shiro三连斩之第三斩，整合 springboot

shiro爱springboot中使用 ，还有thymeleaf前端框架。主要是如何配置

pom.xml配置依赖

<?xml version="1.0" encoding="UTF-8"?>

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

    <modelVersion>4.0.0</modelVersion>

    <parent>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-parent</artifactId>

        <version>2.1.3.RELEASE</version>

        <relativePath/> <!-- lookup parent from repository -->

    </parent>

    <groupId>com</groupId>

    <artifactId>bpms</artifactId>

    <version>0.0.1-SNAPSHOT</version>

    <name>bpms</name>

    <description>Demo project for Spring Boot</description>

    <properties>

        <java.version>1.8</java.version>

    </properties>

    <dependencies>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-thymeleaf</artifactId>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-web</artifactId>

        </dependency>

        <dependency>

            <groupId>org.mybatis.spring.boot</groupId>

            <artifactId>mybatis-spring-boot-starter</artifactId>

            <version>2.0.0</version>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-devtools</artifactId>

            <scope>runtime</scope>

        </dependency>

        <dependency>

            <groupId>mysql</groupId>

            <artifactId>mysql-connector-java</artifactId>

            <scope>runtime</scope>

        </dependency>

        <dependency>

            <groupId>org.springframework.boot</groupId>

            <artifactId>spring-boot-starter-test</artifactId>

            <scope>test</scope>

        </dependency>

        <!--json格式转换-->

        <dependency>

            <groupId>com.fasterxml.jackson.core</groupId>

            <artifactId>jackson-databind</artifactId>

            <version>2.9.8</version>

        </dependency>

        <!--分页插件-->

        <dependency>

            <groupId>com.github.pagehelper</groupId>

            <artifactId>pagehelper-spring-boot-starter</artifactId>

            <version>1.2.3</version>

        </dependency>

        <!--认证，授权，加密相关-->

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-web</artifactId>

            <version>1.4.0</version>

        </dependency>

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-spring</artifactId>

            <version>1.4.0</version>

        </dependency>

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-core</artifactId>

            <version>1.4.0</version>

        </dependency>

        <!--Druid提供强大的监控和扩展功能-->

        <dependency>

            <groupId>com.alibaba</groupId>

            <artifactId>druid-spring-boot-starter</artifactId>

            <version>1.1.14</version>

        </dependency>

        <!--thyemleaf中支持shiro-->

        <dependency>

            <groupId>com.github.theborakompanioni</groupId>

            <artifactId>thymeleaf-extras-shiro</artifactId>

            <version>2.0.0</version>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.springframework.boot</groupId>

                <artifactId>spring-boot-maven-plugin</artifactId>

            </plugin>

            <plugin>

                <groupId>org.mybatis.generator</groupId>

                <artifactId>mybatis-generator-maven-plugin</artifactId>

                <version>1.3.7</version>

                <configuration>

                    <overwrite>true</overwrite>

                    <configurationFile>${basedir}/src/main/resources/generatorConfig.xml</configurationFile>

                </configuration>

                <dependencies>

                    <dependency>

                        <groupId>mysql</groupId>

                        <artifactId>mysql-connector-java</artifactId>

                        <version>5.1.47</version>

                    </dependency>

                </dependencies>

            </plugin>

        </plugins>

    </build>

</project>

Shiro配置文件的设置

package com.bpms.config;

import at.pollux.thymeleaf.shiro.dialect.ShiroDialect;

import com.bpms.shiro.CustomRealm;

import org.apache.shiro.authc.credential.HashedCredentialsMatcher;

import org.apache.shiro.cache.MemoryConstrainedCacheManager;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;

import org.springframework.beans.factory.annotation.Qualifier;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;

import java.util.Map;

/*shiro的注册，springboot没有配置文件，只有通过java类的形式进行注册，

关于shiro一共用 普通java类，SSM框架，springboot分别写了三遍，原理大致是一样的。区别在于怎么配置

1.shiro过滤器，  对登录的用户进行 认证，授权。对url路径进行的拦截，需要shiro过滤器

2.shiro管理器，管理认证 授权 缓存 等等。但是都需要创建配置。首先创建安全管理器，去管理各种组件。

3.shiro自定义域。shiro安全管理器中认证需要的组件

4.密码匹配器。

5.缓存

6.使shiro权限注解生效

7.对类进行aop代理

8.对thymeleaf进行支持

*/

@Configuration//说明这个被为配置信息类，spring 把这个类作为配置文件处理，把里面被@Bean修饰的方法返回的对象交给IOC容器管理。注入需要的地方

