springboot(六)-使用shiro

前提

写之前纠结了一番，这一节放在shiro里面还是springboot里面。后来想了下，还是放springboot里吧，因为这里没有shiro的新东西，只有springboot添加了新东西的使用。

但是这里还是基于shiro那边的代码已经内容来写的，对权限和角色做控制。

pom.xml

按照我个人习惯，新建一个boot工程，首先当然是先配置一下基本的pom.xml文件啦。后期再开发的时候，需要什么再加。

 <?xml version="1.0" encoding="UTF-8"?>
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>

   <groupId>com.how2java</groupId>
   <artifactId>shiro</artifactId>
   <version>0.0.1-SNAPSHOT</version>
   <name>shiro</name>
   <description>shiro</description>
   <packaging>war</packaging>

     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
         <version>1.5.9.RELEASE</version>
     </parent>

     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-tomcat</artifactId>

         </dependency>
         <dependency>
               <groupId>junit</groupId>
               <artifactId>junit</artifactId>
               <version>3.8.1</version>
               <scope>test</scope>
         </dependency>
         <!-- servlet依赖. -->
         <dependency>
               <groupId>javax.servlet</groupId>
               <artifactId>javax.servlet-api</artifactId>

         </dependency>
               <dependency>
                      <groupId>javax.servlet</groupId>
                      <artifactId>jstl</artifactId>
               </dependency>
         <!-- tomcat的支持.-->
         <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-jasper</artifactId>

         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-devtools</artifactId>
             <optional>true</optional> <!-- 这个需要为 true 热部署才有效 -->
         </dependency>

         <!-- mybatis -->
         <dependency>
             <groupId>org.mybatis.spring.boot</groupId>
             <artifactId>mybatis-spring-boot-starter</artifactId>
             <version>1.1.1</version>
         </dependency>

         <!-- mysql -->
         <dependency>
             <groupId>mysql</groupId>
             <artifactId>mysql-connector-java</artifactId>
             <version>5.1.21</version>
         </dependency>

         <!-- mybatis 逆向工程 -->
         <dependency>
           <groupId>org.mybatis.generator</groupId>
           <artifactId>mybatis-generator-core</artifactId>
           <version>1.3.5</version>
         </dependency>

         <!-- shiro -->
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-spring</artifactId>
             <version>1.3.2</version>
         </dependency>

         <!-- shiro-web -->
         <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-web</artifactId>
             <version>1.3.2</version>
         </dependency>
     </dependencies>

     <properties>
         <java.version>1.8</java.version>
     </properties>

     <build>
         <plugins>
             <plugin>
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
             </plugin>
         </plugins>
     </build>

 </project>

点击展开

application.properties

然后，配置application.properties文件或者application.yml文件，我是喜欢yml风格的。

server:
  port: 8084
spring:
  mvc:
    view:
      prefix: /WEB-INF/jsp/
      suffix: .jsp
  datasource:
    url: jdbc:mysql://127.0.0.1:3306/shiro?characterEncoding=UTF-8
    username: root
    password: 1234
    driver-class-name: com.mysql.jdbc.Driver

ShiroConfiguration

springboot最大的特点是啥呀？没有配置文件呐，但是我们使用别人的工具，人家需要添加配置文件，怎么办？在我看来，这是springboot的一个缺点吧，它居然是写配置类，感觉又回到过去了。因为配置文件的方式可读性要强。而且配置文件的方式就是由配置类发展过来的。嗯嗯嗯~~~~

ShiroConfiguration 这个类就是shiro配置类，类名怎么命名都可以，就是要用@Configuration 注解表示它是一个配置类

@Bean

public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {

return new LifecycleBeanPostProcessor();

