必看！springboot整合shiro实现特权管理实战项目

SERT INTO ；还有；还有sys_menu；还有；还有 VALUES (1, 'Gmail转发', NULL, 'user:list', NULL, NULL, NULL, NULL);INSERT INTO ；还有；还有sys_menu；还有；还有 VALUES (2, 'Gmail增设', NULL, 'user:add', NULL, NULL, NULL, NULL);；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Table structure for sys_role；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有DROP TABLE IF EXISTS ；还有；还有sys_role；还有；还有;CREATE TABLE ；还有；还有sys_role；还有；还有 ( ；还有；还有id；还有；还有 int(0) NOT NULL AUTO_INCREMENT COMMENT 'id', ；还有；还有key；还有；还有 varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '唯一图标', ；还有；还有name；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '名字', ；还有；还有create_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '创建者人', ；还有；还有create_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '创建者整整', ；还有；还有update_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '增设人', ；还有；还有update_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '增设整整', PRIMARY KEY (；还有；还有id；还有；还有) USING BTREE) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci COMMENT = '配角此表' ROW_FORMAT = Dynamic;；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Records of sys_role；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有INSERT INTO ；还有；还有sys_role；还有；还有 VALUES (1, 'admin', '超级管理机构人员', NULL, NULL, NULL, NULL);；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Table structure for sys_role_menu；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有DROP TABLE IF EXISTS ；还有；还有sys_role_menu；还有；还有;CREATE TABLE ；还有；还有sys_role_menu；还有；还有 ( ；还有；还有id；还有；还有 int(0) NOT NULL AUTO_INCREMENT COMMENT 'id', ；还有；还有role_id；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '配角id', ；还有；还有menu_id；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '对土话框id', ；还有；还有create_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '创建者人', ；还有；还有create_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '创建者整整', ；还有；还有update_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '增设人', ；还有；还有update_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '增设整整', PRIMARY KEY (；还有；还有id；还有；还有) USING BTREE) ENGINE = InnoDB AUTO_INCREMENT = 2 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci COMMENT = '配角-对土话框-关联此表' ROW_FORMAT = Dynamic;；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Records of sys_role_menu；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有INSERT INTO ；还有；还有sys_role_menu；还有；还有 VALUES (1, '1', '1', NULL, NULL, NULL, NULL);；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Table structure for sys_user；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有DROP TABLE IF EXISTS ；还有；还有sys_user；还有；还有;CREATE TABLE ；还有；还有sys_user；还有；还有 ( ；还有；还有id；还有；还有 int(0) NOT NULL AUTO_INCREMENT COMMENT 'id', ；还有；还有name；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '住址', ；还有；还有username；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT 'Gmail名', ；还有；还有password；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '破解', ；还有；还有create_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '创建者人', ；还有；还有create_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '创建者整整', ；还有；还有update_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '增设人', ；还有；还有update_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '增设整整', PRIMARY KEY (；还有；还有id；还有；还有) USING BTREE) ENGINE = InnoDB AUTO_INCREMENT = 4 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci COMMENT = 'Gmail此表' ROW_FORMAT = Dynamic;；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Records of sys_user；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有INSERT INTO ；还有；还有sys_user；还有；还有 VALUES (1, '超级', 'admin', 'e10adc3949ba59abbe56e057f20f883e', NULL, NULL, NULL, NULL);；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Table structure for sys_user_role；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有DROP TABLE IF EXISTS ；还有；还有sys_user_role；还有；还有;CREATE TABLE ；还有；还有sys_user_role；还有；还有 ( ；还有；还有id；还有；还有 int(0) NOT NULL AUTO_INCREMENT COMMENT 'id', ；还有；还有user_id；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT 'Gmailid', ；还有；还有role_id；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '配角id', ；还有；还有create_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '创建者人', ；还有；还有create_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '创建者整整', ；还有；还有update_by；还有；还有 varchar(32) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci NULL DEFAULT NULL COMMENT '增设人', ；还有；还有update_time；还有；还有 datetime(0) NULL DEFAULT NULL COMMENT '增设整整', PRIMARY KEY (；还有；还有id；还有；还有) USING BTREE) ENGINE = InnoDB AUTO_INCREMENT = 3 CHARACTER SET = utf8mb4 COLLATE = utf8mb4_0900_ai_ci COMMENT = 'Gmail-配角关联此表' ROW_FORMAT = Dynamic;；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有 Records of sys_user_role；还有 ；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有；还有INSERT INTO ；还有；还有sys_user_role；还有；还有 VALUES (1, '1', '1', NULL, NULL, NULL, NULL);SET FOREIGN_KEY_CHECKS = 1;

