自定义标签 + shiro 实现权限细粒度控制

这里我们是使用shiro来实现登录验证,授权等操作,然后利用自定义jsp标签来实现权限菜单的细力度控制。所谓的细粒度控制,就是根据用户登录权限的不同,显示不同的菜单,例如,用户如果有添加用户,修改用户的权限,我们就显示这个俩个菜单,然后我们并不显示删除用户的菜单。

如何自定义jsp标签

1.定义一个权限标签,命名为mytag.tld


<taglib xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-jsptaglibrary_2_0.xsd"
    version="2.0">
    <description>/description>
    <display-name>Permission Tag Librarydisplay-name>
    <tlib-version>1.0tlib-version>
    <short-name>mshort-name>
    <uri>/my-tagsuri>
    <tag>
        <description>权限控制标签description>
        <name>authname>
        <tag-class>com.xxx.core.tag.PrivilegeTagtag-class>  
        <body-content>JSPbody-content>
        <attribute>
            <name>privilegename>
            <required>truerequired>
            <rtexprvalue>truertexprvalue>
            <type>Stringtype>
        attribute>
    tag>
taglib>

2.将该xml文件放于/WEB-INF/tlds下,并实现标签控制类

/**
 * 重写权限标签控制类
 * @author liuxg
 * @date 2015年8月24日 上午9:13:15
 */
public class PrivilegeTag extends TagSupport {

    private static final long serialVersionUID = 1L;
    private String privilege; //标签属性

    @Override
    public int doStartTag() {
        User user =  AuthUtil.getCurrentUser();//获取登录用户信息
        if(user == null) return SKIP_BODY;
        if (isManager(user)) return EVAL_BODY_INCLUDE;  //超级管理员获取所有权限
        boolean bResult = SecurityUtils.getSubject().isPermitted(privilege);//根据标签属性判断用户是否有此菜单功能权限,isPermitted的调用会触发doGetAuthorizationInfo方法
        if(bResult){
            return EVAL_BODY_INCLUDE;
        }
        return SKIP_BODY;
    }


    /**
     * 判断用户是否超级管理员
     * @return
     */
    private boolean isManager(User user){

        List roles = user.getRoles();
        boolean b = false ;
        for (Role role : roles) { //遍历是否有超级管理员角色
            if (role.getIsManager() == Constants.MANAGER_CODE) {
                b = true ;
                break ;
            }
        }
        String accountName = user.getAccountName();
        if (accountName.equals(Constants.ADMIN_ACCOUNT) 
                || accountName.equals(Constants.SYSADMIN_ACCOUNT) 
                || b) {
            return true;
        }
        return false;

    }

    public String getPrivilege() {
        return privilege;
    }

    public void setPrivilege(String privilege) {
        this.privilege = privilege;
    }
}

3.接下来还需要在web.xml设置我们自定义的标签路径

<jsp-config>
        <taglib>
            <taglib-uri>/my-tags</taglib-uri>
            <taglib-location>/WEB-INF/tlds/my-tag.tld</taglib-location>
        </taglib>
    </jsp-config>

到此我们就完成了标签的自定义,那在jsp页面上,我们只需要引入我们自定义的标签库,并在需要控制的html标签上使用我们的权限标签即可


<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>
<%@ taglib prefix="m" uri="/gosun-tags" %>

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>头部title>
head>
<body>
//...
           <m:auth privilege="aaa"> 
                <li >
                  //...
                li>
           m:auth>
            <m:auth privilege="bbb">
                <li >
                    //...
                li>
            m:auth>
            <m:auth privilege="ccc">
                <li >
                    //...
                li>
            m:auth>
        ul> 
    div>
//...
body>

通过包裹的html标签,我们可以在实现类中,通过代码控制显示与否。

使用shiro来进行用户的权限登录和授权

1.因为web项目而且使用spring,我们就先把shiro和spring整合起来吧。


<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans 
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/util
        http://www.springframework.org/schema/util/spring-util.xsd
        ">
    
    <bean id="gipsRealm" class="com.xxx.gips.realm.GIPSRealm" />

    
    <bean id="formAuthenticationFilter" class="com.xxxx.gips.realm.CustomFormAuthenticationFilter">
        <property name="usernameParam" value="username" />
        <property name="passwordParam" value="password" />
        <property name="loginUrl" value="/loginsubmit.do" />
        <property name="rememberMeParam" value="rememberMe" />
    bean>
     
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager" />

    
    <bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
        <property name="cookie" ref="rememberMeCookie" />
    bean>

    
    <bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="rememberMe" />
        <property name="maxAge" value="-1" />
        <property name="httpOnly" value="true"/>
    bean>

