spring mvc +hibernate +spring +shiro 实现权限管理详细配置

60 阅读 0 评论 40 点赞

我是靠谱客的博主文静大山，最近开发中收集的这篇文章主要介绍spring mvc +hibernate +spring +shiro 实现权限管理详细配置，觉得挺不错的，现在分享给大家，希望可以做个参考。

概述

登陆界面 login.jsp

<body>
        <h1>登录页面----${message }</h1>
        <img alt="" src="/static/img/1.jpg">
        <form action="login.do" method="post">
        <input type="text" name="username">
        <input type="password" name="password">
        <input type="submit">
        </form>

      </body>

2.在tomcat容器启动时会对web.xml的文件进行初始化，在web.xml我们会配个shiro过滤器来对请求进行过滤以及对权限认证文件的初始化

web.xml 的 shiro fliter如下

<filter>
       <filter-name>shiroFilter</filter-name>
       <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
       <init-param>
           <param-name>targetFilterLifecycle</param-name>
           <param-value>true</param-value>
       </init-param>
   </filter>

   <filter-mapping>
       <filter-name>shiroFilter</filter-name>
       <url-pattern>*.do</url-pattern>
   </filter-mapping>

3.applicationContext-shiro.xml 文件如下

<?xml version="1.0" encoding="UTF-8" ?>
<beans xmlns="http://www.springframework.org/schema/beans"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:aop="http://www.springframework.org/schema/aop"
   xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context"
   xsi:schemaLocation="
    http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
    http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd
    http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
    http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

   <context:component-scan base-package="com.zisine.service" />
   
   <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
       
       <property name="realm" ref="myShiro" />
       
       <property name="cacheManager" ref="cacheManager" />
   </bean>

   <bean id="myShiro" class="com.zisine.service.MyShiro"></bean>

   
   <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
       
       <property name="securityManager" ref="securityManager" />
       
       <property name="loginUrl" value="/login.jsp" />
       
       <property name="successUrl" value="/user.jsp" />
       
       <property name="unauthorizedUrl" value="/403.jsp" />
       
       <property name="filterChainDefinitions">
           <value>
               

               
               
               /login.do*=anon
               /logout.do=anon
               /loginn.do=anon
               /login.jsp* = anon
               /*.do* = authc

           </value>
       </property>
   </bean>

   <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
   <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

</beans>

4. 接下来我们只需要配置我们在配置文件里写的MyShrio.java

package com.zisine.service;

import java.util.Set;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import com.zisine.entity.Role;
import com.zisine.entity.User;
import com.zisine.util.EncryptUtils;

@Service
@Transactional
public class MyShiro extends AuthorizingRealm{

   @Autowired
   private UserService userServiceImpl;
   //该方法的调用时机是前面有需要授权资源的请求时，比如前台验证某角色是否有改权限
   @Override
   protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
       // TODO Auto-generated method stub
       String loginName=(String) arg0.fromRealm(getName()).iterator().next();
        User user=userServiceImpl.findByName(loginName);
        System.out.println("aaayanan");
        System.out.println("users"+user.getUsername());
        if(user!=null)
        {
        ///用来存放所有查出来的角色和权限信息
           SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
           //用户的角色集合
           info.setRoles(user.getRolesName());
           System.out.println("useRoleNmae");
           Set<Role> roleList=user.getUserRole();
           for(Role role:roleList)

           {
               System.out.println("aa"+role.getRoleName());
               info.addStringPermissions(role.getPermissionsName());

           }

           return info;
        }

       return null;
   }
/*
*
* 登录认证
*///该方法的调用时机为controller层里面的login方法 shiro自动封装的登录方法就会跳到这个方法
   @Override
   protected AuthenticationInfo doGetAuthenticationInfo(
           AuthenticationToken authcToken) throws AuthenticationException {

           //获取基于用户名和密码的令牌
            //实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的
           UsernamePasswordToken token = (UsernamePasswordToken) authcToken;

           //从数据库中查询用户用信息
           User user = userServiceImpl.findByName(token.getUsername());
           if (user != null) {
               System.out.println("password"+user.getPassword());
               //此处无需比对,比对的逻辑Shiro会做,我们只需返回一个和令牌相关的正确的验证信息
               return new SimpleAuthenticationInfo(user.getUsername(), user
                       .getPassword(), getName());
           } else {
               //没有返回登录用户名对应的SimpleAuthenticationInfo对象时,就会在LoginController中抛出UnknownAccountException异常
               return null;
           }
       }

