SpringBoot+Shiro搭建权限管理系统(Demo)

搭建SpringBoot基本框架

pom.xml导入MyBatis Plus依赖

        <dependency>
            <groupId>com.baomidou</groupId>
            <artifactId>mybatis-plus-boot-starter</artifactId>
            <version>3.4.0</version>
        </dependency>

application.yml添加数据源配置

spring:
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/shiroadmin?serverTimezone=UTC&useUnicode=true&characterEncoding=utf8&useSSL=false
    username: root
    password: root

创建数据库

使用mybatis plus代码生成器生成entity

1.添加依赖

<dependency>
<groupId>com.baomidou</groupId>
<artifactId>mybatis-plus-generator</artifactId>
<version>3.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.velocity</groupId>
<artifactId>velocity</artifactId>
<version>1.7</version>
</dependency>

2.运行Main方法

public class Main {
    public static void main(String[] args) {
        //创建generator对象
        AutoGenerator autoGenerator = new AutoGenerator();
        //数据源
        DataSourceConfig dataSourceConfig = new DataSourceConfig();
        dataSourceConfig.setDbType(DbType.MYSQL);
        dataSourceConfig.setUrl("jdbc:mysql://localhost:3306/shiroadmin?serverTimezone=UTC&useUnicode=true&characterEncoding=utf8&useSSL=false");
        dataSourceConfig.setUsername("root");
        dataSourceConfig.setPassword("root");
        dataSourceConfig.setDriverName("com.mysql.cj.jdbc.Driver");
        autoGenerator.setDataSource(dataSourceConfig);
        //全局配置
        GlobalConfig globalConfig = new GlobalConfig();
        globalConfig.setOutputDir(System.getProperty("user.dir")+"/src/main/java");
        //创建好之后打开文件
        globalConfig.setOpen(false);
        globalConfig.setAuthor("Jesse");
        globalConfig.setServiceName("%sService");
        autoGenerator.setGlobalConfig(globalConfig);
        //包信息
        PackageConfig packageConfig = new PackageConfig();
        packageConfig.setParent("com.glg.shiroadmin");

        packageConfig.setController("controller");
        packageConfig.setService("service");
        packageConfig.setServiceImpl("service.impl");
        packageConfig.setEntity("entity");
        packageConfig.setMapper("mapper");
        autoGenerator.setPackageInfo(packageConfig);
        //配置策略
        StrategyConfig strategyConfig = new StrategyConfig();
        strategyConfig.setEntityLombokModel(true);
        strategyConfig.setTablePrefix("tb_");
        //开启字段驼峰命名
        strategyConfig.setColumnNaming(NamingStrategy.underline_to_camel);
        autoGenerator.setStrategy(strategyConfig);

        autoGenerator.execute();
    }
}

MyBatis Plus查询功能测试

@Controller
public class UserController {
    @Autowired
    UserService userService;

    @GetMapping("/userList")
    @ResponseBody
    public List<User> getUserList(){
        List<User> userList = userService.getAllUser();
        return userList;
    }

添加用户角色和权限查询方法

根据用户名查询角色 findRoleByUser，
根据对应的角色查询权限 findPermissionByRole

public interface RoleMapper extends BaseMapper<Role> {
//根据用户查询角色
    List<Role> findRoleByUser(@Param("user") User user);
}

在resource下创建mapper包，编写RoleMapper.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.glg.shiroadmin.mapper.RoleMapper">
<resultMap id="BaseResultMap" type="com.glg.shiroadmin.entity.Role">
    <id column="id" jdbcType="BIGINT" property="id" />
    <result column="role_name" jdbcType="VARCHAR" property="roleName" />
    <result column="remark" jdbcType="VARCHAR" property="remark" />
    <result column="create_time" jdbcType="TIMESTAMP" property="createTime" />
    <result column="modified_time" jdbcType="TIMESTAMP" property="modifiedTime" />
    <result column="status" jdbcType="INTEGER" property="status" />
</resultMap>
    <select id="findRoleByUser" resultType="com.glg.shiroadmin.entity.Role" parameterType="com.glg.shiroadmin.entity.User">
        select
            r.id,r.role_name roleName,r.remark,r.create_time createTime,r.modified_time modifiedTime,r.status
        from
            tb_user u
        LEFT JOIN tb_user_role ur ON u.id = ur.user_id
        LEFT JOIN tb_role r ON r.id = ur.role_id
        <where>
            1 = 1
            <if test="user != null and user != '' ">
                AND u.username = #{user.username}
            </if>
        </where>
    </select>
</mapper>

