SpringBoot+Shiro+JWT前后端分离实现用户权限和接口权限控制

1. 引入需要的依赖

我使用的是原生jwt的依赖包，在maven仓库中有好多衍生的jwt依赖包，可自己在maven仓库中选择，实现大同小异。

　　　　<dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-web</artifactId>

            <version>${shiro.version}</version>

            <scope>compile</scope>

        </dependency>

        <dependency>

            <groupId>org.apache.shiro</groupId>

            <artifactId>shiro-spring</artifactId>

            <version>${shiro.version}</version>

        </dependency>

        <dependency>

            <groupId>org.crazycake</groupId>

            <artifactId>shiro-redis</artifactId>

            <version>${shiro-redis.version}</version>

            <exclusions>

                <exclusion>

                    <artifactId>shiro-core</artifactId>

                    <groupId>org.apache.shiro</groupId>

                </exclusion>

            </exclusions>

        </dependency>

        <!--JWT依赖-->

        <dependency>

            <groupId>com.auth0</groupId>

            <artifactId>java-jwt</artifactId>

            <version>${jwt.version}</version>

        </dependency>

2. 配置shiro信息

2.1. 配置文件增加属性值配置

# shiro 配置

shiro:

  filter-chain-map:

    # 用户登录

    '[/login/**]': origin

    # 获取api token

    '[/api/token/**]': anon

    # api接口权限配置

    '[/api/**]': api

    # 用户权限控制

    '[/**]': origin, jwt

  # 设置权限缓存时间

  cache-timeout: 60

2.2. shiro 配置类

package com.example.shiro.configuration;

import org.apache.shiro.mgt.DefaultSessionStorageEvaluator;

import org.apache.shiro.mgt.DefaultSubjectDAO;

import org.apache.shiro.mgt.SessionStorageEvaluator;

import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.apache.shiro.web.mgt.DefaultWebSessionStorageEvaluator;

import org.crazycake.shiro.RedisCacheManager;

import org.crazycake.shiro.RedisManager;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.beans.factory.annotation.Qualifier;

import org.springframework.beans.factory.annotation.Value;

import org.springframework.boot.autoconfigure.AutoConfigureAfter;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.springframework.context.annotation.Lazy;

import javax.servlet.Filter;

import java.util.HashMap;

import java.util.Map;

/**

 * shiro配置文件

 *

 * @author xsshu

 * @date 2020-07-18 16:22

 */

@Configuration

@AutoConfigureAfter(ShiroProperties.class)

public class ShiroConfig {

    @Autowired

    private ShiroProperties shiroProperties;

    @Value("${spring.redis.host}:${spring.redis.port}")

    private String host;

    @Value("${spring.redis.password}")

    private String password;

    @Value("${spring.redis.database}")

    private int database;

    /**

     * shiroFilter

     *

     * @param securityManager

     * @return

     */

    @Bean("shiroFilter")

    public ShiroFilterFactoryBean factory(@Qualifier("webSecurityManager") @Lazy DefaultWebSecurityManager securityManager) {

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        // 必须设置 SecurityManager

        shiroFilterFactoryBean.setSecurityManager(securityManager);

        shiroFilterFactoryBean.setFilterChainDefinitionMap(shiroProperties.getFilterChainMap());

        Map<String, Filter> filters = new HashMap<>(3);

        // 跨域拦截

        OriginFilter originFilter = new OriginFilter();

        filters.put("origin", originFilter);

        // 用户请求拦截

        filters.put("jwt", new UserJwtFilter());

        // API请求拦截

        filters.put("api", new AppJwtFilter());

        shiroFilterFactoryBean.setFilters(filters);

        return shiroFilterFactoryBean;

    }

    /**

     * redis配置

     *

     * @return

     */

    public RedisManager redisManager() {

        RedisManager redisManager = new RedisManager();

        redisManager.setHost(host);

        redisManager.setPassword(password);

        redisManager.setDatabase(database);

        return redisManager;

    }

    @Bean("redisCacheManager")

    public RedisCacheManager cacheManager() {

        RedisCacheManager cacheManager = new RedisCacheManager();

        cacheManager.setRedisManager(redisManager());