                //这个注入，好像时方法中的参数。会被自动调用

public class ShiroConfig {

    //Shiro过滤器配置，并注入安全管理器

    @Bean

    public ShiroFilterFactoryBean shiroFilterFactoryBean(@Qualifier("sm") DefaultWebSecurityManager securityManager) {

        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();

        bean.setLoginUrl("/login.html");

        bean.setUnauthorizedUrl("/403.html");

        Map map = new LinkedHashMap();

        map.put("/login.html", "anon");

        map.put("/doLogin", "anon");

        map.put("/css/**", "anon");

        map.put("/static/**", "anon");

        map.put("/js/**", "anon");

        map.put("/images/**", "anon");

        map.put("/*", "authc");

        bean.setFilterChainDefinitionMap(map);

        bean.setSecurityManager(securityManager);

        return bean;

    }

    //Shiro安全管理器，把域放入安全管理器

    @Bean("sm")

    public DefaultWebSecurityManager securityManager(CustomRealm customRealm) {

        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

        securityManager.setRealm(customRealm);

        return securityManager;

    }

    //配置自定义域，可以注入密码匹配器

    @Bean

    public CustomRealm customRealm(HashedCredentialsMatcher matcher, MemoryConstrainedCacheManager manager) {

        CustomRealm realm = new CustomRealm();

        realm.setCredentialsMatcher(matcher);//注入

        realm.setCacheManager(manager);

        return realm;

    }

    //密码匹配器

    @Bean

    public HashedCredentialsMatcher matcher() {

        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();

        matcher.setHashAlgorithmName("md5");

        matcher.setHashIterations(2);

        return matcher;

    }

    //缓存

    @Bean

    public MemoryConstrainedCacheManager cacheManager() {

        MemoryConstrainedCacheManager manager = new MemoryConstrainedCacheManager();

        return manager;

    }

    //使Shiro权限注解生效。让controller中添加的 对权限，或者角色 后台拦截的标签生效

    @Bean

    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {

        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();

        advisor.setSecurityManager(securityManager);

        return advisor;

    }

    //对类进行aop代理。shiro的认证功能 属于在请求到达方法前进行的，切面编程。执行aop代理

    @Bean

    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {

        DefaultAdvisorAutoProxyCreator creator = new DefaultAdvisorAutoProxyCreator();

        creator.setProxyTargetClass(true);

        return creator;

    }

    //支持thyemleaf

    @Bean

    public ShiroDialect shiroDialect() {

        ShiroDialect dialect = new ShiroDialect();

        return dialect;

    }

}

Shiro配置文件中需要的自定义域的编写，和Shiro第二斩的中一致

package com.bpms.shiro;

import com.bpms.pojo.User;

import com.bpms.service.AuthService;

import com.bpms.service.UserService;

import org.apache.shiro.authc.*;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.apache.shiro.util.ByteSource;

import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;

import java.util.List;

import java.util.Set;

public class CustomRealm extends AuthorizingRealm {

    @Autowired

    private UserService userService;

    @Autowired

    private AuthService authService;

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        User user = (User)principalCollection.getPrimaryPrincipal();

        List<String> list = authService.findPerms(user.getUserId());

        for(String str : list){

            System.out.println("授权："+str);

        }

        Set<String> perms= new HashSet<>(list);

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

        info.setStringPermissions(perms);

        return info;

    }

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        String userName = (String) authenticationToken.getPrincipal();

        User user  = userService.findUserByName(userName);

        if(user == null){

            throw new UnknownAccountException("unkown account");

        }

        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user,user.getPassword(),this.getClass().getName());

        info.setCredentialsSalt(ByteSource.Util.bytes(user.getSalt()));

        return info;

    }

}

前端使用thymeleaf框架，使用shiro的标签

//在thymeleaf框架中，shiro:hasPermission="sys:user:save" 修饰的标签，如果当前用户的权限中没有 匹配 sys:user:save 字段的。就不会显示。后台的拦截，参考shiro第二斩

　　//就是配置的方式不同，在使用方面是一样的。

//在html标签中做一下声明，这个HTML页面为thymeleaf ，并且可以使用 shiro标签

　　<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">

 <a shiro:hasPermission="sys:user:save" class="easyui-linkbutton" data-options="iconCls:'icon-add'" onclick="oepnAddDialog()">添加</a>

 <a shiro:hasPermission="sys:user:update" class="easyui-linkbutton" data-options="iconCls:'icon-edit'" onclick="openModifyDialog()">修改</a>

 <a shiro:hasPermission="sys:user:delete" class="easyui-linkbutton" data-options="iconCls:'icon-remove'" onclick="deleteUser()">删除</a>