shiro框架学习-10-shiro整合springboot案例

1. 技术选型：

　　前后端分离的权限检验 + SpringBoot2.x + Mysql + Mybatis + Shiro + Redis + IDEA + JDK8

2. RBAC权限控制设计

• 用户
• 角色(一个用户可以具有多种角色,一个角色可以被多个用户使用，用户与角色为多对多关系)
• 权限(一个角色可以拥有多种权限，一个权限可以归属到多种角色，也是N:N关系)

  想要获取一个用户所能访问的资源，根据用户查询用户角色，根据用户角色查询权限，理清了这个关系，就可以创建数据库了：

CREATE TABLE `permission` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `name` varchar(128) DEFAULT NULL COMMENT '名称',
  `url` varchar(128) DEFAULT NULL COMMENT '接口路径',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8;
INSERT INTO `permission` VALUES (1,'video_update','/api/video/update'),(2,'video_delete','/api/video/delete'),(3,'video_add','/api/video/add'),(4,'order_list','/api/order/list'),(5,'user_list','/api/user/list');

CREATE TABLE `user` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(128) DEFAULT NULL COMMENT '用户名',
  `password` varchar(256) DEFAULT NULL COMMENT '密码',
  `create_time` datetime DEFAULT NULL,
  `salt` varchar(128) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
INSERT INTO `user` VALUES (1,'二当家小D','4280d89a5a03f812751f504cc10ee8a5',NULL,NULL),(2,'大当家','123456789',NULL,NULL),(3,'jack','d022646351048ac0ba397d12dfafa304',NULL,NULL);

CREATE TABLE `role_permission` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `role_id` int(11) DEFAULT NULL,
  `permission_id` int(11) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=8 DEFAULT CHARSET=utf8;
INSERT INTO `role_permission` VALUES (1,3,1),(2,3,2),(3,3,3),(4,2,1),(5,2,2),(6,2,3),(7,2,4);


CREATE TABLE `role` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `name` varchar(128) DEFAULT NULL COMMENT '名称',
  `description` varchar(64) DEFAULT NULL COMMENT '描述',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
INSERT INTO `role` VALUES (1,'admin','普通管理员'),(2,'root','超级管理员'),(3,'editor','审核人员');


CREATE TABLE `user_role` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `role_id` int(11) DEFAULT NULL,
  `user_id` int(11) DEFAULT NULL,
  `remarks` varchar(64) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8;
INSERT INTO `user_role` VALUES (1,3,1,'二当家小D是editor'),(2,1,3,'jack是admin'),(3,2,3,'jack是root'),(4,3,3,'jack是editor'),(5,1,2,'大当家是admin'),(6,1,1,'二当家小D是root');

3.新建springboot项目，添加如下项目依赖：

<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <!-- 下面这个runtime需要去掉！！！ -->
            <!--    <scope>runtime</scope>-->
        </dependency>

        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.3.2</version>
        </dependency>

        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.6</version>
        </dependency>

        <!-- spring整合shiro-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.0</version>
        </dependency>

        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.9</version>
        </dependency>

        <!-- 热部署 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <optional>true</optional>
        </dependency>

        <!-- shiro+redis缓存插件 -->
        <dependency>
            <groupId>org.crazycake</groupId>
            <artifactId>shiro-redis</artifactId>
            <version>3.1.0</version>
        </dependency>


        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.junit.vintage</groupId>
                    <artifactId>junit-vintage-engine</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

4. application.properties配置数据库连接

#数据库配置 spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver spring.datasource.url=jdbc:mysql://localhost:3306/xdclass_shiro?serverTimezone=UTC&useUnicode=true&characterEncoding=UTF-8&userSSL=false spring.datasource.username=root spring.datasource.password=lchadmin #使用druid数据源 #spring.datasource.type=com.alibaba.druid.pool.DruidDataSource #开启控制台打印sql mybatis.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl #开启数据库字段下划线自动转Java驼峰命名 mybatis.configuration.map-underscore-to-camel-case=true