public interface MenuMapper extends BaseMapper<Menu> {
    //根据角色名查权限
       List<Menu> findPermissionByRole(@Param("role") Role role);
}

resource/mapper创建MenuMapper.xml

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.glg.shiroadmin.mapper.MenuMapper">
    <resultMap id="BaseResultMap" type="com.glg.shiroadmin.entity.Menu">
        <id column="id" jdbcType="BIGINT" property="id" />
        <result column="parent_id" jdbcType="BIGINT" property="parentId" />
        <result column="menu_name" jdbcType="VARCHAR" property="menuName" />
        <result column="url" jdbcType="VARCHAR" property="url" />
        <result column="perms" jdbcType="VARCHAR" property="perms" />
        <result column="icon" jdbcType="VARCHAR" property="icon" />
        <result column="type" jdbcType="CHAR" property="icon" />
        <result column="order_num" jdbcType="BIGINT" property="orderNum" />
        <result column="create_time" jdbcType="TIMESTAMP" property="createTime" />
        <result column="modified_time" jdbcType="TIMESTAMP" property="modifiedTime" />
        <result column="available" jdbcType="INTEGER" property="available" />
        <result column="open" jdbcType="INTEGER" property="open" />
    </resultMap>
    <select id="findPermissionByRole" resultType="com.glg.shiroadmin.entity.Menu" parameterType="com.glg.shiroadmin.entity.Role">
        SELECT
        p.id,
        p.perms,
        p.url
        from
        tb_role r
        LEFT JOIN tb_role_menu rp ON r.id = rp.role_id
        LEFT JOIN tb_menu p ON rp.menu_id = p.id
        <where>
            1 = 1
            <if test="role != null and role != '' ">
                AND r.role_name = #{role.roleName}
            </if>
        </where>
    </select>
</mapper>

测试：

    @Test
    void testt(){
        User user = new User();
        user.setUsername("admin");
        roleMapper.findRoleByUser(user).forEach(System.out::println);
    }

    @Test
    void test(){
        Role role = new Role();
        role.setRoleName("超级管理员");
        menuMapper.findPermissionByRole(role).forEach(System.out::println);
    }

开始添加Shiro

1.pom.xml添加shiro依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.5.3</version>
        </dependency>

自定义Shiro过滤器

2.创建一个realm包 ，编写UserRealm类

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.glg.shiroadmin.entity.Menu;
import com.glg.shiroadmin.entity.Role;
import com.glg.shiroadmin.entity.User;
import com.glg.shiroadmin.mapper.MenuMapper;
import com.glg.shiroadmin.mapper.RoleMapper;
import com.glg.shiroadmin.mapper.UserMapper;
import com.glg.shiroadmin.service.UserService;
import com.glg.shiroadmin.utils.AesCipherUtil;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

public class UserRealm extends AuthorizingRealm {
    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RoleMapper roleMapper;
    @Autowired
    private MenuMapper menuMapper;
    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        //1.获取当前用户信息，
        Subject subject = SecurityUtils.getSubject();
        //获取用户信息
        User user = (User) subject.getPrincipal();
        //设置角色
        Set<String> roles = new HashSet<>();
        //根据用户查询角色
        List<Role> roleList =  roleMapper.findRoleByUser(user);
        System.out.println(user.getUsername()+"拥有的角色有"+roleList.toString());
        for (Role role : roleList){
            if (role != null){
                //添加用户角色
                simpleAuthorizationInfo.addRole(role.getRoleName());
                //根据用户角色查询权限
                List<Menu> menuList = menuMapper.findPermissionByRole(role);
                System.out.println(role.getRoleName()+"角色拥有的权限有"+menuList.toString());
                for(Menu menu : menuList){
                    if(menu!=null){
          simpleAuthorizationInfo.addStringPermission(menu.getPerms());
                    }
                }
            }
        }
        return simpleAuthorizationInfo;
    }
    //认证
    /**
     * 执行subject.login(token);这个方法的时候shiro就会直接到我们自己创建的Realm类中寻找
     * doGetAuthenticationInfo方法,在这个方法里我们使用如下方式来验证数据库中的密码
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //1.先认证
        /**客户端传来的用户名封装在token里，根据用户名进行查询，如果不存在return null，shiro自动抛出账户不存在的异常。
         * 不为空，返回SimpleAuthenticationInfo对象，对象里传入数据库查询的密码和token的得到的密码。自动验证，
          *如果密码不对，shiro也会抛出异常 我们只需要捕获这两个异常
         */
        String userName = (String) token.getPrincipal();
        if (userName == null || userName.length() == 0) { return null; }
        QueryWrapper wrapper = new QueryWrapper();
        wrapper.eq("username",userName);
        User userInfo = userMapper.selectOne(wrapper);

