狂神shiro視訊詳細筆記
阿新 • • 發佈：2020-12-07
技術標籤：shirospring boot
文章目錄
一、 shiro初始環境pom.xml
<dependencies>
<!-- thymeleaf-shiro整合包 -->
<dependency>
<groupId>com.github.theborakompanioni</groupId>
<artifactId>thymeleaf- 二、前端頁面
2.1 user目錄下建立add.html和update.html
2.1.1
add.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>增加</title>
</head>
<body>
<h2>add</h2>
</body>
</html>
2.1.2
update.html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>更新</title>
</head>
<body>
<h2>update</h2>
</body>
</html>
2.2 templates目錄建立login.html和index.html
2.2.1
index.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
<head>
<meta charset="UTF-8">
<title>shiro</title>
</head>
<body>
<h1>首頁</h1>
<div th:if="${session.loginUser==null}">
<a th:href="@{/toLogin}">登入</a>
</div>
<p th:text="${msg}"></p>
<hr/>
<div shiro:hasPermission="ss:mm">
<a th:href="@{/user/add}">add</a>
</div>
<div shiro:hasPermission="user:update">
<a th:href="@{/user/update}">update</a>
</div>
<div th:if="${session.loginUser}">
<p><a th:href="@{/logout}">退出</a></p>
</div>
</body>
</html>
2.2.2
login.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
<meta charset="UTF-8">
<title>shiro登入</title>
</head>
<body>
<div>
<p th:text="${msg}" style="color: #ff0000"></p>
<form method="get" th:action="@{/login}">
<p>使用者名稱:<input type="text" name="username"></p>
<p>密 碼:<input type="text" name="password"></p>
<p><input type="submit" value="登入"></p>
</form>
</div>
</body>
</html>
三、連線資料庫和認證授權
3.1 config包下建立ShiroConfig和UserRealm
3.1.1
ShrioConfig
@Configuration
public class ShiroConfig {
//ShiroFilterFactoryBean 第三步
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
//設定安全管理器
shiroFilterFactoryBean.setSecurityManager(securityManager);
/*
新增shiro的內建過濾器
anon：無須認證就可以訪問
authc：必須認證了才可以訪問
perms：擁有對某個資源的許可權才能訪問
role:擁有某個角色才可以訪問
*/
Map<String, String> filterMap = new LinkedHashMap();
// filterMap.put("/user/add","authc");
// filterMap.put("/user/update","authc");
filterMap.put("/user/add","perms[ss:mm]");
filterMap.put("/user/update","perms[m:add]");
filterMap.put("/user/*","authc");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
//設定跳轉到登入頁面
shiroFilterFactoryBean.setLoginUrl("/toLogin");
//設定到未授權頁面
shiroFilterFactoryBean.setUnauthorizedUrl("/noauth");
return shiroFilterFactoryBean;
}
//DefaultWebSecurityManager 第二步
@Bean(name = "securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
//關聯realm
securityManager.setRealm(userRealm);
return securityManager;
}
//建立realm 域物件，需要自定義 第一步
@Bean(name = "userRealm")
public UserRealm getUserRealm(){
return new UserRealm();
}
//shiro 整合thymeleaf
@Bean
public ShiroDialect getShiroDialect(){
return new ShiroDialect();
}
}
解釋:
filterMap.put("/user/update",“perms[m:add]”); perms[]括號裡是字串，隨便字串都行,
資料庫perms欄位需要加入與perms[]括號裡面相同的字串
3.1.2
UserRealm
public class UserRealm extends AuthorizingRealm {
@Autowired
private UserService userService;
@Override //授權
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
System.out.println("-----授權了-----AuthorizationInfo");
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
// info.addStringPermission("user:add");
//從資料庫查許可權
Subject subject = SecurityUtils.getSubject();
User currentUser = (User) subject.getPrincipal();//其實就是拿認證成功的時候的那個user
info.addStringPermission(currentUser.getPerms());
return info;
}
@Override //認證
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
System.out.println("-----認證了-----AuthenticationInfo");
UsernamePasswordToken userToken = (UsernamePasswordToken) token;
//使用者名稱，密碼去資料庫取