5. 用户-角色-权限 多对多关联查询SQL

* 第一步 查询用户对应的角色映射关系
  select * from user u left join user_role ur on u.id=ur.user_id where  u.id=3

* 第二步 查询用户对应的角色信息
  select * from user u left join user_role ur on u.id=ur.user_id left join role r on ur.role_id = r.id  where  u.id=3
* 第三步 查询角色和权限的关系
  select * from user u 
  left join user_role ur on u.id=ur.user_id
  left join role r on ur.role_id = r.id
  left join role_permission rp on r.id=rp.role_id
  where  u.id=1
* 第四步 查询角色对应的权限信息（某个用户具备的角色和权限集合）
  select * from user u 
  left join user_role ur on u.id=ur.user_id
  left join role r on ur.role_id = r.id
  left join role_permission rp on r.id=rp.role_id
  left join permission p on rp.permission_id=p.id
  where  u.id=1

6. POJO定义

数据库查询接口:

 

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.User;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;

import javax.websocket.server.ServerEndpoint;

public interface UserMapper {

    @Select("select * from user where username= #{username}")
    User findByUserName(@Param("username") String username);

    @Select("select * from user where id = #{userId}")
    User findById(@Param("userId") int id);

    @Select("select * from user where username=#{username} and password=#{pwd}")
    User findByUsernameAndPwd(@Param("username") String userName,@Param("pwd")String pwd);

}

 

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.Role;
import org.apache.ibatis.annotations.*;
import org.apache.ibatis.mapping.FetchType;

import java.util.List;

public interface RoleMapper {

    @Select("select ur.role_id id,r.name name,r.description description from role r\n" +
            "left join user_role ur  on r.id = ur.role_id where ur.user_id = #{userId}")
    @Results(
            value={
                    @Result(id=true,property = "id",column="id"),
                    @Result(property = "name",column="name"),
                    @Result(property = "description",column="description"),
                    @Result(property = "permissionList",column="id",
                    many = @Many(select = "net.xdclass.xdclassshiro.dao.PermissionMapper.findPermissionListByRoleId",fetchType = FetchType.DEFAULT))
            }
    )
    List<Role> findRoleListByUserId(@Param("userId") int userId);
}

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.Permission;
import net.xdclass.xdclassshiro.domain.Role;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;

import java.util.List;

public interface PermissionMapper {

    @Select("select p.id id,p.name name,p.url url from permission p left join role_permission rp on rp.permission_id = p.id\n" +
            "where rp.role_id= #{roleId}")
    List<Permission> findPermissionListByRoleId(@Param("roleId") int roleId);

}

主启动类添加mapper包扫描

package net.xdclass.xdclassshiro;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
//扫描mapper包
@MapperScan("net.xdclass.xdclassshiro.dao")
public class XdclassShiroApplication {

    public static void main(String[] args) {
        SpringApplication.run(XdclassShiroApplication.class, args);
    }

}

Service接口及实现：

package net.xdclass.xdclassshiro.service;

import net.xdclass.xdclassshiro.domain.User;
import org.apache.ibatis.annotations.Select;

public interface UserService {
    /**
     * 获取用户全部信息，包含角色权限
     * @param username
     * @return
     */
    User findAllUserInfoByUsername(String username);

    /**
     * 获取用户基本信息
     * @param userId
     * @return
     */
    User findSimpleUserInfoById(int userId);

    /**
     * 根据用户名查找用户
     * @param username
     * @return
     */
    User findSimpleUserInfoByUsername(String username);
}

package net.xdclass.xdclassshiro.service.impl;

import net.xdclass.xdclassshiro.dao.RoleMapper;
import net.xdclass.xdclassshiro.dao.UserMapper;
import net.xdclass.xdclassshiro.domain.Role;
import net.xdclass.xdclassshiro.domain.User;
import net.xdclass.xdclassshiro.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class UserServiceImpl implements UserService {

