spring boot 集成 shiro 自定义密码验证 自定义freemarker标签根据权限渲染

<dependency>

  <groupid>org.apache.shiro</groupid>

  <artifactid>shiro-spring</artifactid>

  <version> 1.4 . 0 </version>

</dependency>

public class adminuser implements serializable {

  private static final long serialversionuid = 8264158018518861440l;

  private integer id;

  private string username;

  private string password;

  private integer roleid;

  // getter setter...

}

public class role implements serializable {

  private static final long serialversionuid = 7824693669858106664l;

  private integer id;

  private string name;

  // getter setter...

}

public class permission implements serializable {

  private static final long serialversionuid = -2694960432845360318l;

  private integer id;

  private string name;

  private string value;

  // 权限的父节点的id

  private integer pid;

  // getter setter...

}

@component

public class myshirorealm extends authorizingrealm {

  private logger log = loggerfactory.getlogger(myshirorealm. class );

  @autowired

  private adminuserservice adminuserservice;

  @autowired

  private roleservice roleservice;

  @autowired

  private permissionservice permissionservice;

  // 用户权限配置

  @override

  protected authorizationinfo dogetauthorizationinfo(principalcollection principals) {

  //访问@requirepermission注解的url时触发

  simpleauthorizationinfo simpleauthorizationinfo = new simpleauthorizationinfo();

  adminuser adminuser = adminuserservice.selectbyusername(principals.tostring());

  //获得用户的角色，及权限进行绑定

  role role = roleservice.selectbyid(adminuser.getroleid());

  // 其实这里也可以不要权限那个类了，直接用角色这个类来做鉴权，

  // 不过角色包含很多的权限，已经算是大家约定的了，所以下面还是查询权限然后放在authorizationinfo里

  simpleauthorizationinfo.addrole(role.getname());

  // 查询权限

  list<permission> permissions = permissionservice.selectbyroleid(adminuser.getroleid());

  // 将权限具体值取出来组装成一个权限string的集合

  list<string> permissionvalues = permissions.stream().map(permission::getvalue).collect(collectors.tolist());

  // 将权限的string集合添加进authorizationinfo里，后面请求鉴权有用

  simpleauthorizationinfo.addstringpermissions(permissionvalues);

  return simpleauthorizationinfo;

  }

  // 组装用户信息

  @override

  protected authenticationinfo dogetauthenticationinfo(authenticationtoken token) throws authenticationexception {

  string username = (string) token.getprincipal();

  log.info( "用户：{} 正在登录..." , username);

  adminuser adminuser = adminuserservice.selectbyusername(username);

  // 如果用户不存在，则抛出未知用户的异常

  if (adminuser == null ) throw new unknownaccountexception();

  return new simpleauthenticationinfo(username, adminuser.getpassword(), getname());

  }

}

public class mycredentialsmatcher implements credentialsmatcher {

  @override

  public boolean docredentialsmatch(authenticationtoken token, authenticationinfo info) {

  // 大坑！！！！！！！！！！！！！！！！！！！

  // 明明token跟info两个对象的里的credentials类型都是object，断点看到的类型都是 char[]

  // 但是！！！！！ token里转成string要先强转成 char[]

  // 而info里取credentials就可以直接使用 string.valueof() 转成string

  // 醉了。。

  string rawpassword = string.valueof(( char []) token.getcredentials());

  string encodedpassword = string.valueof(info.getcredentials());

  return new bcryptpasswordencoder().matches(rawpassword, encodedpassword);

  }

}

@configuration

public class shiroconfig {

  private logger log = loggerfactory.getlogger(shiroconfig. class );

  @autowired

  private myshirorealm myshirorealm;

  @bean

  public shirofilterfactorybean shirofilter(securitymanager securitymanager) {

  log.info( "开始配置shirofilter..." );

  shirofilterfactorybean shirofilterfactorybean = new shirofilterfactorybean();

  shirofilterfactorybean.setsecuritymanager(securitymanager);

  //拦截器.

  map<string,string> map = new hashmap<>();

  // 配置不会被拦截的链接 顺序判断 相关静态资源

  map.put( "/static/**" , "anon" );

  //配置退出 过滤器,其中的具体的退出代码shiro已经替我们实现了

  map.put( "/admin/logout" , "logout" );

  //<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;