    
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="gipsRealm" />
        <property name="cacheManager" ref="cacheManager" /> 
         <property name="rememberMeManager" ref="rememberMeManager" /> 
    bean>

    
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login/login.jsp" />
        <property name="successUrl" value="/backer/auth/homePage" />
        <property name="filters">
            <util:map>
                <entry key="authc" value-ref="formAuthenticationFilter" />
            util:map>
        property>
        <property name="filterChainDefinitions">
            <value>
                /front/** = anon  
                /loginsubmit.do = authc 
                /logout.do = logout 
                /backer/** = user 
            value>
        property>
    bean>

    
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    bean>

    
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

beans>

这是spring-shiro的配置文件,需要加入到web.xml的contextConfigLocation里面,接下来看看怎么写登录的jsp页面


<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%>

<html>
<head>
<meta charset="UTF-8">
<title>用户登录title>
head>
<body>

  <form action="${pageContext.request.contextPath}/loginsubmit.do" method="post" >
        用户名:<input type = "text"  name = "username"/><br><br>
        密 码:<input type = "password"  name = "password"/><br><br>
     <label>保存密码<input type = "checkbox" name = "rememberMe" />label>
     <input type = "submit" value = "登录" />
  form>
body>
html>

2.定义Realm,进行权限验证和登录授权

import java.util.ArrayList;
import java.util.List;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import com.gosun.backer.permission.entity.Permission;
import com.gosun.backer.role.entity.Role;
import com.gosun.backer.user.entity.User;
import com.gosun.backer.user.service.UserMgrService;
import com.gosun.core.utils.Constants;
import com.gosun.util.auth.AuthUtil;


/**
 * 用户登录进去的域
 * @author liuxg
 * @date 2016年5月30日 下午4:02:06
 */
public class GIPSRealm extends AuthorizingRealm {

    @Autowired UserMgrService userService;

    /**
     * 对当前路径予权限和角色,因为配置ehcache,所以可以把用户权限角色信息缓存起来
     * 当用户调用Security.getSubject().isPermitted(permissions),ecurity.getSubject().hasRole(roleIdentifier)
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        User user = AuthUtil.getCurrentUser();
        SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();  
        simpleAuthorInfo.addRoles(getRoles(user));
        simpleAuthorInfo.addStringPermissions(getPermCodes(user));
        return simpleAuthorInfo;

    }



    /**
     * 获取权限,string存放的是权限编码
     * @param user
     * @return
     */
    private List getPermCodes(User user) {

        List perms = new ArrayList();
        List roles = user.getRoles();
        for (Role role : roles) {
            List _perms = role.getPermissions();
            for (Permission _perm : _perms) {
                perms.add(_perm.getPermCode());
            }
        }
        return perms;
    }


    /**
     * 获取角色集合,string存放的角色名称
     * @param user
     * @return
     */
    private List getRoles(User user) {

        List roles = new ArrayList();
        for (Role role : user.getRoles()) {
            roles.add(role.getRoleName());
        }
        return roles;
    }

    /**
     * 登录认证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {

        UsernamePasswordToken token = (UsernamePasswordToken)authcToken; 
        User user = userService.findByAccountName(token.getUsername()) ;//通过帐号获取用户实例

        if (user != null && ByteSource.Util.bytes(token.getPassword())
                .equals(ByteSource.Util.bytes(user.getPassword()))) {//用户校验
            setSessionInfo(user);
            return  new SimpleAuthenticationInfo(user.getAccountName(), user.getPassword(), user.getNickName());   //验证成功之后进行授权
        }

        return null ;

    }


    /**
     * 存放一些信息到session中,便于获取,可以通过httpsession获取相应的信息
     * @param user
     */
    @SuppressWarnings("unused")
    private void setSessionInfo(User user){

        Subject sub = SecurityUtils.getSubject();
        Session session = sub.getSession();

        //显示的设置权限和角色,避免下次再去数据库获取,提高效率
        List roles = user.getRoles();
        for (int i = 0; i < roles.size(); i++) {
            Role role = roles.get(i);
            List perms = role.getPermissions();
            for (Permission permission : perms) {}
            role.setPermissions(perms);
            roles.set(i,role);
        }
        user.setRoles(roles);

        session.setAttribute(Constants.CURRENT_USER, user);
    }
}

这里我们还可以自定义一个form拦截器,可以在验证之前做一些东西,例如验证码验证等等

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;


/**
 * 自定义登录拦截器,可以在shiro调用自身登录之前做一些操作
 * @author liuxg
 * @date 2016年5月30日 下午8:10:56
 */
public class CustomFormAuthenticationFilter extends FormAuthenticationFilter{


     @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response)
            throws Exception {
        return super.onAccessDenied(request, response);
    }
}