    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RoleMapper roleMapper;

    @Override
    public User findAllUserInfoByUsername(String username) {
        User user = userMapper.findByUserName(username);
        List<Role> roleList = roleMapper.findRoleListByUserId(user.getId());
        user.setRoleList(roleList);
        return user;
    }

    @Override
    public User findSimpleUserInfoById(int userId) {

        return userMapper.findById(userId);
    }

    @Override
    public User findSimpleUserInfoByUsername(String username) {
        return userMapper.findByUserName(username);
    }
}

自定义realm

package net.xdclass.xdclassshiro.config;  2 
import net.xdclass.xdclassshiro.domain.Permission;  4 import net.xdclass.xdclassshiro.domain.Role;  5 import net.xdclass.xdclassshiro.domain.User;  6 import net.xdclass.xdclassshiro.service.UserService;  7 import org.apache.commons.lang3.StringUtils;  8 import org.apache.shiro.authc.AuthenticationException;  9 import org.apache.shiro.authc.AuthenticationInfo; 10 import org.apache.shiro.authc.AuthenticationToken; 11 import org.apache.shiro.authc.SimpleAuthenticationInfo; 12 import org.apache.shiro.authz.AuthorizationInfo; 13 import org.apache.shiro.authz.SimpleAuthorizationInfo; 14 import org.apache.shiro.realm.AuthorizingRealm; 15 import org.apache.shiro.subject.PrincipalCollection; 16 import org.springframework.beans.factory.annotation.Autowired; 17 
import java.util.ArrayList; 19 import java.util.Collections; 20 import java.util.List; 21 
/**
 * 自定义realm,继承AuthorizingRealm，重写认证，授权的方法 24  */
public class CustomRealm extends AuthorizingRealm { 26  @Autowired 27     private UserService userService; 28 
    /**
 * 进行授权校验 31  * @param principalCollection 32  * @return
     */
 @Override 35     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { 36         User principal = (User) principalCollection.getPrimaryPrincipal(); 37         User user = userService.findAllUserInfoByUsername(principal.getUsername()); 38         List<String> roleList = new ArrayList<>(); 39         List<String> permissionList = new ArrayList<>(); 40         List<Role> userRoleList = user.getRoleList(); 41        // 把用户的角色，权限放到对应的list中
       if(userRoleList.size() >0 && userRoleList.get(0) != null){ 43             for (Role role : userRoleList){ 44  roleList.add(role.getName()); 45                 for (Permission p: role.getPermissionList()){ 46                     if(null != p.getName()){ 47  permissionList.add(p.getName()); 48  } 49  } 50  } 51  } 52         
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(); 54 simpleAuthorizationInfo.addRoles(roleList); 55 simpleAuthorizationInfo.addStringPermissions(permissionList); 56 // 返回simpleAuthorizationInfo对象，交给shiro框架去做权限校验 57 return simpleAuthorizationInfo; 58  } 59 
    /**
 * 自定义shiro认证 62  * @param authenticationToken 63  * @return
 * @throws AuthenticationException 65      */
 @Override 67     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { 68         //从token中获取用户信息，token代表用户输入
        String username = (String) authenticationToken.getPrincipal(); 70         User user = userService.findAllUserInfoByUsername(username); 71 
        String pwd = user.getPassword(); 73         if(StringUtils.isBlank(pwd)){ 74 return null; 75 } 76 //org.apache.shiro.authc.SimpleAuthenticationInfo.SimpleAuthenticationInfo(java.lang.Object, java.lang.Object, java.lang.String) 77 // return new SimpleAuthenticationInfo(username,pwd,this.getClass().getName()); 78         // 使用shiro-reids插件，该插件默认会把SimpleAuthenticationInfo的第一个参数作为redis的key来使用，这里需要把username改为userc才能保证key的唯一性
        return new SimpleAuthenticationInfo(user,pwd,this.getClass().getName()); 80  } 81 }

