2017.2.15 开涛shiro教程-第二十一章-授予身份与切换身份（二） controller

2022-11-07 09:35:48

原博客地址：http://jinnianshilongnian.iteye.com/blog/2018398

根据下载的pdf学习。

开涛shiro教程-第二十一章-授予身份与切换身份（二）

1.回顾上节

在《2017.2.15 开涛shiro教程-第二十一章-授予身份与切换身份（一）table、entity、service、dao 》中，做了这四件事。这只是准备材料，要实现 B 假借 A 的身份进行访问，还需要完成controller部分。

1 table：sys_user_runas

2 entity：UserRunAs

3 service：UserRunAsService、UserRunAsServiceImpl

4 dao：UserRunAsDao、UserRunAsDaoImpl

2.最终效果

（1）涉及到的jsp

（2）页面效果

3.controller

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import com.github.zhangkaitao.shiro.chapter21.entity.Organization;

 import com.github.zhangkaitao.shiro.chapter21.service.OrganizationService;

 import org.apache.shiro.authz.annotation.RequiresPermissions;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.PathVariable;

 import org.springframework.web.bind.annotation.RequestMapping;

 import org.springframework.web.bind.annotation.RequestMethod;

 import org.springframework.web.bind.annotation.RequestParam;

 import org.springframework.web.servlet.mvc.support.RedirectAttributes;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-14

  * <p>Version: 1.0

  */

 @Controller

 @RequestMapping("/organization")

 public class OrganizationController {

     @Autowired

     private OrganizationService organizationService;

     @RequiresPermissions("organization:view")

     @RequestMapping(method = RequestMethod.GET)

     public String index(Model model) {

         return "organization/index";

     }

     @RequiresPermissions("organization:view")

     @RequestMapping(value = "/tree", method = RequestMethod.GET)

     public String showTree(Model model) {

         model.addAttribute("organizationList", organizationService.findAll());

         return "organization/tree";

     }

     @RequiresPermissions("organization:create")

     @RequestMapping(value = "/{parentId}/appendChild", method = RequestMethod.GET)

     public String showAppendChildForm(@PathVariable("parentId") Long parentId, Model model) {

         Organization parent = organizationService.findOne(parentId);

         model.addAttribute("parent", parent);

         Organization child = new Organization();

         child.setParentId(parentId);

         child.setParentIds(parent.makeSelfAsParentIds());

         model.addAttribute("child", child);

         model.addAttribute("op", "新增");

         return "organization/appendChild";

     }

     @RequiresPermissions("organization:create")

     @RequestMapping(value = "/{parentId}/appendChild", method = RequestMethod.POST)

     public String create(Organization organization) {

         organizationService.createOrganization(organization);

         return "redirect:/organization/success";

     }

     @RequiresPermissions("organization:update")

     @RequestMapping(value = "/{id}/maintain", method = RequestMethod.GET)

     public String showMaintainForm(@PathVariable("id") Long id, Model model) {

         model.addAttribute("organization", organizationService.findOne(id));

         return "organization/maintain";

     }

     @RequiresPermissions("organization:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.POST)

     public String update(Organization organization, RedirectAttributes redirectAttributes) {

         organizationService.updateOrganization(organization);

         redirectAttributes.addFlashAttribute("msg", "修改成功");

         return "redirect:/organization/success";

     }

     @RequiresPermissions("organization:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.POST)

     public String delete(@PathVariable("id") Long id, RedirectAttributes redirectAttributes) {

         organizationService.deleteOrganization(id);

         redirectAttributes.addFlashAttribute("msg", "删除成功");

         return "redirect:/organization/success";

     }

     @RequiresPermissions("organization:update")

     @RequestMapping(value = "/{sourceId}/move", method = RequestMethod.GET)

     public String showMoveForm(@PathVariable("sourceId") Long sourceId, Model model) {

         Organization source = organizationService.findOne(sourceId);

         model.addAttribute("source", source);

         model.addAttribute("targetList", organizationService.findAllWithExclude(source));

         return "organization/move";

     }

     @RequiresPermissions("organization:update")

     @RequestMapping(value = "/{sourceId}/move", method = RequestMethod.POST)

     public String move(

             @PathVariable("sourceId") Long sourceId,

             @RequestParam("targetId") Long targetId) {

         Organization source = organizationService.findOne(sourceId);

         Organization target = organizationService.findOne(targetId);

         organizationService.move(source, target);

         return "redirect:/organization/success";

     }

     @RequiresPermissions("organization:view")

     @RequestMapping(value = "/success", method = RequestMethod.GET)

     public String success() {

         return "organization/success";

