【Shiro】08 SpringBoot整合

需要的依赖的坐标：

        <!-- Shiro依赖 -->
        <dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
        </dependency>

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring-boot-web-starter</artifactId>
            <version>1.5.3</version>
        </dependency>
        
        <!-- Thymeleaf模版引擎 -->
        <dependency>
            <groupId>org.thymeleaf</groupId>
            <artifactId>thymeleaf-spring5</artifactId>
        </dependency>

        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-java8time</artifactId>
        </dependency>
        
        <!-- web组件 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

【配置编写】

先编写自定义Realm：

package cn.dai.shiro;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

/**
 * @author DaiZhiZhou
 * @file Shiro
 * @create 2020-08-01 22:44
 */
public class UserRealm extends AuthorizingRealm {

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        String principal = authenticationToken.getPrincipal().toString();

        if ("xxx".equals(principal)) return new SimpleAuthenticationInfo(principal, "123456", this.getName());

        return null;
    }

}

再编写配置类：

package cn.dai.config;

import cn.dai.shiro.UserRealm;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * @author DaiZhiZhou
 * @file Shiro
 * @create 2020-08-01 22:39
 */
@Configuration
public class ShiroConfiguration {

    
    @Bean("realm") /* 自定义Realm配置 */
    public Realm getRealm() {
        return new UserRealm();
    }

    @Bean("defaultWebSecurityManager") /* 注入安全管理器 */
    public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(realm);
        return defaultWebSecurityManager;
    }

    @Bean("shiroFilterFactoryBean") /* 注入Shiro过滤器工厂Bean */
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
        return shiroFilterFactoryBean;
    }
}

配置Controller：

package cn.dai.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.HttpSession;

/**
 * @author DaiZhiZhou
 * @file Shiro
 * @create 2020-08-01 22:53
 */
@Controller
public class AccessController {
    
    @RequestMapping("logout")
    public String logout() { 
        SecurityUtils.getSubject().logout();
        return "redirect:/loginview"; // 账号退出，重定向到登录页
    }
    
    @RequestMapping("loginview")
    public String login() {
        return "login"; // 跳转登陆页面
    }
    
    @RequestMapping("login")
    public String login(String username, String password, HttpSession session) {
        try {
            Subject subject = SecurityUtils.getSubject();
            subject.login(new UsernamePasswordToken(username, password));
            return "redirect:/index"; // login方法执行没出现异常，登陆正常
        } catch (UnknownAccountException unknownAccountException) {
            unknownAccountException.printStackTrace();
            System.out.println("用户名错误");
        } catch (IncorrectCredentialsException incorrectCredentialsException) {
            incorrectCredentialsException.printStackTrace();
            System.out.println("密码错误");
        } catch (Exception exception) {
            exception.printStackTrace();
        }
        
        return "redirect:/loginview";
    }
    
}

然后再更改权限控制：

package cn.dai.config;

import cn.dai.shiro.UserRealm;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;

/**
 * @author DaiZhiZhou
 * @file Shiro
 * @create 2020-08-01 22:39
 */
@Configuration
public class ShiroConfiguration {


    @Bean("realm") /* 自定义Realm配置 */
    public Realm getRealm() {
        return new UserRealm();
    }

    @Bean("defaultWebSecurityManager") /* 注入安全管理器 */
    public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(realm);
        return defaultWebSecurityManager;
    }

    @Bean("shiroFilterFactoryBean") /* 注入Shiro过滤器工厂Bean */
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);

        HashMap<String, String> map = new HashMap<>();
        
        map.put("/login", "anon"); // 登录shiro控制程序，随意访问
        map.put("/loginview", "anon"); // 登录页面随意访问
        map.put("/logout", "anon"); //退出页面随意访问
        map.put("/**", "authc"); // 其余资源都必须授权访问
        
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        shiroFilterFactoryBean.setLoginUrl("/login");
        return shiroFilterFactoryBean;
    }
}