sm整合shiro权限控制
CasUser：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.domain.entity.cas; import java.util.HashSet; import java.util.Set; import javax.persistence.Entity; import javax.persistence.JoinColumn; import javax.persistence.JoinTable; import javax.persistence.ManyToMany; import javax.persistence.Table; import javax.persistence.Transient; import com.fasterxml.jackson.annotation.JsonIgnore; import com.micropattern.urp.domain.entity.base.BaseIdAndTime; import com.micropattern.urp.domain.entity.role.Role; /** * cas集成用户<br/> * * @author zuo * @Date 2020年4月20日 上午11:11:05 * @since 1.0.0 * */ @SuppressWarnings("serial") @Table(name = "t_cas_user") @Entity public class CasUser extends BaseIdAndTime{ private String userName; private String role; @Transient private String searchKey; private String salt; private String password; private String remark; /** * 用户角色关系表 */ @JsonIgnore @ManyToMany @JoinTable(name="t_cas_user_role", joinColumns={@JoinColumn(name="user_id",referencedColumnName="id")}, inverseJoinColumns={@JoinColumn(name="role_id",referencedColumnName="id")}) private Set<Role> roles = new HashSet<>(); public String getUserName() { return userName; } public void setUserName(String userName) { this.userName = userName; } public String getRole() { return role; } public void setRole(String role) { this.role = role; } public String getSearchKey() { return searchKey; } public void setSearchKey(String searchKey) { this.searchKey = searchKey; } public Set<Role> getRoles() { return roles; } public void setRoles(Set<Role> roles) { this.roles = roles; } public String getSalt() { return salt; } public void setSalt(String salt) { this.salt = salt; } public String getPassword() { return password; } public void setPassword(String password) { this.password = password; } public String getRemark() { return remark; } public void setRemark(String remark) { this.remark = remark; } }
Role：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.domain.entity.role; import java.util.HashSet; import java.util.Set; import javax.persistence.Entity; import javax.persistence.JoinColumn; import javax.persistence.JoinTable; import javax.persistence.ManyToMany; import javax.persistence.Table; import com.fasterxml.jackson.annotation.JsonIgnore; import com.micropattern.urp.domain.entity.base.BaseIdAndTime; import com.micropattern.urp.domain.entity.cas.CasUser; import com.micropattern.urp.domain.entity.permission.Permission; /** * 此处应有类说明<br/> * * @author why * @Date 2020年4月13日 下午3:36:58 * @since 1.0.0 * */ @SuppressWarnings("serial") @Table(name = "t_cas_role") @Entity public class Role extends BaseIdAndTime{ /** * 角色名 */ private String name; private Boolean delFlag; private String remark; /** * 角色，用户，多对多 */ @JsonIgnore @ManyToMany(mappedBy="roles") private Set<CasUser> users=new HashSet<>(); @JsonIgnore @ManyToMany @JoinTable(name="t_cas_role_permission", joinColumns={@JoinColumn(name="role_id",referencedColumnName="id")}, inverseJoinColumns={@JoinColumn(name="permission_id",referencedColumnName="id")}) private Set<Permission> permissions = new HashSet<>(); public Set<Permission> getPermissions() { return permissions; } public void setPermissions(Set<Permission> permissions) { this.permissions = permissions; } public Boolean getDelFlag() { return delFlag; } public void setDelFlag(Boolean delFlag) { this.delFlag = delFlag; } public String getName() { return name; } public void setName(String name) { this.name = name; } public Set<CasUser> getUsers() { return users; } public void setUsers(Set<CasUser> users) { this.users = users; } public String getRemark() { return remark; } public void setRemark(String remark) { this.remark = remark; } }
