springboot整合shiro笔记-登录验证

最近使用springboot框架做了一个项目，其中使用了shiro进行登录认证和权限管理，这里给shiro模块做一个笔记。

导入shiro依赖

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring-boot-web-starter</artifactId>
    <version>1.4.1</version>
</dependency>

User实体类

public class User implements Serializable{
    private static final long serialVersionUID = 1L;
    private int userId;
    private String userName;
    private String password;
    private boolean rememberMe;
    private List<Role> roles;
    //setter、getter...
}

Role实体类

public class Role {
    private int roleId;
    private String roleName;
    private List<User> users;
    private List<Resource> resources;
    //setter、getter...
}

Resource实体类

public class Resource {
    private int resourceId;
    private String resourceUri;
    private String resourceName;
    private String permission;
    private List<Role> roles;
    //setter、getter
}

自定义Realm

@Component
public class MyRealm extends AuthorizingRealm {
    @Autowired
    private ResourceService resourceService;
    @Autowired
    private UserService userService;



    /**
     * 给用户授权
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        //获取用户对象
        User user = (User) principalCollection.getPrimaryPrincipal();
        //获取用户的角色信息
        List<Role> roles = user.getRoles();
        if (roles != null && !roles.isEmpty()) {
            //遍历当前用户的所有角色，将角色名添加到用户权限中
            roles.forEach(role -> {
                simpleAuthorizationInfo.addRole(role.getRoleName());
                //获取每个角色能访问的资源
                List<Resource> resources =
                        resourceService.getResourcesByRoleId(role.getRoleId());
                if (resources != null && !resources.isEmpty()) {
                    //遍历当角色所能访问的资源，将资源的uri添加到用户权限中
                    resources.forEach(resource ->
                            simpleAuthorizationInfo.addStringPermission(resource.getResourceUri()));
                }
            });
        }
        return simpleAuthorizationInfo;
    }

    /**
     * 用户认证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //获取令牌（即用户名）
        String userName = (String) authenticationToken.getPrincipal();
        //获取数据库中的用户信息，用于比对
        User user = userService.getUserByUserName(userName);
        if(user == null) {
            throw new UnknownAccountException("用户名不存在");
        }

        //设置盐
        ByteSource salt = ByteSource.Util.bytes(userName+ MD5Util.getSALT());

        return new SimpleAuthenticationInfo(user,user.getPassword(),salt,getName());
    }


}

shiro配置类

@Configuration
@Component
public class ShiroConfig {


    /**
     * 配置Realm
     */
    @Bean
    public MyRealm realm() {

        MyRealm myRealm = new MyRealm();
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        //设置加密方式
        hashedCredentialsMatcher.setHashAlgorithmName("MD5");
        //设置加密次数
        hashedCredentialsMatcher.setHashIterations(1024);
        myRealm.setCredentialsMatcher(hashedCredentialsMatcher);

        return myRealm;
    }

    /**
     * 注册默认的安全管理器
     */
    @Bean
    public DefaultSecurityManager securityManager() {
        DefaultSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(realm());
        return manager;
    }

    /**
     * 配置shiro过滤器工厂
     * -----------------
     * 拦截权限
     * anon：匿名访问，无需登录
     * authc：登录后才能访问
     * user：登录过能访问
     * logout：登出
     * roles：角色过滤器
     * ------------------
     * URL匹配风格
     * ?：匹配一个字符，如 /admin? 将匹配 /admin1，但不匹配 /admin 或 /admin/
     * *：匹配零个或多个字符串，如 /admin* 将匹配 /admin 或/admin123，但不匹配 /admin/1
     * **：匹配路径中的零个或多个路径，如 /admin/** 将匹配 /admin/a 或 /admin/a/b
     * -----------------------
     * 方法名不能乱写，如果我们定义为别的名称，又没有添加注册过滤器的配置，那么shiro会加载ShiroWebFilterConfiguration过滤器，
     * 该过滤器会寻找shiroFilterFactoryBean，找不到会抛出异常
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean() {
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
        shiroFilter.setSecurityManager(securityManager());

        shiroFilter.setLoginUrl("/account/loginVue");
        shiroFilter.setSuccessUrl("/account/dashboard");

        Map<String,String> map = new LinkedHashMap<>();
        map.put("/", "authc");
        map.put("/static/**", "anon");
        map.put("/js/**", "anon");
        map.put("/css/**", "anon");
        map.put("/plugin/**", "anon");
        map.put("/account/login", "anon");
        map.put("/account/loginVue", "anon");
        map.put("/api/login", "anon");
        map.put("/account/register", "anon");
        map.put("/account/registerVue", "anon");
        map.put("/api/user", "anon");

        map.put("/common/**", "user");
        map.put("/test/**", "user");
        map.put("/**", "authc");

        shiroFilter.setFilterChainDefinitionMap(map);

        return shiroFilter;
    }

    /**
     * 注册ShiroDialect，让thymeleaf支持shiro标签
     */
    @Bean
    public ShiroDialect shiroDialect() {
        return new ShiroDialect();
    }

    /**
     * 自动代理类，支持Shiro的注解
     */
    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator =
                new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    /**
     * 开启Shiro的注解
     */
    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(){
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor =
                new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
        return authorizationAttributeSourceAdvisor;
    }
}

UserServiceImpl类

@Service
public class UserServiceImpl implements UserService {

    @Override
    public Result<User> login(User user) {
        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();

        //将传来的user信息封装到UsernamePasswordToken
        UsernamePasswordToken usernamePasswordToken =
                new UsernamePasswordToken(user.getUserName(),
                        user.getPassword());
        usernamePasswordToken.setRememberMe(user.getRememberMe());

        try {
            //登录验证
            subject.login(usernamePasswordToken);
            subject.checkRoles();
        } catch (AuthenticationException e) {
            e.printStackTrace();
            return new Result<>(Result.ResultStatus.FAILED.status,
                    "用户名或密码错误");
        }

        //将用户信息加入到session里
        Session session = subject.getSession();
        session.setAttribute("user",subject.getPrincipal());
        return new Result<>(Result.ResultStatus.SUCCESS.status,
                "登录成功", user);
    }

    @Override
    public void logout() {
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        Session session = subject.getSession();
        session.removeAttribute("user");
    }
}