}

这种写法就和 applicationContext-shiro.xml 中的

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

是同一个作用，只要用@Bean 注解了，就表示是被spring管理起来的对象了。

这个类里面就声明了SecurityManager,DatabaseRealm, HashedCredentialsMatcher，ShiroFilterFactoryBean 等等东西，只是写法变化了，其实和配置文件里是一样的。
需要注意一点，URLPathMatchingFilter 并没有用@Bean管理起来。 原因是Shiro的bug, 这个也是过滤器，ShiroFilterFactoryBean 也是过滤器，当他们都出现的时候，默认的什么anno,authc,logout过滤器就失效了。所以不能把他声明为@Bean。

public URLPathMatchingFilter getURLPathMatchingFilter() {

return new URLPathMatchingFilter();

}

 package com.how2java.shiro;

 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;

 import javax.servlet.Filter;

 import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
 import org.apache.shiro.mgt.SecurityManager;
 import org.apache.shiro.spring.LifecycleBeanPostProcessor;
 import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
 import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
 import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;

 import com.how2java.filter.URLPathMatchingFilter;
 import com.how2java.realm.DatabaseRealm;

 @Configuration
 public class ShiroConfiguration {
     @Bean
     public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
         return new LifecycleBeanPostProcessor();
     }

     /**
      * ShiroFilterFactoryBean 处理拦截资源文件问题。
      * 注意：单独一个ShiroFilterFactoryBean配置是或报错的，因为在
      * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
      *
      Filter Chain定义说明
      1、一个URL可以配置多个Filter，使用逗号分隔
      2、当设置多个过滤器时，全部验证通过，才视为通过
      3、部分过滤器可指定参数，如perms，roles
      *
      */
     @Bean
     public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager){
         System.out.println("ShiroConfiguration.shirFilter()");
         ShiroFilterFactoryBean shiroFilterFactoryBean  = new ShiroFilterFactoryBean();

         // 必须设置 SecurityManager
         shiroFilterFactoryBean.setSecurityManager(securityManager);
         // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
         shiroFilterFactoryBean.setLoginUrl("/login");
         // 登录成功后要跳转的链接
         shiroFilterFactoryBean.setSuccessUrl("/index");
         //未授权界面;
         shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
         //拦截器.
         Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
         //自定义拦截器
         Map<String, Filter> customisedFilter = new HashMap<>();
         customisedFilter.put("url", getURLPathMatchingFilter());

         //配置映射关系
         filterChainDefinitionMap.put("/login", "anon");
         filterChainDefinitionMap.put("/index", "anon");
         filterChainDefinitionMap.put("/static/**", "anon");
         filterChainDefinitionMap.put("/config/**", "anon");
         filterChainDefinitionMap.put("/doLogout", "logout");;
         filterChainDefinitionMap.put("/**", "url");
         shiroFilterFactoryBean.setFilters(customisedFilter);
         shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
         return shiroFilterFactoryBean;
     }

     public URLPathMatchingFilter getURLPathMatchingFilter() {
         return new URLPathMatchingFilter();
     }

     @Bean
     public SecurityManager securityManager(){
         DefaultWebSecurityManager securityManager =  new DefaultWebSecurityManager();
         //设置realm.
         securityManager.setRealm(getDatabaseRealm());
         return securityManager;
     }

     @Bean
     public DatabaseRealm getDatabaseRealm(){
         DatabaseRealm myShiroRealm = new DatabaseRealm();
         myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
         return myShiroRealm;
     }

     /**
      * 凭证匹配器
      * （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了
      *  所以我们需要修改下doGetAuthenticationInfo中的代码;
      * ）
      * @return
      */
     @Bean
     public HashedCredentialsMatcher hashedCredentialsMatcher(){
         HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();

         hashedCredentialsMatcher.setHashAlgorithmName("md5");//散列算法:这里使用MD5算法;
         hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5(""));

         return hashedCredentialsMatcher;
     }

     /**
      *  开启shiro aop注解支持.
      *  使用代理方式;所以需要开启代码支持;
      * @param securityManager
      * @return
      */
     @Bean
     public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
         AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
         authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
         return authorizationAttributeSourceAdvisor;
     }
 }

