springboot + shiro 构建权限模块

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

权限模块基本流程

权限模块的基本流程：用户申请账号和权限 -->登陆认证 -->安全管控模块认证 -->调用具体权限模块(基于角色的权限控制) --> 登陆成功 -->访问资源 -->安全模块鉴权 -->通过后获取资源。整个流程如下图

常用的两个安全管控模块比较

JAAS，java验证和授权模块，jdk提供的一套标准的方法，对于有异构分布式的大型企业推荐这个框架，很多开源项目的安全框架就是JAAS，例如CAS 、tomcat、activemq等。

spring security，市场占有率最高的框架，支持范围广、功能更强大，但是学习比较复杂，成本比较高，跟spring框架绑定，无法在非spring项目中使用，对于安全需求复杂、支持范围广的项目可以使用。

shiro，简单易学，功能对于一般的web项目已经足够，相对独立，可用于非Spring的项目。

shiro基础知识

shiro扩展性很强，我们可以实现自己的realms、sessionDao、cachemanager以及自定义过滤器来实现个性化需求，其架构图如下：

shiro的核心概念有：

subject：用户，这个用户不一定使人，而是指任何与当前系统交互的对象

principal：身份标示，表示主体的抽象概念，可以用来表示任何实体，如username、ID、phone等

credentail：密码

token：principal+ credentail，用户在登陆时提交的

securityManager：安全管理器，shiro的核心模块，查看源码就可以从这个类开始看

authenticator：认证器，负责主体认证，其需要认证策略，决定什么用户可以认证通过

authorizer：鉴权器，决定用户是否有权限访问某个资源

releam：安全实体数据源，自带了多种实现，我们也可以扩展自己的

role：角色，权限和用户的桥梁

permissions：权限，shiro权限描述，printer：print：A，第一个代表域，第二个代表操作，第三个代表实例

shiro自带的过滤器实现：

springboot2.x整合shiro

项目依赖

<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-ehcache</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<version>1.18.8</version>
</dependency>
</dependencies>

application.yml

spring:
datasource:
url: jdbc:mysql://localhost:3306/test?serverTimezone=UTC&useUnicode=true&characterEncoding=utf-8
username: root
password: 1234
driver-class-name: com.mysql.cj.jdbc.Driver jpa:
database: mysql
show-sql: true
hibernate:
ddl-auto: update
properties:
hibernate:
dialect: org.hibernate.dialect.MySQL5Dialect thymeleaf:
cache: false
mode: HTML

自定义的安全实体数据源

package com.jlwj.shiro.config;import com.jlwj.shiro.model.SysPermission;
import com.jlwj.shiro.model.SysRole;
import com.jlwj.shiro.model.UserInfo;
import com.jlwj.shiro.service.UserInfoService;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;import javax.annotation.Resource;@Slf4j
public class MyShiroRealm extends AuthorizingRealm {
@Resource
private UserInfoService userInfoService;
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
log.info("principals:{}",principals);
SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
UserInfo userInfo = (UserInfo)principals.getPrimaryPrincipal();
for(SysRole role:userInfo.getRoleList()){
authorizationInfo.addRole(role.getRole());
for(SysPermission p:role.getPermissions()){
authorizationInfo.addStringPermission(p.getPermission());
}
}
return authorizationInfo;
} /*主要是用来进行身份认证的，也就是说验证用户输入的账号和密码是否正确。*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
throws AuthenticationException {
log.info("token:{}",token);
//获取用户的输入的账号.
String username = (String)token.getPrincipal();
System.out.println(token.getCredentials());
//通过username从数据库中查找 User对象，如果找到，没找到.
//实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法
UserInfo userInfo = userInfoService.findByUsername(username);
// log.info("userInfo:{}",userInfo);
if(userInfo == null){
return null;
}
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
userInfo, //用户名
userInfo.getPassword(), //密码
ByteSource.Util.bytes(userInfo.getCredentialsSalt()),//salt
getName() //realm name
);
return authenticationInfo;
} public void clearCached() {
PrincipalCollection principals = SecurityUtils.getSubject().getPrincipals();
super.clearCache(principals);
}}

