夜雨聆风
如何实现一个权限管理系统?(附源码)
Subject subject = SecurityUtils.getSubject();UsernamePasswordToken token = new UsernamePasswordToken(username, password);//提交认证subject.login(token);
//Shiro进行认证@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {UsernamePasswordToken token = (UsernamePasswordToken)authcToken;//获取用户信息SysUserEntity user = new SysUserEntity();user.setUsername(token.getUsername());user = sysUserDao.selectOne(user);//账号不存在if(user == null) {throw new UnknownAccountException("账号或密码不正确");}SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPassword(), ByteSource.Util.bytes(user.getSalt()), getName());return info;}
//Shiro进行授权@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {//获取认证时候添加到SimpleAuthenticationInfo中的实例SysUserEntity user = (SysUserEntity)principals.getPrimaryPrincipal();Long userId = user.getUserId();//查询用户所有权限Set<String> permsSet = new HashSet<String>();List<String> permsList = sysUserDao.queryAllPerms(userId);for(String perms : permsList){if(StringUtils.isBlank(perms)){continue;}permsSet.addAll(Arrays.asList(perms.trim().split(",")));}SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();info.setStringPermissions(permsSet);return info;}
接口权限，通过注解的方式进行控制，在REST层，方法如果加了@RequiresPermissions注解，Shiro会调用自定义Realm获取权限信息，看指定的权限是否在数据中存在，存在则授权通过，不存在则拒绝访问，从而实现对接口的权限校验。
@RequestMapping("/delete")@RequiresPermissions("sys:del")public R delete(long deptId){//判断是否有子部门List<Long> deptList = sysDeptService.queryDetpIdList(deptId);if(deptList.size() > 0){return R.error("请先删除子部门");}sysDeptService.deleteById(deptId);return R.ok();}
动手点关注 干货不迷路 👇