样本如下： Gmail，admin，破解123456 配角：超级管理机构人员 admin 对土话框：user:list Gmail转发 同上：这里只是测试可用、如果是实际案例的土话，超级管理机构人员是拥有全部职责的

2、代码作用于和mybatisplus整合

这里土话说明的可以查看该社论 作用于特别联的类controller、service、serviceImpl、mapper、mapper.xml等

3、重写AuthenticationToken构建类

这个意在主要是在Realm的验证和批准后的时候，很难换取到token

package com.walker.shiro.common.config.shiro;import lombok.AllArgsConstructor;import org.apache.shiro.authc.AuthenticationToken;/*** author:walker* time: 2023/2/10* description: AuthenticationToken的构建类*/@AllArgsConstructorpublic class JwtToken implements AuthenticationToken { private String token; @Override public Object getPrincipal() { return token; } @Override public Object getCredentials() { return token; }}4、realm配有

该为主要应用于配有验证和职责等

package com.walker.shiro.common.config.shiro;import cn.hutool.core.collection.CollUtil;import com.alibaba.fastjson.JSON;import com.walker.shiro.common.utils.Assert;import com.walker.shiro.common.utils.JWTUtils;import com.walker.shiro.domain.model.SysMenu;import com.walker.shiro.domain.model.SysRole;import com.walker.shiro.domain.model.SysUser;import lombok.extern.slf4j.Slf4j;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.AuthenticationInfo;import org.apache.shiro.authc.AuthenticationToken;import org.apache.shiro.authc.SimpleAuthenticationInfo;import org.apache.shiro.authz.AuthorizationInfo;import org.apache.shiro.authz.SimpleAuthorizationInfo;import org.apache.shiro.realm.AuthorizingRealm;import org.apache.shiro.subject.PrincipalCollection;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Component;import ja.util.List;import ja.util.stream.Collectors;/*** author:walker* time: 2023/2/10* description: token Realm 应用于配有验证和职责等*/@Component@Slf4j//后继者AuthorizingRealmpublic class TokenRealm extends AuthorizingRealm { @Autowired private JWTUtils jwtUtils; /** * 生效条件，因为realm可以有很多个，所以无需来进行新设 */ @Override public boolean supports(AuthenticationToken token) { return token instanceof JwtToken; } /** * 职责配有 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { String token = principalCollection.toString(); Assert.isBlank(token,"token不共存，商量不须受保护"); SysUser userEntity = jwtUtils.parseToken(token, SysUser.class); Assert.isNull(userEntity,"token解析失败，商量再一受保护"); log.info("受保护Gmail资讯：{}", JSON.toJSONString(userEntity)); SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(); //新设配角 List roles = userEntity.getRoles(); Assert.isCollEmpty(roles,"该Gmail并未绑定配角"); authorizationInfo.addRoles(roles.stream().map(SysRole::getKey).collect(Collectors.toSet())); //新设职责 for (SysRole role : roles) { List menuEntityList = role.getMenus(); if(CollUtil.isEmpty(menuEntityList)){ continue; } authorizationInfo.addStringPermissions(menuEntityList.stream().map(SysMenu::getPerm).collect(Collectors.toSet())); } log.info("Gmail{} shiro配角:{} 职责:{}",userEntity.getUsername(),authorizationInfo.getRoles(),authorizationInfo.getStringPermissions()); return authorizationInfo; } /** * 验证配有 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { String token = (String) authenticationToken.getCredentials(); return new SimpleAuthenticationInfo(token,token,getName()); }}5、token过滤器package com.walker.shiro.common.config.shiro;import cn.hutool.core.util.StrUtil;import com.walker.shiro.common.constants.RedisConstant;import com.walker.shiro.common.properties.JWTProperties;import com.walker.shiro.common.utils.HttpUtils;import lombok.AllArgsConstructor;import lombok.SneakyThrows;import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;import org.springframework.data.redis.core.StringRedisTemplate;import jax.servlet.ServletRequest;import jax.servlet.ServletResponse;import jax.servlet.http.HttpServletRequest;/** * author:walker * time: 2023/2/10 * description: token过滤器 */public class TokenFilter extends BasicHttpAuthenticationFilter { /** * 这里因为TokenFilter不是罐，所以无需新设属性，然后通过初始化的时候传递 */ private StringRedisTemplate redisTemplate; private JWTProperties jwtProperties; public TokenFilter(StringRedisTemplate redisTemplate, JWTProperties jwtProperties) { this.redisTemplate = redisTemplate; this.jwtProperties = jwtProperties; } /** * isAccessAllowed：有否允许会见 */ @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { if(isLoginAttempt(request, response)){ try { executeLogin(request, response); } catch (Exception e) { e.printStackTrace(); } return true; } return false; } /** * onAccessDenied：拒绝会见时，无需做什么执行 * 如果isAccessAllowed步骤返回True，则不可能会再调用onAccessDenied步骤，如果isAccessAllowed步骤返回Flase,则可能会继续调用onAccessDenied步骤。 * 而onAccessDenied步骤上头则是土话说明拒绝执行登陆的地方。由于我们已经登陆，所以此步骤就可能会返回True(filter准许),所以上头的onPreHandle步骤上头的onAccessDenied步骤就不可能会被拒绝执行。 * */ @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { //这里直接返回false,如果不默许会见时，直接为false均可 return false; } /** * 更进一步受保护 */ @SneakyThrows @Override protected boolean isLoginAttempt(ServletRequest request, ServletResponse response) { HttpServletRequest req= (HttpServletRequest) request; String token = req.getHeader(jwtProperties.getHeader()); if(StrUtil.isEmpty(token)){ HttpUtils.resp(response,"商量不须来进行受保护"); return false; } //判断token有否共存，如果不共存则证明过载或者过期 String s = redisTemplate.opsForValue().get(RedisConstant.TOKEN_USER_KEY + token); if(StrUtil.isEmpty(s)){ HttpUtils.resp(response,"token已过载/不共存，商量再一受保护"); return false; } return true; } /** * 拒绝执行受保护 */ @Override protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception { HttpServletRequest req= (HttpServletRequest) request; String token = req.getHeader(jwtProperties.getHeader()); JwtToken jwtToken = new JwtToken(token); getSubject(request, response).login(jwtToken); return true; }}6、shiro配有package com.walker.shiro.common.config.shiro;import com.walker.shiro.common.properties.JWTProperties;import com.walker.shiro.common.utils.JWTUtils;import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;import org.apache.shiro.mgt.DefaultSubjectDAO;import org.apache.shiro.mgt.SecurityManager;import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;import org.apache.shiro.spring.web.ShiroFilterFactoryBean;import org.apache.shiro.web.mgt.DefaultWebSecurityManager;import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import org.springframework.data.redis.core.StringRedisTemplate;import jax.servlet.Filter;import ja.util.HashMap;/*** shiro配有*/@Configurationpublic class ShiroConfig { @Autowired private TokenRealm tokenRealm; @Autowired private JWTProperties jwtProperties; @Autowired private StringRedisTemplate redisTemplate; //免校验 String ANON="anon"; //filter名字 token String FILTER_TOKEN="token"; //所有方向上 String ALL_PATH="/**"; /** * 过滤工厂 * 配有哪些商量求无需过滤器，哪些不无需 */ @Bean public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager){ ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean(); bean.setSecurityManager(securityManager); //添加token过滤器 HashMap filterHashMap = new HashMap<>(1); filterHashMap.put(FILTER_TOKEN,new TokenFilter(redisTemplate,jwtProperties)); bean.setFilters(filterHashMap); //商量求过滤 //无需验证：authc 不无需验证：anon //token: 无需经过token过滤器执行 HashMap map = new HashMap<>(); //白名单 String[] whiteList = jwtProperties.getWhiteList().split(","); for (String s : whiteList) { map.put(s,ANON); } map.put(ALL_PATH,FILTER_TOKEN); bean.setFilterChainDefinitionMap(map); return bean; } /** * 确保安全管理机构器 * 新设realm和关闭session */ @Bean public SecurityManager securityManager(){ DefaultWebSecurityManager manager = new DefaultWebSecurityManager(); //新设realm manager.setRealm(tokenRealm); //关闭shiro自隙的session,从前可用jwt 不无需session DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO(); DefaultSessionStorageEvaluator sessionStorageEvaluator = new DefaultSessionStorageEvaluator(); sessionStorageEvaluator.setSessionStorageEnabled(false); subjectDAO.setSessionStorageEvaluator(sessionStorageEvaluator); manager.setSubjectDAO(subjectDAO); return manager; } /** * 根据spring-framework-reference,DefaultAdvisorAutoProxyCreator创建者代理更加通用薄弱,可用此系统包括: * a.而无须一个DefaultAdvisorAutoProxyCreator Bean的假定. * b.而无须在完全一致或特别的正则表达式中所任意存量的Advisor.同上意,才会是Advisor，而某种意义是interceptor或advice.这是充分的,因为才会有一个切点被风险评估,以便检查每个advice到候选bean假定有否合格 */ /** * @ConditionalOnMissingBean，它是修饰bean的一个同上解，主要构建的是，当ean被登记在此之后，如果而登记完全一致类型的bean，就不可能会成功，它可能会确保ean只有一个，即你的实例只有一个，当你登记多个完全一致的bean时，可能会持续性 */ @Bean @ConditionalOnMissingBean public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator(){ DefaultAdvisorAutoProxyCreator proxyCreator = new DefaultAdvisorAutoProxyCreator(); proxyCreator.setProxyTargetClass(true); return proxyCreator; } /** * 批准后属性乃是理事 */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){ AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor(); advisor.setSecurityManager(securityManager); return advisor; }}7、controller测试类package com.walker.shiro.domain.controller;import com.sun.media.sound.FFT;import com.walker.shiro.domain.component.UserComponent;import com.walker.shiro.domain.model.common.R;import com.walker.shiro.domain.model.form.UserLoginForm;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.web.bind.annotation.PostMapping;import org.springframework.web.bind.annotation.RequestBody;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RestController;import jax.validation.Valid;/** *

