shiro實現動態權限管理

用到shiro框架實現權限控制時，根據實際要求，權限在數據庫增刪改后都要把權限過濾鏈變化實時更新到服務器中。

1、配置文件里配置的filterchains都是靜態的，但實際開發中更多的是從數據庫中動態的獲取filterchains。

我們都知道ShiroFilterFactoryBean中的setFilterChainDefinitions()是讀取配置文件里默認的filterchains，所以我們的思路是重寫這個方法，才能達到我們想要的目的：

package com.xiyinli.web.shiro;

import com.baomidou.mybatisplus.mapper.EntityWrapper;
import com.xiyinli.model.CoreUser;
import com.xiyinli.model.RolesPermissions;
import com.xiyinli.service.CoreUserService;
import com.xiyinli.service.RolesPermissionsService;
import org.apache.shiro.config.Ini;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.util.CollectionUtils;
import org.apache.shiro.web.config.IniFilterChainResolverFactory;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.*;
import java.util.stream.Collectors;

/**
 * Created by Administrator on 2017/8/14 0014.
 */
public class ShiroPermissionFactory extends ShiroFilterFactoryBean {
    /**記錄配置中的過濾鏈*/
    public static String definition = "";
    @Autowired
    private RolesPermissionsService rolesPermissionsService;

    /**
     * 初始化設置過濾鏈
     */
    @Override
    public void setFilterChainDefinitions(String definitions) {
//        String token =  manageUserService.getAdminToken(0);

        //可從數據庫讀取后，添加至過濾鏈，參考此處已注釋的代碼
        definition = definitions;//記錄配置的靜態過濾鏈
//        List<Permission> permissions = permissService.findAll();

        List<RolesPermissions> rolesPermissions = rolesPermissionsService.selectList(new EntityWrapper<>());
        Set<String> urls = new LinkedHashSet<>();
        for (RolesPermissions rolesPermission : rolesPermissions) {
            urls.add(rolesPermission.getUrl());
        }

        Map<String,String> otherChains = new HashMap<>();
        for (String url : urls) {
            StringBuilder roleOrFilters = new StringBuilder();
            for (int i = 0; i < rolesPermissions.size(); i++) {
                if (Objects.equals(url, rolesPermissions.get(i).getUrl())) {
                    if (i == 0) {
                        roleOrFilters.append(rolesPermissions.get(i).getRolesName());
                    }else{
                        roleOrFilters.append(",").append(rolesPermissions.get(i).getRolesName());
                    }
                }
            }
            String rolesStr = roleOrFilters.toString();
            if (!"".equals(rolesStr)) {
                otherChains.put(url, "roleOrFilter["+rolesStr+"]"); //  /discover/newstag  authc,roles[user,admin]
            }
        }
        //加載配置默認的過濾鏈
        Ini ini = new Ini();
        ini.load(definitions);
        Ini.Section section = ini.getSection(IniFilterChainResolverFactory.URLS);
        if (CollectionUtils.isEmpty(section)) {
            section = ini.getSection(Ini.DEFAULT_SECTION_NAME);
        }
        //加上數據庫中過濾鏈
        section.putAll(otherChains);
        section.put("/**", "anon");
        setFilterChainDefinitionMap(section);
    }
}

 

這里定義的一個靜態屬性definition，作用是記錄下配置文件中的filterchains，這個屬性在等下更新權限的時候會用到。

配置文件 spring-shiro.xml 如下：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">

    <!-- 緩存管理器(自帶) -->
    <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/>

    <!-- 繼承自AuthorizingRealm的自定義Realm,即指定Shiro驗證用戶登錄的類為自定義的ShiroDbRealm.java -->
    <!--<bean id="codeRealm" class="com.xiyinli.web.shiro.CodeRealm"/>-->

    <!-- 繼承自AuthorizingRealm的自定義Realm,即指定Shiro驗證用戶登錄的類為自定義的ShiroDbRealm.java -->
    <bean id="passwordRealm" class="com.xiyinli.web.shiro.PasswordRealm"/>

