<!-- Shiro Framework -->
<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring-boot-starter</artifactId><version>1.4.0</version>
</dependency><!-- 如果使用Shiro权限授权的注解，还需要添加Spring AOP依赖 -->
<dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-aop</artifactId><version>2.1.4.RELEASE</version>
</dependency>

/*** 自定义令牌*/
public class CustomToken implements AuthenticationToken {// HTTP Request Heard token 字段名public static String TOKENHEARDNAME = "token";private String token;public CustomToken(String token) {this.token = token;}/*** 获取标识信息* @return*/@Overridepublic Object getPrincipal() {return token;}/*** 获取凭证信息* @return*/@Overridepublic Object getCredentials() {return token;}
}

/*** 自定义拦截器*/
public class CustomFilter extends AuthenticatingFilter {/*** 以供认证时，根据Http请求头构建一个基于Token的自定义令牌* @param servletRequest* @param servletResponse* @return*/@Overrideprotected AuthenticationToken createToken(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {String token = getTokenFromHeard(servletRequest);if( token == null ) {return null;}return new CustomToken(token);}/*** 判定该请求是否允许访问，true: 则拦截器直接放行该请求; false: 将继续调用onAccessDenied方法* @apiNote 1. 在url拦截规则中, 对于无需认证的url直接设置为anon(可匿名访问),故不会被该拦截器所拦截,* @apiNote 2. 这里该方法可直接返回false,将是否需要进行认证放在 onAccessDenied 方法中去实现* @param request* @param response* @param mappedValue* @return*/@Overrideprotected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {return false;}/*** 如果请求头中不含 token, 则返回false,拦截该请求;* 否则调用 executeLogin 方法 以进行基于token的自定义令牌的认证* @param servletRequest* @param servletResponse* @return* @throws Exception*/@Overrideprotected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {String token = getTokenFromHeard(servletRequest);// 无token则拦截该请求if( token==null ) {HttpServletResponse httpServletResponse = (HttpServletResponse)servletResponse;httpServletResponse.setStatus(401);httpServletResponse.getWriter().write("Error: No Token Message");return false;}return executeLogin(servletRequest, servletResponse);   // 有token则进行认证}/*** 可选地，用于向浏览器返回认证失败时的响应信息* @param token* @param e* @param request* @param response* @return*/@Overrideprotected boolean onLoginFailure(AuthenticationToken token, AuthenticationException e, ServletRequest request, ServletResponse response) {HttpServletResponse httpServletResponse = (HttpServletResponse)response;httpServletResponse.setStatus(401);try {httpServletResponse.getWriter().write( e.getMessage() );} catch (IOException e1) {}return false;}/*** 从 HTTP Request Heard 中提取 token 字段的数据* @param request* @return*/private String getTokenFromHeard(ServletRequest request) {return ((HttpServletRequest)request).getHeader(CustomToken.TOKENHEARDNAME);}
}

/*** 自定义Realm类，用于实现认证、授权的判定逻辑*/
public class CustomRealm extends AuthorizingRealm {@Autowiredprivate UserTokenService userTokenService;@Autowiredprivate UserService userService;@Autowiredprivate RolePermService rolePermService;/*** 是否支持该类型的令牌* @param token* @return*/@Overridepublic boolean supports(AuthenticationToken token) {// 只支持基于token的自定义令牌return token instanceof CustomToken;}/*** 认证，失败直接抛出异常即可* @param authenticationToken* @return* @throws AuthenticationException*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {String token = (String)authenticationToken.getPrincipal();Map param = new HashMap();param.clear();param.put("token", token);List<UserToken> userTokenList = userTokenService.findList(param);// 从数据库中查询符合的用户Token记录只应该有一条if( userTokenList==null || userTokenList.size() != 1 ) {throw new AuthenticationException("Error: Invalid Token");}Integer userId = userTokenList.get(0).getUserId();// 用户主键不应无效if( userId==null || userId <=0) {throw new AuthenticationException("Error: Invalid Token");}// 根据主键查询用户信息User user = userService.findById(userId);if( user==null ) {throw new AuthenticationException("Error: Invalid Token");}// 根据HTTP请求头中的token查找到相关的用户，支持认证成功AuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user, token, getName());return authenticationInfo;}/*** 授权* @apiNote 只有认证通过后才会进行授权* @param principalCollection* @return*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {// 获取用户的角色、权限信息User user = (User) principalCollection.getPrimaryPrincipal();RolePerm rolePerm = rolePermService.findById( user.getRoleId() );// 用户的角色名称集合Set<String> roleNameSet = new HashSet<>();roleNameSet.add( rolePerm.getName() );// 用户的权限集合Set<String> permNameSet = new HashSet<>();permNameSet.add( rolePerm.getPerm() );SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();info.setRoles( roleNameSet );   // 设置角色信息info.setStringPermissions( permNameSet );   // 设置权限信息return info;}
}