接下来,我们来看看,定义的几个实体类,权限,角色和用户实体类
首先是我们的用户实体类

/**
 * 用户实体类
 * @author liuxg
 * @date 2016年6月1日 下午2:36:13
 */
@SuppressWarnings("serial")
@Entity
@Where(clause = "is_deleted = 0")
@Table(name = "tb_user")
public class User extends IdEntity{

    private String accountName ;
    private String password ;
    private String nickName ;
    private String mobilePhone ;
    private String email ;
    private Byte isDeleted ;
    private Date createTime ;
    private List roles ;


    public User(String accountName, String password, String nickName, String mobilePhone, String email, Byte isDeleted,
            Date createTime) {
        super();
        this.accountName = accountName;
        this.password = password;
        this.nickName = nickName;
        this.mobilePhone = mobilePhone;
        this.email = email;
        this.isDeleted = isDeleted;
        this.createTime = createTime;
    }


    public User(){} ;


    @Column(name = "account_name")
    public String getAccountName() {
        return accountName;
    }
    public void setAccountName(String accountName) {
        this.accountName = accountName;
    }
    @Column(name = "password")
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    @Column(name = "mobile_phone")
    public String getMobilePhone() {
        return mobilePhone;
    }
    public void setMobilePhone(String mobilePhone) {
        this.mobilePhone = mobilePhone;
    }
    @Column(name = "email")
    public String getEmail() {
        return email;
    }
    public void setEmail(String email) {
        this.email = email;
    }

    @Column(name = "is_deleted")
    public Byte getIsDeleted() {
        return isDeleted;
    }

    public void setIsDeleted(Byte isDeleted) {
        this.isDeleted = isDeleted;
    }

    @Column(name = "create_time")
    @DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
    public Date getCreateTime() {
        return createTime;
    }

    public void setCreateTime(Date createTime) {
        this.createTime = createTime;
    }

    @ManyToMany(mappedBy = "users")
    public List getRoles() {
        return roles;
    }

    public void setRoles(List roles) {
        this.roles = roles;
    }

    @Column(name = "nick_name")
    public String getNickName() {
        return nickName;
    }

    public void setNickName(String nickName) {
        this.nickName = nickName;
    }   
}

再然后是角色实体类


/**
 * 角色实体类
 * @author liuxg
 * @date 2016年6月1日 下午2:35:37
 */
@SuppressWarnings("serial")
@Entity
@Where(clause = "is_deleted = 0")
@Table(name = "tb_role")
public class Role extends IdEntity {

    private String roleName ;
    private String roleDesc ;
    private Byte isDeleted ;
    private Byte isManager ;
    private Date createTime ;
    private List permissions ;
    private List users ;

    public Role(String roleName, String roleDesc, Byte isDeleted, Byte isManager, Date createTime) {
        super();
        this.roleName = roleName;
        this.roleDesc = roleDesc;
        this.isDeleted = isDeleted;
        this.isManager = isManager;
        this.createTime = createTime;
    }

    public Role(){} ;

    @Column(name = "role_name")
    public String getRoleName() {
        return roleName;
    }
    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }
    @Column(name = "role_desc")
    public String getRoleDesc() {
        return roleDesc;
    }
    public void setRoleDesc(String roleDesc) {
        this.roleDesc = roleDesc;
    }
    @Column(name = "is_deleted")
    public Byte getIsDeleted() {
        return isDeleted;
    }
    public void setIsDeleted(Byte isDeleted) {
        this.isDeleted = isDeleted;
    }
    @Column(name = "is_manager")
    public Byte getIsManager() {
        return isManager;
    }
    public void setIsManager(Byte isManager) {
        this.isManager = isManager;
    }

    @Column(name = "create_time")
    @DateTimeFormat(pattern = "yyyy-MM-dd HH:mm:ss")
    public Date getCreateTime() {
        return createTime;
    }
    public void setCreateTime(Date createTime) {
        this.createTime = createTime;
    }


    @ManyToMany(fetch = FetchType.LAZY)
    @JoinTable(name="tb_user_role_conf", joinColumns={@JoinColumn(name="role_id",referencedColumnName="id")},
    inverseJoinColumns={@JoinColumn(name="user_id",referencedColumnName="id") }) 
    public List getUsers() {
        return users;
    }

    public void setUsers(List users) {
        this.users = users;
    }


    @ManyToMany(fetch = FetchType.LAZY)
    @JoinTable(name="tb_role_permission_conf", joinColumns={@JoinColumn(name="role_id",referencedColumnName="id")},
    inverseJoinColumns={@JoinColumn(name="permisson_id",referencedColumnName="id") }) 
    public List getPermissions() {
        return permissions;
    }

    public void setPermissions(List permissions) {
        this.permissions = permissions;
    }
}