     }

 }

OrganizationController

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import com.github.zhangkaitao.shiro.chapter21.entity.Resource;

 import com.github.zhangkaitao.shiro.chapter21.service.ResourceService;

 import org.apache.shiro.authz.annotation.RequiresPermissions;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.ModelAttribute;

 import org.springframework.web.bind.annotation.PathVariable;

 import org.springframework.web.bind.annotation.RequestMapping;

 import org.springframework.web.bind.annotation.RequestMethod;

 import org.springframework.web.servlet.mvc.support.RedirectAttributes;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-14

  * <p>Version: 1.0

  */

 @Controller

 @RequestMapping("/resource")

 public class ResourceController {

     @Autowired

     private ResourceService resourceService;

     @ModelAttribute("types")

     public Resource.ResourceType[] resourceTypes() {

         return Resource.ResourceType.values();

     }

     @RequiresPermissions("resource:view")

     @RequestMapping(method = RequestMethod.GET)

     public String list(Model model) {

         model.addAttribute("resourceList", resourceService.findAll());

         return "resource/list";

     }

     @RequiresPermissions("resource:create")

     @RequestMapping(value = "/{parentId}/appendChild", method = RequestMethod.GET)

     public String showAppendChildForm(@PathVariable("parentId") Long parentId, Model model) {

         Resource parent = resourceService.findOne(parentId);

         model.addAttribute("parent", parent);

         Resource child = new Resource();

         child.setParentId(parentId);

         child.setParentIds(parent.makeSelfAsParentIds());

         model.addAttribute("resource", child);

         model.addAttribute("op", "新增子节点");

         return "resource/edit";

     }

     @RequiresPermissions("resource:create")

     @RequestMapping(value = "/{parentId}/appendChild", method = RequestMethod.POST)

     public String create(Resource resource, RedirectAttributes redirectAttributes) {

         resourceService.createResource(resource);

         redirectAttributes.addFlashAttribute("msg", "新增子节点成功");

         return "redirect:/resource";

     }

     @RequiresPermissions("resource:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.GET)

     public String showUpdateForm(@PathVariable("id") Long id, Model model) {

         model.addAttribute("resource", resourceService.findOne(id));

         model.addAttribute("op", "修改");

         return "resource/edit";

     }

     @RequiresPermissions("resource:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.POST)

     public String update(Resource resource, RedirectAttributes redirectAttributes) {

         resourceService.updateResource(resource);

         redirectAttributes.addFlashAttribute("msg", "修改成功");

         return "redirect:/resource";

     }

     @RequiresPermissions("resource:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.GET)

     public String delete(@PathVariable("id") Long id, RedirectAttributes redirectAttributes) {

         resourceService.deleteResource(id);

         redirectAttributes.addFlashAttribute("msg", "删除成功");

         return "redirect:/resource";

     }

 }

ResourceController

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import com.github.zhangkaitao.shiro.chapter21.entity.Role;

 import com.github.zhangkaitao.shiro.chapter21.service.ResourceService;

 import com.github.zhangkaitao.shiro.chapter21.service.RoleService;

 import org.apache.shiro.authz.annotation.RequiresPermissions;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.PathVariable;

 import org.springframework.web.bind.annotation.RequestMapping;

 import org.springframework.web.bind.annotation.RequestMethod;

 import org.springframework.web.servlet.mvc.support.RedirectAttributes;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-14

  * <p>Version: 1.0

  */

 @Controller

 @RequestMapping("/role")

 public class RoleController {

     @Autowired

     private RoleService roleService;

     @Autowired

     private ResourceService resourceService;

     @RequiresPermissions("role:view")

     @RequestMapping(method = RequestMethod.GET)

     public String list(Model model) {

         model.addAttribute("roleList", roleService.findAll());

         return "role/list";

     }

     @RequiresPermissions("role:create")

     @RequestMapping(value = "/create", method = RequestMethod.GET)

     public String showCreateForm(Model model) {

         setCommonData(model);

         model.addAttribute("role", new Role());

         model.addAttribute("op", "新增");

         return "role/edit";

     }

     @RequiresPermissions("role:create")

     @RequestMapping(value = "/create", method = RequestMethod.POST)

     public String create(Role role, RedirectAttributes redirectAttributes) {

         roleService.createRole(role);

         redirectAttributes.addFlashAttribute("msg", "新增成功");

         return "redirect:/role";

     }

     @RequiresPermissions("role:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.GET)

     public String showUpdateForm(@PathVariable("id") Long id, Model model) {

         setCommonData(model);

         model.addAttribute("role", roleService.findOne(id));

         model.addAttribute("op", "修改");

         return "role/edit";

