接续上一篇，spring boot 、mybatis-plus、shiro整合入门教程(二)——mybatis-plus常用操作

这篇主要介绍下shiro在项目中是如何使用的，
前期的主要工作是数据库表的设计，上篇文章已经给出表的设计，详细的数据库初始化sql，可以参考代码库的sql，
简单说下登录原理，用户每次登录的时候生成token，同时根据用户id更新数据库中的token有效时间和token值，用户下次登录的时候会去校验token的有效时间，不在有效期内会返回登录页重新登录刷新。
登录的代码和shiro整合的相关代码：

/*** 登录* @param username* @param password* @param captcha* @param randomStr* @return*/@RequestMapping (value="/login", method = RequestMethod.POST)public Map<String, Object> login(String username, String password,String captcha, String randomStr) {String value = (String)redisTemplate.opsForValue().get(Constants.NUMBER_CODE_KEY + randomStr);if (StringUtils.isBlank(value)) {return WebResult.error("验证码过期");}if (!captcha.equals(value)) {return WebResult.error("验证码不正确");}SysUser sysUser = sysUserService.getOne(username);if(sysUser == null || !sysUser.getPassword().equals(new Sha256Hash(password, sysUser.getSalt()).toHex())) {return WebResult.error("账号或密码不正确");}if(sysUser.getStatus() == 0){return WebResult.error("账号已被锁定，请联系管理员");}//生成token 保存到数据库  可优化为存储到redis和数据库return sysUserTokenService.createToken(sysUser.getUserId());}
/*** 生成token* @param userId* @return*/public WebResult createToken(long userId) {String token = TokenGenerator.generateValue();//当前时间LocalDateTime now = LocalDateTime.now();//过期时间LocalDateTime expireTime = now.plusHours(Constants.EXPIRE);//判断是否生成tokenSysUserToken sysUserToken = sysUserTokenMapper.selectById(userId);if(sysUserToken == null){sysUserToken = new SysUserToken();sysUserToken.setUserId(userId);sysUserToken.setToken(token);sysUserToken.setUpdateTime(now);sysUserToken.setExpireTime(expireTime);baseMapper.insert(sysUserToken);}else{sysUserToken.setToken(token);sysUserToken.setUpdateTime(now);sysUserToken.setExpireTime(expireTime);sysUserTokenMapper.updateById(sysUserToken);}return new WebResult().put("token", token).put("expire", expireTime);}

