【Shiro】Springboot集成Shiro（三）-阿里云开发者社区

【Shiro】Springboot集成Shiro（三）

2023-07-25 108

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： 【Shiro】Springboot集成Shiro（三）

【3.7】UserAdapter

1. package com.itheima.shiro.core.adapter;
2. 
3. import com.itheima.shiro.pojo.Resource;
4. import com.itheima.shiro.pojo.Role;
5. import com.itheima.shiro.pojo.User;
6. 
7. import java.util.List;
8. 
9. 
10. /**
11.  * @Description 后台登陆用户适配器接口
12.  */
13. 
14. public interface UserAdapter {
15. 
16.   /**
17.    * @Description 按用户名查找用户
18.    * @param loginName 登录名
19.    * @return
20.    */
21.   User findUserByLoginName(String loginName);
22. 
23.   /**
24.    * @Description 查找用户所有角色
25.    * @param userId 用户Id
26.    * @return
27.    */
28.   List<Role> findRoleByUserId(String userId);
29. 
30.   /**
31.    * @Description 查询用户有那些资源
32.    * @param userId 用户Id
33.    * @return
34.    */
35.   List<Resource> findResourceByUserId(String userId);
36. 
37. }

【3.8】UserAdapterImpl

1. package com.itheima.shiro.core.adapter.impl;
2. 
3. import com.itheima.shiro.constant.SuperConstant;
4. import com.itheima.shiro.core.adapter.UserAdapter;
5. import com.itheima.shiro.mapper.UserMapper;
6. import com.itheima.shiro.mappercustom.UserAdapterMapper;
7. import com.itheima.shiro.pojo.Resource;
8. import com.itheima.shiro.pojo.Role;
9. import com.itheima.shiro.pojo.User;
10. import com.itheima.shiro.pojo.UserExample;
11. import org.springframework.beans.factory.annotation.Autowired;
12. import org.springframework.stereotype.Component;
13. 
14. import java.util.HashMap;
15. import java.util.List;
16. import java.util.Map;
17. import java.util.concurrent.TimeUnit;
18. 
19. 
20. /**
21.  * @Description 后台登陆用户适配器接口实现
22.  */
23. @Component("userAdapter")
24. public class UserAdapterImpl implements UserAdapter {
25. 
26.   @Autowired
27.   private UserMapper userMapper;
28. 
29.   @Autowired
30.   private UserAdapterMapper userAdapterMapper;
31. 
32.   @Override
33.   public User findUserByLoginName(String loginName) {
34.     UserExample userExample = new UserExample();
35.     userExample.createCriteria().andEnableFlagEqualTo(SuperConstant.YES).andLoginNameEqualTo(loginName);
36.     List<User> userList = userMapper.selectByExample(userExample);
37.     if (userList.size()==1) {
38.       return userList.get(0);
39.     }else {
40.       return null;
41.     }
42.   }
43. 
44.   @Override
45.   public List<Role> findRoleByUserId(String userId) {
46.     Map<String, Object> values = new HashMap<String, Object>();
47.     values.put("userId", userId);
48.     values.put("enableFlag", SuperConstant.YES);
49.     List<Role> list = userAdapterMapper.findRoleByUserId(values);
50.     return list;
51.   }
52. 
53.   @Override
54.   public List<Resource> findResourceByUserId(String userId) {
55.     Map<String, Object> values = new HashMap<String, Object>();
56.     values.put("userId", userId);
57.     values.put("enableFlag", SuperConstant.YES);
58.     List<Resource> list=userAdapterMapper.findResourceByUserId(values);
59.     return list;
60.   }
61. }

5、ShiroConfig配置

【1】图解

【2】原理分析

（1）、创建SimpleCookie，访问项目时，会在客户端中cookie中存放ShiroSession的对

（2）、创建DefaultWebSessionManager会话管理器定义cookie机制、定时刷新、全局会话超时时间然后交

于DefaultWebSecurityManager权限管理器管理

（3）、创建自定义ShiroDbRealm实现，用于权限认证、授权、加密方式的管理，同时从数据库中取得相关的

角色、资源、用户的信息，然后交于DefaultWebSecurityManager权限管理器管理

（4）、创建DefaultWebSecurityManager权限管理器用于管理DefaultWebSessionManager会话管理器、ShiroDbRealm

