SpringMVC+Shiro权限管理-白红宇

SpringMVC+Shiro权限管理

阅读量：5776 次

发布时间：2019-06-18

本文共 18653 字，大约阅读时间需要 62 分钟。

1、什么是权限？example：

我有一个论坛，注册用户分为normal用户、manager用户

对论坛的帖子的操作有这些：

添加，删除，更新，查看，回复

我们规定：

normal用户只能：添加查看，回复

manager用户可以：删除，更新

normal，manager对应的是角色（role）

添加，删除，更新等对应的是权限（permission）

我们采用下面的逻辑创建权限表结构（不是绝对的，根据需要修改）

一个用户可以有多种角色（normal,manager,admin等等）

一个角色可以有多个用户（user1,user2,user3等等）

一个角色可以有多个权限（save,update,delete,query等等）

一个权限只属于一个角色（delete只属于manager角色）

我们创建四张表：

t_user用户表:设置了3个用户

-------------------------------

id + username + password

---+----------------+----------

1 + tom + 000000

2 + jack + 000000

3 + rose + 000000

---------------------------------

t_role角色表：设置3个角色

--------------

id + rolename

---+----------

1 + admin

2 + manager

3 + normal

--------------

t_user_role用户角色表：tom是admin和normal角色，jack是manager和normal角色，rose是normal角色

---------------------

user_id + role_id

-----------+-----------

1 + 1

1 + 3

2 + 2

2 + 3

3 + 3

---------------------

t_permission权限表：admin角色可以删除，manager角色可以添加和更新，normal角色可以查看

-----------------------------------

id + permissionname + role_id

----+------------------------+-----------

1 + add + 2

2 + del + 1

3 + update + 2

4 + query + 3

-----------------------------------

建立对应的POJO：

Java代码

package com.cn.pojo;

import java.util.HashSet;

import java.util.List;

import java.util.Set;

import javax.persistence.Entity;

import javax.persistence.GeneratedValue;

import javax.persistence.GenerationType;

import javax.persistence.Id;

import javax.persistence.JoinColumn;

import javax.persistence.JoinTable;

import javax.persistence.ManyToMany;

import javax.persistence.Table;

import javax.persistence.Transient;

import org.hibernate.validator.constraints.NotEmpty;

(name="t_user")

public class User {

private Integer id;

@NotEmpty(message="用户名不能为空")

private String username;

@NotEmpty(message="密码不能为空")

private String password;

private List<Role> roleList;//一个用户具有多个角色

@GeneratedValue(strategy=GenerationType.IDENTITY)

public Integer getId() {

return id;

}

public void setId(Integer id) {

this.id = id;

}

public String getUsername() {

return username;

}

public void setUsername(String username) {

this.username = username;

}

public String getPassword() {

return password;

}

public void setPassword(String password) {

this.password = password;

}

@ManyToMany

@JoinTable(name="t_user_role",joinColumns={
@JoinColumn(name="user_id")},inverseJoinColumns={
@JoinColumn(name="role_id")})

public List<Role> getRoleList() {

return roleList;

}

public void setRoleList(List<Role> roleList) {

this.roleList = roleList;

}

@Transient

public Set<String> getRolesName(){

List<Role> roles=getRoleList();

Set<String> set=new HashSet<String>();

for (Role role : roles) {

set.add(role.getRolename());

}

return set;

}

}

Java代码

package com.cn.pojo;

import java.util.ArrayList;

import java.util.List;

import javax.persistence.Entity;

import javax.persistence.GeneratedValue;

import javax.persistence.GenerationType;

import javax.persistence.Id;

import javax.persistence.JoinColumn;

import javax.persistence.JoinTable;

import javax.persistence.ManyToMany;

import javax.persistence.OneToMany;

import javax.persistence.Table;

import javax.persistence.Transient;

@Entity

@Table(name="t_role")

public class Role {

private Integer id;

private String rolename;

private List<Permission> permissionList;//一个角色对应多个权限

private List<User> userList;//一个角色对应多个用户

@GeneratedValue(strategy=GenerationType.IDENTITY)

public Integer getId() {

return id;

}

public void setId(Integer id) {

this.id = id;

}

public String getRolename() {

return rolename;