        // redis key默认 = shiro:cache:com.unionticketing.auth.interceptor.realm.MyRealm.authorizationCache:用户ID

        // redis key = shiro:cache:com.unionticketing.auth.interceptor.realm.MyRealm.authorizationCache:token值

        cacheManager.setPrincipalIdFieldName("token");

        cacheManager.setExpire(shiroProperties.getCacheTimeout());

        return cacheManager;

    }

    /**

     * 禁用session, 不保存用户登录状态。保证每次请求都重新认证。

     * 需要注意的是，如果用户代码里调用Subject.getSession()还是可以用session

     */

    @Bean

    protected SessionStorageEvaluator sessionStorageEvaluator(){

        DefaultWebSessionStorageEvaluator sessionStorageEvaluator = new DefaultWebSessionStorageEvaluator();

        sessionStorageEvaluator.setSessionStorageEnabled(false);

        return sessionStorageEvaluator;

    }

    /**

     * 配置webSecurityManager

     *

     * @param

     * @return

     **/

    @Bean("webSecurityManager")

    public DefaultWebSecurityManager securityManager() {

        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

        securityManager.setRealm(myRealm());

        DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();

        DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();

        defaultSessionStorageEvaluator.setSessionStorageEnabled(false);

        subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);

        securityManager.setSubjectDAO(subjectDAO);

        securityManager.setCacheManager(cacheManager());

        return securityManager;

    }

    @Bean("myRealm")

    public MyRealm myRealm() {

        return new MyRealm();

    }

    /**

     * 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions)

     *

     * @param securityManager

     * @return

     */

    @Bean

    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(@Qualifier("webSecurityManager") @Lazy

                                                                                           DefaultWebSecurityManager securityManager) {

        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();

        advisor.setSecurityManager(securityManager);

        return advisor;

    }

}

2.3. MyRealm

package com.example.shiro.configuration;

import com.example.shiro.service.TokenService;

import lombok.NoArgsConstructor;

import lombok.extern.slf4j.Slf4j;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

import org.apache.shiro.subject.SimplePrincipalCollection;

import org.springframework.beans.factory.annotation.Autowired;

import org.springframework.context.annotation.Lazy;

import java.util.ArrayList;

import java.util.List;

/**

 * 自定义Realm

 *

 * @author xsshu

 * @date 2020-07-18 16:33:12

 */

@Slf4j

@NoArgsConstructor

public class MyRealm extends AuthorizingRealm {

    /**

     * 增加@Lazy注解 是TokenService为低优先级注入的bean,为防止项目启动时报Bean 'xxx' of type [com.xx.xxx.xxxx.xxxxx$$EnhancerBySpringCGLIB$$babebd0] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)

     */

    @Autowired

    @Lazy

    private TokenService tokenService;

    /**

     * 定义自己的认证匹配方式

     *

     * @param jwtCredentialsMatcher

     */

    public MyRealm(JwtCredentialsMatcher jwtCredentialsMatcher) {

        super(jwtCredentialsMatcher);

    }

    /**

     * 添加支持自定义token

     *

     * @param token token

     * @return 是否支持

     */

    @Override

    public boolean supports(AuthenticationToken token) {

        if (token instanceof JwtToken) {

            return true;

        }

        return super.supports(token);

    }

    /**

     * 清除权限缓存

     *

     * @param principals

     */

    @Override

    protected void clearCachedAuthenticationInfo(PrincipalCollection principals) {

        super.clearCachedAuthenticationInfo(new SimplePrincipalCollection(principals, getName()));

    }

    /**

     * 授权

     *

     * @param authenticationToken 请求的token

     * @return

     * @throws AuthenticationException

     */

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        if (authenticationToken instanceof JwtToken) {

            JwtToken jwtToken = (JwtToken) authenticationToken;

            // 用户TOKEN 授权

            String tokenType = jwtToken.getTokenType();

            try {

                if (JwtToken.USER_TYPE.equals(tokenType) || JwtToken.API_TYPE.equals(tokenType)) {

                    tokenService.validateToken(jwtToken);