        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                userInfo, //用户名
                userInfo.getPassword(), //密码
                ByteSource.Util.bytes(userInfo.getSalt()), //盐
                getName() //realm name
        );
        return authenticationInfo;
    }
}

3.编写配置ShiroConfig.java

import com.glg.shiroadmin.realm.UserRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.Hashtable;
import java.util.Map;

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean factoryBean = new ShiroFilterFactoryBean();
        factoryBean.setSecurityManager(securityManager);
        //权限设置
        Map<String,String> map = new Hashtable<>();
        map.put("/public","anon");
        map.put("/userList","authc");
        map.put("/systemadmin", "perms[system]");
        map.put("/menusystem", "perms[menu]");
        map.put("/usersystem", "perms[users]");
        factoryBean.setFilterChainDefinitionMap(map);
        //设置登录页面
//        factoryBean.setLoginUrl("/login");
        //设置未授权页面
        factoryBean.setUnauthorizedUrl("/unauth");
        return factoryBean;
    }
    @Bean
    public DefaultWebSecurityManager securityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
        manager.setRealm(userRealm);
        return manager;
    }
    /**
     * 凭证匹配器
     * 密码校验交给Shiro的SimpleAuthenticationInfo进行处理
     */
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher() {
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("MD5");//散列算法:这里使用MD5算法;
        hashedCredentialsMatcher.setHashIterations(2);//散列的次数;
        return hashedCredentialsMatcher;
    }
    //MD5加密
    @Bean
    public UserRealm userRealm(){
        UserRealm  userRealm = new UserRealm();
        userRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return userRealm;
    }
    /**
     * 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证
     * 配置以下两个bean(DefaultAdvisorAutoProxyCreator(可选)和AuthorizationAttributeSourceAdvisor)即可实现此功能
     */
     /* 下面的代码是添加注解支持
     */
    @Bean
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        // 强制使用cglib，防止重复代理和可能引起代理出错的问题，https://zhuanlan.zhihu.com/p/29161098
        defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
        return defaultAdvisorAutoProxyCreator;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }
}

认证以及授权完成，接下来编写登录，注册，退出的controller

1.在实体类，添加注解

      @TableField(fill = FieldFill.INSERT)
      private Date createTime;
      @TableField(fill = FieldFill.INSERT_UPDATE)
      private Date modifiedTime;

2.编写handler.java

@Component
public class MyMetaObjectHandler implements MetaObjectHandler {
    @Override
    public void insertFill(MetaObject metaObject) {
        this.setFieldValByName("createTime",new Date(),metaObject);
        this.setFieldValByName("modifiedTime",new Date(),metaObject);}
    @Override
    public void updateFill(MetaObject metaObject) {
    this.setFieldValByName("modifiedTime",new Date(),metaObject);}}