* Gmail此表 内侧控制器 *

* * @author walker * @since 2023-02-09 */@RestController@RequestMapping("/sys-user")public class SysUserController { @Autowired private UserComponent userComponent; /** * 受保护终端 */ @PostMapping("/login") public R login(@RequestBody @Valid UserLoginForm form){ return R.ok(userComponent.login(form)); } /** * 增设Gmail终端 */ @PostMapping("/add") public R add(@RequestBody @Valid UserLoginForm form){ userComponent.add(form); return R.ok(); }}package com.walker.shiro.domain.controller;import com.walker.shiro.domain.model.common.R;import org.apache.shiro.authz.annotation.RequiresPermissions;import org.apache.shiro.authz.annotation.RequiresRoles;import org.springframework.web.bind.annotation.GetMapping;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RestController;@RestController@RequestMapping("/test")public class TestController { @GetMapping("/get") public R get(){ return R.ok("hello"); } @GetMapping("/role_admin") @RequiresRoles("admin") public R role_admin(){ return R.ok("OK"); } @GetMapping("/role_vip") //配角判断 @RequiresRoles("vip") public R role_vip(){ return R.ok("OK"); } @GetMapping("/userAdd") @RequiresPermissions("user:add") public R userAdd(){ return R.ok("fail"); } @GetMapping("/userList") @RequiresPermissions("user:list") public R userList(){ return R.ok("ok"); }}8、可用postman来进行测试login终端

login终端因为是新设为白名单的，所以不无需Token，直接准许 可以发现很难换取到token，

在此之后将受保护在此之后的token复制一下，用来其他终端的测试

get 终端，不隙token时

可以发现，提示无需token

get终端， 隙token

当隙上token时，就ok了

role_admin终端

该终端无需admin这个配角，然后目前我们的admin帖子刚好有该配角

发现是可以换取到结果的

role_vip终端

该终端无需vip配角，admin没有，所以结果提示为没有职责

userAdd终端

由于admin只有user:list帖子，所以不具备该职责

userList

调用成功

总结

职责管理机构可以土话说在大部分的概念设计都是无需可用的了，shiro土话说明职责和验证的配有，是合乎我们跨国企业概念设计合作开发的，所以我们还是得研修一下，希望对你有所尽力哈

书名链接；

。

鼻窦炎能用阿莫西林克拉维酸钾片吗
着凉拉肚子吃什么药
用什么方法能让感冒嗓子疼好的快点
怎么补充眼部营养让视力变好
治感冒喉咙痛的药