SpringMVC+Shiro权限管理

SpringMVC+Shiro权限管理

 

 什么是权限呢？举个简单的例子：

我有一个论坛，注册的用户分为normal用户，manager用户。
对论坛的帖子的操作有这些：
添加，删除，更新，查看，回复
我们规定：
normal用户只能：添加，查看，回复
manager用户可以：删除，更新

normal，manager对应的是角色（role）
添加，删除，更新等对应的是权限（permission）

我们采用下面的逻辑创建权限表结构（不是绝对的，根据需要修改）

一个用户可以有多种角色（normal,manager,admin等等）
一个角色可以有多个用户（user1,user2,user3等等）
一个角色可以有多个权限（save,update,delete,query等等）
一个权限只属于一个角色（delete只属于manager角色）

 

 我们创建四张表：
t_user用户表:设置了3个用户
-------------------------------
id + username   + password
---+----------------+----------
1  +   tom           +  000000
2  +   jack           +  000000
3  +   rose          +  000000
---------------------------------
t_role角色表：设置3个角色
--------------
id + rolename 
---+----------
1  + admin
2  + manager
3  + normal
--------------
t_user_role用户角色表：tom是admin和normal角色，jack是manager和normal角色，rose是normal角色
---------------------
user_id  +  role_id
-----------+-----------
1            +     1
1            +     3
2            +     2
2            +     3
3            +     3
---------------------
t_permission权限表：admin角色可以删除，manager角色可以添加和更新，normal角色可以查看
-----------------------------------
id  +  permissionname  +  role_id
----+------------------------+-----------
1   +   add                     +     2
2   +   del                       +    1
3   +   update                +     2
4   +   query                   +    3
-----------------------------------

 

 建立对应的POJO：

package com.cn.pojo;

import java.util.HashSet;
import java.util.List;
import java.util.Set;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.Table;
import javax.persistence.Transient;

import org.hibernate.validator.constraints.NotEmpty;

@Entity
@Table(name="t_user")
public class User {

    private Integer id;
    @NotEmpty(message="用户名不能为空")
    private String username;
    @NotEmpty(message="密码不能为空")
    private String password;
    private List roleList;//一个用户具有多个角色

    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
        return id;
    }
    public void setId(Integer id) {
        this.id = id;
    }
    public String getUsername() {
        return username;
    }
    public void setUsername(String username) {
        this.username = username;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    @ManyToMany
    @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="user_id")},inverseJoinColumns={@JoinColumn(name="role_id")})
    public List getRoleList() {
        return roleList;
    }
    public void setRoleList(List roleList) {
        this.roleList = roleList;
    }

    @Transient
    public Set getRolesName(){
        List roles=getRoleList();
        Set set=new HashSet();
        for (Role role : roles) {
            set.add(role.getRolename());
        }
        return set;
    }

}

 

package com.cn.pojo;

import java.util.ArrayList;
import java.util.List;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.JoinTable;
import javax.persistence.ManyToMany;
import javax.persistence.OneToMany;
import javax.persistence.Table;
import javax.persistence.Transient;

@Entity
@Table(name="t_role")
public class Role {

    private Integer id;
    private String rolename;
    private List permissionList;//一个角色对应多个权限
    private List userList;//一个角色对应多个用户

    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
        return id;
    }
    public void setId(Integer id) {
        this.id = id;
    }
    public String getRolename() {
        return rolename;
    }
    public void setRolename(String rolename) {
        this.rolename = rolename;
    }
    @OneToMany(mappedBy="role")
    public List getPermissionList() {
        return permissionList;
    }
    public void setPermissionList(List permissionList) {
        this.permissionList = permissionList;
    }
    @ManyToMany
    @JoinTable(name="t_user_role",joinColumns={@JoinColumn(name="role_id")},inverseJoinColumns={@JoinColumn(name="user_id")})
    public List getUserList() {
        return userList;
    }
    public void setUserList(List userList) {
        this.userList = userList;
    }

    @Transient
    public List getPermissionsName(){
        List list=new ArrayList();
        List perlist=getPermissionList();
        for (Permission per : perlist) {
            list.add(per.getPermissionname());
        }
        return list;
    }
}