     }

     @RequiresPermissions("role:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.POST)

     public String update(Role role, RedirectAttributes redirectAttributes) {

         roleService.updateRole(role);

         redirectAttributes.addFlashAttribute("msg", "修改成功");

         return "redirect:/role";

     }

     @RequiresPermissions("role:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.GET)

     public String showDeleteForm(@PathVariable("id") Long id, Model model) {

         setCommonData(model);

         model.addAttribute("role", roleService.findOne(id));

         model.addAttribute("op", "删除");

         return "role/edit";

     }

     @RequiresPermissions("role:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.POST)

     public String delete(@PathVariable("id") Long id, RedirectAttributes redirectAttributes) {

         roleService.deleteRole(id);

         redirectAttributes.addFlashAttribute("msg", "删除成功");

         return "redirect:/role";

     }

     private void setCommonData(Model model) {

         model.addAttribute("resourceList", resourceService.findAll());

     }

 }

RoleController

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import com.github.zhangkaitao.shiro.chapter21.entity.User;

 import com.github.zhangkaitao.shiro.chapter21.service.*;

 import com.github.zhangkaitao.shiro.chapter21.service.RoleService;

 import com.github.zhangkaitao.shiro.chapter21.service.UserService;

 import org.apache.shiro.authz.annotation.RequiresPermissions;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.PathVariable;

 import org.springframework.web.bind.annotation.RequestMapping;

 import org.springframework.web.bind.annotation.RequestMethod;

 import org.springframework.web.servlet.mvc.support.RedirectAttributes;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-14

  * <p>Version: 1.0

  */

 @Controller

 @RequestMapping("/user")

 public class UserController {

     @Autowired

     private UserService userService;

     @Autowired

     private OrganizationService organizationService;

     @Autowired

     private RoleService roleService;

     @RequiresPermissions("user:view")

     @RequestMapping(method = RequestMethod.GET)

     public String list(Model model) {

         model.addAttribute("userList", userService.findAll());

         return "user/list";

     }

     @RequiresPermissions("user:create")

     @RequestMapping(value = "/create", method = RequestMethod.GET)

     public String showCreateForm(Model model) {

         setCommonData(model);

         model.addAttribute("user", new User());

         model.addAttribute("op", "新增");

         return "user/edit";

     }

     @RequiresPermissions("user:create")

     @RequestMapping(value = "/create", method = RequestMethod.POST)

     public String create(User user, RedirectAttributes redirectAttributes) {

         userService.createUser(user);

         redirectAttributes.addFlashAttribute("msg", "新增成功");

         return "redirect:/user";

     }

     @RequiresPermissions("user:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.GET)

     public String showUpdateForm(@PathVariable("id") Long id, Model model) {

         setCommonData(model);

         model.addAttribute("user", userService.findOne(id));

         model.addAttribute("op", "修改");

         return "user/edit";

     }

     @RequiresPermissions("user:update")

     @RequestMapping(value = "/{id}/update", method = RequestMethod.POST)

     public String update(User user, RedirectAttributes redirectAttributes) {

         userService.updateUser(user);

         redirectAttributes.addFlashAttribute("msg", "修改成功");

         return "redirect:/user";

     }

     @RequiresPermissions("user:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.GET)

     public String showDeleteForm(@PathVariable("id") Long id, Model model) {

         setCommonData(model);

         model.addAttribute("user", userService.findOne(id));

         model.addAttribute("op", "删除");

         return "user/edit";

     }

     @RequiresPermissions("user:delete")

     @RequestMapping(value = "/{id}/delete", method = RequestMethod.POST)

     public String delete(@PathVariable("id") Long id, RedirectAttributes redirectAttributes) {

         userService.deleteUser(id);

         redirectAttributes.addFlashAttribute("msg", "删除成功");

         return "redirect:/user";

     }

     @RequiresPermissions("user:update")

     @RequestMapping(value = "/{id}/changePassword", method = RequestMethod.GET)

     public String showChangePasswordForm(@PathVariable("id") Long id, Model model) {

         model.addAttribute("user", userService.findOne(id));

         model.addAttribute("op", "修改密码");

         return "user/changePassword";

     }

     @RequiresPermissions("user:update")

     @RequestMapping(value = "/{id}/changePassword", method = RequestMethod.POST)

     public String changePassword(@PathVariable("id") Long id, String newPassword, RedirectAttributes redirectAttributes) {

         userService.changePassword(id, newPassword);

         redirectAttributes.addFlashAttribute("msg", "修改密码成功");

         return "redirect:/user";