点击展开

SpringContextUtils.java

继续上面的知识点，因为URLPathMatchingFilter 没有被声明为@Bean, 那么换句话说 URLPathMatchingFilter 就没有被Spring管理起来，那么也就无法在里面注入 PermissionService类了。 
但是在业务上URLPathMatchingFilter 里面又必须使用PermissionService类，怎么办呢? 就借助SpringContextUtils 这个工具类，来获取PermissionService的实例。 
这里提供工具类，下个步骤讲解如何使用这个工具类。

package com.how2java.util;

import org.springframework.beans.BeansException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.stereotype.Component;

@Component
public class SpringContextUtils implements ApplicationContextAware {
    private static ApplicationContext context; 

    public void setApplicationContext(ApplicationContext context)
            throws BeansException {
        SpringContextUtils.context = context;
    } 

    public static ApplicationContext getContext(){
        return context;
    }
} 

URLPathMatchingFilter.java

因为前面两个步骤的原因，既不能把 URLPathMatchingFilter.java 作为@Bean管理起来，又需要在里面使用 PermissionService，所以就用上一步的工具类 SpringContextUtils.java，通过如下方式获取 PermissionService了：

permissionService = SpringContextUtils.getContext().getBean(PermissionService.class);

 package com.how2java.filter;

 import java.util.Arrays;
 import java.util.Set;

 import javax.servlet.ServletRequest;
 import javax.servlet.ServletResponse;

 import org.apache.shiro.SecurityUtils;
 import org.apache.shiro.authz.UnauthorizedException;
 import org.apache.shiro.subject.Subject;
 import org.apache.shiro.web.filter.PathMatchingFilter;
 import org.apache.shiro.web.util.WebUtils;
 import org.springframework.beans.factory.annotation.Autowired;

 import com.how2java.service.PermissionService;
 import com.how2java.service.impl.PermissionServiceImpl;
 import com.how2java.util.SpringContextUtils;

 public class URLPathMatchingFilter extends PathMatchingFilter {
     @Autowired
     PermissionService permissionService;

     @Override
     protected boolean onPreHandle(ServletRequest request, ServletResponse response, Object mappedValue)
             throws Exception {
         if(null==permissionService)
             permissionService = SpringContextUtils.getContext().getBean(PermissionService.class);

         String requestURI = getPathWithinApplication(request);
         System.out.println("requestURI:" + requestURI);

         Subject subject = SecurityUtils.getSubject();
         // 如果没有登录，就跳转到登录页面
         if (!subject.isAuthenticated()) {
             WebUtils.issueRedirect(request, response, "/login");
             return false;
         }

         // 看看这个路径权限里有没有维护，如果没有维护，一律放行(也可以改为一律不放行)
         System.out.println("permissionService:"+permissionService);
         boolean needInterceptor = permissionService.needInterceptor(requestURI);
         if (!needInterceptor) {
             return true;
         } else {
             boolean hasPermission = false;
             String userName = subject.getPrincipal().toString();
             Set<String> permissionUrls = permissionService.listPermissionURLs(userName);
             for (String url : permissionUrls) {
                 // 这就表示当前用户有这个权限
                 if (url.equals(requestURI)) {
                     hasPermission = true;
                     break;
                 }
             }

             if (hasPermission)
                 return true;
             else {
                 UnauthorizedException ex = new UnauthorizedException("当前用户没有访问路径 " + requestURI + " 的权限");

                 subject.getSession().setAttribute("ex", ex);

                 WebUtils.issueRedirect(request, response, "/unauthorized");
                 return false;
             }

         }

     }
 }

点击展开

测试

启动该springboot工程，大家试下效果吧。

---

代码下载地址：https://gitee.com/fengyuduke/my_open_resources/blob/master/springboot-shiro.zip