = SecurityUtils.getSubject();
  2. Session session = currentUser.getSession();
  3. currentUser.isAuthenticated()
  4. currentUser.getPrincipal()
  5. currentUser.hasRole("schwartz")
  6. currentUser.isPermitted("lightsaber:wield")
  7. currentUser.isPermitted("winnebago:drive:eagle5")
  8. currentUser.logout();

shiro整合springboot

1）导入依赖

  1. <!--
  2.             Subjects
  3.             shiro securityManager
  4.             Realm
  5.         -->
  7.         <!--shiro整合spring的包-->
  8.         <dependency>
  9.             <groupId>org.apache.shiro</groupId>
  10.             <artifactId>shiro-spring</artifactId>
  11.             <version>1.8.0</version>
  12.         </dependency>

2）自定义Realm

  1. //自定义realm
  2. public class UserRealm extends AuthorizingRealm{
  3.     //授权
  4.     @Override
  5.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
  7.         System.out.println("执行了=>>授权doGetAuthorizationInfo");
  9.         return null;
  10.     }
  12.     //认证
  13.     @Override
  14.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
  16.         System.out.println("执行了=>>认证doGetAuthenticationInfo");
  17.         return null;
  18.     }
  19. }

3）配置类

  1. @Configuration
  2. public class MyConfig {
  4.     //ShiroFilterFactoryBean：第三步
  5.     @Bean
  6.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
  7.         ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
  8.         //设置安全管理器
  9.         bean.setSecurityManager(defaultWebSecurityManager);
  10.         return bean;
  12.     }
  13.     //defaultWebSecurityBean：第二步
  14.     @Bean(name = "securityManager")
  15.     public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
  16.         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  18.         //关联UserRealm
  19.         securityManager.setRealm(userRealm);
  20.         return securityManager;
  21.     }
  22.     //创建 realm对象，需要自定义:第一步
  23.     @Bean
  24.     public UserRealm userRealm(){
  25.         return new UserRealm();
  26.     }
  27. }

4）controller与html

登录拦截

1）配置过滤器

  1.  @Bean
  2.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
  3.         ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
  4.         //设置安全管理器
  5.         bean.setSecurityManager(defaultWebSecurityManager);
  7.         //添加shiro的内置过滤器
  8.         /*
  9.             anno：无需认证就可访问
  10.             authc：必须认证了才能访问
  11.             user：必须拥有记住我功能才能用
  12.             perms：拥有对某个资源的权限才能访问
  13.             role：拥有某个角色权限才能访问
  14.          */
  15.         Map<String, String> filterMap = new LinkedHashMap<>();
  17.         filterMap.put("/user/add","authc");
  18.         filterMap.put("/user/update","authc");
  19.         bean.setFilterChainDefinitionMap(filterMap);
  20.         bean.setLoginUrl("/toLogin");
  21.         return bean;
  23.     }

2）login.html及controller略

shiro整合mybatis

1）导入mybatis，mysql，lombok，log4j依赖

2）进行配置

image.png
image.png

3）mapper层，service层，controller层

image.png

4）认证

  1. @Autowired
  2.     UserService userService;
  3.     //认证
  4.     @Override
  5.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
  7.         System.out.println("执行了=>>认证doGetAuthenticationInfo");
  9.         UsernamePasswordToken userToken = (UsernamePasswordToken) authenticationToken;
  11.         User user = userService.queryUserByName(userToken.getUsername());
  13.         if(user == null){
  14.             return null;
  15.         }
  17.         //可以加密：MD5盐值加密
  18.         //密码认证 shiro做
  19.         return new SimpleAuthenticationInfo("",user.getPassword(),"");
  20.     }

5）授权

未授权页面
image.png
shiroConfig中设置页面的权限
image.png
自定义Realm中设置用户权限
image.png

shiro整合thymeleaf

1）导包

  1. <dependency>
  2.     <groupId>com.github.theborakompanioni</groupId>
  3.     <artifactId>thymeleaf-extras-shiro</artifactId>
  4.     <version>2.1.0</version>
  5. </dependency>

2）首页中使用thymeleaf与shiro的整合

命名空间（很重要）

  1. <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
  1. <!DOCTYPE html>
  2. <html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
  3. <head>
  4.     <meta charset="UTF-8">
  5.     <title>Title</title>
  6. </head>
  7. <body>
  8. <h1>首页</h1>
  9. <!--如果没认证，就显示登录按钮-->
  10. <div shiro:notAuthenticated="">
  11.     <a th:href="@{/toLogin}">登录</a>
  12. </div>
  13. <p th:text="${msg}"></p>
  14. <!--如果有add页面权限，就显示add页面的按钮-->
  15. <div shiro:hasPermission="user:add">
  16.     <a th:href="@{/user/add}">add</a>
  17. </div>
  18. <!--如果有update页面权限，就显示update页面的按钮-->
  19. <div shiro:hasPermission="user:update">
  20.     <a th:href="@{/user/update}">update</a>
  21. </div>
  22. </body>
  23. </html>