教你 Shiro 整合 SpringBoot，避开各种坑 (3)

当然，同样的道理也可以这样写：

@Bean public SecurityManager securityManager(CustomRealm customRealm) { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); // 设置realm. securityManager.setRealm(customRealm); return securityManager; }

然后只要在 CustomRealm 类加上个类似 @Component 的注解即可

功能实现

本文的功能全部以接口返回 json 数据的方式实现

根据 url 权限分配 controller 游客 @RestController @RequestMapping("/guest") public class GuestController{ @Autowired private final ResultMap resultMap; @RequestMapping(value = "/enter", method = RequestMethod.GET) public ResultMap login() { return resultMap.success().message("欢迎进入，您的身份是游客"); } @RequestMapping(value = "/getMessage", method = RequestMethod.GET) public ResultMap submitLogin() { return resultMap.success().message("您拥有获得该接口的信息的权限！"); } } 普通登陆用户 @RestController @RequestMapping("/user") public class UserController{ @Autowired private final ResultMap resultMap; @RequestMapping(value = "/getMessage", method = RequestMethod.GET) public ResultMap getMessage() { return resultMap.success().message("您拥有用户权限，可以获得该接口的信息！"); } } 管理员 @RestController @RequestMapping("/admin") public class AdminController { @Autowired private final ResultMap resultMap; @RequestMapping(value = "/getMessage", method = RequestMethod.GET) public ResultMap getMessage() { return resultMap.success().message("您拥有管理员权限，可以获得该接口的信息！"); } }

突然注意到 CustomRealm 类那里抛出了 AccountException 异常，现在建个类进行异常捕获

@RestControllerAdvice public class ExceptionController { private final ResultMap resultMap; @Autowired public ExceptionController(ResultMap resultMap) { this.resultMap = resultMap; } // 捕捉 CustomRealm 抛出的异常 @ExceptionHandler(AccountException.class) public ResultMap handleShiroException(Exception ex) { return resultMap.fail().message(ex.getMessage()); } }

还有进行登陆等处理的 LoginController

@RestController public class LoginController { @Autowired private ResultMap resultMap; private UserMapper userMapper; @RequestMapping(value = "/notLogin", method = RequestMethod.GET) public ResultMap notLogin() { return resultMap.success().message("您尚未登陆！"); } @RequestMapping(value = "/notRole", method = RequestMethod.GET) public ResultMap notRole() { return resultMap.success().message("您没有权限！"); } @RequestMapping(value = "/logout", method = RequestMethod.GET) public ResultMap logout() { Subject subject = SecurityUtils.getSubject(); //注销 subject.logout(); return resultMap.success().message("成功注销！"); } /** * 登陆 * * @param username 用户名 * @param password 密码 */ @RequestMapping(value = "/login", method = RequestMethod.POST) public ResultMap login(String username, String password) { // 从SecurityUtils里边创建一个 subject Subject subject = SecurityUtils.getSubject(); // 在认证提交前准备 token（令牌） UsernamePasswordToken token = new UsernamePasswordToken(username, password); // 执行认证登陆 subject.login(token); //根据权限，指定返回数据 String role = userMapper.getRole(username); if ("user".equals(role)) { return resultMap.success().message("欢迎登陆"); } if ("admin".equals(role)) { return resultMap.success().message("欢迎来到管理员页面"); } return resultMap.fail().message("权限错误！"); } } 测试