    <!-- 繼承自AuthorizingRealm的自定義Realm,即指定Shiro驗證用戶登錄的類為自定義的ShiroDbRealm.java -->
    <bean id="adminPasswordRealm" class="com.xiyinli.web.shiro.AdminPasswordRealm"/>
    <!-- 踢出用戶 -->
    <!--<bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO" />-->
    <bean id="sessionDAO" class="com.xiyinli.web.shiro.RedisSessionDao" />
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="sessionDAO" ref="sessionDAO" />
        <property name="globalSessionTimeout" value="-1000"/>
    </bean>
    <!-- Shiro默認會使用Servlet容器的Session,可通過sessionMode屬性來指定使用Shiro原生Session -->
    <!-- 即<property name="sessionMode" value="native"/>,詳細說明見官方文檔 -->
    <!-- 這里主要是設置自定義的單Realm應用,若有多個Realm,可使用'realms'屬性代替 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realms">
            <list>
                <!--<ref bean="codeRealm" />-->
                <ref bean="passwordRealm" />
                <ref bean="adminPasswordRealm" />
            </list>
        </property>
        <property name="sessionManager" ref="sessionManager" />
        <!-- 使用下面配置的緩存管理器 -->
        <!--<property name="cacheManager" ref="cacheManager"/>-->
    </bean>

    <!--自定義的filter-->
    <bean id="roleOrFilter" class="com.xiyinli.web.shiro.CustomRolesAuthorizationFilter">
    </bean>
    <!-- Shiro主過濾器本身功能十分強大,其強大之處就在於它支持任何基於URL路徑表達式的、自定義的過濾器的執行 -->
    <!-- Web應用中,Shiro可控制的Web請求必須經過Shiro主過濾器的攔截,Shiro對基於Spring的Web應用提供了完美的支持 -->
    <bean id="shiroFilter" class="com.xiyinli.web.shiro.ShiroPermissionFactory">
    <!--<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">-->
        <!-- Shiro的核心安全接口,這個屬性是必須的 -->
        <property name="securityManager" ref="securityManager"/>
        <!-- 要求登錄時的鏈接(可根據項目的URL進行替換),非必須的屬性,默認會自動尋找Web工程根目錄下的"/login.jsp"頁面 -->
        <property name="loginUrl" value="/login.map"/>
        <!-- 登錄成功后要跳轉的連接(本例中此屬性用不到,因為登錄成功后的處理邏輯在LoginController里硬編碼為main.jsp了) -->
        <!-- <property name="successUrl" value="/index.html"/> -->
        <!-- 用戶訪問未對其授權的資源時,所顯示的連接 -->
        <!-- 若想更明顯的測試此屬性可以修改它的值,如unauthor.jsp,然后用[玄玉]登錄后訪問/admin/listUser.jsp就看見瀏覽器會顯示unauthor.jsp -->
        <property name="unauthorizedUrl" value="/unauthorized.map"/>
        <!-- Shiro連接約束配置,即過濾鏈的定義 -->
        <!-- 此處可配合我的這篇文章來理解各個過濾連的作用http://blog.csdn.net/jadyer/article/details/12172839 -->
        <!-- 下面value值的第一個'/'代表的路徑是相對於HttpServletRequest.getContextPath()的值來的 -->
        <!-- anon：它對應的過濾器里面是空的,什么都沒做,這里.do和.jsp后面的*表示參數,比方說login.jsp?main這種 -->
        <!-- authc：該過濾器下的頁面必須驗證后才能訪問,它是Shiro內置的一個攔截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter -->
        <property name="filters">
            <util:map>
                <entry key="roleOrFilter" value-ref="roleOrFilter"/>
            </util:map>
        </property>
        <property name="filterChainDefinitions">
            <value>
                # 注意此處配置的路徑不需要輸入工程名，  / 就包括  http://地址:端口/項目名/
                <!--/api/user/login/** = anon-->
                <!--/api/user/pcLogin/** = anon-->
                <!--/api/user/register/** = anon-->
                <!---->
                <!--/api/user/logout = logout-->
                <!---->
                <!--/assets/**  = anon-->
                <!--/css/**  = anon-->
                <!--/img/**  = anon-->
                <!--/js/**  = anon-->
                <!--/tpl/**  = anon-->

