接续上一篇，spring boot 、mybatis-plus、shiro整合入门教程(二)——mybatis-plus常用操作 这篇主要介绍下shiro在项目中是如何使用的， 前期的主要工作是数据库表的设计，上篇文章已经给出表的设计，详细的数据库初始化sql，可以参考代码库的sql， 简单说下登录原理，用户每次登录的时候生成token，同时根据用户id更新数据库中的token有效时间和token值，用户下次登录的时候会去校验token的有效时间，不在有效期内会返回登录页重新登录刷新。 登录的代码和shiro整合的相关代码：
/** * 登录 * @param username * @param password * @param captcha * @param randomStr * @return */ @RequestMapping (value="/login", method = RequestMethod.POST) public Map<String, Object> login(String username, String password,String captcha, String randomStr) { String value = (String)redisTemplate.opsForValue().get(Constants.NUMBER_CODE_KEY + randomStr); if (StringUtils.isBlank(value)) { return WebResult.error("验证码过期"); } if (!captcha.equals(value)) { return WebResult.error("验证码不正确"); } SysUser sysUser = sysUserService.getOne(username); if(sysUser == null || !sysUser.getPassword().equals(new Sha256Hash(password, sysUser.getSalt()).toHex())) { return WebResult.error("账号或密码不正确"); } if(sysUser.getStatus() == 0){ return WebResult.error("账号已被锁定，请联系管理员"); } //生成token 保存到数据库 可优化为存储到redis和数据库 return sysUserTokenService.createToken(sysUser.getUserId()); } /** * 生成token * @param userId * @return */ public WebResult createToken(long userId) { String token = TokenGenerator.generateValue(); //当前时间 LocalDateTime now = LocalDateTime.now(); //过期时间 LocalDateTime expireTime = now.plusHours(Constants.EXPIRE); //判断是否生成token SysUserToken sysUserToken = sysUserTokenMapper.selectById(userId); if(sysUserToken == null){ sysUserToken = new SysUserToken(); sysUserToken.setUserId(userId); sysUserToken.setToken(token); sysUserToken.setUpdateTime(now); sysUserToken.setExpireTime(expireTime); baseMapper.insert(sysUserToken); }else{ sysUserToken.setToken(token); sysUserToken.setUpdateTime(now); sysUserToken.setExpireTime(expireTime); sysUserTokenMapper.updateById(sysUserToken); } return new WebResult().put("token", token).put("expire", expireTime); }项目中使用shiro需要继承AuthenticatingFilter和AuthorizingRealm，代码如下：
/** * @author liuyi * @date 2019/5/15 * * oauth 过滤器 */ @Slf4j public class OAuthFilter extends AuthenticatingFilter { @Override protected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception { String token = getRequestToken((HttpServletRequest) request); if(StringUtils.isBlank(token)){ return null; } return new OAuthToken(token); } @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) { if (request instanceof HttpServletRequest) { if (((HttpServletRequest) request).getMethod().toUpperCase().equals("OPTIONS")) { return true; } } return super.isAccessAllowed(request, response, mappedValue); } @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { //获取请求token，如果token不存在，直接返回401 String token = getRequestToken((HttpServletRequest) request); if(StringUtils.isBlank(token)){ HttpServletResponse httpResponse = (HttpServletResponse) response; String json = JSON.toJSONString(WebResult.error(HttpStatus.SC_UNAUTHORIZED, "invalid token")); httpResponse.getWriter().print(json); return false; } return executeLogin(request, response); } @Override protected boolean onLoginFailure(AuthenticationToken token, AuthenticationException ep, ServletRequest request, ServletResponse response) { HttpServletResponse httpResponse = (HttpServletResponse) response; httpResponse.setContentType("application/json;charset=utf-8"); try { //处理登录失败的异常 Throwable throwable = ep.getCause() == null ? ep : ep.getCause(); WebResult result = WebResult.error(HttpStatus.SC_UNAUTHORIZED, throwable.getMessage()); String json = JSON.toJSONString(result); httpResponse.getWriter().print(json); } catch (IOException e) { log.error("OAuthFilter 异常", e); } return false; } /** * 获取请求的token * @param httpRequest * @return */ private String getRequestToken(HttpServletRequest httpRequest){ //从header中获取token String token = httpRequest.getHeader("token"); //如果header中不存在token，则从参数中获取token if(StringUtils.isBlank(token)){ token = httpRequest.getParameter("token"); } return token; } } @Component public class OAuthRealm extends AuthorizingRealm { @Resource private ShiroServiceImpl shiroService; @Override public boolean supports(AuthenticationToken token) { return token instanceof OAuthToken; } /** * 授权(验证权限时调用) * @param principals * @return */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { SysUser user = (SysUser)principals.getPrimaryPrincipal(); Long