spring boot 集成 shiro 自定义密码验证 自定义freemarker标签根据权限渲染不同页面(推荐

<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring</artifactId>
 <version>1.4.0</version>
</dependency>

public class AdminUser implements Serializable {

 private static final long serialVersionUID = 8264158018518861440L;
 private Integer id;
 private String username;
 private String password;
 private Integer roleId;
 // getter setter...
}

public class Role implements Serializable {
 private static final long serialVersionUID = 7824693669858106664L;
 private Integer id;
 private String name;
 // getter setter...
}

public class Permission implements Serializable {
 private static final long serialVersionUID = -2694960432845360318L;
 private Integer id;
 private String name;
 private String value;
 // 权限的父节点的id
 private Integer pid;
 // getter setter...
}

@Component
public class MyShiroRealm extends AuthorizingRealm {
 private Logger log = LoggerFactory.getLogger(MyShiroRealm.class);
 @Autowired
 private AdminUserService adminUserService;
 @Autowired
 private RoleService roleService;
 @Autowired
 private PermissionService permissionService;
 // 用户权限配置
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
 //访问@RequirePermission注解的url时触发
 SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
 AdminUser adminUser = adminUserService.selectByUsername(principals.toString());
 //获得用户的角色，及权限进行绑定
 Role role = roleService.selectById(adminUser.getRoleId());
 // 其实这里也可以不要权限那个类了，直接用角色这个类来做鉴权，
 // 不过角色包含很多的权限，已经算是大家约定的了，所以下面还是查询权限然后放在AuthorizationInfo里
 simpleAuthorizationInfo.addRole(role.getName());
 // 查询权限
 List<Permission> permissions = permissionService.selectByRoleId(adminUser.getRoleId());
 // 将权限具体值取出来组装成一个权限String的集合
 List<String> permissionValues = permissions.stream().map(Permission::getValue).collect(Collectors.toList());
 // 将权限的String集合添加进AuthorizationInfo里，后面请求鉴权有用
 simpleAuthorizationInfo.addStringPermissions(permissionValues);
 return simpleAuthorizationInfo;
 }
 // 组装用户信息
 @Override
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
 String username = (String) token.getPrincipal();
 log.info("用户：{} 正在登录...", username);
 AdminUser adminUser = adminUserService.selectByUsername(username);
 // 如果用户不存在，则抛出未知用户的异常
 if (adminUser == null) throw new UnknownAccountException();
 return new SimpleAuthenticationInfo(username, adminUser.getPassword(), getName());
 }
}

public class MyCredentialsMatcher implements CredentialsMatcher {

 @Override
 public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
 // 大坑！！！！！！！！！！！！！！！！！！！
 // 明明token跟info两个对象的里的Credentials类型都是Object，断点看到的类型都是 char[]
 // 但是！！！！！ token里转成String要先强转成 char[]
 // 而info里取Credentials就可以直接使用 String.valueOf() 转成String
 // 醉了。。
 String rawPassword = String.valueOf((char[]) token.getCredentials());
 String encodedPassword = String.valueOf(info.getCredentials());
 return new BCryptPasswordEncoder().matches(rawPassword, encodedPassword);
 }
}

@Configuration
public class ShiroConfig {
 private Logger log = LoggerFactory.getLogger(ShiroConfig.class);
 @Autowired
 private MyShiroRealm myShiroRealm;
 @Bean
 public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
 log.info("开始配置shiroFilter...");
 ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
 shiroFilterFactoryBean.setSecurityManager(securityManager);
 //拦截器.
 Map<String,String> map = new HashMap<>();
 // 配置不会被拦截的链接 顺序判断 相关静态资源
 map.put("/static/**", "anon");
 //配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
 map.put("/admin/logout", "logout");
 //<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
 //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
 map.put("/admin/**", "authc");
 // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
 shiroFilterFactoryBean.setLoginUrl("/adminlogin");
 // 登录成功后要跳转的链接
 shiroFilterFactoryBean.setSuccessUrl("/admin/index");
 //未授权界面;
 shiroFilterFactoryBean.setUnauthorizedUrl("/error");
 shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
 return shiroFilterFactoryBean;
 }
 // 配置加密方式
 // 配置了一下，这货就是验证不过，，改成手动验证算了，以后换加密方式也方便
 @Bean
 public MyCredentialsMatcher myCredentialsMatcher() {
 return new MyCredentialsMatcher();
 }
 // 安全管理器配置
 @Bean
 public SecurityManager securityManager() {
 DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
 myShiroRealm.setCredentialsMatcher(myCredentialsMatcher());
 securityManager.setRealm(myShiroRealm);
 return securityManager;
 }
}

@PostMapping("/adminlogin")
public String adminLogin(String username, String password,
       @RequestParam(defaultValue = "0") Boolean rememberMe,
       RedirectAttributes redirectAttributes) {
 try {
 // 添加用户认证信息
 Subject subject = SecurityUtils.getSubject();
 if (!subject.isAuthenticated()) {
  UsernamePasswordToken token = new UsernamePasswordToken(username, password, rememberMe);
  //进行验证，这里可以捕获异常，然后返回对应信息
  subject.login(token);
 }
 } catch (AuthenticationException e) {
 // e.printStackTrace();
 log.error(e.getMessage());
 redirectAttributes.addFlashAttribute("error", "用户名或密码错误");
 redirectAttributes.addFlashAttribute("username", username);
 return redirect("/adminlogin");
 }
 return redirect("/admin/index");
}

@Component
public class ShiroTag {
 // 判断当前用户是否已经登录认证过
 public boolean isAuthenticated(){
 return SecurityUtils.getSubject().isAuthenticated();
 }
 // 获取当前用户的用户名
 public String getPrincipal() {
 return (String) SecurityUtils.getSubject().getPrincipal();
 }
 // 判断用户是否有 xx 角色
 public boolean hasRole(String name) {
 return SecurityUtils.getSubject().hasRole(name);
 }
 // 判断用户是否有 xx 权限
 public boolean hasPermission(String name) {
 return !StringUtils.isEmpty(name) && SecurityUtils.getSubject().isPermitted(name);
 }
}

@Configuration
public class FreemarkerConfig {
 private Logger log = LoggerFactory.getLogger(FreeMarkerConfig.class);
 @Autowired
 private ShiroTag shiroTag;
 @PostConstruct
 public void setSharedVariable() throws TemplateModelException {
 //注入全局配置到freemarker
 log.info("开始配置freemarker全局变量...");
 // shiro鉴权
 configuration.setSharedVariable("sec", shiroTag);
 log.info("freemarker自定义标签配置完成!");
 }
}

<#if sec.hasPermission("topic:list")>
 <li <#if page_tab=='topic'>class="active"</#if>>
 <a href="/admin/topic/list" rel="external nofollow" >
  <i class="fa fa-list"></i>
  <span>话题列表</span>
 </a>
 </li>
</#if>

//加入注解的使用，不加入这个注解不生效
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
 AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
 authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
 return authorizationAttributeSourceAdvisor;
}
@Bean
@ConditionalOnMissingBean
public DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator() {
 DefaultAdvisorAutoProxyCreator defaultAAP = new DefaultAdvisorAutoProxyCreator();
 defaultAAP.setProxyTargetClass(true);
 return defaultAAP;
}

@Controller
@RequestMapping("/admin/topic")
public class TopicAdminController extends BaseAdminController {

 @RequiresPermissions("topic:list")
 @GetMapping("/list")
 public String list() {
 // TODO
 return "admin/topic/list";
 }
}