}

public void setRolename(String rolename) {

this.rolename = rolename;

}

@OneToMany(mappedBy="role")

public List<Permission> getPermissionList() {

return permissionList;

}

public void setPermissionList(List<Permission> permissionList) {

this.permissionList = permissionList;

}

@ManyToMany

@JoinTable(name="t_user_role",joinColumns={
@JoinColumn(name="role_id")},inverseJoinColumns={
@JoinColumn(name="user_id")})

public List<User> getUserList() {

return userList;

}

public void setUserList(List<User> userList) {

this.userList = userList;

}

@Transient

public List<String> getPermissionsName(){

List<String> list=new ArrayList<String>();

List<Permission> perlist=getPermissionList();

for (Permission per : perlist) {

list.add(per.getPermissionname());

}

return list;

}

}

Java代码

package com.cn.pojo;

import javax.persistence.Entity;

import javax.persistence.GeneratedValue;

import javax.persistence.GenerationType;

import javax.persistence.Id;

import javax.persistence.JoinColumn;

import javax.persistence.ManyToOne;

import javax.persistence.Table;

@Entity

@Table(name="t_permission")

public class Permission {

private Integer id;

private String permissionname;

private Role role;//一个权限对应一个角色

@GeneratedValue(strategy=GenerationType.IDENTITY)

public Integer getId() {

return id;

}

public void setId(Integer id) {

this.id = id;

}

public String getPermissionname() {

return permissionname;

}

public void setPermissionname(String permissionname) {

this.permissionname = permissionname;

}

@ManyToOne

@JoinColumn(name="role_id")

public Role getRole() {

return role;

}

public void setRole(Role role) {

this.role = role;

}

}

使用SHIRO的步骤：

1，导入jar

2，配置web.xml

3，建立dbRelm

4，在Spring中配置

pom.xml中配置如下：

Xml代码

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>com.hyx</groupId>

<artifactId>springmvc</artifactId>

<packaging>war</packaging>

<version>0.0.1-SNAPSHOT</version>

<name>springmvc Maven Webapp</name>

<url>http://maven.apache.org</url>

<dependencies>

<dependency>

<groupId>junit</groupId>

<artifactId>junit</artifactId>

<version>3.8.1</version>

<scope>test</scope>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>3.2.4.RELEASE</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-jdbc</artifactId>

<version>3.2.4.RELEASE</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-orm</artifactId>

<version>3.2.4.RELEASE</version>

</dependency>

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-core</artifactId>

<version>4.2.5.Final</version>

</dependency>

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-ehcache</artifactId>

<version>4.2.5.Final</version>

</dependency>

<dependency>

<groupId>net.sf.ehcache</groupId>

<artifactId>ehcache</artifactId>

<version>2.7.2</version>

</dependency>

<dependency>

<groupId>commons-dbcp</groupId>

<artifactId>commons-dbcp</artifactId>

<version>1.4</version>

</dependency>

<dependency>

<groupId>mysql</groupId>

<artifactId>mysql-connector-java</artifactId>

<version>5.1.26</version>

</dependency>

<dependency>

<groupId>javax.inject</groupId>

<artifactId>javax.inject</artifactId>

<version>1</version>

</dependency>

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-validator</artifactId>

<version>5.0.1.Final</version>

</dependency>

<dependency>

<groupId>org.codehaus.jackson</groupId>

<artifactId>jackson-mapper-asl</artifactId>

<version>1.9.13</version>

</dependency>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>jstl</artifactId>

<version>1.2</version>

</dependency>

<dependency>

<groupId>javax.servlet</groupId>

<artifactId>servlet-api</artifactId>

<version>2.5</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

<version>1.2.2</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-web</artifactId>

<version>1.2.2</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-spring</artifactId>