shiro配置类：

package net.xdclass.xdclassshiro.config;  2 
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;  4 import org.apache.shiro.mgt.SecurityManager;  5 import org.apache.shiro.session.mgt.SessionManager;  6 import org.apache.shiro.spring.web.ShiroFilterFactoryBean;  7 import org.apache.shiro.web.mgt.DefaultWebSecurityManager;  8 import org.crazycake.shiro.RedisCacheManager;  9 import org.crazycake.shiro.RedisManager;  10 import org.crazycake.shiro.RedisSessionDAO;  11 import org.springframework.context.annotation.Bean;  12 import org.springframework.context.annotation.Configuration;  13 
import javax.servlet.Filter;  15 import java.util.LinkedHashMap;  16 import java.util.Map;  17 
/**
 * ShiroFilterFactoryBean配置，要加@Configuration注解  20  *  21  */
@Configuration  23 public class ShiroConfig {  24 

    /**
 * @param securityManager  28  * @return
 * @Bean是一个方法级别上的注解，主要用在@Configuration注解的类里，也可以用在@Component注解的类里。添加的bean的id为方法名 等同于xml配置中的<bean id = " shiroFilter " class = " org.apache.shiro.spring.web.ShiroFilterFactoryBean " />  30      */
 @Bean  32     public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {  33         System.out.println("ShiroFilterFactoryBean.shiroFilter");  34         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();  35         // 设置securityManager
 shiroFilterFactoryBean.setSecurityManager(securityManager);  37         // 如果访问配置的这个接口时用户还未登录，则调用该接口登录
        shiroFilterFactoryBean.setLoginUrl("/pub/need_login");  39         // 登录成功后重定向url 前后端分离的，没有这个调用
        shiroFilterFactoryBean.setSuccessUrl("/");  41         // 没有页面访问权限（登录了，未授权），调用该接口
        shiroFilterFactoryBean.setUnauthorizedUrl("/pub/not_permit");  43 
        // 设置自定义Filter
        Map<String, Filter> filterMap = new LinkedHashMap<>(); 46 filterMap.put("roleOrFilter", new CustomRolesAuthorizationFilter()); 47 // 绑定 48 shiroFilterFactoryBean.setFilters(filterMap);  49 
        // 注意，这里必须使用有序的LinkedHashMap，过滤器链是从上往下顺序执行，一般将/**放在最后，否则部分路径无法拦截
        Map<String,String> filterChainDefinitionMap = new LinkedHashMap<>();  52         // 登出过滤器
       filterChainDefinitionMap.put("/logout", "logout");  54         // 匿名访问过滤器(游客访问)
        filterChainDefinitionMap.put("/pub/**", "anon");  56         // 登陆用户访问
        filterChainDefinitionMap.put("/authc/**", "authc");  58         // 设置自定义Filter,只要是管理员角色或者root角色就能访问
        filterChainDefinitionMap.put("/admin/**", "roleOrFilter[admin,root]");  60         // 配置roles[admin,root]表示必须同时具备admin和root角色才能访问,实际应用不会这么用,使用自定义filter  61 // filterChainDefinitionMap.put("/admin/**", "roles[admin,root]");  62         // 有编辑权限才可以访问 /video/update是数据库配置的权限路径
        filterChainDefinitionMap.put("/video/update", "perms[video_update]");  64         // authc： 定义的url必须通过认证才可以访问 anon: url可以匿名访问
        filterChainDefinitionMap.put("/**", "authc");  66          // 这里没设置，过滤器不生效！！！
 shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);  68         return shiroFilterFactoryBean;  69  }  70 
 @Bean  72     public SecurityManager securityManager() {  73         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();  74         // 错误写法：securityManager.setRealm(new CustomRealm());  75         // 不是前后端分离项目，这里可以不用设置sessionmanager
 securityManager.setSessionManager(sessionManager());  77        // 使用自定义的cacheManager  78  securityManager.setCacheManager(cacheManager());  79         // 必须通过spring实例化CustomRealm的实例之后，这里再通过customRealm()进行注入
 securityManager.setRealm(customRealm());  81         return securityManager;  82  }  83 
    /**
 * 注入realm  86  * @return
     */
 @Bean  89     public CustomRealm customRealm(){  90         CustomRealm customRealm = new CustomRealm();  91         // 设置密码验证器 使用明文密码进行登录测试时，需要将这里注释掉，或者在数据库存储new SimpleHash("md5",pwd,null,2)加密过的密码  92         //数据库修改二当家小D的密码为4280d89a5a03f812751f504cc10ee8a5,这里密码验证注释放开，使用明文密码访问http://localhost:8080/pub/login,能够登录成功
 customRealm.setCredentialsMatcher(hashedCredentialsMatcher());  94         return customRealm;  95  }  96 
    /**
 * 设置自定义sessionManager  99  * @return
     */
 @Bean 102     public SessionManager sessionManager(){ 103         CustomSessionManager sessionManager = new CustomSessionManager(); 104         // 设置session过期时间,不设置默认是30分钟,单位ms
        sessionManager.setGlobalSessionTimeout(200000); 106         // 设置session持久化到redis中,这样服务器重启后，用户还可以通过之前的session进行操作
 sessionManager.setSessionDAO(redisSessionDAO()); 108         return sessionManager; 109  } 110 
    /**
 * 密码加解密规则 113  * @return
     */
 @Bean 116     public HashedCredentialsMatcher hashedCredentialsMatcher(){ 117         HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher(); 118         // 设置散列算法,进行加解密
        credentialsMatcher.setHashAlgorithmName("md5"); 120         // 设置散列迭代次数，2 表示 hash之后再次hash
        credentialsMatcher.setHashIterations(2); 122         return credentialsMatcher; 123  } 124 

