shiro整合mybatis
-
继上个文章继续编写！！！
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>8.0.19</version>
</dependency>
<dependency>
<groupId>log4j</groupId>
<artifactId>log4j</artifactId>
<version>1.2.17</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.1.12</version>
</dependency>
<dependency>
<groupId>org.mybatis.spring.boot</groupId>
<artifactId>mybatis-spring-boot-starter</artifactId>
<version>2.1.1</version>
</dependency>
编写application.yaml
spring:
datasource:
username: root
password: 123456
url: jdbc:mysql://localhost:3306/shop?useUnicode=true&characterEncoding=UTF-8&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=UTC
driver-class-name: com.mysql.cj.jdbc.Driver
type: com.alibaba.druid.pool.DruidDataSource
#Spring Boot 默认是不注入这些属性值的，需要自己绑定
#druid 数据源专有配置
initialSize: 5
minIdle: 5
maxActive: 20
maxWait: 60000
timeBetweenEvictionRunsMillis: 60000
minEvictableIdleTimeMillis: 300000
validationQuery: SELECT 1 FROM DUAL
testWhileIdle: true
testOnBorrow: false
testOnReturn: false
poolPreparedStatements: true
#配置监控统计拦截的filters，stat:监控统计、log4j：日志记录、wall：防御sql注入
#如果允许时报错 java.lang.ClassNotFoundException: org.apache.log4j.Priority
#则导入 log4j 依赖即可，Maven 地址：https://mvnrepository.com/artifact/log4j/log4j
filters: stat,wall,log4j
maxPoolPreparedStatementPerConnectionSize: 20
useGlobalDataSourceStat: true
connectionProperties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=500
mybatis:
type-aliases-package: com.saxon.springbootshiro.pojo
mapper-locations: classpath:mapper/*.xml
编写实体类
导入lombok
User.java
@Data
@AllArgsConstructor
@NoArgsConstructor
public class User {
private int id;
private String name;
private String pwd;
private String perms;
}
mapper包编写UserMapper
@Mapper//这个注解表示了这是一个mybatis的mapper类
@Repository
public interface UserMapper {
List<User> queryUserList();
User queryUserById(int id);
int addUser(User user);
int updateUser(User user);
int deleteUser(int id);
}
resource包下新建mybatis包下健mapper
UserMapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.saxon.springbootshiro.mapper.UserMapper">
<select id="queryUserList" resultType="User">
select * from users;
</select>
<select id="queryUserByName" resultType="User" parameterType="String">
select * from users where name=#{name}
</select>
</mapper>
?
service层 UserService接口
public interface UserService {
List<User> queryUserList();
User queryUserByName(String name);
}
UserServiceImpl
import java.util.List;
@Service
public class UserServiceImpl implements UserService{
@Autowired
UserMapper userMapper;
@Override
public List<User> queryUserList() {
return userMapper.queryUserList();
}
@Override
public User queryUserByName(String name) {
return userMapper.queryUserByName(name);
}
}
SpringbootshiroApplicationTests中进行测试
@SpringBootTest
class SpringbootshiroApplicationTests {
@Autowired
UserServiceImpl userService;
@Test
void contextLoads() {
System.out.println(userService.queryUserByName("李四"));
}
}
- 测试成功
MyRealm.java
package com.saxon.springbootshiro.config;
import com.saxon.springbootshiro.pojo.User;
import com.saxon.springbootshiro.service.UserServiceImpl;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;
public class MyRealm extends AuthorizingRealm {
@Autowired
UserServiceImpl userService;
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("授权方法执行了");
return null;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
System.out.println("认证方法执行了");
// String username="root";
// String password="123456";
//查询真实数据库
UsernamePasswordToken token =(UsernamePasswordToken) authenticationToken;
User user = userService.queryUserByName(token.getUsername());
String name=user.getName();
String password=user.getPwd();
if(user==null){//说明查无此人
return null;
}
// //用户名验证
// if (!token.getUsername().equals(username)){
// //自动抛出异常
// return null;
// }
//密码验证
return new SimpleAccount("",password,"");
}
}
Shiro实现请求授权
MyRealm.java
package com.saxon.springbootshiro.config;
import com.saxon.springbootshiro.pojo.User;
import com.saxon.springbootshiro.service.UserServiceImpl;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
