本文旨在用Vert.x，shiro JdbcRealm开发一个对restfu api进行鉴权的demo
Vert.x：参看 http://vertx.io
shiro：参看 http://shiro.apache.org/
业务逻辑很简单，就是实现用户登录验证，然后对restful api进行鉴权。
数据库用mysql。
数据库名：myshiro
数据表：
1 -- ---------------------------- 2 -- Table structure for t_permission 3 -- ---------------------------- 4 DROP TABLE IF EXISTS `t_permission`; 5 CREATE TABLE `t_permission` ( 6 `id` int(11) NOT NULL, 7 `permission` varchar(255) NOT NULL, 8 `role_id` int(11) DEFAULT NULL, 9 PRIMARY KEY (`id`) 10 ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 11 12 -- ---------------------------- 13 -- Table structure for t_role 14 -- ---------------------------- 15 DROP TABLE IF EXISTS `t_role`; 16 CREATE TABLE `t_role` ( 17 `id` int(11) NOT NULL, 18 `role_name` varchar(255) DEFAULT NULL, 19 PRIMARY KEY (`id`) 20 ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 21 22 -- ---------------------------- 23 -- Table structure for t_user 24 -- ---------------------------- 25 DROP TABLE IF EXISTS `t_user`; 26 CREATE TABLE `t_user` ( 27 `id` int(11) NOT NULL, 28 `username` varchar(255) DEFAULT NULL, 29 `password` varchar(255) DEFAULT NULL, 30 PRIMARY KEY (`id`) 31 ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 32 33 -- ---------------------------- 34 -- Table structure for t_user_role 35 -- ---------------------------- 36 DROP TABLE IF EXISTS `t_user_role`; 37 CREATE TABLE `t_user_role` ( 38 `id` int(11) NOT NULL, 39 `user_id` int(11) DEFAULT NULL, 40 `role_id` int(11) DEFAULT NULL, 41 PRIMARY KEY (`id`) 42 ) ENGINE=InnoDB DEFAULT CHARSET=utf8; 43 后台代码： 44 45
1 package cn.endv.realtime.apigateway;
2
3 import java.util.HashSet;
4 import java.util.Set;
5
6 import org.apache.shiro.realm.jdbc.JdbcRealm;
7 import org.apache.tomcat.jdbc.pool.DataSource;
8
9 import io.vertx.core.AbstractVerticle;
10 import io.vertx.core.Future;
11 import io.vertx.core.MultiMap;
12 import io.vertx.core.http.HttpServer;
13 import io.vertx.core.http.HttpServerRequest;
14 import io.vertx.core.json.JsonObject;
15 import io.vertx.ext.auth.AuthProvider;
16 import io.vertx.ext.auth.User;
17 import io.vertx.ext.auth.shiro.ShiroAuth;
18 import io.vertx.ext.web.Router;
19 import io.vertx.ext.web.RoutingContext;
20 import io.vertx.ext.web.Session;
21 import io.vertx.ext.web.handler.AuthHandler;
22 import io.vertx.ext.web.handler.BodyHandler;
23 import io.vertx.ext.web.handler.CookieHandler;
24 import io.vertx.ext.web.handler.RedirectAuthHandler;
25 import io.vertx.ext.web.handler.SessionHandler;
26 import io.vertx.ext.web.handler.UserSessionHandler;
27 import io.vertx.ext.web.sstore.LocalSessionStore;
28
29 public class ApiGatewayVerticle2 extends AbstractVerticle {
30
31 private AuthProvider authProvider;
32
33 @Override
34 public void start(Future<Void> startFuture) throws Exception {
35
36 // 用户权限信息-JDBC形式
37 JdbcRealm jdbcRealm = getJdbcRealm();
38 authProvider = ShiroAuth.create(vertx, jdbcRealm);
39
40 // 路由器
41 Router router = Router.router(vertx);
42
43 // 为所有route创建session handler
44 router.route().handler(BodyHandler.create());
45 router.route().handler(CookieHandler.create());
46 router.route().handler(SessionHandler.create(LocalSessionStore.create(vertx)).setSessionTimeout(1000 * 60 * 1));