Permission：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.domain.entity.permission; import javax.persistence.Entity; import javax.persistence.Table; import javax.persistence.Transient; import com.micropattern.urp.domain.entity.base.BaseIdAndTime; /** * 此处应有类说明<br/> * * @author why * @Date 2020年4月13日 下午3:50:53 * @since 1.0.0 * */ @SuppressWarnings("serial") @Table(name = "t_cas_permission") @Entity public class Permission extends BaseIdAndTime{ /** * 权限名称 */ private String name; /** * 权限类型 */ private Integer type; /** * 资源路径 */ private String url; private Boolean delFlag; /** * 是否勾选 * true : 勾选 * false : 未勾选 */ @Transient private Boolean checked; /** * 排序 */ private Integer sort; /** * 菜单等级 * 1：父节点 * 2：子节点 */ private Integer level; /** * 父id */ private String parentId; public String getName() { return name; } public void setName(String name) { this.name = name; } public Integer getType() { return type; } public void setType(Integer type) { this.type = type; } public String getUrl() { return url; } public void setUrl(String url) { this.url = url; } public Boolean getDelFlag() { return delFlag; } public void setDelFlag(Boolean delFlag) { this.delFlag = delFlag; } public Boolean getChecked() { return checked; } public void setChecked(Boolean checked) { this.checked = checked; } public Integer getSort() { return sort; } public void setSort(Integer sort) { this.sort = sort; } public Integer getLevel() { return level; } public void setLevel(Integer level) { this.level = level; } public String getParentId() { return parentId; } public void setParentId(String parentId) { this.parentId = parentId; } }
建表sql：
CREATE TABLE `t_cas_user` ( `id` varchar(255) NOT NULL COMMENT '用户id', `password` varchar(255) DEFAULT NULL COMMENT '密码', `user_name` varchar(64) DEFAULT NULL COMMENT '用户名', `role` varchar(64) DEFAULT NULL COMMENT '角色', `salt` varchar(64) DEFAULT NULL COMMENT '密码盐', `create_time` datetime DEFAULT NULL COMMENT '创建时间', `create_user` varchar(64) DEFAULT NULL COMMENT '创建用户', `update_time` datetime DEFAULT NULL COMMENT '更新时间', `update_user` varchar(64) DEFAULT NULL COMMENT '更新用户', `version` int(11) DEFAULT '0', `remark` varchar(255) DEFAULT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; CREATE TABLE `t_cas_user_role` ( `user_id` varchar(255) NOT NULL, `role_id` varchar(255) NOT NULL, PRIMARY KEY (`user_id`,`role_id`), KEY `FK_h6p8coxk4oxl6txq1hd7jim82` (`role_id`), CONSTRAINT `FK_h6p8coxk4oxl6txq1hd7jim82` FOREIGN KEY (`role_id`) REFERENCES `t_cas_role` (`id`), CONSTRAINT `FK_oajhcq0g0st27cocwugnq47mf` FOREIGN KEY (`user_id`) REFERENCES `t_cas_user` (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; CREATE TABLE `t_cas_role` ( `id` varchar(255) NOT NULL, `name` varchar(64) DEFAULT NULL COMMENT '权限名称', `create_time` datetime DEFAULT NULL COMMENT '创建时间', `create_user` varchar(255) DEFAULT NULL COMMENT '创建用户', `update_time` datetime DEFAULT NULL COMMENT '更新时间', `update_user` varchar(255) DEFAULT NULL COMMENT '更新用户', `version` int(11) DEFAULT '0' COMMENT '版本号', `del_flag` bit(1) DEFAULT NULL COMMENT '是否删除，0：未删除', `remark` varchar(255) DEFAULT NULL, PRIMARY KEY (`id`), UNIQUE KEY `name` (`name`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='角色表'; CREATE TABLE `t_cas_role_permission` ( `role_id` varchar(255) NOT NULL, `permission_id` varchar(255) NOT NULL, PRIMARY KEY (`role_id`,`permission_id`), KEY `FK_ssde3tsrhwnl5s15n0cys16p0` (`permission_id`), CONSTRAINT `FK_13au68ku0hwd8b01mtpdp49mo` FOREIGN KEY (`role_id`) REFERENCES `t_cas_role` (`id`), CONSTRAINT `FK_ssde3tsrhwnl5s15n0cys16p0` FOREIGN KEY (`permission_id`) REFERENCES `t_cas_permission` (`id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8; CREATE TABLE `t_cas_permission` ( `id` varchar(255) NOT NULL COMMENT '主键', `name` varchar(100) DEFAULT NULL COMMENT '权限名称', `type` int(11) DEFAULT NULL COMMENT '权限类型，1:菜单 2:按钮 3:API', `url` varchar(200) DEFAULT NULL COMMENT '资源路径', `create_time` datetime DEFAULT NULL COMMENT '创建时间', `create_user` varchar(255) DEFAULT NULL COMMENT '创建用户', `update_time` datetime DEFAULT NULL COMMENT '更新时间', `update_user` varchar(255) DEFAULT NULL COMMENT '更新用户', `version` int(11) DEFAULT '0' COMMENT '版本号', `del_flag` bit(1) DEFAULT NULL COMMENT '是否删除，0：未删除', `sort` int(11) DEFAULT '0' COMMENT '排序', `parent_id` varchar(64) DEFAULT NULL COMMENT '父id', `level` int(11) DEFAULT NULL COMMENT '权限等级,1:父节点,2:子节点', PRIMARY KEY (`id`), UNIQUE KEY `name` (`name`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='资源表';
spring-shiro.xml：
