shiro授权+注解式开发

shiro授权和注解式开发

1、shiro授权角色、权限

2、Shiro的注解式开发

ShiroUserMapper.xml

 1 <select id="getRolesByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
 2   select r.roleid from t_shiro_user u,t_shiro_user_role ur,t_shiro_role r
 3     where u.userid = ur.userid and ur.roleid = r.roleid
 4     and u.userid = #{userid}
 5 </select>
 6 <select id="getPersByUserId" resultType="java.lang.String" parameterType="java.lang.Integer">
 7   select p.permission from t_shiro_user u,t_shiro_user_role ur,t_shiro_role_permission rp,t_shiro_permission p
 8   where u.userid = ur.userid and ur.roleid = rp.roleid and rp.perid = p.perid
 9   and u.userid = #{userid}
10 </select>

ShiroUserService

 1 /**
 2      * 查询角色
 3      * @param userid
 4      * @return
 5      */
 6     Set<String> getRolesByUserId(Integer userid);
 7
 8     /**
 9      * 查询角色权限
10      * @param userid
11      * @return
12      */
13     Set<String> getPersByUserId(Integer userid);

service实现类

 @Override
    public Set<String> getRolesByUserId(Integer userid) {
        return shiroUserMapper.getRolesByUserId(userid);
    }

    @Override
    public Set<String> getPersByUserId(Integer userid) {
        return shiroUserMapper.getPersByUserId(userid);
    }

重写自定义realm中的授权方法

 1  /*
 2         授权的方法
 3          */
 4     @Override
 5     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
 6         String uname = principalCollection.getPrimaryPrincipal().toString();
 7         ShiroUser shiroUser = this.shiroUserService.queryByName(uname);
 8         Set<String> perids = this.shiroUserService.getPersByUserId(shiroUser.getUserid());
 9         Set<String> roleIds = this.shiroUserService.getRolesByUserId(shiroUser.getUserid());
10         SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
11         info.setRoles(roleIds);
12         info.setStringPermissions(perids);
13         return info;
14
15     }

 

注解式开发

  @RequiresUser:表示当前Subject已经身份验证或者通过记住我登录的

  @RequiresGuest:表示当前Subject没有身份验证或者通过记住我登录过，即是游客身份

  @RequiresRoles(value = {"admin","user"},logical = Logical.AND):表示当前Subject需要角色admin和user

  @RequiresPermissions(value = {"user:delete","user:b"},logical = Logical.OR):表示当前Subject需要权限user:delete或者user:b

Controller层

 1 @RequiresUser
 2 @ResponseBody
 3 @RequestMapping("/passUser")
 4     public String passUser(){
 5
 6     return "身份认证成功，能够访问！！！";
 7     }
 8
 9     @RequiresRoles(value = {"2","3"}, logical = Logical.OR) //value：不同或者多个的角色，logical：value值的拼接方式可以是AND或者OR
10     @ResponseBody
11     @RequestMapping("/passRole")
12     public String passRole(){
13
14         return "角色认证成功，能够访问！！！";
15     }
16
17     @RequiresPermissions(value = {"user:update","user:create"}, logical = Logical.OR)
18     @ResponseBody
19     @RequestMapping("/passPer")
20     public String passPer(){
21
22         return "权限认证成功，能够访问！！！";
23     }

springmvc-servlet.xml

 1 <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
 2       depends-on="lifecycleBeanPostProcessor">
 3     <property name="proxyTargetClass" value="true"></property>
 4 </bean>
 5 <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
 6     <property name="securityManager" ref="securityManager"/>
 7 </bean>
 8
 9 <bean id="exceptionResolver" class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">
10     <property name="exceptionMappings">
11         <props>
12             <prop key="org.apache.shiro.authz.UnauthorizedException">
13                 unauthorized
14             </prop>
15         </props>
16     </property>
17     <property name="defaultErrorView" value="unauthorized"/>
18 </bean>

在main.jsp中添加

 1 <ul>
 2     shiro注解
 3     <li>
 4         <a href="${pageContext.request.contextPath}/passUser">用户认证</a>
 5     </li>
 6     <li>
 7         <a href="${pageContext.request.contextPath}/passRole">角色</a>
 8     </li>
 9     <li>
10         <a href="${pageContext.request.contextPath}/passPer">权限认证</a>
11     </li>
12 </ul>

用户zs身份认证，未认证。登录即可访问

用户ls角色认证，不同角色有不同的访问权限，即使zs登录也不可以访问此页面

权限认证结果图同上，
  从代码来看
             @RequiresPermissions(value = {"user:update","user:create"}, logical = Logical.OR)
    @ResponseBody
    @RequestMapping("/passPer")
    public String passPer(){

        return "权限认证成功，能够访问！！！";
    }

拥有  "user:update","user:create"  这两个权限的即可访问此页面。从顶部的图中可以看出那些用户对应了哪些权限。

谢谢观看！！！