47 router.route().handler(UserSessionHandler.create(authProvider));
48
49 // 当请求中没有user session时，自动跳转到 /login
50 AuthHandler authHandler = RedirectAuthHandler.create(authProvider, "/login");
51 Set<String> authorities = new HashSet<String>();
52 authHandler.addAuthorities(authorities);
53
54 // 为所有需要鉴权的路由安装authHandler
55 router.route("/").handler(authHandler);
56 router.route("/api/*").handler(authHandler);
57
58 // restful api 鉴权
59 router.get("/api/liaota/liaota").handler(this::listLiaotaHandler);
60 router.put("/api/liaota/liaota/:id").handler(this::updateLiaotaHandler);
61 router.post("/api/liaota/liaota/").handler(this::addLiaotaHandler);
62 router.delete("/api/liaota/liaota/:id").handler(this::deleteLiaotaHandler);
63
64 // 登录跳转、登录验证、登出处理handler
65 router.get("/login").handler(this::loginHandler);
66 router.post("/login-auth").handler(this::loginAuthHandler);
67 router.get("/logout").handler(context -> {
68 context.clearUser();
69 context.response().setStatusCode(302).putHeader("Location", "/").end();
70 });
71
72 // 启动httpServer
73 vertx.createHttpServer().requestHandler(router::accept).listen(8080, h-> {
74 if(h.succeeded())
75 System.out.println("server start.");
76 else
77 h.cause().printStackTrace();
78 });
79 }
80
81 /**
82 * 通过JDBC获取用户、角色、权限
83 *
84 * @return
85 */
86 private JdbcRealm getJdbcRealm(){
87 // 数据库连接池 此处用硬编码方式（生产环境用配置文件方式）
88 DataSource dataSource = new DataSource();
89 dataSource.setDriverClassName("com.mysql.jdbc.Driver");
90 dataSource.setUrl("jdbc:mysql://localhost:3306/myshiro?useUnicode=true&characterEncoding=utf8");
91 dataSource.setUsername("demo");
92 dataSource.setPassword("123456");
93 // 配置数据库断开后自动连接
94 dataSource.setLogAbandoned(true);
95 dataSource.setRemoveAbandoned(true);
96 dataSource.setRemoveAbandonedTimeout(60);
97 dataSource.setTestWhileIdle(true);
98 dataSource.setValidationQuery("select id from user where name='demo'");
99
100 // 配置jdbcRealm
101 JdbcRealm jdbcRealm = new JdbcRealm();
102 jdbcRealm.setDataSource(dataSource);
103 jdbcRealm.setPermissionsLookupEnabled(true);//true:允许查找角色的权限。false:只查找用户和角色，不会查找角色的权限。
104
105 // jdbcRealm.setAuthenticationCachingEnabled(false);//禁止缓存用户查询结果。禁止后，每次都要从数据库查询。
106 // jdbcRealm.setAuthorizationCachingEnabled(false);//禁止缓存角色，权限查询结果。禁止后，每次都要从数据库查询。
107 jdbcRealm.setCachingEnabled(false);//禁止缓存
108
109 // 修改查询数据库SQL，根据自己的数据库表结构进行修改。
110 jdbcRealm.setAuthenticationQuery("select password from t_user where username = ?");
111 jdbcRealm.setUserRolesQuery("select t_r.role_name from t_user_role t_ur "
112 + "inner join t_role t_r on t_ur.role_id=t_r.id "
113 + "inner join t_user t_u on t_u.id = t_ur.user_id where t_u.username = ?");
114 jdbcRealm.setPermissionsQuery("select permission from t_permission t_p "
115 + "inner join t_role t_r on t_r.id = t_p.role_id where t_r.role_name = ?");
116
117 return jdbcRealm;
118 }
119
120 private void loginAuthHandler(RoutingContext context) {
121 HttpServerRequest req = context.request();
122 MultiMap params = req.formAttributes();
123 String username = params.get("username");
124 String password = params.get("password");
125
126 Session session = context.session();
