shiro框架学习-10-shiro整合springboot案例

1. 技术选型：

　　前后端分离的权限检验 + SpringBoot2.x + Mysql + Mybatis + Shiro + Redis + IDEA + JDK8

2. RBAC权限控制设计

• 用户
• 角色(一个用户可以具有多种角色,一个角色可以被多个用户使用，用户与角色为多对多关系)
• 权限(一个角色可以拥有多种权限，一个权限可以归属到多种角色，也是N:N关系)

  想要获取一个用户所能访问的资源，根据用户查询用户角色，根据用户角色查询权限，理清了这个关系，就可以创建数据库了：

CREATE TABLE `permission` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `name` varchar(128) DEFAULT NULL COMMENT '名称',
  `url` varchar(128) DEFAULT NULL COMMENT '接口路径',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8;
INSERT INTO `permission` VALUES (1,'video_update','/api/video/update'),(2,'video_delete','/api/video/delete'),(3,'video_add','/api/video/add'),(4,'order_list','/api/order/list'),(5,'user_list','/api/user/list');

CREATE TABLE `user` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(128) DEFAULT NULL COMMENT '用户名',
  `password` varchar(256) DEFAULT NULL COMMENT '密码',
  `create_time` datetime DEFAULT NULL,
  `salt` varchar(128) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
INSERT INTO `user` VALUES (1,'二当家小D','4280d89a5a03f812751f504cc10ee8a5',NULL,NULL),(2,'大当家','123456789',NULL,NULL),(3,'jack','d022646351048ac0ba397d12dfafa304',NULL,NULL);

CREATE TABLE `role_permission` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `role_id` int(11) DEFAULT NULL,
  `permission_id` int(11) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=8 DEFAULT CHARSET=utf8;
INSERT INTO `role_permission` VALUES (1,3,1),(2,3,2),(3,3,3),(4,2,1),(5,2,2),(6,2,3),(7,2,4);


CREATE TABLE `role` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `name` varchar(128) DEFAULT NULL COMMENT '名称',
  `description` varchar(64) DEFAULT NULL COMMENT '描述',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;
INSERT INTO `role` VALUES (1,'admin','普通管理员'),(2,'root','超级管理员'),(3,'editor','审核人员');


CREATE TABLE `user_role` (
  `id` int(11) unsigned NOT NULL AUTO_INCREMENT,
  `role_id` int(11) DEFAULT NULL,
  `user_id` int(11) DEFAULT NULL,
  `remarks` varchar(64) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8;
INSERT INTO `user_role` VALUES (1,3,1,'二当家小D是editor'),(2,1,3,'jack是admin'),(3,2,3,'jack是root'),(4,3,3,'jack是editor'),(5,1,2,'大当家是admin'),(6,1,1,'二当家小D是root');

3.新建springboot项目，添加如下项目依赖：

<dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <!-- 下面这个runtime需要去掉！！！ -->
            <!--    <scope>runtime</scope>-->
        </dependency>

        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>1.3.2</version>
        </dependency>

        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.6</version>
        </dependency>

        <!-- spring整合shiro-->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.0</version>
        </dependency>

        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.9</version>
        </dependency>

        <!-- 热部署 -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-devtools</artifactId>
            <optional>true</optional>
        </dependency>

        <!-- shiro+redis缓存插件 -->
        <dependency>
            <groupId>org.crazycake</groupId>
            <artifactId>shiro-redis</artifactId>
            <version>3.1.0</version>
        </dependency>


        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
            <exclusions>
                <exclusion>
                    <groupId>org.junit.vintage</groupId>
                    <artifactId>junit-vintage-engine</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

4. application.properties配置数据库连接

#数据库配置
spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
spring.datasource.url=jdbc:mysql://localhost:3306/xdclass_shiro?serverTimezone=UTC&useUnicode=true&characterEncoding=UTF-8&userSSL=false
spring.datasource.username=root
spring.datasource.password=lchadmin
#使用druid数据源
#spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
#开启控制台打印sql
mybatis.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl
#开启数据库字段下划线自动转Java驼峰命名
mybatis.configuration.map-underscore-to-camel-case=true

5. 用户-角色-权限 多对多关联查询SQL

* 第一步 查询用户对应的角色映射关系
  select * from user u left join user_role ur on u.id=ur.user_id where  u.id=3

