在spring boot项目中配置权限框架shiro

spring boot技术在国内慢慢流行起来，其版本迭代速度也是相当快，截止当前时间，官方版本稳定版是1.4.3，开发版已经是2.0了，2017的脚步已经启程，2.0还会远吗？

spring自家也有安全框架，也就是security，而在spring boot中使用security似乎也是理所当然。今天我所说的是另一个--shiro。由于对shiro的理解还不是很深，但基本的权限控制是不成问题的，写博客还是想锻炼一下自己的思路，巩固所学的知识，如果有错误还请提出，谢谢。对于spring boot和shiro的知识这里不做讲解，特别是对于spring boot默认大家已经比较熟悉了，那么下面开始：

1.数据库表的设计，共5张表

admin 管理员

字段：id  name  password

role 角色

字段：id  name  description

permission 权限

字段：id   name   description

role_permission 角色权限

字段：id  role_id  permission_id

admin_role 管理员角色

字段：id  admin_id   role_id

简单说明各表之间的关系，admin，role，permission三张表作为独立表，role_permission 记录某个角色所拥有的权限，admin_role记录某个管理员拥有的角色。这种设计也就是RBAC模型，建表之后请自行添加测试数据，并创建对应的Model类。

2.在pom.xml中添加shiro依赖

<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.2.3</version>
</dependency>

3.开始各种配置类的创建
①.创建AdminShiro类，代码如下：

@Service
public class AdminShiro {

@Autowired
private AdminRepository adminRepository;
@Autowired
private AdminRoleRepository adminRoleRepository;
@Autowired
private RolePermissionRepository rolePermissionRepository;
@Autowired
private PermissionRepository permissionRepository;

public Admin getAdminByAdminName(String adminName){
Admin admin = adminRepository.findByAdminName(adminName);
return admin;
}

/**
* 根据用户名获取权限授权
*/
public List<String> getPermissionsByAdminName(String adminName){
Admin admin = getAdminByAdminName(adminName);
if (admin == null){
return null;
}

List<String> list = new ArrayList<>();
List<AdminRole> adminRoleList = adminRoleRepository.findAllByAdminId(admin.getId());

for(AdminRole adminRole : adminRoleList){
List<RolePermission> rolePermissionList = rolePermissionRepository.findAllByRoleId(adminRole.getRoleId());
for (RolePermission role : rolePermissionList){
Permission p = permissionRepository.findOne(role.getPermissionId());
list.add(p.getUrl());
}
}
return list;
}
}②.创建MyShiroRealm，并继承AuthorizingRealm，即自定义Realm，代码如下：
public class MyShiroRealm extends AuthorizingRealm {

@Autowired
private AdminShiro adminShiro;

/**
* 读取当前用户所有权限
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
String adminName = (String) principals.fromRealm(getName()).iterator().next();
if (MyUtils.checkNull(new Object[]{adminName})){
List<String> permissions = adminShiro.getPermissionsByAdminName(adminName);
SimpleAuthorizationInfo info = null;
if (permissions.size() > 0){
info = new SimpleAuthorizationInfo();
for (String s : permissions){
info.addStringPermission(s);
}
return info;
}
}
return null;
}

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken _token) throws AuthenticationException {
UsernamePasswordToken token = (UsernamePasswordToken) _token;
String adminName = token.getUsername();
if (adminName!=null && !adminName.equals("")){
Admin admin = adminShiro.getAdminByAdminName(adminName);
if (admin != null){
return new SimpleAuthenticationInfo(admin.getAdminName(),admin.getPassword(),getName());
}
}
return null;
}

}③.创建ShiroConfiguration类，即shiro配置类，设置验证规则等，代码如下：
public class ShiroConfiguration {
/**
* 设置验证规则
*/
@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);

Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
filterChainDefinitionMap.put("/manage/admin/logout","anon");
filterChainDefinitionMap.put("/manage/admin/login","anon");
filterChainDefinitionMap.put("/manage/admin/unauthorized","anon");
filterChainDefinitionMap.put("/manage/admin/**","perms[/manage/admin]");
filterChainDefinitionMap.put("/**", "authc");

shiroFilterFactoryBean.setLoginUrl("/manage/admin/login");
shiroFilterFactoryBean.setUnauthorizedUrl("/manage/admin/unauthorized");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return shiroFilterFactoryBean;
}

@Bean
public SecurityManager securityManager(){
DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
defaultWebSecurityManager.setRealm(myShiroRealm());
return defaultWebSecurityManager;
}

@Bean
public MyShiroRealm myShiroRealm(){
MyShiroRealm myShiroRealm = new MyShiroRealm();
return myShiroRealm;
}

配置到此结束，博客新手，不喜勿喷，如有问题，欢迎留言给出您的意见！