Spring Boot 整合Apache Shiro实现按钮级别的权限控制?

经验文章nimo972025-01-12 12:30:5312A⁺A^-

之前在评论中看到有粉丝说通过Apache实现按钮级别的权限控制，其实在Spring Boot中整合Apache Shiro来实现按钮级别的权限可以通过如下的步骤来实现，下面我们就来看如何实现按钮级别的权限控制。

引入依赖

首先需要引入ApacheShiro的依赖，如下所示。

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.1</version>
</dependency>

配置Shiro

跟之前介绍的内容一样，我们需要添加一个Shiro的配置类并且在其中注入一些关键的组件。如下所示。

import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        // 配置需要保护的路径和权限
        return shiroFilterFactoryBean;
    }

    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(myRealm());
        return securityManager;
    }

    @Bean
    public MyRealm myRealm() {
        return new MyRealm();
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager);
        return advisor;
    }
}

创建自定义的Realm

我们可以通过创建自定义的Realm来对相关的认证授权进行处理如下所示。

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.SimpleCredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class MyRealm extends AuthorizingRealm {

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = (String) principals.getPrimaryPrincipal();
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        // 从数据库或其他数据源中获取用户角色和权限
        // authorizationInfo.addRole("admin");
        // authorizationInfo.addStringPermission("user:create");
        return authorizationInfo;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        String username = upToken.getUsername();
        String password = new String(upToken.getPassword());
        // 验证用户名和密码
        return new SimpleAuthenticationInfo(username, password, getName());
    }
}

配置完成之后，接下来就让我们看看如何使用吧？

使用权限注解

我们可以在需要进行权限访问控制的类或者是方法上添加上Shiro提供的注解，这个在之前的分享中也介绍过。

import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TestController {

    @GetMapping("/create")
    @RequiresPermissions("user:create")
    public String createUser() {
        return "User created!";
    }
}

前端按钮权限控制

这里就是最关键的地方了，在前端页面中，我们需要根据用户动态权限来控制按钮的显实与隐藏，这里我们以Thymeleaf模板引擎为例，代码如下所示。

<!DOCTYPE html>
<html xmlns:th="http://www.thymeleaf.org">
<head>
    <title>Button Permission Control</title>
</head>
<body>
    <button th:if="${#authorization.expression('hasPermission('user:create')')}">Create User</button>
</body>
</html>

这样我们就可以判断用户是否具有相关的权限了，如果有的话那么按钮就会出现，如果没有权限那么按钮就不会出现。