* 第二步 查询用户对应的角色信息
  select * from user u left join user_role ur on u.id=ur.user_id left join role r on ur.role_id = r.id  where  u.id=3
* 第三步 查询角色和权限的关系
  select * from user u 
  left join user_role ur on u.id=ur.user_id
  left join role r on ur.role_id = r.id
  left join role_permission rp on r.id=rp.role_id
  where  u.id=1
* 第四步 查询角色对应的权限信息（某个用户具备的角色和权限集合）
  select * from user u 
  left join user_role ur on u.id=ur.user_id
  left join role r on ur.role_id = r.id
  left join role_permission rp on r.id=rp.role_id
  left join permission p on rp.permission_id=p.id
  where  u.id=1

6. POJO定义

数据库查询接口:

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.User;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;

import javax.websocket.server.ServerEndpoint;

public interface UserMapper {

    @Select("select * from user where username= #{username}")
    User findByUserName(@Param("username") String username);

    @Select("select * from user where id = #{userId}")
    User findById(@Param("userId") int id);

    @Select("select * from user where username=#{username} and password=#{pwd}")
    User findByUsernameAndPwd(@Param("username") String userName,@Param("pwd")String pwd);

}

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.Role;
import org.apache.ibatis.annotations.*;
import org.apache.ibatis.mapping.FetchType;

import java.util.List;

public interface RoleMapper {

    @Select("select ur.role_id id,r.name name,r.description description from role r
" +
            "left join user_role ur  on r.id = ur.role_id where ur.user_id = #{userId}")
    @Results(
            value={
                    @Result(id=true,property = "id",column="id"),
                    @Result(property = "name",column="name"),
                    @Result(property = "description",column="description"),
                    @Result(property = "permissionList",column="id",
                    many = @Many(select = "net.xdclass.xdclassshiro.dao.PermissionMapper.findPermissionListByRoleId",fetchType = FetchType.DEFAULT))
            }
    )
    List<Role> findRoleListByUserId(@Param("userId") int userId);
}

package net.xdclass.xdclassshiro.dao;

import net.xdclass.xdclassshiro.domain.Permission;
import net.xdclass.xdclassshiro.domain.Role;
import org.apache.ibatis.annotations.Param;
import org.apache.ibatis.annotations.Select;

import java.util.List;

public interface PermissionMapper {

    @Select("select p.id id,p.name name,p.url url from permission p left join role_permission rp on rp.permission_id = p.id
" +
            "where rp.role_id= #{roleId}")
    List<Permission> findPermissionListByRoleId(@Param("roleId") int roleId);

}

主启动类添加mapper包扫描

package net.xdclass.xdclassshiro;

import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
//扫描mapper包
@MapperScan("net.xdclass.xdclassshiro.dao")
public class XdclassShiroApplication {

    public static void main(String[] args) {
        SpringApplication.run(XdclassShiroApplication.class, args);
    }

}

Service接口及实现：

package net.xdclass.xdclassshiro.service;

import net.xdclass.xdclassshiro.domain.User;
import org.apache.ibatis.annotations.Select;

public interface UserService {
    /**
     * 获取用户全部信息，包含角色权限
     * @param username
     * @return
     */
    User findAllUserInfoByUsername(String username);

    /**
     * 获取用户基本信息
     * @param userId
     * @return
     */
    User findSimpleUserInfoById(int userId);

    /**
     * 根据用户名查找用户
     * @param username
     * @return
     */
    User findSimpleUserInfoByUsername(String username);
}

package net.xdclass.xdclassshiro.service.impl;

import net.xdclass.xdclassshiro.dao.RoleMapper;
import net.xdclass.xdclassshiro.dao.UserMapper;
import net.xdclass.xdclassshiro.domain.Role;
import net.xdclass.xdclassshiro.domain.User;
import net.xdclass.xdclassshiro.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class UserServiceImpl implements UserService {

    @Autowired
    private UserMapper userMapper;
    @Autowired
    private RoleMapper roleMapper;

    @Override
    public User findAllUserInfoByUsername(String username) {
        User user = userMapper.findByUserName(username);
        List<Role> roleList = roleMapper.findRoleListByUserId(user.getId());
        user.setRoleList(roleList);
        return user;
    }

    @Override
    public User findSimpleUserInfoById(int userId) {

        return userMapper.findById(userId);
    }

    @Override
    public User findSimpleUserInfoByUsername(String username) {
        return userMapper.findByUserName(username);
    }
}