userId = user.getUserId(); //用户权限列表 Set<String> permsSet = shiroService.getUserPermissions(userId); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); info.setStringPermissions(permsSet); return info; } /** * 认证 * @param token * @return * @throws AuthenticationException */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { String accessToken = (String) token.getPrincipal(); //根据accessToken，查询用户信息 SysUserToken tokenEntity = shiroService.queryByToken(accessToken); //token失效 if(tokenEntity == null || tokenEntity.getExpireTime().toInstant(ZoneOffset.of("+8")).toEpochMilli() < System.currentTimeMillis()){ throw new IncorrectCredentialsException("token失效，请重新登录"); } //查询用户信息 SysUser user = shiroService.queryUser(tokenEntity.getUserId()); //账号锁定 if(user.getStatus() == 0){ throw new LockedAccountException("账号已被锁定,请联系管理员"); } SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, accessToken, getName()); return info; } } public class OAuthToken implements AuthenticationToken { private String token; public OAuthToken(String token) { this.token = token; } @Override public String getPrincipal() { return token; } @Override public Object getCredentials() { return token; } } /** * @author liuyi * @date 2019/5/15 */ @Configuration public class ShiroConfig { /** * 权限过滤器 * @param securityManager * @return */ @Bean(name="shiroFilter") public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) { ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean(); shiroFilter.setSecurityManager(securityManager); shiroFilter.setLoginUrl("/sys/unauthorized"); shiroFilter.setUnauthorizedUrl("/sys/unauthorized"); //oauth过滤 Map<String, Filter> filters = new HashMap<>(); filters.put("oauth", new OAuthFilter()); shiroFilter.setFilters(filters); Map<String, String> filterMap = new LinkedHashMap<>(); filterMap.put("/actuator/**", "anon"); //APP 模块开放 后面通过拦截器管理 filterMap.put("/app/**", "anon"); //用户密码登录 filterMap.put("/sys/login", "anon"); //未认证 filterMap.put("/sys/unauthorized", "anon"); //验证码 filterMap.put("/sys/captcha/**", "anon"); filterMap.put("/v2/**", "anon"); filterMap.put("/", "anon"); filterMap.put("/**", "oauth"); shiroFilter.setFilterChainDefinitionMap(filterMap); return shiroFilter; } /** * 配置安全事务管理器 * @param authRealm * @param sessionManager * @return */ @Bean("securityManager") public SecurityManager securityManager(OAuthRealm authRealm, SessionManager sessionManager) { DefaultWebSecurityManager manager=new DefaultWebSecurityManager(); manager.setRealm(authRealm); manager.setSessionManager(sessionManager); return manager; } /** * session管理 * @return */ @Bean("sessionManager") public SessionManager sessionManager(){ DefaultWebSessionManager sessionManager = new DefaultWebSessionManager(); sessionManager.setSessionValidationSchedulerEnabled(true); sessionManager.setSessionIdCookieEnabled(true); return sessionManager; } @Bean public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){ return new LifecycleBeanPostProcessor(); } @Bean public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator(){ DefaultAdvisorAutoProxyCreator creator=new DefaultAdvisorAutoProxyCreator(); creator.setProxyTargetClass(true); return creator; } @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) { AuthorizationAttributeSourceAdvisor advisor=new AuthorizationAttributeSourceAdvisor(); advisor.setSecurityManager(securityManager); return advisor; } } /** * @author liuyi * @date 2019/5/15 */ @Configuration public class FilterConfig { @Bean public FilterRegistrationBean shiroFilterRegistration() { FilterRegistrationBean registrationBean = new FilterRegistrationBean(); registrationBean.setFilter(new DelegatingFilterProxy("shiroFilter")); registrationBean.addInitParameter("targetFilterLifecycle", "true"); registrationBean.setEnabled(true); registrationBean.setOrder(Integer.MAX_VALUE - 1); registrationBean.addUrlPatterns("/*"); return registrationBean; } @Bean public FilterRegistrationBean xssFilterRegistration() { FilterRegistrationBean registration = new FilterRegistrationBean(); registration.setDispatcherTypes(DispatcherType.REQUEST); registration.setFilter(new XssFilter()); registration.addUrlPatterns("/*"); registration.setName("xssFilter"); registration.setOrder(Integer.MAX_VALUE); return registration; } }代码地址 下一篇