 

package com.cn.pojo;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.ManyToOne;
import javax.persistence.Table;

@Entity
@Table(name="t_permission")
public class Permission {

    private Integer id;
    private String permissionname;
    private Role role;//一个权限对应一个角色

    @Id
    @GeneratedValue(strategy=GenerationType.IDENTITY)
    public Integer getId() {
        return id;
    }
    public void setId(Integer id) {
        this.id = id;
    }
    public String getPermissionname() {
        return permissionname;
    }
    public void setPermissionname(String permissionname) {
        this.permissionname = permissionname;
    }
    @ManyToOne
    @JoinColumn(name="role_id")
    public Role getRole() {
        return role;
    }
    public void setRole(Role role) {
        this.role = role;
    }

}

 

 使用SHIRO的步骤：
1，导入jar
2，配置web.xml
3，建立dbRelm
4，在Spring中配置

pom.xml中配置如下：

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
  <modelVersion>4.0.0modelVersion>
  <groupId>com.hyxgroupId>
  <artifactId>springmvcartifactId>
  <packaging>warpackaging>
  <version>0.0.1-SNAPSHOTversion>
  <name>springmvc Maven Webappname>
  <url>http://maven.apache.orgurl>
  <dependencies>
    <dependency>
      <groupId>junitgroupId>
      <artifactId>junitartifactId>
      <version>3.8.1version>
      <scope>testscope>
    dependency>

    <dependency>
        <groupId>org.springframeworkgroupId>
        <artifactId>spring-webmvcartifactId>
        <version>3.2.4.RELEASEversion>
    dependency>

    <dependency>
        <groupId>org.springframeworkgroupId>
        <artifactId>spring-jdbcartifactId>
        <version>3.2.4.RELEASEversion>
    dependency>
    <dependency>
        <groupId>org.springframeworkgroupId>
        <artifactId>spring-ormartifactId>
        <version>3.2.4.RELEASEversion>
    dependency>


    <dependency>
        <groupId>org.hibernategroupId>
        <artifactId>hibernate-coreartifactId>
        <version>4.2.5.Finalversion>
    dependency>
    <dependency>
        <groupId>org.hibernategroupId>
        <artifactId>hibernate-ehcacheartifactId>
        <version>4.2.5.Finalversion>
    dependency>
    <dependency>
        <groupId>net.sf.ehcachegroupId>
        <artifactId>ehcacheartifactId>
        <version>2.7.2version>
    dependency>
    <dependency>
        <groupId>commons-dbcpgroupId>
        <artifactId>commons-dbcpartifactId>
        <version>1.4version>
    dependency>
    <dependency>
        <groupId>mysqlgroupId>
        <artifactId>mysql-connector-javaartifactId>
        <version>5.1.26version>
    dependency>

    <dependency>
        <groupId>javax.injectgroupId>
        <artifactId>javax.injectartifactId>
        <version>1version>
    dependency>



    <dependency>
        <groupId>org.hibernategroupId>
        <artifactId>hibernate-validatorartifactId>
        <version>5.0.1.Finalversion>
    dependency>

    <dependency>
        <groupId>org.codehaus.jacksongroupId>
        <artifactId>jackson-mapper-aslartifactId>
        <version>1.9.13version>
    dependency>

    <dependency>
        <groupId>javax.servletgroupId>
        <artifactId>jstlartifactId>
        <version>1.2version>
    dependency>

    <dependency>
      <groupId>javax.servletgroupId>
      <artifactId>servlet-apiartifactId>
      <version>2.5version>
    dependency>


    <dependency>
      <groupId>org.apache.shirogroupId>
      <artifactId>shiro-coreartifactId>
      <version>1.2.2version>
    dependency>
    <dependency>
      <groupId>org.apache.shirogroupId>
      <artifactId>shiro-webartifactId>
      <version>1.2.2version>
    dependency>
    <dependency>
      <groupId>org.apache.shirogroupId>
      <artifactId>shiro-springartifactId>
      <version>1.2.2version>
    dependency>
  dependencies>