自定义的过滤器，用于验证码校验

package com.jlwj.shiro.filter;import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;/**
* @author hehang on 2019-08-14
* @description sdf
*/
@Slf4j
public class CustomFormAuthenticationFilter extends FormAuthenticationFilter {
@Override
protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
log.info("自定义过滤器");
//在这里进行验证码的校验 //从session获取正确验证码
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
HttpSession session =httpServletRequest.getSession();
//取出session的验证码（正确的验证码）
String validateCode = (String) session.getAttribute("validateCode");
log.info("session:{}",validateCode); //取出页面的验证码
//输入的验证和session中的验证进行对比
String randomcode = httpServletRequest.getParameter("randomcode");
String username = httpServletRequest.getParameter("username");
log.info("randomcode:{}",randomcode);
if(randomcode!=null && validateCode!=null && !randomcode.equals(validateCode)){
//如果校验失败，将验证码错误失败信息，通过shiroLoginFailure设置到request中
httpServletRequest.setAttribute("shiroLoginFailure", "randomCodeError");
//拒绝访问，不再校验账号和密码
return true;
}
//验证码通过，才会到用户认证否则直接到controller层
return super.onAccessDenied(request, response);
}
}

shiro核心配置

package com.jlwj.shiro.config;import com.jlwj.shiro.filter.CustomFormAuthenticationFilter;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.cache.ehcache.EhCacheManager;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.mgt.RememberMeManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.util.ByteSource;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.handler.SimpleMappingExceptionResolver;import javax.servlet.Filter;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.Properties;/**
* @author hehang on 2019-08-13
* @description sd
*/
@Configuration
public class ShiroConfig {
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
Map<String, Filter> filterMap = new LinkedHashMap<>();
filterMap.put("authc",formAuthenticationFilter());
shiroFilterFactoryBean.setFilters(filterMap);
//拦截器.
Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
//静态资源放行
filterChainDefinitionMap.put("/static/**", "anon");
//配置退出过滤器,其中的具体的退出代码Shiro已经替我们实现了
filterChainDefinitionMap.put("/logout", "logout");
//所有请求必须登陆
filterChainDefinitionMap.put("/**", "authc");
// 设置登陆链接
shiroFilterFactoryBean.setLoginUrl("/login");
// 登录成功后要跳转的链接
shiroFilterFactoryBean.setSuccessUrl("/index");
// 未授权链接
shiroFilterFactoryBean.setUnauthorizedUrl("/refuse");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
} /**
* 凭证匹配器
* （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了
* ）
* @return
*/ @Bean
public FormAuthenticationFilter formAuthenticationFilter(){
FormAuthenticationFilter formAuthenticationFilter = new CustomFormAuthenticationFilter();
formAuthenticationFilter.setPasswordParam("password");
formAuthenticationFilter.setUsernameParam("username");
formAuthenticationFilter.setRememberMeParam("rememberMe");
return formAuthenticationFilter;
}
@Bean
public HashedCredentialsMatcher hashedCredentialsMatcher(){
HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
hashedCredentialsMatcher.setHashAlgorithmName("md5");//散列算法:这里使用MD5算法;
hashedCredentialsMatcher.setHashIterations(2);//散列的次数，比如散列两次，相当于 md5(md5(""));
return hashedCredentialsMatcher;
} @Bean
public MyShiroRealm myShiroRealm(){
MyShiroRealm myShiroRealm = new MyShiroRealm();
myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
return myShiroRealm;
} @Bean
public SecurityManager securityManager(){
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setCacheManager(cacheManager());
securityManager.setSessionManager(sessionManager());
securityManager.setRememberMeManager(rememberMeManager());
securityManager.setRealm(myShiroRealm());
return securityManager;
}
@Bean
public CacheManager cacheManager(){
EhCacheManager cacheManager = new EhCacheManager();
cacheManager.setCacheManagerConfigFile("classpath:shiro-ehcache.xml");
return cacheManager;
}
@Bean
public SessionManager sessionManager(){
DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
sessionManager.setGlobalSessionTimeout(600000);
sessionManager.setDeleteInvalidSessions(true);
return sessionManager;
}
@Bean
public RememberMeManager rememberMeManager(){
CookieRememberMeManager rememberMeManager = new CookieRememberMeManager();
rememberMeManager.setCookie(rememberCookie());
return rememberMeManager;
}
@Bean
public SimpleCookie rememberCookie(){
SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
simpleCookie.setMaxAge(2592000);
return simpleCookie;
} /**
* 开启shiro aop注解支持.
* 使用代理方式;所以需要开启代码支持;
* @param securityManager
* @return
*/
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
} //注册时加密方法
public static final String md5(String password, String salt){
//加密方式
String hashAlgorithmName = "MD5";
//盐：为了即使相同的密码不同的盐加密后的结果也不同
ByteSource byteSalt = ByteSource.Util.bytes(salt);
//密码
Object source = password;
//加密次数
int hashIterations = 2;
SimpleHash result = new SimpleHash(hashAlgorithmName, source, byteSalt, hashIterations);
return result.toString();
}}