自定义realm

package net.xdclass.xdclassshiro.config;

import net.xdclass.xdclassshiro.domain.Permission;
import net.xdclass.xdclassshiro.domain.Role;
import net.xdclass.xdclassshiro.domain.User;
import net.xdclass.xdclassshiro.service.UserService;
import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.ArrayList;
import java.util.Collections;
import java.util.List;

/**
 * 自定义realm,继承AuthorizingRealm，重写认证，授权的方法
 */
public class CustomRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;

    /**
     * 进行授权校验
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        User principal = (User) principalCollection.getPrimaryPrincipal();
        User user = userService.findAllUserInfoByUsername(principal.getUsername());
        List<String> roleList = new ArrayList<>();
        List<String> permissionList = new ArrayList<>();
        List<Role> userRoleList = user.getRoleList();
       // 把用户的角色，权限放到对应的list中
       if(userRoleList.size() >0 && userRoleList.get(0) != null){
            for (Role role : userRoleList){
                roleList.add(role.getName());
                for (Permission p: role.getPermissionList()){
                    if(null != p.getName()){
                        permissionList.add(p.getName());
                    }
                }
            }
        }
        
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
54         simpleAuthorizationInfo.addRoles(roleList);
55         simpleAuthorizationInfo.addStringPermissions(permissionList);
56         // 返回simpleAuthorizationInfo对象，交给shiro框架去做权限校验
57         return simpleAuthorizationInfo;
    }

    /**
     * 自定义shiro认证
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //从token中获取用户信息，token代表用户输入
        String username = (String) authenticationToken.getPrincipal();
        User user = userService.findAllUserInfoByUsername(username);

        String pwd = user.getPassword();
        if(StringUtils.isBlank(pwd)){
74             return null;
75         }
//org.apache.shiro.authc.SimpleAuthenticationInfo.SimpleAuthenticationInfo(java.lang.Object, java.lang.Object, java.lang.String)
//        return new SimpleAuthenticationInfo(username,pwd,this.getClass().getName());
        // 使用shiro-reids插件，该插件默认会把SimpleAuthenticationInfo的第一个参数作为redis的key来使用，这里需要把username改为userc才能保证key的唯一性
        return new SimpleAuthenticationInfo(user,pwd,this.getClass().getName());
    }
}

shiro配置类：

package net.xdclass.xdclassshiro.config;

import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.crazycake.shiro.RedisCacheManager;
import org.crazycake.shiro.RedisManager;
import org.crazycake.shiro.RedisSessionDAO;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.servlet.Filter;
import java.util.LinkedHashMap;
import java.util.Map;

/**
 *  ShiroFilterFactoryBean配置，要加@Configuration注解
 *
 */
@Configuration
public class ShiroConfig {


    /**
     * @param securityManager
     * @return
     * @Bean是一个方法级别上的注解，主要用在@Configuration注解的类里，也可以用在@Component注解的类里。添加的bean的id为方法名 等同于xml配置中的<bean id = " shiroFilter " class = " org.apache.shiro.spring.web.ShiroFilterFactoryBean " />
     */
    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        System.out.println("ShiroFilterFactoryBean.shiroFilter");
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 设置securityManager
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 如果访问配置的这个接口时用户还未登录，则调用该接口登录
        shiroFilterFactoryBean.setLoginUrl("/pub/need_login");
        // 登录成功后重定向url 前后端分离的，没有这个调用
        shiroFilterFactoryBean.setSuccessUrl("/");
        // 没有页面访问权限（登录了，未授权），调用该接口
        shiroFilterFactoryBean.setUnauthorizedUrl("/pub/not_permit");

        // 设置自定义Filter
        Map<String, Filter> filterMap = new LinkedHashMap<>();
 46         filterMap.put("roleOrFilter", new CustomRolesAuthorizationFilter());
 47         // 绑定
 48         shiroFilterFactoryBean.setFilters(filterMap);