  <build>
    <finalName>springmvcfinalName>

    <plugins>
        <plugin>
          <groupId>org.mortbay.jettygroupId>
          <artifactId>jetty-maven-pluginartifactId>
          <configuration>
            <scanIntervalSeconds>10scanIntervalSeconds>
            <webApp>
              <contextPath>/contextPath>
            webApp>

            <connectors>
               <connector implementation="org.eclipse.jetty.server.nio.SelectChannelConnector">
                  <port>80port>
                  <maxIdleTime>60000maxIdleTime>
               connector>
            connectors>
          configuration>
        plugin>
    plugins>
  build>
project>

 

 web.xml中的配置：

xml version="1.0" encoding="UTF-8" ?>
<web-app version="2.5"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee
    http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd">
  <display-name>Archetype Created Web Applicationdisplay-name>


  <filter>
    <filter-name>opensessioninviewfilter-name>
    <filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilterfilter-class>
  filter>
  <filter-mapping>
    <filter-name>opensessioninviewfilter-name>
    <url-pattern>/*url-pattern>
  filter-mapping>


  <servlet>
    <servlet-name>springmvcservlet-name>
    <servlet-class>org.springframework.web.servlet.DispatcherServletservlet-class>
    <load-on-startup>1load-on-startup>
  servlet>
  <servlet-mapping>
    <servlet-name>springmvcservlet-name>

    <url-pattern>/url-pattern>
  servlet-mapping>


  <context-param>
    <param-name>contextConfigLocationparam-name>
    <param-value>classpath:applicationContext*.xmlparam-value>
  context-param>
  <listener>
    <listener-class>
        org.springframework.web.context.ContextLoaderListener
    listener-class>
  listener>


  <filter>
    <filter-name>shiroFilterfilter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
  filter>
  <filter-mapping>
    <filter-name>shiroFilterfilter-name>
    <url-pattern>/*url-pattern>
  filter-mapping>

web-app>

 

 

package com.cn.service;

import java.util.List;

import javax.inject.Inject;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import com.cn.pojo.Role;
import com.cn.pojo.User;

@Service
@Transactional
public class MyShiro extends AuthorizingRealm{

    @Inject
    private UserService userService;
    /**
     * 权限认证
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //获取登录时输入的用户名
        String loginName=(String) principalCollection.fromRealm(getName()).iterator().next();
        //到数据库查是否有此对象
        User user=userService.findByName(loginName);
        if(user!=null){
            //权限信息对象info,用来存放查出的用户的所有的角色（role）及权限（permission）
            SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
            //用户的角色集合
            info.setRoles(user.getRolesName());
            //用户的角色对应的所有权限，如果只使用角色定义访问权限，下面的四行可以不要
            List roleList=user.getRoleList();
            for (Role role : roleList) {
                info.addStringPermissions(role.getPermissionsName());
            }
            return info;
        }
        return null;
    }

    /**
     * 登录认证;
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken authenticationToken) throws AuthenticationException {
        //UsernamePasswordToken对象用来存放提交的登录信息
        UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;
        //查出是否有此用户
        User user=userService.findByName(token.getUsername());
        if(user!=null){
            //若存在，将此用户存放到登录认证info中
            return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
        }
        return null;
    }

}

 

 在spring的配置文件中配置，为了区别spring原配置和shiro我们将shiro的配置独立出来。

applicationContext-shiro.xml

xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:tx="http://www.springframework.org/schema/tx"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="
http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">


    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

        <property name="realm" ref="myShiro"/>

        <property name="cacheManager" ref="cacheManager"/>
    bean>


    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

        <property name="securityManager" ref="securityManager"/>

        <property name="loginUrl" value="/login"/>

        <property name="successUrl" value="/user"/>

        <property name="unauthorizedUrl" value="/403"/>

        <property name="filterChainDefinitions">
            <value>

                /static/**=anon

                /user=perms[user:query]

                /user/add=roles[manager]
                /user/del/**=roles[admin]
                /user/edit/**=roles[manager]