127 JsonObject authInfo = new JsonObject().put("username", username).put("password", password);
128
129 authProvider.authenticate(authInfo, res -> {
130 JsonObject json = new JsonObject();
131 json.put("message", "loginFail");
132
133 if (res.succeeded()) {
134 json.put("message", "loginSuccess");
135 User user = res.result();
136 context.setUser(user);
137 if (session != null) {
138 session.regenerateId(); // 更新session id
139 }
140 }
141 req.response().headers().set("Content-Type", "text/html; charset=UTF-8");
142 req.response().end(json.encode());
143 });
144 }
145
146 private void loginHandler(RoutingContext context) {
147 HttpServerRequest req = context.request();
148 req.response().headers().set("Content-Type", "text/html; charset=UTF-8");
149 req.response().end("login");
150 }
151
152 private void listLiaotaHandler(RoutingContext context) {
153 context.user().isAuthorised("query", h -> {
154 if(h.result())
155 doSomething(context);
156 else {
157 authFail(context);
158 }
159 });
160 }
161
162 private void updateLiaotaHandler(RoutingContext context) {
163 context.user().isAuthorised("update", h -> {
164 if(h.result())
165 doSomething(context);
166 else {
167 authFail(context);
168 }
169 });
170 }
171
172 private void addLiaotaHandler(RoutingContext context) {
173 context.user().isAuthorised("add", h -> {
174 if(h.result())
175 doSomething(context);
176 else {
177 authFail(context);
178 }
179 });
180 }
181
182 private void deleteLiaotaHandler(RoutingContext context) {
183 context.user().isAuthorised("delete", h -> {
184 if(h.result())
185 doSomething(context);
186 else {
187 authFail(context);
188 }
189 });
190 }
191
192 private void doSomething(RoutingContext context){
193 System.out.println("鉴权通过，进行业务逻辑处理。");
194 JsonObject json = new JsonObject();
195 json.put("success", true).put("message", "业务处理完成。");
196 context.request().response().headers().set("Content-Type", "text/html; charset=UTF-8");
197 context.request().response().end(json.toString());
198 }
199
200 private void authFail(RoutingContext context){
201 JsonObject json = new JsonObject();
202 json.put("success", false).put("message", "无此权限。");
203 context.request().response().headers().set("Content-Type", "text/html; charset=UTF-8");
204 context.request().response().end(json.toString());
205 }
206
207 }
pom.xml需要引入：
1 <dependencies> 2 <dependency> 3 <groupId>io.vertx</groupId> 4 <artifactId>vertx-core</artifactId> 5 <version>3.4.2</version> 6 </dependency> 7 <dependency> 8 <groupId>io.vertx</groupId> 9 <artifactId>vertx-web</artifactId> 10 <version>3.4.2</version> 11 </dependency> 12 <dependency> 13 <groupId>io.vertx</groupId> 14 <artifactId>vertx-auth-shiro</artifactId> 15 <version>3.4.2</version> 16 </dependency> 17 <dependency> 18 <groupId>org.apache.tomcat</groupId> 19 <artifactId>tomcat-jdbc</artifactId> 20 <version>8.5.11</version> 21 </dependency> 22 <dependency> 23 <groupId>org.apache.tomcat</groupId> 24 <artifactId>tomcat-juli</artifactId> 25 <version>8.5.11</version> 26 </dependency> 27 <dependency> 28 <groupId>mysql</groupId> 29 <artifactId>mysql-connector-java</artifactId> 30 <version>5.1.26</version> 31 </dependency> 32 </dependencies>