<version>1.2.2</version>

</dependency>

</dependencies>

<build>

<finalName>springmvc</finalName>

<plugins>

<plugin>

<groupId>org.mortbay.jetty</groupId>

<artifactId>jetty-maven-plugin</artifactId>

<configuration>

<scanIntervalSeconds>10</scanIntervalSeconds>

<webApp>

<contextPath>/</contextPath>

</webApp>

<connectors>

<connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">

<port>80</port>

<maxIdleTime>60000</maxIdleTime>

</connector>

</connectors>

</configuration>

</plugin>

</plugins>

</build>

</project>

web.xml中的配置：

Xml代码

<?xml version="1.0" encoding="UTF-8" ?>

<web-app version="2.5"

xmlns="http://java.sun.com/xml/ns/javaee"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xsi:schemaLocation="http://java.sun.com/xml/ns/javaee

http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">

<display-name>Archetype Created Web Application</display-name>

<filter>

<filter-name>opensessioninview</filter-name>

<filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilter</filter-class>

</filter>

<filter-mapping>

<filter-name>opensessioninview</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<servlet>

<servlet-name>springmvc</servlet-name>

<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

<load-on-startup>1</load-on-startup>

</servlet>

<servlet-mapping>

<servlet-name>springmvc</servlet-name>

<url-pattern>/</url-pattern>

</servlet-mapping>

<context-param>

<param-name>contextConfigLocation</param-name>

<param-value>classpath:applicationContext*.xml</param-value>

</context-param>

<listener>

<listener-class>

org.springframework.web.context.ContextLoaderListener

</listener-class>

</listener>

<filter>

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>shiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

</web-app>

Java代码

package com.cn.service;

import java.util.List;

import javax.inject.Inject;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.springframework.stereotype.Service;

import org.springframework.transaction.annotation.Transactional;

import com.cn.pojo.Role;

import com.cn.pojo.User;

@Service

@Transactional

public class MyShiro extends AuthorizingRealm{

@Inject

private UserService userService;

* 权限认证

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

//获取登录时输入的用户名

String loginName=(String) principalCollection.fromRealm(getName()).iterator().next();

//到数据库查是否有此对象

User user=userService.findByName(loginName);

if(user!=null){

//权限信息对象info,用来存放查出的用户的所有的角色（role）及权限（permission）

SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();

//用户的角色集合

info.setRoles(user.getRolesName());

//用户的角色对应的所有权限，如果只使用角色定义访问权限，下面的四行可以不要

List<Role> roleList=user.getRoleList();

for (Role role : roleList) {

info.addStringPermissions(role.getPermissionsName());

}

return info;

}

return null;

}

* 登录认证;

@Override

protected AuthenticationInfo doGetAuthenticationInfo(

AuthenticationToken authenticationToken) throws AuthenticationException {

//UsernamePasswordToken对象用来存放提交的登录信息

UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;

//查出是否有此用户

User user=userService.findByName(token.getUsername());

if(user!=null){

//若存在，将此用户存放到登录认证info中

return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());

}

return null;

}

}

在spring的配置文件中配置，为了区别spring原配置和shiro我们将shiro的配置独立出来。

applicationContext-shiro.xml

Xml代码

<?xml version="1.0" encoding="UTF-8" ?>

<beans xmlns="http://www.springframework.org/schema/beans"

xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

xmlns:aop="http://www.springframework.org/schema/aop"

xmlns:tx="http://www.springframework.org/schema/tx"

xmlns:context="http://www.springframework.org/schema/context"

xsi:schemaLocation="

http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd

http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd

http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd

http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="realm" ref="myShiro"/>

<property name="cacheManager" ref="cacheManager"/>

</bean>

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<property name="securityManager" ref="securityManager"/>

<property name="loginUrl" value="/login"/>

<property name="successUrl" value="/user"/>

<property name="unauthorizedUrl" value="/403"/>

<property name="filterChainDefinitions">

<value>

/static/**=anon

/user=perms[user:query]

/user/add=roles[manager]

/user/del/**=roles[admin]

/user/edit/**=roles[manager]

/** = authc

</value>

</property>

</bean>

<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

</beans>

用于登录，登出，权限跳转的控制：

Java代码

package com.cn.controller;

import javax.validation.Valid;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.validation.BindingResult;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.RequestMethod;

import org.springframework.web.servlet.mvc.support.RedirectAttributes;

import com.cn.pojo.User;

@Controller

public class HomeController {

@RequestMapping(value="/login",method=RequestMethod.GET)

public String loginForm(Model model){

model.addAttribute("user", new User());

return "/login";

}

@RequestMapping(value="/login",method=RequestMethod.POST)

public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){

try {

if(bindingResult.hasErrors()){

return "/login";