        // 注意，这里必须使用有序的LinkedHashMap，过滤器链是从上往下顺序执行，一般将/**放在最后，否则部分路径无法拦截
        Map<String,String> filterChainDefinitionMap = new LinkedHashMap<>();
        // 登出过滤器
        filterChainDefinitionMap.put("/logout", "logout");
        // 匿名访问过滤器(游客访问)
        filterChainDefinitionMap.put("/pub/**", "anon");
        // 登陆用户访问
        filterChainDefinitionMap.put("/authc/**", "authc");
        // 设置自定义Filter,只要是管理员角色或者root角色就能访问
        filterChainDefinitionMap.put("/admin/**", "roleOrFilter[admin,root]");
        // 配置roles[admin,root]表示必须同时具备admin和root角色才能访问,实际应用不会这么用,使用自定义filter
//        filterChainDefinitionMap.put("/admin/**", "roles[admin,root]");
        // 有编辑权限才可以访问 /video/update是数据库配置的权限路径
        filterChainDefinitionMap.put("/video/update", "perms[video_update]");
        // authc： 定义的url必须通过认证才可以访问 anon: url可以匿名访问
        filterChainDefinitionMap.put("/**", "authc");
         // 这里没设置，过滤器不生效！！！
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 错误写法：securityManager.setRealm(new CustomRealm());
        // 不是前后端分离项目，这里可以不用设置sessionmanager
        securityManager.setSessionManager(sessionManager());
        // 使用自定义的cacheManager
        securityManager.setCacheManager(cacheManager());
        // 必须通过spring实例化CustomRealm的实例之后，这里再通过customRealm()进行注入
        securityManager.setRealm(customRealm());
        return securityManager;
    }

    /**
     * 注入realm
     * @return
     */
    @Bean
    public CustomRealm customRealm(){
        CustomRealm customRealm = new CustomRealm();
        // 设置密码验证器  使用明文密码进行登录测试时，需要将这里注释掉，或者在数据库存储new SimpleHash("md5",pwd,null,2)加密过的密码
        //数据库修改二当家小D的密码为4280d89a5a03f812751f504cc10ee8a5,这里密码验证注释放开，使用明文密码访问http://localhost:8080/pub/login,能够登录成功
        customRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return customRealm;
    }

    /**
     * 设置自定义sessionManager
     * @return
     */
    @Bean
    public SessionManager sessionManager(){
        CustomSessionManager sessionManager = new CustomSessionManager();
        // 设置session过期时间,不设置默认是30分钟,单位ms
        sessionManager.setGlobalSessionTimeout(200000);
        // 设置session持久化到redis中,这样服务器重启后，用户还可以通过之前的session进行操作
        sessionManager.setSessionDAO(redisSessionDAO());
        return sessionManager;
    }

    /**
     * 密码加解密规则
     * @return
     */
    @Bean
    public HashedCredentialsMatcher hashedCredentialsMatcher(){
        HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
        // 设置散列算法,进行加解密
        credentialsMatcher.setHashAlgorithmName("md5");
        // 设置散列迭代次数，2 表示 hash之后再次hash
        credentialsMatcher.setHashIterations(2);
        return credentialsMatcher;
    }


    /**
     * 配置redisManager，使用redis来存数session数据
     * @return
     */
    public RedisManager getRedisManager(){
        RedisManager redisManager = new RedisManager();
//        redisManager.setHost("192.168.5.112");
        redisManager.setHost("192.168.0.114"); //单机redis地址
        redisManager.setPort(8007);    //单机redis端口
        return redisManager;
    }

    /**
     * 配置缓存管理器具体实现类，然后添加到securityManager里面
     * @return
     */
    public RedisCacheManager cacheManager(){
        RedisCacheManager redisCacheManager = new RedisCacheManager();
        redisCacheManager.setRedisManager(getRedisManager());
        // 设置缓存过期时间，单位秒
        redisCacheManager.setExpire(1800);
        return redisCacheManager;
    }

    /**
     * 1.通过shiro redis插件自定义session持久化
     * 2.在shiro的sessionManager中配置session持久化
     * @return
     */
    public RedisSessionDAO redisSessionDAO(){
        RedisSessionDAO redisSessionDao = new RedisSessionDAO();
        redisSessionDao.setRedisManager(getRedisManager());
        // session持久化的过期时间，单位s,如果不设置，默认使用session的过期时间，如果设置了，则使用这里设置的过期时间
        redisSessionDao.setExpire(1800);

        //设置自定义sessionId生成
        redisSessionDao.setSessionIdGenerator(new CustomSessionIdGenerator());
        return redisSessionDao;
    }
}

shiro配置类中使用到的自定义的内容：

(1)前后端分离情况下自定义SessionManager

package net.xdclass.xdclassshiro.config;

import org.apache.commons.lang3.StringUtils;
import org.apache.shiro.session.mgt.SessionKey;
import org.apache.shiro.web.servlet.ShiroHttpServletRequest;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.Serializable;