                } else {

                    log.error("不合法的token");

                    throw new AuthenticationException("不合法的token");

                }

            } catch (Exception e) {

                log.error("tokenType:{} 校验异常:{}", tokenType, e.getMessage());

                throw new AuthenticationException("token校验失败", e);

            }

            return new SimpleAuthenticationInfo(jwtToken, authenticationToken, getName());

        }

        throw new AuthenticationException("token不合法.");

    }

    /**

     * 设置权限信息

     *

     * @param principals

     * @return 设置权限

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

        Object primaryPrincipal = principals.getPrimaryPrincipal();

        List<String> permissionList = new ArrayList<>();

        if (primaryPrincipal instanceof JwtToken) {

            JwtToken jwtToken = (JwtToken) primaryPrincipal;

            // TOKEN 授权

            String token = jwtToken.getToken();

            String tokenType = jwtToken.getTokenType();

            if (tokenType.equals(JwtToken.USER_TYPE)) {

                // 根据token解析用户信息查询用户所拥有的的权限列表，这里只是测试数据

                permissionList.add("demo:user:query");

            } else {

                // 获取接口的权限列表,这里只是测试数据

                permissionList.add("demo:api:test:add");

                permissionList.add("demo:api:test:delete");

            }

        }

        SimpleAuthorizationInfo authInfo = new SimpleAuthorizationInfo();

        authInfo.addStringPermissions(permissionList);

        return authInfo;

    }

}

说明

MyReam类中用到了@Lazy注解，该注解的作用是：增加@Lazy注解是TokenService为低优先级注入的bean,为防止项目启动时报Bean 'xxx' of type [com.xx.xxx.xxxx.xxxxx$$EnhancerBySpringCGLIB$$babebd0] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)

关于权限的设置，如果权限存在包含关系，那么配置了大范围的权限后，即使没有配置范围小的权限，也是可以访问的。比如：父菜单-用户权限管理，对应权限编码为：demo:user:auth；功能菜单用户管理查询对应权限编码为：demo:user:auth:query；那么配置了demo:user:auth后，即使没有配置demo:user:auth:query，去访问相应的带权限查询接口的时候依然可以访问到。避免上述问题的解决方案具体操作如下：

父菜单-用户权限管理，对应权限编码为：demo:user:auth:manager；子菜单-用户管理查询，对应权限编码为：demo:user:auth:query
查询菜单的时候排除掉父菜单-用户权限管理这种非功能性菜单权限

3. 测试

3.1. 登录测试

POST http://localhost:6666/login

Content-Type: application/json;utf-8

Body

{"account": "admin", "password": "admin"}

返回数据

{"ret":0,"code":0,"msg":"success","data":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIiwiYXVkIjoidXNlciIsIm5iZiI6MTU5NTIyNzg5MywiaXNzIjoiYWRtaW4iLCJpYXQiOjE1OTUyMjc4OTMsImFjY291bnQiOiJhZG1pbiIsImp0aSI6ImExYjEyYjkyLWM1YjQtNGRmZC05ZjI5LWNjNTRiOGNkZjU4YyJ9.H4SGEHKo6f9SwrRYEYacKKJfR9GxKhYFO3zGmCv_f5k"}

3.2. 用户查询（权限编码：demo:user:query）

GET http://localhost:6666/user/query

Authorization: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ1c2VyIiwiYXVkIjoidXNlciIsIm5iZiI6MTU5NTIyNzg5MywiaXNzIjoiYWRtaW4iLCJpYXQiOjE1OTUyMjc4OTMsImFjY291bnQiOiJhZG1pbiIsImp0aSI6ImExYjEyYjkyLWM1YjQtNGRmZC05ZjI5LWNjNTRiOGNkZjU4YyJ9.H4SGEHKo6f9SwrRYEYacKKJfR9GxKhYFO3zGmCv_f5k

返回数据

{"ret":0,"code":0,"msg":"success","data":"hell query"}

demo地址：https://gitee.com/xsshu/shiro-demo.git

如果有什么表述不对的地方，还请各位大佬纠正。

巴特西