博客地址：https://www.lqnb.xyz/
源码地址：https://github.com/memo012/ac-blog

springboot+shiro+redis实现博客权限管理(前后端分离) 一. 背景 现如今，项目的安全权限问题越来越受重视，比如springsecurity，shiro…都可以用于权限管理，被称为权限框架。此博客介绍spring boot整合shiro。
二. 环境

• springboot1.x或springboot2.x
• shiro 1.4.0版本
• redis任意

三. 搭建步骤 1. 导包

org.apache.shiro shiro-spring 1.4.0 org.crazycake shiro-redis 3.1.0 org.projectlombok lombok 1.18.6

整个pom.xml中文件

4.0.0【springboot|springboot+shiro+redis实现博客权限管理(前后端分离)】org.springframework.boot spring-boot-starter-parent 2.1.6.RELEASE com.qiang shiro-redis 0.0.1-SNAPSHOT shiro-redis Demo project for Spring Boot1.8 1.3.3 org.springframework.boot spring-boot-starter-web org.mybatis.spring.boot mybatis-spring-boot-starter ${mybatis.version} mysql mysql-connector-java org.springframework.boot spring-boot-starter-test test com.alibaba druid 1.1.6 org.apache.shiro shiro-spring 1.4.0 org.projectlombok lombok 1.18.6 org.springframework.boot spring-boot-starter-thymeleaf org.crazycake shiro-redis 3.1.0 org.springframework.boot spring-boot-maven-plugin

二. 自定义realm(AuthRealm)

package com.qiang.config; import com.qiang.dao.UserDao; import com.qiang.entity.PermissionEntity; import com.qiang.entity.RoleEntity; import com.qiang.entity.UserEntity; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.SimpleAuthenticationInfo; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.apache.shiro.util.ByteSource; import org.springframework.beans.factory.annotation.Autowired; import java.util.ArrayList; import java.util.List; import java.util.Set; /** * @Author: qiang * @ProjectName: adminsystem * @Package: com.qiang.config * @Description: * @Date: 2019/7/28 0028 20:53 **/ public class AuthRealm extends AuthorizingRealm {@Autowired private UserDao userDao; /** * 授权 * @param principals * @return */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { System.out.println("授权 doGetAuthorizationInfo"); // 获取用户信息 UserEntity userEntity = (UserEntity) principals.getPrimaryPrincipal(); UserEntity byUsername = userDao.findByUsername(userEntity.getUsername()); List roles = new ArrayList<>(); List permissions = new ArrayList<>(); Set roleEntiries = byUsername.getRoleEntiries(); System.out.println(roleEntiries.size()); if(roleEntiries.size() > 0 && roleEntiries != null){ for (RoleEntity r: roleEntiries) { roles.add(r.getRname()); if(r.getPermissionEntities().size() > 0 && r.getPermissionEntities() != null){ for (PermissionEntity p: r.getPermissionEntities()) { permissions.add(p.getName()); System.out.println(p.getName()); } }} } SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(); simpleAuthorizationInfo.addRoles(roles); simpleAuthorizationInfo.addStringPermissions(permissions); return simpleAuthorizationInfo; }/** * 认证 * @param token * @return * @throws AuthenticationException */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { System.out.println("认证 doGetAuthenticationInfo"); String username = (String)token.getPrincipal(); System.out.println(username); UserEntity byUsername = userDao.findSimpleByUsername(username); String password = byUsername.getPassword(); if(password == null || password.equals("")){ return null; } System.out.println(password); //当前realm对象的name String realmName = getName(); //盐值 ByteSource credentialsSalt = ByteSource.Util.bytes(byUsername.getUsername()); SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(byUsername, byUsername.getPassword(),credentialsSalt, realmName); return simpleAuthenticationInfo; } }

三. sessionManager自定义会话管理(CustomSessionManager )

package com.qiang.config; import org.apache.shiro.web.servlet.ShiroHttpServletRequest; import org.apache.shiro.web.session.mgt.DefaultWebSessionManager; import org.apache.shiro.web.util.WebUtils; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import java.io.Serializable; /** * @Author: qiang * @ProjectName: adminsystem * @Package: com.qiang.config * @Description: shiro中sessionManager自定义会话管理 * @Date: 2019/7/28 0028 21:48 **/ public class CustomSessionManager extends DefaultWebSessionManager {private static final String AUTHORIZATION = "token"; public CustomSessionManager() { super(); }@Override protected Serializable getSessionId(ServletRequest request, ServletResponse response) { String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATION); if (sessionId != null) { request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE, ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE); request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId); //automatically mark it valid here.If it is invalid, the //onUnknownSession method below will be invoked and we'll remove the attribute at that time. request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE); return sessionId; } else { return super.getSessionId(request, response); } }}