5.接下来是controller层

@RequestMapping(value="/login",method=RequestMethod.POST)
public String login(User user,BindingResult bindingResult,RedirectAttributes redirectAttributes,ModelMap modelMap)
{
   System.out.println("pass"+user.getPassword());
   if(bindingResult.hasErrors())
       return "login";

   //使用权限工具进行用户登录登录成功后跳到shiro配置成功的url里
//会自动绑定一个SecurityManager的线层也就是在Myshiro文件里

   try {
       Subject currentUser = SecurityUtils.getSubject();
       Session session=currentUser.getSession();
       UsernamePasswordToken token = new UsernamePasswordToken(user.getUsername(),user.getPassword());
       token.setRememberMe(true);
       currentUser.login(token);

    } catch (UnknownAccountException ex) {//用户名没有找到
       System.out.println("用户名没有找到");
           ExceptionUtil.printExceptionMsg( logger, ex );
        ex.printStackTrace();
        redirectAttributes.addFlashAttribute("message", "用户名没有找到");
        return "redirect:/loginn.do";
    } catch (IncorrectCredentialsException ex) {//用户名密码不匹配
       System.out.println("用户名密码不匹配");

        ex.printStackTrace();
        redirectAttributes.addFlashAttribute("message", "用户名密码不匹配");
        return "redirect:/loginn.do";
    }catch (AuthenticationException e) {//其他的登录错误
       System.out.println("其他的登录错误");
        e.printStackTrace();
        return "user.jsp";
    }
    System.out.println("123");
    return "user.jsp";
}

6.前台验证权限

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
    <title>用户列表</title>
</head>
<body>
    <h1>${message}</h1>
    <h1>用户列表--<a href="add.do">添加用户</a>---<a href="logout.do">退出登录</a>    </h1>
    <h2>权限列表</h2>
    <shiro:authenticated>登陆状态：已经登陆</shiro:authenticated><br/>
    <shiro:hasRole name="manager">认证身份：管理员</shiro:hasRole>
    <shiro:hasRole name="admin">认证身份：超级管理员</shiro:hasRole>
    <shiro:hasRole name="normal">认证身份：普通游客</shiro:hasRole>
      <br/>
    <shiro:hasAnyRoles name="manager,admin">**manager or admin 角色用户登录显示此内容**</shiro:hasAnyRoles>
    <br/>当前用户名 :
    <shiro:principal/>
    <br>权限列表
    <shiro:hasPermission name="add">add权限用户显示此内容<br></shiro:hasPermission>
    <shiro:hasPermission name="select">select权限用户显示此内容<br></shiro:hasPermission>
    <shiro:hasPermission name="update">update权限用户显示此内容<br></shiro:hasPermission>
    <shiro:hasPermission name="user:query">query权限用户显示此内容<br/><shiro:principal/></shiro:hasPermission>
    <shiro:lacksPermission name="delete"> 不具有user:del权限的用户显示此内容<br/> </shiro:lacksPermission>
    <ul>
        <c:forEach items="${userList }" var="user">
            <li>用户名：${user.username }----密码：${user.password }----<a href="/user/edit/${user.id}">修改用户</a>----<a href="javascript:;" class="del" ref="${user.id }">删除用户</a></li>
        </c:forEach>
    </ul>
    <img alt="" src="/static/img/1.jpg">
    <script type="text/javascript" src="http://cdn.staticfile.org/jquery/1.9.1/jquery.min.js"></script>
    <script>
        $(function(){
            $(".del").click(function(){
                var id=$(this).attr("ref");
                $.ajax({
                    type:"delete",
                    url:"/user/del/"+id,
                    success:function(e){

                    }
                });
            });
        });
    </script>
</body>
</html>
7.然后关于权限的五张表

一个用户可以有多种角色一个角色可以属于多个用户多对多

一个角色可以有多个权限一个权限同样可以属于多个角色多对多

所以有五张表用户表（user.java）角色表（role.java）用户角色表

权限表（permission.java）角色权限表

user.java

package com.zisine.entity;

import java.util.HashSet;
import java.util.Set;

public class User {
   //用户id
   private Integer id;
   //用户名称
   private String username;
   //用户密码
   private String password;
   private Set<Role> userRole;


   public Set<Role> getUserRole() {
       return userRole;
   }
   public void setUserRole(Set<Role> userRole) {
       this.userRole = userRole;
   }
   //一个用户他拥有多个脚色
   public Integer getId() {
       return id;
   }
   public void setId(Integer id) {
       this.id = id;
   }

   public String getUsername() {
       return username;
   }
   public void setUsername(String username) {
       this.username = username;
   }
   public String getPassword() {
       return password;
   }
   public void setPassword(String password) {
       this.password = password;
   }
   public Set<String> getRolesName(){