/*** Shiro Framework Config 配置类*/
@Configuration
public class ShiroConfig {// 配置一个自定义的Realm类@Bean(name = "customRealm")public CustomRealm getCustomRealm() {return new CustomRealm();}// 配置安全管理器@Bean(name = "securityManager")public DefaultWebSecurityManager  securityManager() {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();securityManager.setRealm( getCustomRealm() );return securityManager;}// 设置 Shiro 的url拦截规则、拦截器@Bean(name = "shiroFilter")public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();shiroFilterFactoryBean.setSecurityManager(securityManager);// 设置自定义的拦截器FilterMap<String, Filter> filters = new HashMap(2);filters.put("customFilter", new CustomFilter() );shiroFilterFactoryBean.setFilters(filters);// 设置 url 拦截规则, 拦截时将按定义顺序进行匹配，故 /** 规则应放在最后Map<String, String> urlFilterMap = new LinkedHashMap<>();// anon 表示该url可匿名访问urlFilterMap.put("/login", "anon");// customFilter 表示该url将由指定的拦截器 customFilter 进行拦截处理urlFilterMap.put("/**", "customFilter");shiroFilterFactoryBean.setFilterChainDefinitionMap(urlFilterMap);return shiroFilterFactoryBean;}/******************** 如果使用Shiro权限授权的注解，还需配置 Shiro 权限控制的注解通知 ********************/@Beanpublic LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {return new LifecycleBeanPostProcessor();}@Bean@DependsOn("lifecycleBeanPostProcessor")public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator(){DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);return defaultAdvisorAutoProxyCreator;}//配置Shiro通知器@Beanpublic AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);return authorizationAttributeSourceAdvisor;}/******************************************************************/
}

@RestController
@ResponseBody
public class ShiroAuthenTestController {@Autowiredprivate UserService userService;@Autowiredprivate UserTokenService userTokenService;@GetMapping("/login")public String login(String username, String password) {String msg = "登录失败";if( StrUtil.isBlank(username) || StrUtil.isBlank(password) ) {return msg;}User user = userService.findByLoginMsg(username, password);if( user==null || user.getId()<=0 ) {return msg;}Map param = new HashMap<>();param.put("userId", user.getId());List<UserToken> userTokens = userTokenService.findList(param);if( userTokens==null || userTokens.size()!=1 ) {return msg;}msg = "Token: " + userTokens.get(0).getToken();return msg;}/*** Shiro 认证测试 Controller* @return*/@GetMapping("/testAuthen")public String testAuthen() {// 获取登录者的信息Subject subject = SecurityUtils.getSubject();User user = (User) subject.getPrincipal();System.out.println("Login Msg: " + user);String msg = "test Shiro success";return msg;}
}

@RestController
@ResponseBody
public class ShiroAuthorTestController {/*** Shiro 授权测试 Controller 1* 只允许 User 用户访问* @return*/@GetMapping("/testAuthor1")@RequiresRoles("user")public String testAuthor1() {return "Msg: success access by User";}/*** Shiro 授权测试 Controller 2* 只允许 Root 用户访问*/@GetMapping("/testAuthor2")@RequiresRoles("root")public String testAuthor2() {return "Msg: success access by User";}
}

@RestController
@ResponseBody
public class ShiroAuthorTestController {/*** Shiro 授权测试 Controller 3* 必须具备指定权限 accessPerm1 的 用户才可以访问* @return*/@GetMapping("/testAuthor3")@RequiresPermissions("accessPerm1")public String testAuthor3() {return "Msg: success access by Perm [accessPerm1] ";}/*** Shiro 授权测试 Controller 4* 必须具备指定权限 accessPerm2 的 用户才可以访问* @return*/@GetMapping("/testAuthor4")@RequiresPermissions("accessPerm2")public String testAuthor4() {return "Msg: success access by Perm [accessPerm2] ";}
}