     }

     private void setCommonData(Model model) {

         model.addAttribute("organizationList", organizationService.findAll());

         model.addAttribute("roleList", roleService.findAll());

     }

 }

UserController

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import org.apache.shiro.authc.IncorrectCredentialsException;

 import org.apache.shiro.authc.UnknownAccountException;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.RequestMapping;

 import javax.servlet.http.HttpServletRequest;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-15

  * <p>Version: 1.0

  */

 @Controller

 public class LoginController {

     @RequestMapping(value = "/login"    )

     public String showLoginForm(HttpServletRequest req, Model model) {

         String exceptionClassName = (String)req.getAttribute("shiroLoginFailure");

         String error = null;

         if(UnknownAccountException.class.getName().equals(exceptionClassName)) {

             error = "用户名/密码错误";

         } else if(IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {

             error = "用户名/密码错误";

         } else if(exceptionClassName != null) {

             error = "其他错误：" + exceptionClassName;

         }

         model.addAttribute("error", error);

         return "login";

     }

 }

LoginController

 package com.github.zhangkaitao.shiro.chapter21.web.controller;

 import com.github.zhangkaitao.shiro.chapter21.entity.Resource;

 import com.github.zhangkaitao.shiro.chapter21.entity.User;

 import com.github.zhangkaitao.shiro.chapter21.web.bind.annotation.CurrentUser;

 import com.github.zhangkaitao.shiro.chapter21.service.ResourceService;

 import com.github.zhangkaitao.shiro.chapter21.service.UserService;

 import org.springframework.beans.factory.annotation.Autowired;

 import org.springframework.stereotype.Controller;

 import org.springframework.ui.Model;

 import org.springframework.web.bind.annotation.RequestMapping;

 import java.util.List;

 import java.util.Set;

 /**

  * <p>User: Zhang Kaitao

  * <p>Date: 14-2-14

  * <p>Version: 1.0

  */

 @Controller

 public class IndexController {

     @Autowired

     private ResourceService resourceService;

     @Autowired

     private UserService userService;

     @RequestMapping("/")

     public String index(@CurrentUser User loginUser, Model model) {

         Set<String> permissions = userService.findPermissions(loginUser.getUsername());

         List<Resource> menus = resourceService.findMenus(permissions);

         model.addAttribute("menus", menus);

         return "index";

     }

     @RequestMapping("/welcome")

     public String welcome() {

         return "welcome";

     }

 }

IndexController

RunAsController:

（1）简要总览

四个方法：展示，授予，收回，切换。

 @Controller

 @RequestMapping("/runas")

 public class RunAsController {

     @Autowired

     private UserRunAsService userRunAsService;

     @Autowired

     private UserService userService;

     @RequestMapping

     public String runasList(

             @CurrentUser User loginUser,

             Model model) {

     ...

     }

    @RequestMapping("/grant/{toUserId}")

     public String grant(

             @CurrentUser User loginUser,

             @PathVariable("toUserId") Long toUserId,

             RedirectAttributes redirectAttributes) {

     ...

     }

     @RequestMapping("/revoke/{toUserId}")

     public String revoke(

             @CurrentUser User loginUser,

             @PathVariable("toUserId") Long toUserId,

             RedirectAttributes redirectAttributes) {

     ...

     }

     @RequestMapping("/switchTo/{switchToUserId}")

     public String switchTo(

             @CurrentUser User loginUser,

             @PathVariable("switchToUserId") Long switchToUserId,

             RedirectAttributes redirectAttributes) {

     ...

     }

     @RequestMapping("/switchBack")

     public String switchBack(RedirectAttributes redirectAttributes) {

     ...

     }

 }

（2）runasList
runasList 展示当前用户能切换到的身份列表，及授予给其他人的身份列表。

     @RequestMapping

     public String runasList(@CurrentUser User loginUser, Model model) {

         //fromUserId是A，toUserId是B。

         //A：授予别人身份的user（领导），B：被授予身份的user（秘书）

         //B可以假借A的身份进行访问

         //查询当前用户是不是被授予身份的，并存好

         model.addAttribute("fromUserIds", userRunAsService.findFromUserIds(loginUser.getId()));

         //查询当前用户有没有授予别人身份，并存好

         model.addAttribute("toUserIds", userRunAsService.findToUserIds(loginUser.getId()));

         //获得除该用户之外的所有users

         List<User> allUsers = userService.findAll();

         allUsers.remove(loginUser);

         model.addAttribute("allUsers", allUsers);

         Subject subject = SecurityUtils.getSubject();