    /**
 * 配置redisManager，使用redis来存数session数据 128  * @return
     */
    public RedisManager getRedisManager(){ 131 RedisManager redisManager = new RedisManager(); 132 // redisManager.setHost("192.168.5.112"); 133 redisManager.setHost("192.168.0.114"); //单机redis地址 134 redisManager.setPort(8007); //单机redis端口 135 return redisManager; 136  } 137 
    /**
 * 配置缓存管理器具体实现类，然后添加到securityManager里面 140  * @return
     */
    public RedisCacheManager cacheManager(){ 143 RedisCacheManager redisCacheManager = new RedisCacheManager(); 144  redisCacheManager.setRedisManager(getRedisManager()); 145 // 设置缓存过期时间，单位秒 146 redisCacheManager.setExpire(1800); 147 return redisCacheManager; 148  } 149 
    /**
 * 1.通过shiro redis插件自定义session持久化 152  * 2.在shiro的sessionManager中配置session持久化 153  * @return
     */
    public RedisSessionDAO redisSessionDAO(){ 156         RedisSessionDAO redisSessionDao = new RedisSessionDAO(); 157  redisSessionDao.setRedisManager(getRedisManager()); 158         // session持久化的过期时间，单位s,如果不设置，默认使用session的过期时间，如果设置了，则使用这里设置的过期时间
        redisSessionDao.setExpire(1800); 160 
        //设置自定义sessionId生成
        redisSessionDao.setSessionIdGenerator(new CustomSessionIdGenerator()); 163         return redisSessionDao; 164  } 165 }

shiro配置类中使用到的自定义的内容：

(1)前后端分离情况下自定义SessionManager

package net.xdclass.xdclassshiro.config;

import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.Serializable;

/**
 * 自定义sessionManager
 * 继承DefaultWebSessionManager并重写该类的getSessionId(javax.servlet.ServletRequest, javax.servlet.ServletResponse)方法
 * 意义：
 * 前后端分离时，用户访问接口时，接口生成一个token保存到map中，
 * 下次用户访问接口时带上这个token，后端进行校验
 */
public class CustomSessionManager extends DefaultWebSessionManager {