四. shiro配置文件(ShiroConfig.java)

package com.qiang.config; import org.apache.shiro.authc.credential.HashedCredentialsMatcher; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.session.mgt.SessionManager; import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.web.mgt.DefaultWebSecurityManager; import org.crazycake.shiro.RedisCacheManager; import org.crazycake.shiro.RedisManager; import org.crazycake.shiro.RedisSessionDAO; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import javax.servlet.Filter; import java.util.LinkedHashMap; import java.util.Map; /** * @Author: qiang * @ProjectName: adminsystem * @Package: com.qiang.config * @Description: * @Date: 2019/7/28 0028 21:19 **/ @Configuration public class ShiroConfig {@Bean("shiroFilter") public ShiroFilterFactoryBean shiroFilter() { ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean(); bean.setSecurityManager(securityManager()); bean.setLoginUrl("/pub/need_login"); // 登录成功 如何前后端分离(不调用) bean.setSuccessUrl("/"); // 没有权限，未授权就会调用此方法 先登录-》再验证是否有权限 bean.setUnauthorizedUrl("/pub/not_permit"); // 设置自定义filter Map filterMap = new LinkedHashMap<>(); filterMap.put("roleOrFilter", new CustomRoleOrAuthorizationFilter()); bean.setFilters(filterMap); // 拦截器路径 Map map = new LinkedHashMap<>(); // 退出过滤器 map.put("/logout", "logout"); // 匿名访问 游客即可 map.put("/pub/**", "anon"); map.put("/index", "anon"); // 认证才可访问 map.put("/authc/**", "authc"); // 管理员才可访问 map.put("/admin/**", "roles[admin]"); // 管理员才可访问 只需具备任意角色中一个即可访问(自定义AuthorizationFilter) // map.put("/admin/**", "roleOrFilter[admin,root]"); // 管理员才可访问 默认必须具备全部角色才可访问 // map.put("/admin/**", "roles[admin,root]"); // 拥有某权限才可访问 map.put("/video/update", "perms[video_update]"); // 坑二 过滤器是顺序执行，从上而下，一般将/** 放到最底下// authc: 认证才可访问 // anon： 匿名即可 map.put("/**", "anon"); bean.setFilterChainDefinitionMap(map); return bean; }@Bean("securityManager") public SecurityManager securityManager() { DefaultWebSecurityManager manager = new DefaultWebSecurityManager(); // 如果前后端不分离，则注释掉即可 manager.setSessionManager(sessionManager()); // 使用自定义cacheManager manager.setCacheManager(redisCacheManager()); // 推荐放到最后 manager.setRealm(authRealm()); return manager; }/** * 自定义realm * * @return */ @Bean("authRealm") public AuthRealm authRealm() { AuthRealm authRealm = new AuthRealm(); authRealm.setCredentialsMatcher(hashedCredentialsMatcher()); return authRealm; }/** * 密码加解密规则 * * @return */ @Bean("hashedCredentialsMatcher") public HashedCredentialsMatcher hashedCredentialsMatcher() { HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher(); // 散列算法：使用MD5加密 hashedCredentialsMatcher.setHashAlgorithmName("MD5"); // 散列次数 hashedCredentialsMatcher.setHashIterations(1024); hashedCredentialsMatcher.setStoredCredentialsHexEncoded(true); return hashedCredentialsMatcher; }/** * 自定义sessionManager * * @return */ @Bean("sessionManager") public SessionManager sessionManager() { CustomSessionManager customSessionManager = new CustomSessionManager(); // 超时时间 默认30分钟，会话超时，方法里面的是单位是毫秒 //customSessionManager.setGlobalSessionTimeout(60 * 1000); // 配置session持久化 customSessionManager.setSessionDAO(redisSessionDAO()); return customSessionManager; }/** * 设置redisManager * @return */ public RedisManager getRedisManager(){ RedisManager redisManager = new RedisManager(); redisManager.setHost("192.168.233.133"); redisManager.setPort(6379); return redisManager; }/** * 配置具体cache实现类 * @return */ @Bean("redisCacheManager") public RedisCacheManager redisCacheManager(){ RedisCacheManager redisCacheManager = new RedisCacheManager(); redisCacheManager.setRedisManager(getRedisManager()); // 设置过期时间，单位是秒 redisCacheManager.setExpire(60 * 30); return redisCacheManager; }/** * 自定义session持久化 * @return */ public RedisSessionDAO redisSessionDAO(){ RedisSessionDAO redisSessionDAO = new RedisSessionDAO(); redisSessionDAO.setRedisManager(getRedisManager()); // 设置sessionId生成器 redisSessionDAO.setSessionIdGenerator(new CustomSessionIdGenerator()); return redisSessionDAO; }/** * 开启 Shiro aop 注解支持 * 用代理方式; 所以需要开启代码支持 * @return advisor */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() { AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor(); advisor.setSecurityManager(securityManager()); return advisor; } }