         //subject.isRunAs，用于判定该用户是不是已经是RunAs用户

         model.addAttribute("isRunas", subject.isRunAs());

         if(subject.isRunAs()) {

             //一个用户可以切换很多次身份，之前的身份用栈存储

             String previousUsername =

                     (String)subject.getPreviousPrincipals().getPrimaryPrincipal();

             model.addAttribute("previousUsername", previousUsername);

         }

         return "runas";
     }

（2）grant

 @RequestMapping("/grant/{toUserId}")

     public String grant(

             @CurrentUser User loginUser,

             @PathVariable("toUserId") Long toUserId,

             RedirectAttributes redirectAttributes) {

         if(loginUser.getId().equals(toUserId)) {

             redirectAttributes.addFlashAttribute("msg", "自己不能切换到自己的身份");
return "redirect:/runas";
         }

         userRunAsService.grantRunAs(loginUser.getId(), toUserId);
         redirectAttributes.addFlashAttribute("msg", "操作成功");

         return "redirect:/runas";

     }

（3）revoke

 @RequestMapping("/revoke/{toUserId}")

     public String revoke(

             @CurrentUser User loginUser,

             @PathVariable("toUserId") Long toUserId,

             RedirectAttributes redirectAttributes) {
        userRunAsService.revokeRunAs(loginUser.getId(), toUserId);
         redirectAttributes.addFlashAttribute("msg", "操作成功");

         return "redirect:/runas";

     }

（4）switchTo

 @RequestMapping("/switchTo/{switchToUserId}")

     public String switchTo(

             @CurrentUser User loginUser,

             @PathVariable("switchToUserId") Long switchToUserId,

             RedirectAttributes redirectAttributes) {

         Subject subject = SecurityUtils.getSubject();

         //查找要切换的用户
 User switchToUser = userService.findOne(switchToUserId);
         if(loginUser.equals(switchToUser)) {

             redirectAttributes.addFlashAttribute("msg", "自己不能切换到自己的身份");

             return "redirect:/runas";

         }

         //判定能否切换

         if(switchToUser == null || !userRunAsService.exists(switchToUserId, loginUser.getId())) {

             redirectAttributes.addFlashAttribute("msg", "对方没有授予您身份，不能切换");

             return "redirect:/runas";

         }

         //切换身份
subject.runAs(new SimplePrincipalCollection(switchToUser.getUsername(), ""));
         redirectAttributes.addFlashAttribute("msg", "操作成功");

         redirectAttributes.addFlashAttribute("needRefresh", "true");

         return "redirect:/runas";

     }

（5）switchBack

要注意的是，数据使用栈数据结构保存的。所以如果A --> B, B-->C, 那么C要调用两次releaseRunAs（）才能切换回A。

同样，Subject. getPreviousPrincipals()得到上一次切换到的身份，比如当前是 C；那么调用该 API将得到 B 的身份。

 @RequestMapping("/switchBack")

     public String switchBack(RedirectAttributes redirectAttributes) {

         Subject subject = SecurityUtils.getSubject();

         if(subject.isRunAs()) {//现在是切换的身份中

            //切换至上一个身份
           subject.releaseRunAs();
         }

         redirectAttributes.addFlashAttribute("msg", "操作成功");

         redirectAttributes.addFlashAttribute("needRefresh", "true");

         return "redirect:/runas";

     }

综上可知：

要区分，授予身份与切换身份。

1.A授予身份时

 首先判定是不是给自己授予身份

 如果不是，就调用这句话：userRunAsService.grantRunAs(loginUser.getId(), toUserId);

 而这句话，执行的sql语句是：String sql = "insert into sys_user_runas(from_user_id, to_user_id) values (?,?)";
即它只是在数据库的runas表里插入了一条（A,B）记录。

2.回收身份时，类似，只是删除了一条（A,B）记录。

3.A切换身份至B时

 先找到这个要切换的B，确认存在并且不等于A

 然后判定B是否被A授予了身份，执行的sql是：String sql = "select count(1) from sys_user_runas where from_user_id=? and to_user_id=?"; 即判定关系（A,B）是否存在。
 然后进行身份的切换：subject.runAs(new SimplePrincipalCollection(switchToUser.getUsername(), ""));

4.B切换回A时

先判定这个身份是不是被授予的身份：subject.isRunAs()

然后切换回上一个（从栈数据中拿上一个身份的信息）：subject.releaseRunAs();

即，身份的切换是shiro帮我们做好的。我们要做的就是，维护 (fromUserId，toUserId)的关系。换句话说，授予身份由我们完成，切换身份由shiro完成。

码农公寓

相关文章