（5）、创建lifecycleBeanPostProcessor和DefaultAdvisorAutoProxyCreator相互配合事项注解的权限鉴权

（6）、创建ShiroFilterFactoryBean的shiro过滤器指定权限管理器、同时启动连接链及登录URL、未登录的URL

的跳转

【3】ShiroConfig代码

1. package com.itheima.shiro.config;
2. 
3. 
4. import com.itheima.shiro.core.ShiroDbRealm;
5. import com.itheima.shiro.core.impl.ShiroDbRealmImpl;
6. import com.itheima.shiro.properties.PropertiesUtil;
7. import lombok.extern.log4j.Log4j2;
8. import org.apache.shiro.spring.LifecycleBeanPostProcessor;
9. import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
10. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
11. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
12. import org.apache.shiro.web.servlet.SimpleCookie;
13. import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
14. import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
15. import org.springframework.context.annotation.Bean;
16. import org.springframework.context.annotation.ComponentScan;
17. import org.springframework.context.annotation.Configuration;
18. import org.springframework.context.annotation.DependsOn;
19. 
20. import java.util.LinkedHashMap;
21. import java.util.List;
22. import java.util.Map;
23. 
24. /**
25.  * @Description：权限配置类
26.  */
27. @Configuration
28. @ComponentScan(basePackages = "com.itheima.shiro.core")
29. @Log4j2
30. public class ShiroConfig {
31. 
32. /**
33.      * @Description 创建cookie对象
34.      */
35. @Bean(name="sessionIdCookie")
36. public SimpleCookie simpleCookie(){
37. SimpleCookie simpleCookie = new SimpleCookie();
38.         simpleCookie.setName("ShiroSession");
39. return simpleCookie;
40.     }
41. 
42. /**
43.      * @Description 权限管理器
44.      */
45. @Bean(name="securityManager")
46. public DefaultWebSecurityManager defaultWebSecurityManager(){
47. DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
48.         securityManager.setRealm(shiroDbRealm());
49.         securityManager.setSessionManager(shiroSessionManager());
50. return securityManager;
51.     }
52. 
53. /**
54.      * @Description 自定义RealmImpl
55.      */
56. @Bean(name="shiroDbRealm")
57. public ShiroDbRealm shiroDbRealm(){
58. return new ShiroDbRealmImpl();
59.     }
60. 
61. 
62. /**
63.      * @Description 会话管理器
64.      */
65. @Bean(name="sessionManager")
66. public DefaultWebSessionManager shiroSessionManager(){
67. DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
68.         sessionManager.setSessionValidationSchedulerEnabled(false);
69.         sessionManager.setSessionIdCookieEnabled(true);
70.         sessionManager.setSessionIdCookie(simpleCookie());
71.         sessionManager.setGlobalSessionTimeout(3600000);
72. return sessionManager;
73.     }
74. 
75. /**
76.      * @Description 保证实现了Shiro内部lifecycle函数的bean执行
77.      */
78. @Bean(name = "lifecycleBeanPostProcessor")
79. public static LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
80. return new LifecycleBeanPostProcessor();
81.     }
82. 
83. /**
84.      * @Description AOP式方法级权限检查
85.      */
86. @Bean
87. @DependsOn("lifecycleBeanPostProcessor")
88. public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
89. DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
90.         defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
91. return defaultAdvisorAutoProxyCreator;
92.     }
93. 
94. /**
95.      * @Description 配合DefaultAdvisorAutoProxyCreator事项注解权限校验
96.      */
97. @Bean
98. public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor() {
99. AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();
100.         aasa.setSecurityManager(defaultWebSecurityManager());
101. return new AuthorizationAttributeSourceAdvisor();
102.     }
103. 
104. /**
105.      * @Description 过滤器链
106.      */
107. private Map<String, String> filterChainDefinition(){
108.         List<Object> list  = PropertiesUtil.propertiesShiro.getKeyList();
109.         Map<String, String> map = new LinkedHashMap<>();
110. for (Object object : list) {
111. String key = object.toString();
112. String value = PropertiesUtil.getShiroValue(key);
113.             log.info("读取防止盗链控制：---key{},---value:{}",key,value);
114.             map.put(key, value);
115.         }
116. return map;
117.     }
118. 
119. /**
120.      * @Description Shiro过滤器
121.      */
122. @Bean("shiroFilter")
123. public ShiroFilterFactoryBean shiroFilterFactoryBean(){
124. ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
125.         shiroFilter.setSecurityManager(defaultWebSecurityManager());
126.         shiroFilter.setFilterChainDefinitionMap(filterChainDefinition());
127.         shiroFilter.setLoginUrl("/login");
128.         shiroFilter.setUnauthorizedUrl("/login");
129. return shiroFilter;
130.     }
131. 
132. }