SpringBoot整合Shiro(二)

/**
   * 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions)
   *
   * @return
   */
  @Bean
  public static DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {
      DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
      defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
      return defaultAdvisorAutoProxyCreator;
  }

  /**
   * 开启shiro 注解模式
   * 可以在controller中的方法前加上注解
   * 如 @RequiresPermissions("userInfo:add")
   *
   * @param securityManager
   * @return
   */
  @Bean
  public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(@Qualifier("securityManager") SecurityManager securityManager) {
      AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
      authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
      return authorizationAttributeSourceAdvisor;
  }

@RequiresPermissions("userInfo:del")
@RequestMapping(value = "/del",method = RequestMethod.GET)
@ResponseBody
public String del(Model model) {
    userService.del("baiyp");
    return "删除用户名为baiyp用户成功";

}

/**
  * 解决： 无权限页面不跳转 shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized") 无效
  * shiro的源代码ShiroFilterFactoryBean.Java定义的filter必须满足filter instanceof AuthorizationFilter，
  * 只有perms，roles，ssl，rest，port才是属于AuthorizationFilter，而anon，authcBasic，auchc，user是AuthenticationFilter，
  * 所以unauthorizedUrl设置后页面不跳转 Shiro注解模式下，登录失败与没有权限都是通过抛出异常。
  * 并且默认并没有去处理或者捕获这些异常。在SpringMVC下需要配置捕获相应异常来通知用户信息
  *
  * @return
  */
@Bean
public SimpleMappingExceptionResolver simpleMappingExceptionResolver() {
    SimpleMappingExceptionResolver simpleMappingExceptionResolver = new SimpleMappingExceptionResolver();
    Properties properties = new Properties();
    //这里的 /unauthorized 是页面，不是访问的路径
    properties.setProperty("org.apache.shiro.authz.UnauthorizedException", "/unauthorized");
    properties.setProperty("org.apache.shiro.authz.UnauthenticatedException", "/unauthorized");
    simpleMappingExceptionResolver.setExceptionMappings(properties);
    return simpleMappingExceptionResolver;
}

/**
  * 解决spring-boot2.0 Whitelabel Error Page
  *
  * @return
  */
@Bean
public WebServerFactoryCustomizer<ConfigurableWebServerFactory> webServerFactoryCustomizer() {
    return factory -> {
        ErrorPage error401Page = new ErrorPage(HttpStatus.UNAUTHORIZED, "/unauthorized");
        ErrorPage error404Page = new ErrorPage(HttpStatus.NOT_FOUND, "/404");
        ErrorPage error500Page = new ErrorPage(HttpStatus.INTERNAL_SERVER_ERROR, "/500");
        factory.addErrorPages(error401Page, error404Page, error500Page);
    };

/**
  * cookie对象;会话Cookie模板 ,默认为: JSESSIONID 问题: 与SERVLET容器名冲突,重新定义为sid或rememberMe，自定义
  *
  * @return
  */
@Bean
public SimpleCookie rememberMeCookie() {
    //这个参数是cookie的名称，对应前端的checkbox的name = rememberMe
    SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
    //setcookie的httponly属性如果设为true的话，会增加对xss防护的安全系数。它有以下特点：

    //setcookie()的第七个参数
    //设为true后，只能通过http访问，javascript无法访问
    //防止xss读取cookie
    simpleCookie.setHttpOnly(true);
    simpleCookie.setPath("/");
    //<!-- 记住我cookie生效时间30天 ,单位秒;-->
    simpleCookie.setMaxAge(2592000);
    return simpleCookie;
}

/**
  * cookie管理对象;记住我功能,rememberMe管理器
  *
  * @return
  */
@Bean
public CookieRememberMeManager rememberMeManager() {
    CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
    cookieRememberMeManager.setCookie(rememberMeCookie());
    //rememberMe cookie加密的密钥 建议每个项目都不一样 默认AES算法 密钥长度(128 256 512 位)
    cookieRememberMeManager.setCipherKey(Base64.decode("6ZmI6I2j5Y+R5aSn5ZOlAA=="));
    return cookieRememberMeManager;
}

/**
  * FormAuthenticationFilter 过滤器 过滤记住我
  *
  * @return
  */
@Bean
public FormAuthenticationFilter formAuthenticationFilter() {
    FormAuthenticationFilter formAuthenticationFilter = new FormAuthenticationFilter();
    //对应前端的checkbox的name = rememberMe
    formAuthenticationFilter.setRememberMeParam("rememberMe");
    return formAuthenticationFilter;
}

/**
  * 配置核心安全事务管理器
  *
  * @param shiroRealm
  * @return
  */
@Bean(name = "securityManager")
public SecurityManager securityManager(@Qualifier("shiroRealm") ShiroRealm shiroRealm) {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    //设置自定义realm.
    securityManager.setRealm(shiroRealm);
    //配置记住我
    securityManager.setRememberMeManager(rememberMeManager());
	...

    return securityManager;
}

/**
  * ShiroFilterFactoryBean 处理拦截资源文件问题。
  * 注意：初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
  * Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截
  *
  * @param securityManager
  * @return
  */
@Bean(name = "shirFilter")
public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager securityManager) {
	...

    //其他资源都需要认证  authc 表示需要认证才能进行访问
    // filterChainDefinitionMap.put("/**", "authc");
    //其他资源都需要认证  authc 表示需要认证才能进行访问 user表示配置记住我或认证通过可以访问的地址
    filterChainDefinitionMap.put("/**", "user");

 	...

    return shiroFilterFactoryBean;
}

@RequestMapping(value = "/login", method = RequestMethod.POST)
public String loginUser(HttpServletRequest request, String username, String password, boolean rememberMe, Model model, HttpSession session) {

    //对密码进行加密
    //password=new SimpleHash("md5", password, ByteSource.Util.bytes(username.toLowerCase() + "shiro"),2).toHex();
    //如果有点击  记住我
    UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password, rememberMe);
    //注释掉
    // UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username,password);
    ...
}

public class User implements Serializable {
	...
}