                <!--/login.html  = anon-->
                <!--#/api/admin/** = authc-->
                <!--#/api/coreUser/sendMsmOrEmail/2 = authc-->
                <!--#/api/coreUser/sendMsmOrEmail/3 = authc-->
                <!--#/api/coreUser/sendMsmOrEmail/4 = authc-->
                <!--#/api/coreUser/sendMsmOrEmail/5 = authc-->
                <!--#/api/coreCollection/rmUserCollection = authc-->

                <!--# authc 如果全部放行必須放在最后-->
                /###/@@@/** = authc

            </value>
        </property>
    </bean>

    <!-- 保證實現了Shiro內部lifecycle函數的bean執行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <!-- 開啟Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP掃描使用Shiro注解的類,並在必要時進行安全邏輯驗證 -->
    <!-- 配置以下兩個bean即可實現此功能 -->
    <!-- Enable Shiro Annotations for Spring-configured beans. Only run after the lifecycleBeanProcessor has run -->
    <!-- 由於本例中並未使用Shiro注解,故注釋掉這兩個bean(個人覺得將權限通過注解的方式硬編碼在程序中,查看起來不是很方便,沒必要使用) -->
    <!--
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>
      <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
      </bean>
    -->

</beans>

其中：

    <bean id="passwordRealm" class="com.xiyinli.web.shiro.PasswordRealm"/>
    <bean id="adminPasswordRealm" class="com.xiyinli.web.shiro.AdminPasswordRealm"/>
    <bean id="sessionDAO" class="com.xiyinli.web.shiro.RedisSessionDao" />

在此不做詳述！

/###/@@@/** = authc

為一個項目接口不存在的路徑 權限是authc(需要登錄)，是為了保證初始過濾鏈不為空。

<bean id="roleOrFilter" class="com.xiyinli.web.shiro.CustomRolesAuthorizationFilter">

為自定義的filter ,作用是角色權限設置成或者的關系，shiro自帶的roles為並且關系，不符合要要求。

package com.xiyinli.web.shiro;

import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * // AuthorizationFilter抽象類事項了javax.servlet.Filter接口，它是個過濾器。
 * Created by Administrator on 2017/8/15 0015.
 */
public class CustomRolesAuthorizationFilter extends AuthorizationFilter {
    @Override
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        Subject subject = getSubject(request, response);
        String[] rolesArray = (String[]) mappedValue;
        if (rolesArray == null || rolesArray.length == 0) {
            return true;
        }
        for (String aRolesArray : rolesArray) {
            if (subject.hasRole(aRolesArray)) {
                return true;
            }
        }
        return false;
    }
}

 注(2017.9.13更新)：使用如上自定義CustomRolesAuthorizationFilter后實際項目中遇到多角色同時擁有一個接口權限時，會出現多次調用自定義Realm中的doGetAuthorizationInfo方法（原因是是subject.hasRole一次觸發一次），嚴重影響效率。

故自定義CustomRolesAuthorizationFilter做如下更改，修改過后自定義Realm中的doGetAuthorizationInfo方法將不再被調用，角色鑒權在CustomRolesAuthorizationFilter中被執行，其中用到了redis作為緩存：

 

package com.xiyinli.web.shiro;

import com.xiyinli.model.RolesPermissions;
import com.xiyinli.redis.RedisClusterCache;
import com.xiyinli.service.RolesPermissionsService;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;
import org.springframework.beans.factory.annotation.Autowired;

import javax.annotation.Resource;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import java.io.Serializable;
import java.util.*;
import java.util.stream.Collectors;

/**
 * // AuthorizationFilter抽象類事項了javax.servlet.Filter接口，它是個過濾器。
 * Created by Administrator on 2017/8/15 0015.
 */
public class CustomRolesAuthorizationFilter extends AuthorizationFilter {
    private HttpServletRequest request;
    @Autowired
    private RolesPermissionsService rolesPermissionsService;
    @Resource
    private RedisClusterCache redisClusterCache;