  //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->

  map.put( "/admin/**" , "authc" );

  // 如果不设置默认会自动寻找web工程根目录下的"/login.jsp"页面

  shirofilterfactorybean.setloginurl( "/adminlogin" );

  // 登录成功后要跳转的链接

  shirofilterfactorybean.setsuccessurl( "/admin/index" );

  //未授权界面;

  shirofilterfactorybean.setunauthorizedurl( "/error" );

  shirofilterfactorybean.setfilterchaindefinitionmap(map);

  return shirofilterfactorybean;

  }

  // 配置加密方式

  // 配置了一下，这货就是验证不过，，改成手动验证算了，以后换加密方式也方便

  @bean

  public mycredentialsmatcher mycredentialsmatcher() {

  return new mycredentialsmatcher();

  }

  // 安全管理器配置

  @bean

  public securitymanager securitymanager() {

  defaultwebsecuritymanager securitymanager = new defaultwebsecuritymanager();

  myshirorealm.setcredentialsmatcher(mycredentialsmatcher());

  securitymanager.setrealm(myshirorealm);

  return securitymanager;

  }

}

@postmapping ( "/adminlogin" )

public string adminlogin(string username, string password,

        @requestparam (defaultvalue = "0" ) boolean rememberme,

        redirectattributes redirectattributes) {

  try {

  // 添加用户认证信息

  subject subject = securityutils.getsubject();

  if (!subject.isauthenticated()) {

   usernamepasswordtoken token = new usernamepasswordtoken(username, password, rememberme);

   //进行验证，这里可以捕获异常，然后返回对应信息

   subject.login(token);

  }

  } catch (authenticationexception e) {

  // e.printstacktrace();

  log.error(e.getmessage());

  redirectattributes.addflashattribute( "error" , "用户名或密码错误" );

  redirectattributes.addflashattribute( "username" , username);

  return redirect( "/adminlogin" );

  }

  return redirect( "/admin/index" );

}

@component

public class shirotag {

  // 判断当前用户是否已经登录认证过

  public boolean isauthenticated(){

  return securityutils.getsubject().isauthenticated();

  }

  // 获取当前用户的用户名

  public string getprincipal() {

  return (string) securityutils.getsubject().getprincipal();

  }

  // 判断用户是否有 xx 角色

  public boolean hasrole(string name) {

  return securityutils.getsubject().hasrole(name);

  }

  // 判断用户是否有 xx 权限

  public boolean haspermission(string name) {

  return !stringutils.isempty(name) && securityutils.getsubject().ispermitted(name);

  }

}

@configuration

public class freemarkerconfig {

  private logger log = loggerfactory.getlogger(freemarkerconfig. class );

  @autowired

  private shirotag shirotag;

  @postconstruct

  public void setsharedvariable() throws templatemodelexception {

  //注入全局配置到freemarker

  log.info( "开始配置freemarker全局变量..." );

  // shiro鉴权

  configuration.setsharedvariable( "sec" , shirotag);

  log.info( "freemarker自定义标签配置完成!" );

  }

}

<# if sec.haspermission( "topic:list" )>

  <li <# if page_tab== 'topic' > class = "active" </# if >>

  <a href= "/admin/topic/list" rel= "external nofollow" >

   <i class = "fa fa-list" ></i>

   <span>话题列表</span>

  </a>

  </li>

</# if >

//加入注解的使用，不加入这个注解不生效

@bean

public authorizationattributesourceadvisor authorizationattributesourceadvisor(defaultwebsecuritymanager securitymanager) {

  authorizationattributesourceadvisor authorizationattributesourceadvisor = new authorizationattributesourceadvisor();

  authorizationattributesourceadvisor.setsecuritymanager(securitymanager);

  return authorizationattributesourceadvisor;

}

@bean

@conditionalonmissingbean

public defaultadvisorautoproxycreator defaultadvisorautoproxycreator() {

  defaultadvisorautoproxycreator defaultaap = new defaultadvisorautoproxycreator();

  defaultaap.setproxytargetclass( true );

  return defaultaap;

}

@controller

@requestmapping ( "/admin/topic" )

public class topicadmincontroller extends baseadmincontroller {

  @requirespermissions ( "topic:list" )

  @getmapping ( "/list" )

  public string list() {

  // todo

  return "admin/topic/list" ;

  }

}