}

//使用权限工具进行用户登录，登录成功后跳到shiro配置的successUrl中，与下面的return没什么关系！

SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));

return "redirect:/user";

} catch (AuthenticationException e) {

redirectAttributes.addFlashAttribute("message","用户名或密码错误");

return "redirect:/login";

}

}

@RequestMapping(value="/logout",method=RequestMethod.GET)

public String logout(RedirectAttributes redirectAttributes ){

//使用权限管理工具进行用户的退出，跳出登录，给出提示信息

SecurityUtils.getSubject().logout();

redirectAttributes.addFlashAttribute("message", "您已安全退出");

return "redirect:/login";

}

@RequestMapping("/403")

public String unauthorizedRole(){

return "/403";

}

}

三个主要的JSP：

login.jsp:

Html代码

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>My JSP 'MyJsp.jsp' starting page</title>

</head>

<body>

<h1>登录页面----${message }</h1>

<img alt="" src="/static/img/1.jpg">

<form:form action="/login" commandName="user" method="post">

用户名：<form:input path="username"/> <form:errors path="username" cssClass="error"/> <br/>

密   码：<form:password path="password"/> <form:errors path="password" cssClass="error" /> <br/>

<form:button name="button">submit</form:button>

</form:form>

</body>

</html>

user.jsp:

Html代码

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>用户列表</title>

</head>

<body>

<h1>${message }</h1>

<h1>用户列表--<a href="/user/add">添加用户</a>---<a href="/logout">退出登录</a> </h1>

<h2>权限列表</h2>

<shiro:authenticated>用户已经登录显示此内容</shiro:authenticated>

<shiro:hasRole name="manager">manager角色登录显示此内容</shiro:hasRole>

<shiro:hasRole name="admin">admin角色登录显示此内容</shiro:hasRole>

<shiro:hasRole name="normal">normal角色登录显示此内容</shiro:hasRole>

<shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**</shiro:hasAnyRoles>

<shiro:principal/>-显示当前登录用户名

<shiro:hasPermission name="add">add权限用户显示此内容</shiro:hasPermission>

<shiro:hasPermission name="user:query">query权限用户显示此内容<shiro:principal/></shiro:hasPermission>

<shiro:lacksPermission name="user:del"> 不具有user:del权限的用户显示此内容 </shiro:lacksPermission>

<ul>

<c:forEach items="${userList }" var="user">

<li>用户名：${user.username }----密码：${user.password }----<a href="/user/edit/${user.id}">修改用户</a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户</a></li>

</c:forEach>

</ul>

<img alt="" src="/static/img/1.jpg">

<script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js"></script>

<script>

$(function(){

$(".del").click(function(){

var id=$(this).attr("ref");

$.ajax({

type:"delete",

url:"/user/del/"+id,

success:function(e){

}

});

});

});

</script>

</body>

</html>

403.jsp:

Html代码

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>

<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>

<title>权限错误</title>

</head>

<body>

<h1>对不起，您没有权限请求此连接！</h1>

<img alt="" src="/static/img/1.jpg">

</body>

</html>

转载于:https://my.oschina.net/inchlifc/blog/1573470

你可能感兴趣的文章

DLA实现跨地域、跨实例的多AnalyticDB读写访问

【348天】每日项目总结系列086（2018.01.19）

查看>>

【294天】我爱刷题系列053（2017.11.26）

查看>>

Microsoft发布了Azure Bot Service和LUIS的GA版

查看>>

Google发布Puppeteer 1.0

2016/08/25 The Secret Assumption of Agile

查看>>

(Portal 开发读书笔记）Portlet间交互-PortletSession

查看>>

搭建vsftpd服务器，使用匿名账户登入

查看>>

JAVA中循环删除list中元素的方法总结

查看>>

Java虚拟机管理的内存运行时数据区域解释

查看>>

人人都会深度学习之Tensorflow基础快速入门

查看>>

ChPlayer播放器的使用

查看>>

js 经过修改改良的全浏览器支持的软键盘，随机排列

查看>>

Mysql读写分离

查看>>

Oracle 备份与恢复学习笔记（5_1）

查看>>

Oracle 备份与恢复学习笔记（14）

查看>>