Shiro系列之Shiro+Mysql实现用户授权(Authorization)
- - CSDN博客推荐文章昨天,我在《 Shiro系列之Shiro+Mysql实现用户认证(Authentication)》中简单介绍了使用Shiro+Mysql实现用户认证的功能,今天我们继续使用其中的示例,讲解一下如何实现用户授权. 所谓授权,就是判断当前用户具体哪些权限,能够执行哪些操作,或是访问哪些资源(Web中的URL,又或是页面上的一个按钮,一个编辑框等都可以视为资源).
网上大多数介绍Apache Shiro的资料都是使用ini文件的简单配置为例,很少用讲到如何配合数据库来实现用户认证的。我也是刚刚开始接触Shiro,在这里介绍一个入门级别的Shiro+Mysql的配置方法,这个方法仅仅是个开始,并没有和Web,Spring,Mybatis等框架进行整合,后续我还会继续和大家分享我的学习过程及心得。
now we can start the things that we really care about.
数据库中创建一个用户表,字段可以很简单。
CREATE TABLE `sec_user` ( `user_id` int(10) unsigned NOT NULL AUTO_INCREMENT, `user_name` varchar(64) COLLATE utf8_bin DEFAULT NULL, `password` varchar(128) COLLATE utf8_bin DEFAULT NULL, `created_time` datetime DEFAULT NULL, `update_time` timestamp NULL DEFAULT CURRENT_TIMESTAMP, PRIMARY KEY (`user_id`) ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 COLLATE=utf8_bin
在表中插入一条记录,用户名:[email protected],密码:cmao
在resources目录下创建一个ini文件,配置Shiro(后续文件会将此文件内容移至XML文件中)。在这个配置文件中我们要设置数据源,以及用户认证时使用数据库查询语句。这里用到了Shiro中自带的JdbcRealm类。
[main] dataSource=org.springframework.jdbc.datasource.DriverManagerDataSource dataSource.driverClassName=com.mysql.jdbc.Driver dataSource.url=jdbc:mysql://127.0.0.1:3306/YOUR_DATABASE_NAME dataSource.username=YOUR_USERNAME dataSource.password=YOUR_PASSWORD jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm jdbcRealm.permissionsLookupEnabled = true jdbcRealm.dataSource=$dataSource jdbcRealm.authenticationQuery = SELECT password FROM sec_user WHERE user_name = ? jdbcRealm.userRolesQuery = SELECT role_name FROM sec_role WHERE role_name = ? jdbcRealm.permissionsQuery = SELECT permission FROM sec_role_permissions WHERE role_name = ? securityManager.realms=$jdbcRealm
配置文件写好后,我们就可以动手写个测试方法,来验证是否可以实现用户认证功能了。
package com.emerons.learning; import static org.junit.Assert.*; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.DisabledAccountException; import org.apache.shiro.authc.ExcessiveAttemptsException; import org.apache.shiro.authc.ExpiredCredentialsException; import org.apache.shiro.authc.IncorrectCredentialsException; import org.apache.shiro.authc.LockedAccountException; import org.apache.shiro.authc.UnknownAccountException; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.config.IniSecurityManagerFactory; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.subject.Subject; import org.apache.shiro.util.Factory; import org.junit.After; import org.junit.Before; import org.junit.Test; public class JdbcRealmTest { @Before public void setUp() throws Exception { } @After public void tearDown() throws Exception { } @Test public void test() { // 1.获取SecurityManager工厂,此处使用ini配置文件初始化SecurityManager Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro-jdbc-realm.ini"); // 2.获取SecurityManager实例,并绑定到SecurityUtils SecurityManager sm = factory.getInstance(); SecurityUtils.setSecurityManager(sm); // 3.得到Subject Subject subject = SecurityUtils.getSubject(); // 4.创建用户登录凭证 UsernamePasswordToken token = new UsernamePasswordToken("[email protected]", "chrismao"); // 5.登录,如果登录失败会抛出不同的异常,根据异常输出失败原因 try { subject.login(token); // 6.判断是否成功登录 assertEquals(true, subject.isAuthenticated()); System.out.println("登录成功!!"); // 7.注销用户 subject.logout(); } catch (IncorrectCredentialsException e) { System.out.println("登录密码错误. Password for account " + token.getPrincipal() + " was incorrect."); } catch (ExcessiveAttemptsException e) { System.out.println("登录失败次数过多"); } catch (LockedAccountException e) { System.out.println("帐号已被锁定. The account for username " + token.getPrincipal() + " was locked."); } catch (DisabledAccountException e) { System.out.println("帐号已被禁用. The account for username " + token.getPrincipal() + " was disabled."); } catch (ExpiredCredentialsException e) { System.out.println("帐号已过期. the account for username " + token.getPrincipal() + " was expired."); } catch (UnknownAccountException e) { System.out.println("帐号不存在. There is no user with username of " + token.getPrincipal()); } } }
运行测试代码,得到如下输出:
INFO : org.springframework.jdbc.datasource.DriverManagerDataSource - Loaded JDBC driver: com.mysql.jdbc.Driver INFO : org.apache.shiro.realm.AuthorizingRealm - No cache or cacheManager properties have been set. Authorization cache cannot be obtained. INFO : org.apache.shiro.config.IniSecurityManagerFactory - Realms have been explicitly set on the SecurityManager instance - auto-setting of realms will not occur. INFO : org.apache.shiro.session.mgt.AbstractValidatingSessionManager - Enabling session validation scheduler... 登录成功!! INFO : org.apache.shiro.realm.AuthorizingRealm - No cache or cacheManager properties have been set. Authorization cache cannot be obtained.
我们从日志上可以看到,程序加载了Jdbc驱动,明确指定了realm,这说明我们的Shiro配置文件加载成功。最后看到输出了“登录成功”说明这个认证功能已经实现了。大家也可以试着修改测试代码用的用户名或是密码,可以在控制台看到类似下面的输出,说明也可以抛出正确的异常。
INFO : org.springframework.jdbc.datasource.DriverManagerDataSource - Loaded JDBC driver: com.mysql.jdbc.Driver INFO : org.apache.shiro.realm.AuthorizingRealm - No cache or cacheManager properties have been set. Authorization cache cannot be obtained. INFO : org.apache.shiro.config.IniSecurityManagerFactory - Realms have been explicitly set on the SecurityManager instance - auto-setting of realms will not occur. 登录密码错误. Password for account [email protected] was incorrect.
至此,使用Shiro + Mysql实现用户认证(Authentication)的功能已经完成。大家可以在这个基础上,完善实现角色授权(Authroization),操作允可(Permission)等功能。