/**
 * 自定义sessionManager
 * 继承DefaultWebSessionManager并重写该类的getSessionId(javax.servlet.ServletRequest, javax.servlet.ServletResponse)方法
 * 意义：
 * 前后端分离时，用户访问接口时，接口生成一个token保存到map中，
 * 下次用户访问接口时带上这个token，后端进行校验
 */
public class CustomSessionManager extends DefaultWebSessionManager {

    /**
     * 请求头中token的key名
     */
    private static  final String AUTHORIZATION = "token";

    public CustomSessionManager() {
        super();
    }

    @Override
    protected Serializable getSessionId(ServletRequest request, ServletResponse response) {
        String sessionId = WebUtils.toHttp(request).getHeader(AUTHORIZATION);
        if(StringUtils.isBlank(sessionId)){
            return super.getSessionId(request,response);
        } else {
//org.apache.shiro.web.session.mgt.DefaultWebSessionManager.getReferencedSessionId id不为null时的分支处理
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_SOURCE,  ShiroHttpServletRequest.COOKIE_SESSION_ID_SOURCE);
            // 校验sessionId是否有效
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID, sessionId);
            // automatically mark it valid here,if it is invalid, the onUnknowSesson method
            // below will be invoked and we`ll remove the attribute at that time.
            // 标记当前sessionId有效
            request.setAttribute(ShiroHttpServletRequest.REFERENCED_SESSION_ID_IS_VALID, Boolean.TRUE);
            return sessionId;
        }


    }
}

(2) 自定义Shiro Filter过滤器,  配置不同的角色，验证自定义过滤器是否有效

package net.xdclass.xdclassshiro.config;

import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.CollectionUtils;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.util.Set;

/**
 * 1.自定义filter
 * 2. 把自定义filter加入到ShiroConfig中去
 */
public class CustomRolesAuthorizationFilter extends AuthorizationFilter {
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        Subject subject = this.getSubject(request, response);
        String[] rolesArray = (String[]) ((String[]) mappedValue);
        if (rolesArray != null && rolesArray.length != 0) {
            Set<String> roles = CollectionUtils.asSet(rolesArray);
            /*RolesAuthorizationFilter 中是return subject.hasAllRoles(roles)，同时具备所有角色才能够访问
            这里改为遍历角色 ，当前subject是roles中的任意一个，则有权限访问
            * */
            for (String role : roles) {
                if (subject.hasRole(role)) {
                    return true;
                }
            }
            // return subject.hasAllRoles(roles);
        }
        // 没有角色限制，可以直接访问
        return true;
    }
}

(3)Redis整合CacheManager ，见shiroConfig类 78行， 130-136行，142-148行

shiro+redis缓存插件依赖：

 <dependency>
    <groupId>org.crazycake</groupId>
    <artifactId>shiro-redis</artifactId>
    <version>3.1.0</version>
</dependency>

（4）Redis整合SessionManager 管理Session会话

为什么session也要持久化？
  -——应用保活，重启应用，用户无感知，可以继续以原先的状态继续访问：
  如果不做session持久化，假如一个已经登录的用户正在做新增操作，在还没有提交之前，后台服务器进行了重启，然后用户编辑完数据进行提交，这时服务器因为重启，
  之前的session丢失，后台检测到用户成了未登录状态，就跳转到用户登录页面，这样的用户体验很不友好，因此session需要进行持久化

怎么做session持久化：参考shiroconfig类的配置，需要注意的是，DO对象需要实现序列化接口 Serializable 

 //配置session持久化
     customSessionManager.setSessionDAO(redisSessionDAO());       
       /**
       * 自定义session持久化
       * @return‘
       */
      public RedisSessionDAO redisSessionDAO(){
          RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
          redisSessionDAO.setRedisManager(getRedisManager());
          return redisSessionDAO;
      }

（5）自定义sessionId

package net.xdclass.xdclassshiro.config;


import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.SessionIdGenerator;

import java.io.Serializable;
import java.util.UUID;

/**
 *  自定义sessionId
 */
public class CustomSessionIdGenerator implements SessionIdGenerator {
    @Override
    public Serializable generateId(Session session) {
        return UUID.randomUUID().toString().replaceAll("-", "");
    }
}