<?xml version="1.0" encoding="UTF-8"?> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd" default-lazy-init="true"> <description>Shiro Configuration</description> <!-- 安全管理器 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="userRealm" /> <property name="cacheManager" ref="cacheManager" /> <!--设置会话管理器--> <!-- <property name="sessionManager" ref="sessionManager"></property> --> </bean> <!-- 項目自定义的Realm --> <bean id="userRealm" class="com.micropattern.urp.common.shiro.UserRealm"> <property name="cacheManager" ref="cacheManager" /> <!-- <property name="credentialsMatcher" ref="credentialsMatcher"></property> --> <property name="credentialsMatcher" ref="customCredentialsMatcher"></property> </bean> <!-- Shiro Filter --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <!-- 用户登录地址 --> <property name="loginUrl" value="/login"/> <!-- 登录成功 --> <property name="successUrl" value="/login"/> <!-- 未授权的失败页 --> <property name="unauthorizedUrl" value="/error"/> <property name="filterChainDefinitions"> <value> <!-- 设置访问用户list页面需要授权操作 --> /** = anon /manage = anon </value> </property> </bean> <!--配置会话管理器--> <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager"> <!--设置session的超时时间20min--> <property name="globalSessionTimeout" value="1200000"></property> <!--删除失效session--> <property name="deleteInvalidSessions" value="true"></property> </bean> <!-- 给予shior的内存缓存系统 --> <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager"/> <!-- 保证实现了Shiro内部lifecycle函数的bean执行 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" /> <!-- <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <property name="hashAlgorithmName" value="SHA-512"></property> <property name="hashIterations" value="2"></property> </bean> --> <bean id="customCredentialsMatcher" class="com.micropattern.urp.common.shiro.CustomCredentialsMatcher"/> </beans>
UserRealm：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.common.shiro; import java.util.HashSet; import java.util.Set; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.SimpleAuthenticationInfo; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authc.credential.CredentialsMatcher; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.apache.shiro.util.ByteSource; import org.springframework.beans.factory.annotation.Autowired; import com.micropattern.urp.common.constant.ErrorCode.SystemUserError; import com.micropattern.urp.common.enums.SystemUserStatus; import com.micropattern.urp.common.exception.BusinessException; import com.micropattern.urp.domain.entity.permission.Permission; import com.micropattern.urp.domain.entity.role.Role; import com.micropattern.urp.domain.entity.system.User; import com.micropattern.urp.domain.service.system.UserService; /** * shiro管理<br/> * * @author zuo * @Date 2020年4月13日 下午2:10:29 * @since 1.0.0 * */ public class UserRealm extends AuthorizingRealm { @Autowired private UserService userService; //授权认证 @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { System.out.println("=============执行授权逻辑================"); Set<String> set = new HashSet<>();// 权限集合 // 给资源进行授权 SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(); User tokenUser = (User) principals.getPrimaryPrincipal(); User user = userService.findByUserName(tokenUser.getUserName()); Set<Role> roles = user.getRoles(); for (Role role : roles) { Set<Permission> permissions = role.getPermissions(); for (Permission permission : permissions) { set.add(permission.getUrl()); } } simpleAuthorizationInfo.addStringPermissions(set); return simpleAuthorizationInfo; } //登录认证 @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { System.out.println("=============执行认证逻辑================"); UsernamePasswordToken tokens = (UsernamePasswordToken) token; User user = userService.findByUserName(tokens.getUsername()); if (user == null) { throw new BusinessException(SystemUserError.USER_NAME_NOTEXISTS); } if (user.getDelFlag()) { throw new BusinessException(SystemUserError.USER_NAME_NOTEXISTS); } else if (SystemUserStatus.ENABLE != user.getStatus()) { throw new BusinessException(SystemUserError.LOGIN_FORBID); } SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user, user.getPassword(), ByteSource.Util.bytes(user.getSalt()), getName()); return simpleAuthenticationInfo; } //自定义密码校验 @Override public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) { super.setCredentialsMatcher(new CustomCredentialsMatcher()); } //清空权限缓存 public void clearCachedAuthorization(){ clearCachedAuthorizationInfo(SecurityUtils.getSubject().getPrincipals()); } }