五. 密码加密类(ShiroMD5.java)

package com.qiang.config; import org.apache.shiro.crypto.hash.SimpleHash; import org.apache.shiro.util.ByteSource; /** * @Author: qiang * @ProjectName: adminsystem * @Package: com.qiang.shiro * @Description:shiroMD5加密类 * @Date: 2019/6/21 0021 13:17 **/ public class ShiroMD5 {public static Object MD5(String username,String password){ String hashAlgorithName = "MD5"; int hashIterations = 1024; //加密次数 ByteSource credentialsSalt = ByteSource.Util.bytes(username); Object obj = new SimpleHash(hashAlgorithName, password, credentialsSalt, hashIterations); return obj; }public static void main(String[] args) { System.out.println(MD5("dong", "123456")); } }

到此，整合完成
具体代码：https://github.com/memo012/ac-blog
公众号 希望大家多多关注，里面不定期发放干货
领取全套资料：回复关键字【666】

文章图片

推荐阅读

• 

  政策性银行员工是事业编吗 政策性银行有哪些
• 

  为什么喝茶容易失眠 晚上喝黑茶会失眠吗
• 

  塔莱辛魔像在哪里 塔莱辛魔像位置分享
• 

  hp25r|全新升级，照亮前方！Fenix HP25R V2.0头灯体验
• 

  茶叶泡久了变红为什么
• 

  小米|iPhone13再见！没有快充高刷也配称为旗舰华为小米不香吗！
• 

  丰年虾孵化后能活多久 丰年虾孵化后能活多久
• 

  激萌如何变老，faceu激萌变老功能怎么玩
• 

  ntko控件下载,NTKO大文件上传控件
• 

  胃痛推拿有效果吗
• 

  香菇胡萝卜肉馅要不要炒
• 

  用ps制作个性签名 我来分享PS制作粉色个性签名的详细操作
• 

  foxmail如何设置阅读收条 Foxmail设置阅读收条的相关操作步骤
• 

  不用实名认证的5v5游戏，腾讯哪些游戏不需要实名认证的
• 

  鸡 电压力锅 如何用电压锅煲鸡，用电压力锅做鸡的做法
• 

  电热水器漏电开关安装示意图 如何防止电热水器漏电，热水器漏电会电死人吗
• 

  新型冠状病手抄报怎么画
• 

  荣耀80 GT取消8G版本 售价3299元 支持24期免息分期
• 

  05|05 | 行为金融学（ 你能真正了解一家公司吗（信息收集阶段的认知偏差））
• 

  怎么去除杯盖的异味 怎么去除杯盖的胶味

• Activiti（一）SpringBoot2集成Activiti6
• SpringBoot调用公共模块的自定义注解失效的解决
• 解决SpringBoot引用别的模块无法注入的问题
• springboot使用redis缓存
• springboot整合数据库连接池-->druid
• SpringBoot中YAML语法及几个注意点说明
• springboot结合redis实现搜索栏热搜功能及文字过滤
• springboot中.yml文件的值无法读取的问题及解决
• SpringBoot整合MongoDB完整实例代码
• 年薪30万的Java架构师必会的springboot面试题