    @Override
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        Subject subject = getSubject(request, response);
        this.request = (HttpServletRequest) request;
        String localAddr = this.request.getRequestURI();
        PrincipalCollection principals = subject.getPrincipals();
        if (null == principals) {
            return true;
        }
        Session session = subject.getSession();
        Serializable sessionId = session.getId();

        String userName = principals.toString();
        String userName0 = userName.split("==")[0];
        String userName1 = "";

        Object cache = redisClusterCache.getCache(sessionId.toString() + "==" + localAddr + "==" + userName);

        String[] rolesArray = (String[]) mappedValue;
        if (rolesArray == null || rolesArray.length == 0) {
            return true;
        }

        List<String> rolesList = Arrays.asList(rolesArray);

        if ("admin-pc".equals(userName0) || "store-pc".equals(userName0)) {
            if (null != cache) {
                Set<String> cache1 = (Set<String>) cache;
                boolean disjoint = Collections.disjoint(cache1, rolesList);
                return !disjoint;
            }
            userName1 = userName.split("==")[1];
        }

        List<RolesPermissions> rolesPermissions;
        if ("admin-pc".equals(userName0)) {
            rolesPermissions = rolesPermissionsService.selectByAuserName(userName1);
        }else if("store-pc".equals(userName0)){
            rolesPermissions = rolesPermissionsService.selectBySuserName(userName1);
        }else{
            return true;
        }
        //當前用戶具有的權限
        Set<String> roles = rolesPermissions.stream().map(RolesPermissions::getRolesName).collect(Collectors.toSet());

        redisClusterCache.putCacheWithExpireTime(sessionId.toString() + "==" + localAddr + "==" + userName, roles, 86400); //24小時過期

        boolean disjoint = Collections.disjoint(roles, rolesList);
        if (!disjoint) {
            return true;
        }

        /*for (String aRolesArray : rolesArray) {
            if (subject.hasRole(aRolesArray)) {
                return true;
            }
        }*/
        return false;
    }
}

 

其中我這是多端多角色的，所以有一些截取判斷，項目應根據實際做相應修改！

 

2、系統管理員在后台更新權限（增刪改）的時候，要保證數據庫中的filterchains同步到服務器中。

package com.xiyinli.web.shiro;

import org.apache.shiro.util.CollectionUtils;
import org.apache.shiro.web.filter.mgt.DefaultFilterChainManager;
import org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver;
import org.apache.shiro.web.servlet.AbstractShiroFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;

import java.util.Map;

/**
 * Created by Administrator on 2017/8/15 0015.
 */
@Controller
public class FilterChainDefinitionsService {
    @Autowired
    private ShiroPermissionFactory permissFactory;


    public void reloadFilterChains() {
        synchronized (permissFactory) {   //強制同步，控制線程安全
            AbstractShiroFilter shiroFilter = null;

            try {
                shiroFilter = (AbstractShiroFilter) permissFactory.getObject();

                PathMatchingFilterChainResolver resolver = (PathMatchingFilterChainResolver) shiroFilter
                        .getFilterChainResolver();
                // 過濾管理器
                DefaultFilterChainManager manager = (DefaultFilterChainManager) resolver.getFilterChainManager();
                // 清除權限配置
                manager.getFilterChains().clear();
                permissFactory.getFilterChainDefinitionMap().clear();
                // 重新設置權限
                permissFactory.setFilterChainDefinitions(ShiroPermissionFactory.definition);//傳入配置中的filterchains

                Map<String, String> chains = permissFactory.getFilterChainDefinitionMap();
                //重新生成過濾鏈
                if (!CollectionUtils.isEmpty(chains)) {
                    chains.forEach((url, definitionChains) -> {
                        manager.createChain(url, definitionChains.trim().replace(" ", ""));
                    });
                }
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
    }
}

 

這里要注意線程安全控制，用synchronized關鍵字。同時，可以看到前面的靜態屬性definition這里就派上用場了。在接口中修改角色權限時，只需要注入此bean，調用reloadFilterChains()方法即可完成權限的動態更新！