SSM整合shiro

SSM整合shiro

1.添加依赖

war

    
        
        4.3.6.RELEASE
    

    
        
        
            javax.servlet.jsp
            jsp-api
            2.2
            provided  
        
        
        
            javax.servlet
            javax.servlet-api
            3.1.0
            provided  
        
        
        
            jstl
            jstl
            1.2
        
        
        
            org.springframework
            spring-webmvc
            ${spring-version}
        
        
        
            com.fasterxml.jackson.core
            jackson-databind
            2.8.10
        
        
         
            mysql
            mysql-connector-java
            8.0.19
         
        
        
            org.mybatis
            mybatis
            3.4.4
        
        
        
            org.mybatis
            mybatis-spring
            1.3.2
        
        
        
            org.springframework
            spring-test
            ${spring-version}
        
        
        
            org.springframework
            spring-jdbc
            ${spring-version}
        
        
        
            org.aspectj
            aspectjweaver
            1.9.0
        
        
        
            com.alibaba
            druid
            1.1.15
        
        
        
            log4j
            log4j
            1.2.17
        
        
        
            junit
            junit
            4.12
        
        
        
            org.projectlombok
            lombok
            1.18.6
            provided
        
        
        
            javax.annotation
            javax.annotation-api
            1.3.2
        
        
        
            org.apache.shiro
            shiro-web
            1.4.2
        
        
        
            org.apache.shiro
            shiro-spring
            1.4.2
        
    

• 添加依赖后的pom文件

    4.0.0

    com.ym
    shiroSSM
    1.0-SNAPSHOT

    war

    
        
        4.3.6.RELEASE
    

    
        
        
            javax.servlet.jsp
            jsp-api
            2.2
            provided  
        
        
        
            javax.servlet
            javax.servlet-api
            3.1.0
            provided  
        
        
        
            jstl
            jstl
            1.2
        
        
        
            org.springframework
            spring-webmvc
            ${spring-version}
        
        
        
            com.fasterxml.jackson.core
            jackson-databind
            2.8.10
        
        
         
            mysql
            mysql-connector-java
            8.0.19
         
        
        
            org.mybatis
            mybatis
            3.4.4
        
        
        
            org.mybatis
            mybatis-spring
            1.3.2
        
        
        
            org.springframework
            spring-test
            ${spring-version}
        
        
        
            org.springframework
            spring-jdbc
            ${spring-version}
        
        
        
            org.aspectj
            aspectjweaver
            1.9.0
        
        
        
            com.alibaba
            druid
            1.1.15
        
        
        
            log4j
            log4j
            1.2.17
        
        
        
            junit
            junit
            4.12
        
        
        
            org.projectlombok
            lombok
            1.18.6
            provided
        
        
        
            javax.annotation
            javax.annotation-api
            1.3.2
        
        
        
            org.apache.shiro
            shiro-web
            1.4.2
        
        
        
            org.apache.shiro
            shiro-spring
            1.4.2
        
    

    
        
        
            
                src/main/java
                
                    **/*.xml
                
                false
            
            
                src/main/resources
                
                    **/*.properties
                    **/*.xml
                
                false
            
        
        
            
            
                org.apache.maven.plugins
                maven-compiler-plugin
                3.6.1
                
                    1.8
                    1.8
                
            

            
            
                org.apache.tomcat.maven
                tomcat7-maven-plugin
                2.2
                
                    /
                    8080
                
            
        
    

2.修改web.xml文件

    
        shiroFilter
        org.springframework.web.filter.DelegatingFilterProxy
        
        
            targetFilterLifecycle
            true
        
    

    
        contextConfigLocation
        classpath:*.xml
    

    
        org.springframework.web.context.ContextLoaderListener
    

    
        shiroFilter
        /*
    

    
        springmvc
        org.springframework.web.servlet.DispatcherServlet
        
            contextConfigLocation
            classpath:spring-mvc.xml
        
    

    
        springmvc
        /
    

    
    
        encode
        org.springframework.web.filter.CharacterEncodingFilter
        
            encoding
            UTF-8
        
    
    
        encode
        /*
    
    

3.配置文件db.properties ; shiro-spring.xml ; spring-mvc.xml

• db.properties

driver=com.mysql.jdbc.Driver
url=jdbc:mysql://localhost:3307/rbac?useSSL=true&serverTimezone=UTC&characterEncoding=UTF-8
uname=root
upass=root

• shiro-spring.xml

    
        
        
            
            
                /index.html=anon  
                /main.jsp=authc   
                /manager.jsp=authc,roles[manager]   
                /guest.jsp=authc,roles[guest]     
                /select.jsp=perms[select]     
                /delete.jsp=perms[delete]       
            
        
    

    
        
    

    

    

• spring-mvc.xml

4MyRealm.java

package com.ym.shiro;

import com.ym.entity.Permission;
import com.ym.entity.Role;
import com.ym.entity.User;
import com.ym.service.IUserService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import javax.annotation.Resource;
import java.util.List;

public class MyRealm extends AuthorizingRealm {

    @Resource
    private IUserService userService;

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        String username = getAvailablePrincipal(principalCollection).toString();
        List roles = userService.getAllRolesByUsername(username);
        for (Role role : roles) {
            info.addRole(role.getRname());
        }