shiro清空缓存：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.common.shiro; import org.apache.shiro.SecurityUtils; import org.apache.shiro.mgt.RealmSecurityManager; /** * shiro清除缓存<br/> * * @author zuo * @Date 2020年4月17日 上午9:25:50 * @since 1.0.0 * */ public class ShiroUtils { public static void clearShiroCache(){ RealmSecurityManager rsm = (RealmSecurityManager)SecurityUtils.getSecurityManager(); UserRealm realm = (UserRealm)rsm.getRealms().iterator().next(); realm.clearCachedAuthorization(); } }
自定义加密类：
/** * Copyright (c) 2018, All Rights Reserved. * */ package com.micropattern.urp.common.utils; import java.security.MessageDigest; import javax.crypto.Mac; import javax.crypto.spec.SecretKeySpec; import org.apache.commons.lang3.RandomStringUtils; import org.slf4j.Logger; import org.slf4j.LoggerFactory; /** * 签名加密工具类<br/> * Date: 2018年1月29日 下午2:15:59 <br/> * * @author xin.zhou * @version * @since JDK 1.7 * @see */ public class SignUtils { private static final Logger LOG = LoggerFactory.getLogger(SignUtils.class); private static final String DEFAULT_CHARSET = "UTF-8"; private static final char[] DIGITS; public static String hmacSha256(String key, String data) { try { Mac mac = Mac.getInstance("HmacSHA256"); SecretKeySpec signingKey = new SecretKeySpec(key.getBytes(), mac.getAlgorithm()); mac.init(signingKey); return encodeHex(mac.doFinal(data.getBytes())); } catch (Exception e) { LOG.error("execute hmacSHA256 error", e); } return null; } private static String encrypt(String algorithm, String data, String charset) { try { byte[] msg = data.getBytes(charset); MessageDigest md = MessageDigest.getInstance(algorithm); return encodeHex(md.digest(msg)); } catch (Exception e) { LOG.error(e.getMessage(), e); } return null; } public static String md5(String data, String charset) { return encrypt("MD5", data, charset); } public static String sha1(String data, String charset) { return encrypt("SHA1", data, charset); } public static String sha1(String data) { return sha1(data, DEFAULT_CHARSET); } public static String sha256(String data, String charset) { return encrypt("SHA-256", data, charset); } public static String sha256(String data) { return sha256(data, DEFAULT_CHARSET); } public static String sha512(String data, String charset) { return encrypt("SHA-512", data, charset); } public static String sha512(String data) { return sha512(data, DEFAULT_CHARSET); } private static String encodeHex(byte[] data) { int l = data.length; char[] out = new char[l << 1]; int i = 0; for (int j = 0; i < l; ++i) { out[j++] = DIGITS[(240 & data[i]) >>> 4]; out[j++] = DIGITS[15 & data[i]]; } return new String(out); } static { DIGITS = new char[] { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' }; } public static void main(String[] args) { //UPJW1u //1d0c7526881640dfb2a7018c9e2328a3b520b6236bf53378b42059578cc603ffa81c159384119c5bcf280d16503abe32d747104e7c409d53c90ced1e7136fe10 String salt=RandomStringUtils.randomAlphanumeric(6); System.out.println(salt+" "+sha512("123456"+salt)); } }
shiro加密校验：
/** * Copyright (c) 2020, All Rights Reserved. * */ package com.micropattern.urp.common.shiro; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.authc.credential.SimpleCredentialsMatcher; import org.apache.shiro.subject.PrincipalCollection; import com.micropattern.urp.common.utils.SignUtils; import com.micropattern.urp.domain.entity.system.User; /** * 自定义shiro密码校验<br/> * * @author zuo * @Date 2020年4月14日 下午5:30:44 * @since 1.0.0 * */ public class CustomCredentialsMatcher extends SimpleCredentialsMatcher { @Override public boolean doCredentialsMatch(AuthenticationToken authcToken, AuthenticationInfo info) { UsernamePasswordToken token = (UsernamePasswordToken) authcToken; PrincipalCollection principals = info.getPrincipals(); User user = (User) principals.getPrimaryPrincipal(); String salt = user.getSalt(); String password = String.valueOf(token.getPassword()); Object tokenCredentials = encrypt(password, salt); Object accountCredentials = getCredentials(info); //将密码加密与系统加密后的密码校验，内容一致就返回true,不一致就返回false return equals(tokenCredentials, accountCredentials); } //密码加密方法 private String encrypt(String password, String salt) { return SignUtils.sha512(password + salt); } }
页面按钮控制：
<@shiro.hasPermission name="sysuser:add">
<button class="btn btn-primary btn-xs" id="addBtn"><i class="ace-icon glyphicon glyphicon-plus"></i>新增</button>
</@shiro.hasPermission>