MainController

package com.jlwj.shiro.controller;import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;import javax.servlet.http.HttpServletRequest;
import java.util.Map;
import java.util.Random;@Controller
public class MainController {
@RequestMapping({"/","/index"})
public String index(){
return"/index";
} @RequestMapping("/asd")
public String asd(){
return"/asd";
} @RequestMapping("/login")
public String login(HttpServletRequest request, Map<String, Object> map) throws Exception{
System.out.println("HomeController.login()");
// 登录失败从request中获取shiro处理的异常信息。
// shiroLoginFailure:就是shiro异常类的全类名.
String exception = (String) request.getAttribute("shiroLoginFailure");
System.out.println("exception=" + exception);
String msg = "";
if (exception != null) {
if (UnknownAccountException.class.getName().equals(exception)) {
System.out.println("UnknownAccountException -- > 账号不存在：");
msg = "UnknownAccountException -- > 账号不存在：";
} else if (IncorrectCredentialsException.class.getName().equals(exception)) {
System.out.println("IncorrectCredentialsException -- > 密码不正确：");
msg = "IncorrectCredentialsException -- > 密码不正确：";
} else if ("kaptchaValidateFailed".equals(exception)) {
System.out.println("kaptchaValidateFailed -- > 验证码错误");
msg = "kaptchaValidateFailed -- > 验证码错误";
} else {
msg = "else >> "+exception;
System.out.println("else -- >" + exception);
}
}
map.put("msg", msg);
String code = String.valueOf(new Random().nextInt(1000000));
request.getSession().setAttribute("validateCode",code);
map.put("code",code);
// 此方法不处理登录成功,由shiro进行处理
return "/login";
} @RequestMapping("/refuse")
public String unauthorizedRole(){
return "403";
}}

UserInfoController，代表资源

package com.jlwj.shiro.controller;import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;@Controller
@RequestMapping("/userInfo")
public class UserInfoController { /**
* 用户查询.
* @return
*/
@RequestMapping("/userList")
@RequiresPermissions("userInfo:view")//权限管理;
public String userInfo(){
return "userInfo";
} /**
* 用户添加;
* @return
*/
@RequestMapping("/userAdd")
@RequiresPermissions("userInfo:add")//权限管理;
public String userInfoAdd(){
return "userInfoAdd";
} /**
* 用户删除;
* @return
*/
@RequestMapping("/userDel")
@RequiresPermissions("userInfo:del")//权限管理;
public String userDel(){
return "userInfoDel";
}
}

encache配置文件

持久化框架使用jpa，实体类要实现序列化接口，同时注意tostring方法的生成，排除调集合属性，这里就不贴出了

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Login</title>
</head>
<body>
验证码：<h4 th:text="${code}"></h4>
<form action="" method="post">
<p>账号：<input type="text" name="username" value="admin"/></p>
<p>密码：<input type="text" name="password" value="123456"/></p>
<p>验证码：<input type="text" name="randomcode" value="1234"/></p>
<p><input type="checkbox" name="rememberMe" />自动登陆</p>
<p><input type="submit" value="登录"/></p>
</form>
错误信息：<h4 th:text="${msg}"></h4>
</body>
</html>