public class MyRealm extends AuthorizingRealm {
@Autowired
UserServiceImpl userService;
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("授权方法执行了");
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
//info.addStringPermission("user:add");
//拿到当前用户登陆对象
Subject subject= SecurityUtils.getSubject();
User currentUser= (User) subject.getPrincipal();//拿到User对象
info.addStringPermission(currentUser.getPerms());//设置当前用户对象
return info;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
System.out.println("认证方法执行了");
//查询真实数据库
UsernamePasswordToken token =(UsernamePasswordToken) authenticationToken;
User user = userService.queryUserByName(token.getUsername());
if(user==null){//说明查无此人
return null;
}
// //用户名验证
// if (!token.getUsername().equals(username)){
// //自动抛出异常
// return null;
// }
//密码验证
String name=user.getName();
String password=user.getPwd();
return new SimpleAccount(user,password,"");
}
}
Shiro整合Thymeleaf
<!--整合thymeleaf-->
<dependency>
<groupId>com.github.theborakompanioni</groupId>
<artifactId>thymeleaf-extras-shiro</artifactId>
<version>2.0.0</version>
</dependency>
@Configuration
public class ShiroConfig {
//ShiroFilterBean
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
ShiroFilterFactoryBean bean=new ShiroFilterFactoryBean();
//设置安全管理器
bean.setSecurityManager(defaultWebSecurityManager);
//添加shiro的内置过滤器
/*
anon:无需认证就能访问
authc:必须认证才能访问
user:必须拥有记住我功能才能访问
perms:拥有某个资源的权限才能访问
role:拥有某个角色权限才能访问
*/
//拦截
Map<String,String> filterMap =new LinkedHashMap<>();
//授权
filterMap.put("/user/add","perms[user:add]");
filterMap.put("/user/update","perms[user:update]");
filterMap.put("/user/add","authc");
filterMap.put("/user/update","authc");
//设置登陆的请求
bean.setLoginUrl("/toLogin");
//设置未授权的请求
bean.setUnauthorizedUrl("/noauth");
bean.setFilterChainDefinitionMap(filterMap);
return bean;
}
//DefaultWebSecurityManager
@Bean
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("myRealm") MyRealm myRealm){
DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
//关联UserRealm
securityManager.setRealm(myRealm);
return securityManager;
}
//创建realm对象
@Bean
public MyRealm myRealm(){
return new MyRealm();
}
//整合shiroDialect:用来整合shiro thymeleaf
@Bean
public ShiroDialect getShiroDialect(){
return new ShiroDialect();
}
}
命名空间约束
<html lang="en" xmlns:th="http://www.thymeleaf.org"
xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
shiroConfig.java
这是与springsecurity整合thymeleaf的最大不同
@Bean
public ShiroDialect getShiroDialect(){
return new ShiroDialect();
}
前端 index.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<h1>首页</h1>
<div th:if="${session.loginUser==null}">
<a th:href="@{/login}">登录</a>
</div>
<h1 th:text="${msg}"></h1>
<hr/>
<div shiro:hasPermission="add">
<a th:href="@{/add}">添加</a>
</div>
<div shiro:hasPermission="update">
<a th:href="@{/update}">删除</a>
</div>
</body>
</html>
package com.saxon.springbootshiro.controller;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import javax.servlet.http.HttpSession;
@Controller
public class MyController {
@RequestMapping({"/","/index"})
public String toIndex(Model model){
model.addAttribute("msg", "hello,shiro");
return "index";
}
@RequestMapping("/add")
public String toAdd(){
return "user/add";
}
@RequestMapping("/update")
public String toUpdate(){
return "user/update";
}
@RequestMapping("/toLogin")
public String toLogin(){
return "login";
}
@RequestMapping("/login")
public String login(String username,String password,Model model, HttpSession session){
//获取当前用户
Subject subject = SecurityUtils.getSubject();
//封装用户的登录数据
UsernamePasswordToken token = new UsernamePasswordToken(username,password);
try {
subject.login(token);
session.setAttribute("loginUser",username);//设置session
return "index";
} catch (UnknownAccountException uae){
model.addAttribute("msg","用户名错误");
return "login";
}catch (IncorrectCredentialsException ice){
model.addAttribute("msg", "密码错误");
return "login";
} catch (AuthenticationException e) {
model.addAttribute("msg", "登录失败");
return "login";
}
}
@RequestMapping("/noauth")
@ResponseBody
public String unauthorized(){
return "未经授权禁止访问";
}
}