SpringBoot+ Shiro integrated learning login authentication and permission control

Implementation of link permissions

Shiro's permissions are granted by inheriting the AuthorizingRealm abstract class, overloading doGetAuthorizationInfo();

This method is executed only when the link is configured with the appropriate permissions or shiro tags when accessing the page, otherwise it will not be executed, so if there is a simple authentication without permission control, this method may not be implemented and simply return NULL.

The main class used in this method is SimpleAuthorizationInfo

Add roles and permissions.

authorizationInfo.addRole(role.getRole());

authorizationInfo.addStringPermission(p.getPermission());

You can also add a set set: Roles is the role of the current user queried from the database, and stringPermissions is the permissions of the current user queried from the database

authorizationInfo.setRoles(roles);

authorizationInfo.setStringPermissions(stringPermissions);

If added filterChainDefinitionMap in shiro configuration file. The put ("/add ", "perms/permission to add"); To access /add, you must have the "add permission" permission.

If in shiro configuration files added filterChainDefinitionMap put ("/add ", "roles [100002], perms/permission to add"); To access /add, you must have the "add permission" permission and the role of "100002".

/** * Principals */ @override protected AuthorizationInfo doGetAuthorizationInfo System. The out. Println (" access authentication method: MyShiroRealm doGetAuthenticationInfo () "); SysUser token = (SysUser)SecurityUtils.getSubject().getPrincipal(); String userId = token.getId(); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); // Query roles based on user IDS and add them into Authorization. /*Map map = new HashMap(); map.put("user_id", userId); List roleList = sysRoleService.selectByMap(map); Set roleSet = new HashSet(); for(SysRole role : roleList){ roleSet.add(role.getType()); Set roleSet = new HashSet(); Set roleSet = new HashSet(); roleSet.add("100002"); info.setRoles(roleSet); // Query permission according to user ID and add it to Authorization. /*List permissionList = sysPermissionService.selectByMap(map); Set permissionSet = new HashSet(); for(SysPermission Permission : permissionList){ permissionSet.add(Permission.getName()); }*/ Set permissionSet = new HashSet(); Permissionset.add (" add permissions "); info.setStringPermissions(permissionSet); return info; }Copy the code

The implementation of this class completes the second task of our learning goal.

Code the Web layer

@requestMapping (value="login") public String login() {return "login"; @requestMapping (value="login") public String login() {return "login"; } /** * ajax login request * @param username * @param password * @return */ @RequestMapping(value="ajaxLogin",method=RequestMethod.POST) @ResponseBody public Map submitLogin(String username, String password,Model model) { Map resultMap = new LinkedHashMap(); try { ShiroToken token = new ShiroToken(username, password); SecurityUtils.getSubject().login(token); resultMap.put("status", 200); Resultmap. put("message", "login succeeded "); } catch (Exception e) { resultMap.put("status", 500); resultMap.put("message", e.getMessage()); } return resultMap; }Copy the code

<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="utf-8"%> <% String path = request.getContextPath(); String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path; %> Login error message:

    
        
Account:
        
Password:
        

            
        
    



Copy the code

Home page

controller

@requestMapping (value="index") public String index() {return "index"; } @requestMapping (value="logout",method = requestmethod.get) @responseBody public Map logout(){Map  resultMap = new LinkedHashMap(); Try {// Exit securityutils.getSubject ().logout(); } catch (Exception e) { System.err.println(e.getMessage()); } return resultMap; }Copy the code

jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
    pageEncoding="UTF-8"%>
<%
    String path = request.getContextPath();
    String basePath = request.getScheme() + "://"
            + request.getServerName() + ":" + request.getServerPort()
            + path;
%>





Insert title here


    helloJsp
    



Copy the code

Add operation page

controller

@RequestMapping(value="add")
public String add() {
    return "add";
}
Copy the code

jsp

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8"%> <% String path = request.getContextPath(); String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort() + path; %> Insert title here has add permissionCopy the code

test

conclusion

Of course shiro is very powerful, it only completes the login authentication and permission management functions, I will continue to learn and share, talk about the next learning path:

1. Shiro + redis integration, avoid every visit to have permission to link to execute MyShiroRealm. DoGetAuthenticationInfo () method to check the current user permissions, because permissions in actual situation is not often become, so that you can use redis permissions cache.

2. Shiro link permissions dynamic loading, before permission to add a link, to add filterChainDefinitionMap in shiro configuration file. The put ("/add ", "roles [100002], perms [permissions to add]"), it is not very convenient management, One way is to load the linked permissions using the database, and the other way is to read them through an init configuration file.

3. Shiro custom permission check Filter definition, and functional implementation.

4. Shiro Ajax request permission not satisfied, after interception solution. The premise is that Ajax can't redirect and forward pages, so if an Ajax request is not logged in, it will give the user the impression that there is no response and the user does not know that the user has logged out.

5. Shiro JSP tag usage.

6. Shiro logs in and jumps to the last page visited

7. Online display, online user management (kick out login).

8. The login registration password is encrypted and transmitted.

9. Integration verification code.

10. Remember my function. You are still logged in after closing the browser.

11. There are not thought of later, welcome to put forward some suggestions.

Last Updated:
22:46 on February 13, 2017


If you want to reprint, please indicate the source:
Z77z. Oschina. IO / 2017/02/13 /...