最后是权限实体类

/**
 * 权限菜单实体类
 * @author liuxg
 * @date 2016年6月1日 下午2:35:37
 */
@SuppressWarnings("serial")
@Entity
@Table(name = "tb_permission")
public class Permission extends IdEntity{

    private String permName ;
    private String permCode ;
    private String permPath ;
    private Byte permType ;         //权限类型 0一级菜单 1二级菜单 2功能菜单(功能菜单可以没有路径)
    private Integer orderNo ;      //菜单排序号,关系用户登录时候,关系到首页显示具体哪个菜单
    private Permission parent ;
    private List roles ; 

    public Permission(String permName, String permPath, Byte permType ,Permission parent) {
        super();
        this.permType = permType ;
        this.permName = permName;
        this.permPath = permPath;
        this.parent = parent;
    }

    public Permission(){};

    @Column(name= "perm_name")
    public String getPermName() {
        return permName;
    }
    public void setPermName(String permName) {
        this.permName = permName;
    }
    @Column(name= "perm_path")
    public String getPermPath() {
        return permPath;
    }
    public void setPermPath(String permPath) {
        this.permPath = permPath;
    }

    @OneToOne(fetch=FetchType.LAZY)
    @JoinColumn(name="parent_id")
    public Permission getParent() {
        return parent;
    }
    public void setParent(Permission parent) {
        this.parent = parent;
    }

    @ManyToMany(mappedBy = "permissions")
    public List getRoles() {
        return roles;
    }

    public void setRoles(List roles) {
        this.roles = roles;
    }

    @Column(name= "perm_code")
    public String getPermCode() {
        return permCode;
    }

    public void setPermCode(String permCode) {
        this.permCode = permCode;
    }

    @Column(name= "perm_type")
    public Byte getPermType() {
        return permType;
    }

    public void setPermType(Byte permType) {
        this.permType = permType;
    }

    @Column(name= "order_no")
    public Integer getOrderNo() {
        return orderNo;
    }

    public void setOrderNo(Integer orderNo) {
        this.orderNo = orderNo;
    }

}

这里还有一个问题,就是当当用户登录,有某些标签权限,那用户登录之后,就必须根据这些权限,路由到某个路径下,这里就需要做一个权限路径的路由方法。

/**
 * 后台主页路径导航controller
 * @author liuxg
 * @date 2016年5月30日 下午5:56:58
 */
@RestController
@RequestMapping("/backer/auth")
public class AuthController {

    @Autowired AuthService loginService;

    /**
     * 登录成功之后进来这里,根据用户的角色和权限进行菜单路径路由
     * @return
     */
    @RequestMapping("/homePage")
    public ModelAndView homePage() {
        List perms = AuthUtil.getCurrentUserPermissions();
        String path = perms.get(0).getPermPath();
        return new ModelAndView(path); //这里假设路由到user
    }

}

这里我们的AuthUtil这么定义的

/**
 * httpClient工具类
 * @author liuxg
 * @date 2016年6月1日 下午6:29:07
 */
public class AuthUtil {


    /**
     * 获取当前用户
     * @return
     */
    public static User  getCurrentUser(){
        Subject sub = SecurityUtils.getSubject();
        Session session = sub.getSession();
        User user = (User) session.getAttribute(Constants.CURRENT_USER);
        return user ;
    }


    /**
     * 在用户中获取权限信息
     * @return
     */
    public static List  getCurrentUserPermissions() {

        User user = AuthUtil.getCurrentUser();
        List perms = new ArrayList();
        for (Role role : user.getRoles()) {
            for (Permission permission : role.getPermissions()) {
                perms.add(permission);
            }
        }

        perms = filterRepAndSort(perms);

        return perms;
    }


    /**
     * 去重,排序
     * @param perms
     * @return
     */
    private static List filterRepAndSort(List perms) {

         for ( int i = 0 ; i < perms.size() - 1 ; i++ ) {  
             for ( int j = perms.size() - 1 ; j > i; j-- ) {  
               if (perms.get(j).getOrderNo() == perms.get(i).getOrderNo()) {  
                   perms.remove(j);  
               }   
              }   
            }   

        Collections.sort(perms, new Comparator() {

            @Override
            public int compare(Permission p1, Permission p2) {
                return p1.getOrderNo() - p2.getOrderNo();
            }

        });

        return perms;

    }
}

功能就暂时实现到这里,这里细粒度的作用,可以让我们把权限限制到html的任何一个标签上,用户没有权限的标签,我们可以直接隐藏,不给用户操作,用户也不可见。请多指教

你可能感兴趣的:(java开发)