<!-- shiro權(quán)限管理框架 -->
<dependency>
 ? ?<groupId>org.apache.shiro</groupId>
 ? ?<artifactId>shiro-spring-boot-web-starter</artifactId>
 ? ?<version>1.9.1</version>
</dependency>

@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean() {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
 ? ?// 設(shè)置securityManager，負責(zé)權(quán)限驗證的核心事務(wù)處理。
    shiroFilterFactoryBean.setSecurityManager(securityManager());
 ? ?// 配置過濾器鏈
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
 ? ?// anon表示該url不需要經(jīng)過權(quán)限驗證
    filterChainDefinitionMap.put("/static/**", "anon");
 ? ?// logout表示用戶登出功能的過濾器；調(diào)用指定的url會讓已經(jīng)登陸的用戶退出
    filterChainDefinitionMap.put("/logout", "logout");
 ? ?// authc過濾器表示對應(yīng)的url都需要權(quán)限驗證才能訪問
    filterChainDefinitionMap.put("/**", "authc");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
 ? ?// 配置用戶登陸的url。調(diào)用該接口需要傳username和password字段。
    shiroFilterFactoryBean.setLoginUrl("/login");
 ? ?// 登陸成功自動跳轉(zhuǎn)頁面
    shiroFilterFactoryBean.setSuccessUrl("/index");
    return shiroFilterFactoryBean;
  }

@Bean
public DefaultWebSecurityManager securityManager() {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    securityManager.setRealm(userRealm());
    return securityManager;
}

@Bean
public UserRealm userRealm() {
    UserRealm userRealm = new UserRealm();
    userRealm.setCredentialsMatcher(credentialsMatcher());
    return userRealm;
}

package com.example.awesomespring.security;
?
import com.example.awesomespring.bo.AccountInfo;
import com.example.awesomespring.service.AccountService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
?
import javax.annotation.Resource;
?
public class UserRealm extends AuthorizingRealm {
 ?
   ?@Resource
   ?private AccountService accountService;
?
    @Override
   ?protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
 ? ? ? ?// 從authenticationToken中獲取用戶提交的username
     ? ?String accountName = (String) authenticationToken.getPrincipal();
 ? ? ? ?// 通過username查詢到對應(yīng)的用戶信息
     ? ?AccountInfo accountInfo = accountService.findByAccount(accountName);
     ? ?if (accountInfo == null) {
       ? ? ?return null;
     ?  }
 ? ? ? ?// 取出查詢到的用戶密碼
     ? ?String password = accountInfo.getPassword();
 ? ? ? ?// 取出用戶密碼加密需要用到的鹽值
     ? ?String salt = accountInfo.getSalt();
 ? ? ? ?// 把查詢出來的用戶信息、密碼、加密鹽值、Realm名稱包裝進SimpleAuthenticationInfo返回
     ? ?return new SimpleAuthenticationInfo(accountInfo, password, ByteSource.Util.bytes(salt), getName());
    }
 ?
 ? ?// 這個方法是在用戶登陸成功后，調(diào)用需要權(quán)限才能訪問的接口時才來鑒定權(quán)限
   ?@Override
   ?protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
 ? ? ? ?// 拿到已經(jīng)登陸的用戶信息
     ? ?AccountInfo accountInfo = (AccountInfo) principalCollection.getPrimaryPrincipal();
     ? ?SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
     ? ?// 下面的角色和權(quán)限需要從數(shù)據(jù)庫中查詢
 ? ? ? ?// 設(shè)置角色
     ? ?authorizationInfo.addRole("User");
     ? ?// 設(shè)置權(quán)限
     ? ?authorizationInfo.addStringPermission("User:read");
 ? ? ? ?// 返回角色和權(quán)限
     ? ?return authorizationInfo;
    }
}

@Bean
public CredentialsMatcher credentialsMatcher() {
    return new PasswordHashedCredentialsMatcher("MD5");
}
?
package com.example.awesomespring.security;
?
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.util.ByteSource;
?
/**
 * @author zouwei
 * @className PasswordHashedCredentialsMatcher
 * @date: 2022/7/31 下午3:43
 * @description:
 */
public class PasswordHashedCredentialsMatcher extends HashedCredentialsMatcher {
?
   ?public PasswordHashedCredentialsMatcher(String hashAlgorithmName) {
     ? ?super(hashAlgorithmName);
     ? ?setHashIterations(2);
    }
?
   ?public String encryptedPassword(String passwordString, String salt) {
     ? ?return hashProvidedCredentials(passwordString, ByteSource.Util.bytes(salt), getHashIterations()).toHex();
  }
}

package com.example.awesomespring.controller;
?
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PathVariable;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
?
@RestController
@RequestMapping("/user")
@Slf4j
public class UserController {
?
  @GetMapping("/{id}")
  @RequiresPermissions("User:info")
  String getUserInfo(@PathVariable String id) {
    log.info("獲取用戶信息開始");
    log.info("請求參數(shù) id:{}", id);
    log.info("獲取用戶信息結(jié)束");
    return "getUserInfo";
  }
?
  @GetMapping("/hello")
  String hello() {
    return "hello world!";
  }
?
  @GetMapping("/read")
  @RequiresPermissions("User:read")
  String read() {
    return "read";
  }
}