我們從項目中去理解集成的過程,這樣更能加深印象
創建好工程之後,我們需要導入thymeleaf的依賴
<dependency>
<!-- 我們都是基於3.x開發的-->
<groupId>org.thymeleaf</groupId>
<artifactId>thymeleaf-spring5</artifactId>
</dependency>
<dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-java8time</artifactId>
</dependency>
也可以參考官方給的案例中springbootweb’中的依賴
接下來就編寫一個首頁
接着寫一個controller包,和MyController
先簡單的寫一個Controller保證項目能夠正常啓動
項目正常啓動後,我們再來集成shiro,
整合shiro
shiro的三大對象:
Subject:用戶
securityManager:管理所有用戶
Realm:連接數據
導入shiro,springboot整合shiro的包:
<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.5.3</version>
</dependency>
編寫配置類:ShiroConfig
package com.qiu.config;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class ShiroConfig {
//第三步:ShiroFilterFactoryBean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
//設置安全管理器,需要放置在Bean裏面
bean.setSecurityManager(defaultWebSecurityManager);
return bean;
}
//第二步:DefaultWebSecurityManager
@Bean(name = "securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
//關聯Realm
//通過傳參,在加上@Qualifier進行realm和securityManager的綁定
securityManager.setRealm(userRealm);
return securityManager;
}
//第一步://創建realm對象,需要自定義類
//把類放進配置裏面,再加上@bean,這樣我們這個類就被spring託管了
@Bean(name = "userRealm")
public UserRealm userRealm(){
return new UserRealm();
}
}
注意這裏是重下往上寫的
UserRealm類:
package com.qiu.config;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
//自定義的一個realm,需要繼承一個
public class UserRealm extends AuthorizingRealm {
@Override
//授權
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("執行了授權==>doGetAuthorizationInfo");
return null;
}
@Override
//認證
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
System.out.println("執行了認證==>doGetAuthenticationInfo");
return null;
}
}
新建兩個網頁,一個是update,一個是add
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<h1>
add
</h1>
</body>
</html>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<h1>
update
</h1>
</body>
</html>
然後在添加controller
首頁添加代碼:
<hr>
<a th:href="@{/user/add}"></a> | <a th:href="@{/user/update}"></a>
然後啓動項目:
檢驗這兩個頁面都能跑的時候我們來實現登錄驗證
這是我們需要在ShiroConfig中添加shiro的內置過濾器.
/**
* anon:無需認證,即可訪問
* authc:必須認證了才能訪問
* user:必須擁有記住我的功能才能用
* perms:擁有對某個資源的權限才能訪問
* role:擁有某個覺得權限才能訪問
*/
