Shiro学习笔记六(自定义Reaml-使用数据库设置 user roles permissions)

1.工程目录

pom文件还和以前设置的一样就是添加了一个数据库驱动，

 <dependencies>
    <dependency>
      <groupId>junit</groupId>
      <artifactId>junit</artifactId>
      <version>3.8.1</version>
      <scope>test</scope>
    </dependency>
    
    <!-- 添加servlet支持 -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>javax.servlet-api</artifactId>
        <version>3.1.0</version>
    </dependency>
    
    <dependency>
        <groupId>javax.servlet.jsp</groupId>
        <artifactId>javax.servlet.jsp-api</artifactId>
        <version>2.3.1</version>
    </dependency>
    
    <!-- 添加jstl支持 -->
    <dependency>
        <groupId>javax.servlet</groupId>
        <artifactId>jstl</artifactId>
        <version>1.2</version>
    </dependency>
    
    <!-- 添加日志支持 -->
    <dependency>
        <groupId>log4j</groupId>
        <artifactId>log4j</artifactId>
        <version>1.2.17</version>
    </dependency>
    
    
    <dependency>
        <groupId>commons-logging</groupId>
        <artifactId>commons-logging</artifactId>
        <version>1.2</version>
    </dependency>
    
    <!-- 添加shiro支持 -->
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.2.4</version>
    </dependency>
    
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-web</artifactId>
        <version>1.2.4</version>
    </dependency>
    
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-api</artifactId>
        <version>1.7.12</version>
    </dependency>
    
    <dependency>
        <groupId>mysql</groupId>
        <artifactId>mysql-connector-java</artifactId>
        <version>5.1.37</version>
    </dependency>
    
    
  </dependencies>

shiro.ini中的配置

[main]
authc.loginUrl=/login
roles.unauthorizedUrl=/unauthorized.jsp
perms.unauthorizedUrl=/unauthorized.jsp


myRealm=com.zuoyan.shiro.realm.MyRealm
securityManager.realms=$myRealm

[urls]
/login=anon
/admin*=authc
/student=roles[teacher]
/teacher=perms["user:create"]

简单的解释说明一下Realm，这个我解释不清楚，就引用了别人博客上面的

对于什么是Realm，我使用过之后，个人总结一下：shiro要进行身份验证，就要从realm中获取相应的身份信息来进行验证，简单来说，我们可以自行定义realm，在realm中，从数据库获取身份信息，然后和 用户输入的身份信息进行匹配。这一切都由我们自己来定义。

下面就贴出我们自定义realm 的代码

package com.zuoyan.shiro.realm;

import java.sql.Connection;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import com.zuoyan.shiro.dao.UserDao;
import com.zuoyan.shiro.entity.User;
import com.zuoyan.shiro.utils.DbUtil;

public class MyRealm extends AuthorizingRealm{

    private UserDao userDao=new UserDao();
    private DbUtil dbUtil=new DbUtil();
    
    /*
     * 用于授权
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String userName=(String)principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo authorizationInfo=new SimpleAuthorizationInfo();
        Connection con=null;
        try{
            con=dbUtil.getCon();
            authorizationInfo.setRoles(userDao.getRoles(con,userName));
            authorizationInfo.setStringPermissions(userDao.getPermissions(con,userName));
        }catch(Exception e){
            e.printStackTrace();
        }finally{
            try {
                dbUtil.closeCon(con);
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
        return authorizationInfo;
    }
    
    /*
     * 用于认证
     */

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String userName=(String)token.getPrincipal();
        Connection con=null;
        try{
            con=dbUtil.getCon();
            User user=userDao.getByUserName(con, userName);
            if(user!=null){
                AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUserName(),user.getPassword(),"xx");
                return authcInfo;
            }else{
                return null;
            }
        }catch(Exception e){
            e.printStackTrace();
        }finally{
            try {
                dbUtil.closeCon(con);
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
        return null;
    }

}

AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUserName(),user.getPassword(),"xx");
对于这句话，我一开始的理解就是 先查出来标准的账号密码在自定义中的Realm中进行比对，但是正确的是这里设置的是标准的账号密码
比对应该是在下一步

UserDao的就是在数据库中进行查找

package com.zuoyan.shiro.dao;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.util.HashSet;
import java.util.Set;

import com.zuoyan.shiro.entity.User;



public class UserDao {

    public User getByUserName(Connection con,String userName)throws Exception{
        User resultUser=null;
        String sql="select * from t_user where userName=?";
        PreparedStatement pstmt=con.prepareStatement(sql);
        pstmt.setString(1, userName);
        ResultSet rs=pstmt.executeQuery();
        if(rs.next()){
            resultUser=new User();
            resultUser.setId(rs.getInt("id"));
            resultUser.setUserName(rs.getString("userName"));
            resultUser.setPassword(rs.getString("password"));
        }
        return resultUser;
    }

    public Set<String> getRoles(Connection con, String userName) throws Exception{
        Set<String> roles=new HashSet<String>();
        String sql="select * from t_user u,t_roles r where u.roleId=r.id and u.userName=?";
        PreparedStatement pstmt=con.prepareStatement(sql);
        pstmt.setString(1, userName);
        ResultSet rs=pstmt.executeQuery();
        while(rs.next()){
            roles.add(rs.getString("roleName"));
        }
        return roles;
    }

    public Set<String> getPermissions(Connection con, String userName)throws Exception {
        Set<String> permissions=new HashSet<String>();
        String sql="select * from t_user u,t_roles r,t_permission p where u.roleId=r.id and p.roleId=r.id and u.userName=?";
        PreparedStatement pstmt=con.prepareStatement(sql);
        pstmt.setString(1, userName);
        ResultSet rs=pstmt.executeQuery();
        while(rs.next()){
            permissions.add(rs.getString("permissionName"));
        }
        return permissions;
    }
}