shiro三 认证+授权 实战

Shiro 一 简介
Shrio 二 ssm+shiro整合

摘要：

这篇文章主要用Navicate Premium 自带的shiro 数据库 来测试 认证和授权的流程。

一 认证

1、配置

  
        
        
      
       
            
                /logout=logout
                
                /refuse=anon
                /images/**=anon
                /js/**=anon
                /styles/**=anon
        
                /**=authc
            
        
    
  
    
        
    
 
    
        
    

    
    
        
        
    

2、DemoShiro (包含授权)

public class DemoShiro extends AuthorizingRealm {
    @Autowired
    UsersMapper usersMapper;
    @Autowired
    SysPermissionMapper sysPermissionMapper;

    @Override
    public String getName() {
        return "DemoShiro";
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("从数据库查询用户,进行认证");
        String principal = (String) authenticationToken.getPrincipal();
        Users users = usersMapper.selectByPrimaryKey(principal);
        if (users == null) {
            return null;
        }
        String password = users.getPassword();
        String salt = users.getSalt();
        return new SimpleAuthenticationInfo(users, password, ByteSource.Util.bytes(salt), getName());
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("从数据库查询权限进行授权");
        Users users = (Users) principalCollection.getPrimaryPrincipal();
        String id = users.getId();
        List strings = sysPermissionMapper.listPercode(id);
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.addStringPermissions(strings);
        return authorizationInfo;
    }

}

3、login 接口

  // 用户登陆提交
   @RequestMapping("/login")
   public String loginsubmit(Model model, HttpServletRequest request)
           throws Exception {

       // shiro在认证过程中出现错误后将异常类路径通过request返回
       String exceptionClassName = (String) request
               .getAttribute("shiroLoginFailure");
       if (exceptionClassName != null) {
           if (UnknownAccountException.class.getName().equals(exceptionClassName)) {
               throw new CustomException("账号不存在");
           } else if (IncorrectCredentialsException.class.getName().equals(
                   exceptionClassName)) {
               throw new CustomException("用户名/密码错误");
           } else if ("randomCodeError".equals(exceptionClassName)) {
               throw new CustomException("验证码错误");
           } else {
               //最终在异常处理器生成未知错误
               throw new Exception();
           }
       }
       return "login";

   }

4、表单提交

    用户名： 
    密码： 



    

认证成功自动返回上一路径

二 授权

1、开启aop 注解支持(加在spring-mvc 配置文件中)

2、注解授权

  @RequestMapping("/permission")
    @RequiresPermissions("item:create")
    @ExceptionHandler(UnauthorizedException.class)
    public String permission() {
        return "authorationzation";
    }

3、jsp 页面中 授权

<%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    


认证成功

    有查询权限：查询用户信息

友情提示

授权 当没有权限时，会抛出无权访问 异常
处理异常：

@Component
public class CustomExceptionResolver implements HandlerExceptionResolver {
 @Override
    public ModelAndView resolveException(HttpServletRequest request,
      HttpServletResponse response, Object handler, Exception ex) {
        //输出异常
        ex.printStackTrace();

        if (ex instanceof UnauthorizedException) {
                // 跳转到拒绝页面
             ModelAndView mv = new ModelAndView("refuse");
            return mv;
        }
    }
}