            Set<String> set=new HashSet<String>();
            for (Role role : getUserRole()) {
                set.add(role.getRoleName());
            }
            return set;
        }

}
user.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
    "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
    "http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd">

<hibernate-mapping package="com.zisine.entity">

   
    <class name="User" table="pl_user_t" dynamic-insert="true" dynamic-update="true">

       
       <id name="id" column="user_id">
           
           <generator class="native" />
       </id>
       
        <property name="username" column="user_name" />
        <property name="password" column="password" />
      <set name="userRole" table="role_user_t" lazy="false">
            <key column="user_id"/>
            
            <many-to-many class="Role" column="role_id"/>
            
        </set>
    </class>



</hibernate-mapping>

role.java

package com.zisine.entity;

import java.beans.Transient;
import java.util.ArrayList;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

public class Role {
   //角色ID
private Integer id;
//角色名称
private String roleName;
private Set<User> users;
private Set<Permission> permissions;

public Set<Permission> getPermissions() {
   return permissions;
}
public void setPermissions(Set<Permission> permissions) {
   this.permissions = permissions;
}
public Set<User> getUsers() {
   return users;
}
public void setUsers(Set<User> users) {
   this.users = users;
}
public Integer getId() {
   return id;
}
public void setId(Integer id) {
   this.id = id;
}
public String getRoleName() {
   return roleName;
}
public void setRoleName(String roleName) {
   this.roleName = roleName;
}
@Transient
public List<String> getPermissionsName(){
    List<String> list=new ArrayList<String>();
    for (Permission per : getPermissions()) {
        list.add(per.getPermissionName());
    }
    return list;
}

}
role.hbm.xml
<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
    "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
    "http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd">

<hibernate-mapping package="com.zisine.entity">

   
    <class name="Role" table="pl_role_t" dynamic-insert="true" dynamic-update="true">
       
       <id name="id" column="role_id">
           
           <generator class="native" />
       </id>
       
        <property name="roleName" column="role_name" />
      <set name="users" table="role_user_t" inverse="false" lazy="false">
            <key column="role_id"/>
            
            <many-to-many class="User" column="user_id"/>
            
        </set>
        <set name="permissions" table="role_permission_t" lazy="false">
            <key column="role_id"/>
            
            <many-to-many class="com.zisine.entity.Permission" column="permission_id"/>
            
        </set>
    </class>



</hibernate-mapping>

permission.java

package com.zisine.entity;

import java.util.Set;

public class Permission {
   private Integer id;
   private String permissionName;
   private Set<Role> roles;


   public Set<Role> getRoles() {
       return roles;
   }
   public void setRoles(Set<Role> roles) {
       this.roles = roles;
   }
   public Integer getId() {
       return id;
   }
   public void setId(Integer id) {
       this.id = id;
   }
   public String getPermissionName() {
       return permissionName;
   }
   public void setPermissionName(String permissionName) {
       this.permissionName = permissionName;
   }



}

permission.hbm.xml

<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
    "-//Hibernate/Hibernate Mapping DTD 3.0//EN"
    "http://www.hibernate.org/dtd/hibernate-mapping-3.0.dtd">

<hibernate-mapping package="com.zisine.entity">

   
    <class name="Permission" table="pl_permission_t" dynamic-insert="true" dynamic-update="true">
       
       <id name="id" column="permission_id">
           
           <generator class="native" />
       </id>
       
        <property name="permissionName" column="permission_name" />

      <set name="roles" table="role_permission_t" inverse="false" lazy="false">
            <key column="permission_id"/>
            
            <many-to-many class="Role" column="role_id"/>
            
        </set>

    </class>



</hibernate-mapping>

另外：如果项目用的是maven

早pom.xml配置

如下

<dependency>
           <groupId>org.apache.shiro</groupId>
           <artifactId>shiro-core</artifactId>
           <version>1.2.2</version>
       </dependency>

       <dependency>
           <groupId>org.apache.shiro</groupId>
           <artifactId>shiro-web</artifactId>
           <version>1.2.2</version>
       </dependency>
       <dependency>
           <groupId>org.apache.shiro</groupId>
           <artifactId>shiro-spring</artifactId>
           <version>1.2.2</version>
       </dependency>

如果没用的话就去网上下即可