    /**
     * 请求头中token的key名
     */
    private static  final String AUTHORIZATION = "token";

    public CustomSessionManager() {
        super();
    }

    @Override
    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
        String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATION);
        if(StringUtils.isBlank(sessionId)){
            return super.getSessionId(request,response);
        } else {
//org.apache.shiro.web.session.mgt.DefaultWebSessionManager.getReferencedSessionId id不为null时的分支处理
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,  ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
            // 校验sessionId是否有效
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
            // automatically mark it valid here,if it is invalid, the onUnknowSesson method
            // below will be invoked and we`ll remove the attribute at that time.
            // 标记当前sessionId有效
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
            return sessionId;
        }


    }
}

(2) 自定义Shiro Filter过滤器,  配置不同的角色，验证自定义过滤器是否有效

package net.xdclass.xdclassshiro.config;

import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.CollectionUtils;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.util.Set;

/**
 * 1.自定义filter
 * 2. 把自定义filter加入到ShiroConfig中去
 */
public class CustomRolesAuthorizationFilter extends AuthorizationFilter {
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        Subject subject = this.getSubject(request, response);
        String[] rolesArray = (String[]) ((String[]) mappedValue);
        if (rolesArray != null && rolesArray.length != 0) {
            Set<String> roles = CollectionUtils.asSet(rolesArray);
            /*RolesAuthorizationFilter 中是return subject.hasAllRoles(roles)，同时具备所有角色才能够访问
            这里改为遍历角色 ，当前subject是roles中的任意一个，则有权限访问
            * */
            for (String role : roles) {
                if (subject.hasRole(role)) {
                    return true;
                }
            }
            // return subject.hasAllRoles(roles);
        }
        // 没有角色限制，可以直接访问
        return true;
    }
}

(3)Redis整合CacheManager ，见shiroConfig类 78行， 130-136行，142-148行

shiro+redis缓存插件依赖：

 <dependency>
    <groupId>org.crazycake</groupId>
    <artifactId>shiro-redis</artifactId>
    <version>3.1.0</version>
</dependency>

（4）Redis整合SessionManager 管理Session会话

为什么session也要持久化？
  -——应用保活，重启应用，用户无感知，可以继续以原先的状态继续访问：
  如果不做session持久化，假如一个已经登录的用户正在做新增操作，在还没有提交之前，后台服务器进行了重启，然后用户编辑完数据进行提交，这时服务器因为重启，
  之前的session丢失，后台检测到用户成了未登录状态，就跳转到用户登录页面，这样的用户体验很不友好，因此session需要进行持久化

怎么做session持久化：参考shiroconfig类的配置，需要注意的是，DO对象需要实现序列化接口 Serializable 

 //配置session持久化
     customSessionManager.setSessionDAO(redisSessionDAO());       
       /**
       * 自定义session持久化
       * @return‘
       */
      public RedisSessionDAO redisSessionDAO(){
          RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
          redisSessionDAO.setRedisManager(getRedisManager());
          return redisSessionDAO;
      }

（5）自定义sessionId

package net.xdclass.xdclassshiro.config;


import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.SessionIdGenerator;

import java.io.Serializable;
import java.util.UUID;

/**
 *  自定义sessionId
 */
public class CustomSessionIdGenerator implements SessionIdGenerator {
    @Override
    public Serializable generateId(Session session) {
        return UUID.randomUUID().toString().replaceAll("-", "");
    }
}

接口开发：

（1）游客访问接口：

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import net.xdclass.xdclassshiro.domain.UserQuery;
import net.xdclass.xdclassshiro.service.UserService;
import org.apache.commons.collections.MapUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.ToLongBiFunction;

@RestController
@RequestMapping("/pub")
public class PublicController {

    @Autowired
    private UserService userService;