        List permissions = userService.getAllPermissionsByUsername(username);
        for (Permission permission : permissions) {
            info.addStringPermission(permission.getPname());
        }

        return info;
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        AuthenticationInfo info=null;
        UsernamePasswordToken token=(UsernamePasswordToken) authenticationToken;

        String username = token.getUsername();
        char[] password = token.getPassword();
        String pass=new String(password);

        User u = userService.login(username, pass);

        if (u!=null && u.getUid()!=0){
            String name = getName();
            info =new SimpleAuthenticationInfo(username,pass,name);
        }

        return info;
    }
}

5.entity层的Javabean

• User.java : 用户

package com.ym.entity;

import lombok.Data;

import java.io.Serializable;
import java.util.Set;

@Data
public class User implements Serializable {
    private static final long serialVersionUID = 617289138502785533L;
    
    private Integer uid;
    
    private String username;
    
    private String password;
    
    private String tel;
    
    private String addr;

    private Set rs;
}

• Role.java : 角色

package com.ym.entity;

import lombok.Data;

import java.io.Serializable;
import java.util.Set;

@Data
public class Role implements Serializable {
    private static final long serialVersionUID = -74163700661732397L;
    
    private Integer rid;
    
    private String rname;
    
    private String rdesc;

    private Set ps;
}

• Permission.java : 权限

package com.ym.entity;

import lombok.Data;

import java.io.Serializable;

@Data
public class Permission implements Serializable {
    private static final long serialVersionUID = 581645870054218482L;
    
    private Integer pid;
    
    private String pname;
    
    private String pdesc;
}

6.dao层接口IUserDao

package com.ym.dao;

import com.ym.entity.Permission;
import com.ym.entity.Role;
import com.ym.entity.User;

import java.util.List;

public interface IUserDao {

    User login(User user);

    List getAllRolesByUsername(String username);

    List getAllPermissionsByUsername(String username);
}

7.与dao层接口对应的mapper文件

• UserMapper.xml

    
        select * from user where username=#{username} and password=#{password}
    

    
        select r.* from user u
            inner JOIN user_role ur on u.uid = ur.uid
            inner join Role r on r.rid=ur.rid
            where u.username=#{username};
    

    
        select p.* from user u
            inner JOIN user_role ur on u.uid = ur.uid
            inner join Role r on r.rid=ur.rid
            INNER JOIN role_perms rp on r.rid = rp.rid
            INNER JOIN permission p on p.pid = rp.pid
            where u.username=#{username};
    

8.service层接口与实现类

• 接口 IUserService.java

package com.ym.service;

import com.ym.entity.Permission;
import com.ym.entity.Role;
import com.ym.entity.User;

import java.util.List;

public interface IUserService {

    User login(String username, String pass);

    List getAllRolesByUsername(String username);

    List getAllPermissionsByUsername(String username);
}

• 实现类UserServiceImpl.java

package com.ym.service.impl;

import com.ym.dao.IUserDao;
import com.ym.entity.Permission;
import com.ym.entity.Role;
import com.ym.entity.User;
import com.ym.service.IUserService;
import org.springframework.stereotype.Service;

import javax.annotation.Resource;
import java.util.List;

@Service
public class UserServiceImpl implements IUserService {

    @Resource
    private IUserDao userDao;

    @Override
    public User login(String username, String pass) {
        User u=new User();
        u.setUsername(username);
        u.setPassword(pass);
        return userDao.login(u);
    }

    @Override
    public List getAllRolesByUsername(String username) {
        return userDao.getAllRolesByUsername(username);
    }

    @Override
    public List getAllPermissionsByUsername(String username) {
        return userDao.getAllPermissionsByUsername(username);
    }
}

9.controller层UserService.java

package com.ym.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;

@Controller
public class UserController {

    @PostMapping("/login")
    public String login(@RequestParam("username") String username,@RequestParam("password") String password){
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken token=new UsernamePasswordToken(username,password);

        try {
            subject.login(token);
            return "main.jsp";
        } catch (AuthenticationException e) {
            e.printStackTrace();
            return "index.html";
        }
    }
}

10.前端页面

• 登陆成功之后,看是否拥有访问delete.jsp ; select.jsp ; manager.jsp ; guest.jsp的权限

• index.html : 匿名用户访问

    
    


    
this is index page.

    

        username:

        password:

        

    

• main.jsp : 认证之后的用户才可以访问

<%@ page contentType="text/html;charset=UTF-8" language="java" %>
<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>


    


    
this is main page.

    i am login successfully.


    i am a manager
   <%--manager角色才会显示--%>
    i am a guest
    <%--guest角色才会显示--%>


    
        welcome back zhenfu!
        Not zhenfu? Click here to login
    


    i can select
   <%--select权限才可以显示--%>
    i can delete
    <%--delete权限才可以显示--%>

• manager.jsp : 用户角色是manager的用户才可以访问

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    


    
i am a manager

• guest.jsp : 用户角色是guest的用户才可以访问

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    


    
i am a guest

• select.jsp : 拥有select权限的用户才可以访问

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    


    
select

• delete.jsp : 拥有delete权限的用户才可以访问

<%@ page contentType="text/html;charset=UTF-8" language="java" %>


    


    
delete

11.目录结构

SSM整合shiro目录结构.png