3.开始写登录注册的controller

 /**
     * 登录方法
     */
    @PostMapping("/login")
    @ResponseBody
    public ResultTypeDTO login(@RequestBody User user){
        QueryWrapper wrapper = new QueryWrapper();
        wrapper.eq("username",user.getUsername());
        List<User> userList = userMapper.selectList(wrapper);
        if(userList.size()==0){ return new ResultTypeDTO().errorOf(CustomizeErrorCode.USER_NOT_FOUND); }
        //账号密码令牌
        AuthenticationToken token = new UsernamePasswordToken(user.getUsername(), user.getPassword());
        //获得当前用户到登录对象，现在状态为未认证
        Subject subject = SecurityUtils.getSubject();
            try {
                //将令牌传到shiro提供的login方法验证，需要自定义realm
                subject.login(token);
                User logineduser = (User) subject.getPrincipal();
                subject.getSession().setAttribute("logineduser",logineduser);
                return new ResultTypeDTO().okOf().addMsg("message","登陆成功");
            }catch (UnknownAccountException e){
                e.printStackTrace();
                return new ResultTypeDTO().errorOf(CustomizeErrorCode.USER_NOT_FOUND);
            }catch (IncorrectCredentialsException e){
                e.printStackTrace();
                return new ResultTypeDTO().errorOf(CustomizeErrorCode.LOGIN_FAIL);
            }
    }
    @GetMapping("/logout")
    public String logout(){
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        return "login";
    }
    /**
     * 用户注册
     */
        @PostMapping("/register")
        @ResponseBody
        public ResultTypeDTO userRegister(@RequestBody User user){
            // 查询数据库中的帐号信息 判断当前帐号是否存在
            QueryWrapper wrapper = new QueryWrapper();
            wrapper.eq("username",user.getUsername());
            List<User> userList = userMapper.selectList(wrapper);
            if (userList.size() != 0 && StringUtil.isNotBlank(userList.get(0).getPassword())) {
                return new ResultTypeDTO().errorOf(CustomizeErrorCode.THIS_USER_USED); }

            String originalPassword = user.getPassword(); //原始密码
            String hashAlgorithmName = "MD5"; //加密方式
            int hashIterations = 2; //加密的次数
            //盐
            String salt = new SecureRandomNumberGenerator().nextBytes().toHex();
            //加密
            SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, originalPassword, salt, hashIterations);
            String encryptionPassword = simpleHash.toString();
            //创建用户信息
            user.setPassword(encryptionPassword);
            user.setSalt(salt);
            user.setStatus(1);
            //执行新增
            int count = userMapper.insert(user);
            if (count <= 0) {
                throw new CustomException("新增失败(Insert Failure)");
            }
            /** 根据user添加角色
             * user.getId() 直接取插入新数据的id
             */
            int flag = userRoleMapper.insertUserRole(user.getId(),user.getType());
            if(flag <= 0){
                throw new CustomException("新增失败(Insert Failure)");
            }
            return new ResultTypeDTO().okOf();
        }

userRoleMapper.java

package com.glg.shiroadmin.mapper;
import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.glg.shiroadmin.entity.User_role;
import org.apache.ibatis.annotations.Insert;
import org.apache.ibatis.annotations.Param;
public interface userRoleMapper extends BaseMapper<User_role> {
    @Insert("insert into tb_user_role(user_id,role_id) values(#{uid},#{rid})")
    int insertUserRole(@Param("uid") Long uid, @Param("rid")Integer rid);
}

注册 登录测试

=========================

注册不同角色的用户，进行认证授权测试

@Controller
public class AdminController {
    @Autowired
    private UserService userService;
    //开放接口 无需登录
    @GetMapping("/public")
    @ResponseBody
    public String open(){
        return "这是open权限接口";
    }
    @GetMapping("/unauth")
    @ResponseBody
    public ResultTypeDTO unauth(){
        return new ResultTypeDTO().errorOf(CustomizeErrorCode.USER_NOT_PERMISSION);
    }
    //只需登录
    @GetMapping("/userList")
    @ResponseBody
    public List<User> getUserList(){
        List<User> userList = userService.getAllUser();
        return userList;
    }
    //系统管理员才能访问
    @GetMapping("/systemadmin")
    @ResponseBody
    public String systemadmin(){
        return "这是systemadmin权限接口，拥有系统管理权限才能访问";
    }
    //功能模块管理员才能访问
    @GetMapping("/menusystem")
    @ResponseBody
    public String menusystem(){
        return "这是menusystem权限接口，拥有功能模块管理权限才能访问";
    }
    //用户管理员才能访问
    @GetMapping("/usersystem")
    @ResponseBody
    public String usersystem(){
        return "这是usersystem权限接口，拥有用户管理权限才能访问";
    }
}