                /** = authc
            value>
        property>
    bean>


    <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

beans>

 

 用于登录，登出，权限跳转的控制：

package com.cn.controller;

import javax.validation.Valid;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.validation.BindingResult;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.servlet.mvc.support.RedirectAttributes;

import com.cn.pojo.User;

@Controller
public class HomeController {

    @RequestMapping(value="/login",method=RequestMethod.GET)
    public String loginForm(Model model){
        model.addAttribute("user", new User());
        return "/login";
    }

    @RequestMapping(value="/login",method=RequestMethod.POST)
    public String login(@Valid User user,BindingResult bindingResult,RedirectAttributes redirectAttributes){
        try {
            if(bindingResult.hasErrors()){
                return "/login";
            }
            //使用权限工具进行用户登录，登录成功后跳到shiro配置的successUrl中，与下面的return没什么关系！
            SecurityUtils.getSubject().login(new UsernamePasswordToken(user.getUsername(), user.getPassword()));
            return "redirect:/user";
        } catch (AuthenticationException e) {
            redirectAttributes.addFlashAttribute("message","用户名或密码错误");
            return "redirect:/login";
        }
    }

    @RequestMapping(value="/logout",method=RequestMethod.GET)
    public String logout(RedirectAttributes redirectAttributes ){
        //使用权限管理工具进行用户的退出，跳出登录，给出提示信息
        SecurityUtils.getSubject().logout();
        redirectAttributes.addFlashAttribute("message", "您已安全退出");
        return "redirect:/login";
    }

    @RequestMapping("/403")
    public String unauthorizedRole(){
        return "/403";
    }
}

 

 三个主要的JSP：
login.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
>
<html>
  <head>
    <title>My JSP 'MyJsp.jsp' starting pagetitle>
  head>

  <body>
    <h1>登录页面----${message }h1>
    <img alt="" src="/static/img/1.jpg">
    <form:form action="/login" commandName="user" method="post">
        用户名：<form:input path="username"/> <form:errors path="username" cssClass="error"/> <br/>
        密   码：<form:password path="password"/> <form:errors path="password" cssClass="error" /> <br/>
        <form:button name="button">submitform:button>
    form:form>
  body>
html>

 

 user.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
>
<html>
  <head>
    <title>用户列表title>
  head>
  <body>
    <h1>${message }h1>
    <h1>用户列表--<a href="/user/add">添加用户a>---<a href="/logout">退出登录a>    h1>
    <h2>权限列表h2>
    <shiro:authenticated>用户已经登录显示此内容shiro:authenticated>
    <shiro:hasRole name="manager">manager角色登录显示此内容shiro:hasRole>
    <shiro:hasRole name="admin">admin角色登录显示此内容shiro:hasRole>
    <shiro:hasRole name="normal">normal角色登录显示此内容shiro:hasRole>

    <shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**shiro:hasAnyRoles>
    <shiro:principal/>-显示当前登录用户名
    <shiro:hasPermission name="add">add权限用户显示此内容shiro:hasPermission>
    <shiro:hasPermission name="user:query">query权限用户显示此内容<shiro:principal/>shiro:hasPermission>
    <shiro:lacksPermission name="user:del"> 不具有user:del权限的用户显示此内容 shiro:lacksPermission>
    <ul>
        <c:forEach items="${userList }" var="user">
            <li>用户名：${user.username }----密码：${user.password }----<a href="/user/edit/${user.id}">修改用户a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户a>li>
        c:forEach>
    ul>
    <img alt="" src="/static/img/1.jpg">
    <script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js">script>
    <script>
        $(function(){
            $(".del").click(function(){
                var id=$(this).attr("ref");
                $.ajax({
                    type:"delete",
                    url:"/user/del/"+id,
                    success:function(e){

                    }
                });
            });
        });
    script>
  body>
html>

 

 

 403.jsp:

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="form" uri="http://www.springframework.org/tags/form" %>
>
<html>
  <head>
    <title>权限错误title>
  head>

  <body>
    <h1>对不起，您没有权限请求此连接！h1>
    <img alt="" src="/static/img/1.jpg">

  body>
html>