项目中使用shiro需要继承AuthenticatingFilter和AuthorizingRealm，代码如下：

/*** @author liuyi* @date 2019/5/15** oauth 过滤器*/@Slf4j
public class OAuthFilter extends AuthenticatingFilter {@Overrideprotected AuthenticationToken createToken(ServletRequest request, ServletResponse response) throws Exception {String token = getRequestToken((HttpServletRequest) request);if(StringUtils.isBlank(token)){return null;}return new OAuthToken(token);}@Overrideprotected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {if (request instanceof HttpServletRequest) {if (((HttpServletRequest) request).getMethod().toUpperCase().equals("OPTIONS")) {return true;}}return super.isAccessAllowed(request, response, mappedValue);}@Overrideprotected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {//获取请求token，如果token不存在，直接返回401String token = getRequestToken((HttpServletRequest) request);if(StringUtils.isBlank(token)){HttpServletResponse httpResponse = (HttpServletResponse) response;String json = JSON.toJSONString(WebResult.error(HttpStatus.SC_UNAUTHORIZED, "invalid token"));httpResponse.getWriter().print(json);return false;}return executeLogin(request, response);}@Overrideprotected boolean onLoginFailure(AuthenticationToken token, AuthenticationException ep, ServletRequest request, ServletResponse response) {HttpServletResponse httpResponse = (HttpServletResponse) response;httpResponse.setContentType("application/json;charset=utf-8");try {//处理登录失败的异常Throwable throwable = ep.getCause() == null ? ep : ep.getCause();WebResult result = WebResult.error(HttpStatus.SC_UNAUTHORIZED, throwable.getMessage());String json = JSON.toJSONString(result);httpResponse.getWriter().print(json);} catch (IOException e) {log.error("OAuthFilter 异常", e);}return false;}/*** 获取请求的token* @param httpRequest* @return*/private String getRequestToken(HttpServletRequest httpRequest){//从header中获取tokenString token = httpRequest.getHeader("token");//如果header中不存在token，则从参数中获取tokenif(StringUtils.isBlank(token)){token = httpRequest.getParameter("token");}return token;}
}@Component
public class OAuthRealm extends AuthorizingRealm {@Resourceprivate ShiroServiceImpl shiroService;@Overridepublic boolean supports(AuthenticationToken token) {return token instanceof OAuthToken;}/*** 授权(验证权限时调用)* @param principals* @return*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {SysUser user = (SysUser)principals.getPrimaryPrincipal();Long userId = user.getUserId();//用户权限列表Set<String> permsSet = shiroService.getUserPermissions(userId);SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();info.setStringPermissions(permsSet);return info;}/*** 认证* @param token* @return* @throws AuthenticationException*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {String accessToken = (String) token.getPrincipal();//根据accessToken，查询用户信息SysUserToken tokenEntity = shiroService.queryByToken(accessToken);//token失效if(tokenEntity == null || tokenEntity.getExpireTime().toInstant(ZoneOffset.of("+8")).toEpochMilli() < System.currentTimeMillis()){throw new IncorrectCredentialsException("token失效，请重新登录");}//查询用户信息SysUser user = shiroService.queryUser(tokenEntity.getUserId());//账号锁定if(user.getStatus() == 0){throw new LockedAccountException("账号已被锁定,请联系管理员");}SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, accessToken, getName());return info;}
}public class OAuthToken implements AuthenticationToken {private String token;public OAuthToken(String token) {this.token = token;}@Overridepublic String getPrincipal() {return token;}@Overridepublic Object getCredentials() {return token;}
}/*** @author liuyi* @date 2019/5/15*/@Configuration
public class ShiroConfig {/*** 权限过滤器* @param securityManager* @return*/@Bean(name="shiroFilter")public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();shiroFilter.setSecurityManager(securityManager);shiroFilter.setLoginUrl("/sys/unauthorized");shiroFilter.setUnauthorizedUrl("/sys/unauthorized");//oauth过滤Map<String, Filter> filters = new HashMap<>();filters.put("oauth", new OAuthFilter());shiroFilter.setFilters(filters);Map<String, String> filterMap = new LinkedHashMap<>();filterMap.put("/actuator/**", "anon");//APP 模块开放 后面通过拦截器管理filterMap.put("/app/**", "anon");//用户密码登录filterMap.put("/sys/login", "anon");//未认证filterMap.put("/sys/unauthorized", "anon");//验证码filterMap.put("/sys/captcha/**", "anon");filterMap.put("/v2/**", "anon");filterMap.put("/", "anon");filterMap.put("/**", "oauth");shiroFilter.setFilterChainDefinitionMap(filterMap);return shiroFilter;}/*** 配置安全事务管理器* @param authRealm* @param sessionManager* @return*/@Bean("securityManager")public SecurityManager securityManager(OAuthRealm authRealm, SessionManager sessionManager) {DefaultWebSecurityManager manager=new DefaultWebSecurityManager();manager.setRealm(authRealm);manager.setSessionManager(sessionManager);return manager;}/*** session管理* @return*/@Bean("sessionManager")public SessionManager sessionManager(){DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();sessionManager.setSessionValidationSchedulerEnabled(true);sessionManager.setSessionIdCookieEnabled(true);return sessionManager;}@Beanpublic LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){return new LifecycleBeanPostProcessor();}@Beanpublic DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator(){DefaultAdvisorAutoProxyCreator creator=new DefaultAdvisorAutoProxyCreator();creator.setProxyTargetClass(true);return creator;}@Beanpublic AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {AuthorizationAttributeSourceAdvisor advisor=new AuthorizationAttributeSourceAdvisor();advisor.setSecurityManager(securityManager);return advisor;}
}/*** @author liuyi* @date 2019/5/15*/@Configuration
public class FilterConfig {@Beanpublic FilterRegistrationBean shiroFilterRegistration() {FilterRegistrationBean registrationBean = new FilterRegistrationBean();registrationBean.setFilter(new DelegatingFilterProxy("shiroFilter"));registrationBean.addInitParameter("targetFilterLifecycle", "true");registrationBean.setEnabled(true);registrationBean.setOrder(Integer.MAX_VALUE - 1);registrationBean.addUrlPatterns("/*");return registrationBean;}@Beanpublic FilterRegistrationBean xssFilterRegistration() {FilterRegistrationBean registration = new FilterRegistrationBean();registration.setDispatcherTypes(DispatcherType.REQUEST);registration.setFilter(new XssFilter());registration.addUrlPatterns("/*");registration.setName("xssFilter");registration.setOrder(Integer.MAX_VALUE);return registration;}
}

代码地址
下一篇