接口开发：

（1）游客访问接口：

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import net.xdclass.xdclassshiro.domain.UserQuery;
import net.xdclass.xdclassshiro.service.UserService;
import org.apache.commons.collections.MapUtils;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.function.ToLongBiFunction;

@RestController
@RequestMapping("/pub")
public class PublicController {

    @Autowired
    private UserService userService;

    //http://localhost:8080/pub/find_user_info?username=jack
    @GetMapping("/find_user_info")
    public Object queryUserInfo(@RequestParam("username") String username) {
        return userService.findAllUserInfoByUsername(username);
    }

    @RequestMapping("/need_login")
    public JsonData needLogin(){
        return JsonData.buildError("请登录",-2);
    }

// shiroconfig配置类里面配置的路径
    @RequestMapping("/not_permit")
    public JsonData noPermit(){
        return JsonData.buildError("没有权限访问",-3);
    }

    //首页,任何角色的都可以访问
    @RequestMapping("/index")
    public JsonData index(){
        List<String> videoList = new ArrayList<>();
        videoList.add("Mysql零基础入门到实战 数据库教程");
        videoList.add("Redis高并发高可用集群百万级秒杀实战");
        videoList.add("Zookeeper+Dubbo视频教程 微服务教程分布式教程");
        videoList.add("2019年新版本RocketMQ4.X教程消息队列教程");
        videoList.add("微服务SpringCloud+Docker入门到高级实战");
        return JsonData.buildSuccess(videoList);
    }


    /**
     * 登录接口
     * @param userQuery
     * @param request
     * @param response
     * @return
     */
    @PostMapping("/login")
    public JsonData login(@RequestBody UserQuery userQuery, HttpServletRequest request,
                          HttpServletResponse response){
        Map<String,Object> info = new HashMap<>();
        try {
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(userQuery.getName(),userQuery.getPwd());
            subject.login(token);

            info.put("msg", "登录成功");
            info.put("session_id",subject.getSession().getId());
            return JsonData.buildSuccess(info);
        } catch (Exception e){
            e.printStackTrace();
            return JsonData.buildError("登录失败");
        }
    }
}

（2）admin角色才能访问的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  只有admin管理员角色才能访问的接口
 */
@RestController
@RequestMapping("admin")
public class AdminController {

    /**
     *  视频播放列表接口
     * @return
     */
    @PostMapping("/video/order")
    public JsonData findPlayRecord(){
        Map<String ,String> recordMap = new HashMap<>();
        recordMap.put("SpringBoot入门到高级实战","300元");
        recordMap.put("Cloud微服务入门到高级实战","100元");
        recordMap.put("分布式缓存Redis","90元");
        return JsonData.buildSuccess(recordMap);
    }
}

（3）只有登录后才能访问到的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  登录才能访问的接口，使用@RestController，返回json数据到前端
 */
@RestController
@RequestMapping("authc")
public class OrderController {

    /**
     *  视频播放列表接口
     * @return
     */
    @PostMapping("/video/play_record")
    public JsonData findPlayRecord(){
        Map<String ,String> recordMap = new HashMap<>();
        recordMap.put("SpringBoot入门到高级实战","第8章第1集");
        recordMap.put("Cloud微服务入门到高级实战","第4章第10集");
        recordMap.put("分布式缓存Redis","第10章第3集");
        return JsonData.buildSuccess(recordMap);
    }
}

（4）具有指定资源访问权限（video/update）的用户才能访问的接口

package net.xdclass.xdclassshiro.controller;

import net.xdclass.xdclassshiro.domain.JsonData;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

/**
 *  只有具有video/update权限才能访问的接口
 *  select u.username,u.password,ur.remarks,r.name,r.description,rp.role_id,p.name from user u
 * left join user_role ur on u.id = ur.user_id
 * left join role r on r.id = ur.role_id
 * left join role_permission rp on rp.role_id = r.id
 * left join permission p on p.id = rp.permission_id
 * where  p.id = 1
 * 查询出来的用户才能访问该接口
 */
@RestController
@RequestMapping("video")
public class VideoController {
    @PostMapping("/update")
    public JsonData findPlayRecord(){
        return JsonData.buildSuccess("video更新成功");
    }
}

 代码地址：https://github.com/liuch0228/shiro-learn.git   

参考资料：

 Shiro权限管理框架详解

Shiro权限控制+整合shiro  https://blog.csdn.net/qq_43652509/article/details/88074832