User user = userService.queryUserByUsername(userToken.getUsername());
if (user==null){ //沒有這個人
return null; //其實就是丟擲UnknownAccountException異常
}
//之後密碼認證，shiro 它自己會做
SimpleAuthenticationInfo info=new SimpleAuthenticationInfo(user,user.getPassword(),"");
Subject currentSubject = SecurityUtils.getSubject();
Session session = currentSubject.getSession();
session.setAttribute("loginUser",user);
return info;
}
}
3.2 建立資料庫表
create table shiro(
id int auto_increment primary key ,
username varchar(50) not null,
password varchar(40) not null,
perms varchar(30)
);
application.properties
mybatis.type-aliases-package=com.kuang.pojo
mybatis.mapper-locations=classpath:mapper/*.xml
application.yml
spring:
datasource:
username: root
password: Root123
#?serverTimezone=UTC解決時區的報錯
url: jdbc:mysql://localhost:3306/shiro?serverTimezone=UTC&useUnicode=true&characterEncoding=utf-8
driver-class-name: com.mysql.jdbc.Driver
type: com.alibaba.druid.pool.DruidDataSource
#Spring Boot 預設是不注入這些屬性值的，需要自己繫結
#druid 資料來源專有配置
initialSize: 5
minIdle: 5
maxActive: 20
maxWait: 60000
timeBetweenEvictionRunsMillis: 60000
minEvictableIdleTimeMillis: 300000
validationQuery: SELECT 1 FROM DUAL
testWhileIdle: true
testOnBorrow: false
testOnReturn: false
poolPreparedStatements: true
#配置監控統計攔截的filters，stat:監控統計、log4j：日誌記錄、wall：防禦sql注入
#如果允許時報錯 java.lang.ClassNotFoundException: org.apache.log4j.Priority
#則匯入 log4j 依賴即可，Maven 地址： https://mvnrepository.com/artifact/log4j/log4j
filters: stat,wall,log4j
maxPoolPreparedStatementPerConnectionSize: 20
useGlobalDataSourceStat: true
connectionProperties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=500
四、目錄結構程式碼
1.controller包下建立MyController
@Controller
public class MyController {
@RequestMapping({"/","/index"})
public String toIndex(Model model){
model.addAttribute("msg","hello shiro!!!");
return "index";
}
@RequestMapping("/user/add")
public String add(){
return "user/add";
}
@RequestMapping("/user/update")
public String update(){
return "user/update";
}
@RequestMapping("/toLogin")
public String toLogin(){
return "login";
}
@RequestMapping("/login")
public String login(String username,String password,Model model){
//獲取當前輸入的使用者
Subject subject = SecurityUtils.getSubject();
//封裝使用者的資料
UsernamePasswordToken token = new UsernamePasswordToken(username,password);
//登入，沒有異常就說明登入成功
try {
subject.login(token);
return "index";
} catch (UnknownAccountException e) {
model.addAttribute("msg","使用者名稱錯誤");
return "login";
}catch (IncorrectCredentialsException e){
model.addAttribute("msg","密碼錯誤");
return "login";
}
}
//沒授權
@RequestMapping("/noauth")
@ResponseBody
public String unauthorized(){
return "沒經授權無法進入";
}
//退出
@RequestMapping("/logout")
public String logout(){
Subject currentUser = SecurityUtils.getSubject();
currentUser.logout();
System.out.println("退出了");
return "login";
}
}
2.mapper/UserMapper
@Mapper
@Repository
public interface UserMapper {
public User queryUserByUsername(String username);
}
3.service/UserService
public interface UserService {
public User queryUserByUsername(String username);
}
4.service/impl/UserServiceImpl
@Service
public class UserServiceImpl implements UserService {
@Autowired
private UserMapper userMapper;
@Override
public User queryUserByUsername(String username) {
return userMapper.queryUserByUsername(username);
}
}
5.resources/mapper/UserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.kuang.mapper.UserMapper">
<select id="queryUserByUsername" parameterType="String" resultType="User">
select * from user where username=#{username}
</select>
</mapper>