    //http://localhost:8080/pub/find_user_info?username=jack
    @GetMapping("/find_user_info")
    public Object queryUserInfo(@RequestParam("username") String username) {
        return userService.findAllUserInfoByUsername(username);
    }

    @RequestMapping("/need_login")
    public JsonData needLogin(){
        return JsonData.buildError("请登录",-2);
    }

// shiroconfig配置类里面配置的路径
    @RequestMapping("/not_permit")
    public JsonData noPermit(){
        return JsonData.buildError("没有权限访问",-3);
    }

    //首页,任何角色的都可以访问
    @RequestMapping("/index")
    public JsonData index(){
        List<String> videoList = new ArrayList<>();
        videoList.add("Mysql零基础入门到实战 数据库教程");
        videoList.add("Redis高并发高可用集群百万级秒杀实战");
        videoList.add("Zookeeper+Dubbo视频教程 微服务教程分布式教程");
        videoList.add("2019年新版本RocketMQ4.X教程消息队列教程");
        videoList.add("微服务SpringCloud+Docker入门到高级实战");
        return JsonData.buildSuccess(videoList);
    }


    /**
     * 登录接口
     * @param userQuery
     * @param request
     * @param response
     * @return
     */
    @PostMapping("/login")
    public JsonData login(@RequestBody UserQuery userQuery, HttpServletRequest request,
                          HttpServletResponse response){
        Map<String,Object> info = new HashMap<>();
        try {
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(userQuery.getName(),userQuery.getPwd());
            subject.login(token);

            info.put("msg", "登录成功");
            info.put("session_id",subject.getSession().getId());
            return JsonData.buildSuccess(info);
        } catch (Exception e){
            e.printStackTrace();
            return JsonData.buildError("登录失败");
        }
    }
}

（2）admin角色才能访问的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  只有admin管理员角色才能访问的接口
 */
@RestController
@RequestMapping("admin")
public class AdminController {

    /**
     *  视频播放列表接口
     * @return
     */
    @PostMapping("/video/order")
    public JsonData findPlayRecord(){
        Map<String ,String> recordMap = new HashMap<>();
        recordMap.put("SpringBoot入门到高级实战","300元");
        recordMap.put("Cloud微服务入门到高级实战","100元");
        recordMap.put("分布式缓存Redis","90元");
        return JsonData.buildSuccess(recordMap);
    }
}

（3）只有登录后才能访问到的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  登录才能访问的接口，使用@RestController，返回json数据到前端
 */
@RestController
@RequestMapping("authc")
public class OrderController {

    /**
     *  视频播放列表接口
     * @return
     */
    @PostMapping("/video/play_record")
    public JsonData findPlayRecord(){
        Map<String ,String> recordMap = new HashMap<>();
        recordMap.put("SpringBoot入门到高级实战","第8章第1集");
        recordMap.put("Cloud微服务入门到高级实战","第4章第10集");
        recordMap.put("分布式缓存Redis","第10章第3集");
        return JsonData.buildSuccess(recordMap);
    }
}

（4）具有指定资源访问权限（video/update）的用户才能访问的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  只有具有video/update权限才能访问的接口
 *  select u.username,u.password,ur.remarks,r.name,r.description,rp.role_id,p.name from user u
 * left join user_role ur on u.id = ur.user_id
 * left join role r on r.id = ur.role_id
 * left join role_permission rp on rp.role_id = r.id
 * left join permission p on p.id = rp.permission_id
 * where  p.id = 1
 * 查询出来的用户才能访问该接口
 */
@RestController
@RequestMapping("video")
public class VideoController {
    @PostMapping("/update")
    public JsonData findPlayRecord(){
        return JsonData.buildSuccess("video更新成功");
    }
}

 代码地址：https://github.com/liuch0228/shiro-learn.git   

参考资料：

 Shiro权限管理框架详解

Shiro权限控制+整合shiro  https://blog.csdn.net/qq_43652509/article/details/88074832