import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;

import java.util.Objects;

import java.util.Set;

/**

• 认证校验类

• @author： 刘朋

• 
  date： 2019-05-05

*/

public class MyShiroRealm extends AuthorizingRealm {

//slf4j记录日志，可以不使用

private Logger logger = LoggerFactory.getLogger(MyShiroRealm.class);

@Autowired

private LoginService loginService;

/**

• 设置授权信息,目前这个方法没有什么作用

*/

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

logger.info(“开始授权(doGetAuthorizationInfo)”);

SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

//角色

Set roles = new HashSet<>();

roles.add(“role1”);

authorizationInfo.setRoles(roles);

//权限

Set permissions = new HashSet<>();

permissions.add(“user:list”);

authorizationInfo.setStringPermissions(permissions);

return authorizationInfo;

}

/**

• 设置认证信息

*/

@Override

protected AuthenticationInfo doGetAuthenticationInfo(

AuthenticationToken authcToken) throws AuthenticationException {

logger.info(“开始认证(doGetAuthenticationInfo)”);

UsernamePasswordToken token = (UsernamePasswordToken) authcToken;

String username = token.getUsername();

String password = new String(token.getPassword());

//查询用户是否存在，这里是用的Mybatis Plus,可以根据自己的方式进行校验

QueryWrapper queryWrapper = new QueryWrapper<>();

queryWrapper.eq(“name”, username);

queryWrapper.eq(“password”, password);

UserPO userPO = loginService.querySingle(queryWrapper);

if (Objects.isNull(userPO)) {

throw new IncorrectCredentialsException(“用户名密码错误！”);

}

return new SimpleAuthenticationInfo(

userPO,

token.getPassword(),

getName()

);

}

}

3.创建shiro配置类

---

package com.youyou.login.config;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;

import java.util.Map;

@Configuration

public class ShiroConfiguration {

private static Logger logger = LoggerFactory.getLogger(ShiroConfiguration.class);

/**

• 需要认证

*/

private static final String ANON = “anon”;

/**

• 排除认证

*/

private static final String AUTHC = “authc”;

@Bean(name = “shiroFilter”)

public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {

logger.info(“进入shiroFilter…”);

ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

shiroFilterFactoryBean.setSecurityManager(securityManager);

//设置不需要拦截的路径

Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

//按顺序依次判断，这是一个责任链模式，如果有匹配的拦截，后面就不会匹配了

filterChainDefinitionMap.put("/static/**", ANON);

//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了

filterChainDefinitionMap.put("/logout", “logout”);

//

/*************************初始化所有的权限信息开始

《一线大厂Java面试题解析+后端开发学习笔记+最新架构讲解视频+实战项目源码讲义》

【docs.qq.com/doc/DSmxTbFJ1cmN1R2dB】 完整内容开源分享

*******************************/

//这里，如果以后再项目中使用的话，直接从数据库中查询

filterChainDefinitionMap.put("/user/list", “authc,perms[user:list]”);

//filterChainDefinitionMap.put("/user/add", “authc,perms[user:add]”);

/初始化所有的权限信息开始结束******/

filterChainDefinitionMap.put("/api/**", AUTHC);

// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面

shiroFilterFactoryBean.setLoginUrl("/login");

// 登录成功后要跳转的链接

// shiroFilterFactoryBean.setSuccessUrl("/index");

//未授权界面

shiroFilterFactoryBean.setUnauthorizedUrl("/error/403");

shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

return shiroFilterFactoryBean;

}

@Bean

public MyShiroRealm myShiroRealm() {

MyShiroRealm myShiroRealm = new MyShiroRealm();

//后面这里可以设置缓存的机制

return myShiroRealm;

}

@Bean

public SecurityManager securityManager() {

DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

securityManager.setRealm(myShiroRealm());

return securityManager;

}

@Bean