权限五表与Shiro

package com.config;


import at.pollux.thymeleaf.shiro.dialect.ShiroDialect;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;


import java.util.LinkedHashMap;
import java.util.Map;


@Configuration
public class ShiroConfig {


    /**
     * 请求过滤
     * @return
     */
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("defaultWebSecurityManager")DefaultWebSecurityManager defaultWebSecurityManager){


        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);


        /**
         * 常用的过滤器
         *      anon:无需认证（登录）可以访问
         *      authc:必须认证才可以访问
         *      user：如果使用RemeberMe的功能可以直接访问
         *      perms：该资源必须得到资源权限才可以访问
         *      role：该资源必须得到角色权限才可以访问
         */
        Map<String,String> filterMap = new LinkedHashMap<>();
//        filterMap.put("/add","authc");
//        filterMap.put("/update","authc");
        filterMap.put("/test","anon");
        filterMap.put("/login","anon");
//        授权拦截 ， 没权限会跳转到未授权页面
        filterMap.put("/add","perms[user:add]");
        filterMap.put("/update","perms[user:update]");
//      拦截请求，可以加个一级菜单
        filterMap.put("/*","authc");


        //配置登录页面URL
        shiroFilterFactoryBean.setLoginUrl("/toLogin");
        //配置未授权的页面
        shiroFilterFactoryBean.setUnauthorizedUrl("/noAuth");


        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);


        return shiroFilterFactoryBean;
    }


    /**
     * 创建SecurityManager
     * @param userRealm
     * @return
     */
    @Bean
    public DefaultWebSecurityManager defaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(userRealm);


        return defaultWebSecurityManager;
    }


    /**
     * 创建Realm
     * @return
     */
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }


    /**
     * shiro 配合模板技术去显示隐藏
     * @return
     */
    @Bean
    public ShiroDialect getShiroDialect (){
        return new ShiroDialect();
    }
}

package com.config;


import com.pojo.Permission;
import com.pojo.User;
import com.service.IPermissionService;
import com.service.IUserService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;


import java.util.Collection;
import java.util.List;


public class UserRealm extends AuthorizingRealm {


    @Autowired
    private IUserService userService;


    @Autowired
    private IPermissionService permissionService;
    /**
     * 执行授权逻辑
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {


        //给资源进行授权
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();


        //登录者
        Subject subject = SecurityUtils.getSubject();
        //授权方法传的信息
        User user = (User) subject.getPrincipal();
        //查询权限
        List<Permission> permissions = permissionService.permissions(user.getUsernmae());


        for (Permission permission : permissions) {
            info.addStringPermission(permission.getPerms());
        }
//        查询权限
//        User byId = userService.findById(user.getId());
        //添加权限
//        info.addStringPermission(byId.getPerms());


        return info;
    }


    /**
     * 执行认证逻辑
     * @param authenticationToken
     * @return
     * @throws
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {


        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;


        User byUser = userService.findByUser(token.getUsername());
        if(byUser==null){
            //用户名不存在
            return null;//shiro自己会抛出UnknownAccountException
        }


        //往session存登录信息
//        Subject currentSubject = SecurityUtils.getSubject();
//        Session session = currentSubject.getSession();
//        session.setAttribute("loginUser",byUser);


        // 第一个 参数是授权方法的 getPrincipal   第二个是密码
        return new SimpleAuthenticationInfo(byUser,byUser.getPassword(),"");
    }
}