是撒大大大

1. package realm;
2. ?
3. import java.util.ArrayList;
4. import java.util.List;
5. ?
6. import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
7. import org.apache.commons.lang3.builder.ToStringStyle;
8. import org.apache.shiro.SecurityUtils;
9. import org.apache.shiro.authc.AuthenticationException;
10. import org.apache.shiro.authc.AuthenticationInfo;
11. import org.apache.shiro.authc.AuthenticationToken;
12. import org.apache.shiro.authc.SimpleAuthenticationInfo;
13. import org.apache.shiro.authc.UsernamePasswordToken;
14. import org.apache.shiro.authz.AuthorizationException;
15. import org.apache.shiro.authz.AuthorizationInfo;
16. import org.apache.shiro.authz.SimpleAuthorizationInfo;
17. import org.apache.shiro.realm.AuthorizingRealm;
18. import org.apache.shiro.session.Session;
19. import org.apache.shiro.subject.PrincipalCollection;
20. import org.apache.shiro.subject.Subject;
21. import org.springframework.beans.factory.annotation.Autowired;
22. ?
23. import utils.StrUtils;
24. ?
25. import com.jxzg.mvc.web.entitys.user.Role;
26. import com.jxzg.mvc.web.entitys.user.RoleRight;
27. import com.jxzg.mvc.web.entitys.user.User;
28. import com.jxzg.mvc.web.service.user.IUserManager;
29. ?
30. public
    class MyRealm extends AuthorizingRealm {
31. ?
32. [email protected]
33. ???private IUserManager userManager;
34. ?
35. ???/**
36. ????* 为当前登录的Subject授予角色和权限
37. ????* @see 经测试:本例中该方法的调用时机为用户登录后,被调用
38. ????*/
39. [email protected]
40. ???protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
41. ??????// 获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()
42. ??????String currentUsername = (String) super.getAvailablePrincipal(principals);
43. ??????List<String> roleList = new ArrayList<String>();
44. ??????List<String> permissionList = new ArrayList<String>();
45. ??????// 从数据库中获取当前登录用户的详细信息
46. ??????User user = userManager.getByUsername(currentUsername);
47. ??????if (null != user) {
48. ?????????// 实体类User中包含有用户角色的实体类信息
49. ?????????if (null != user.getRole()) {
50. ????????????// 获取当前登录用户的角色
51. ????????????Role role = user.getRole();
52. ????????????roleList.add(role.getName());
53. ????????????//如果是超级管理员直接赋予所有权限
54. ????????????if(role.getName().equals("admin")){
55. ???????????????permissionList.add("user");
56. ???????????????permissionList.add("school");
57. ????????????}
58. ?
59. ????????????else{
60. ???????????????// 实体类Role中包含有角色权限的实体类信息
61. ???????????????if (null != role.getRights() && role.getRights().size() > 0) {
62. ??????????????????// 获取权限
63. ??????????????????for (RoleRight pmss : role.getRights()) {
64. ?????????????????????if(pmss.isFlag()){
65. ????????????????????????if (!StrUtils.isNullOrEmpty(pmss.getRight())) {
66. ???????????????????????????permissionList.add(pmss.getRight().getName());
67. ????????????????????????}
68. ?????????????????????}
69. ??????????????????}
70. ???????????????}
71. ????????????}
72. ?????????}
73. ??????} else {
74. ?????????throw
    new AuthorizationException();
75. ??????}
76. ??????// 为当前用户设置角色和权限
77. ??????SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();
78. ??????simpleAuthorInfo.addRoles(roleList);
79. ??????simpleAuthorInfo.addStringPermissions(permissionList);
80. ??????return simpleAuthorInfo;
81. ???}
82. ?
83. ???/**
84. ????* 验证当前登录的Subject
85. ????* @see 经测试:本例中该方法的调用时机为LoginController.login()方法中执行Subject.login()时
86. ????*/
87. [email protected]
88. ???protected AuthenticationInfo doGetAuthenticationInfo(
89. ?????????AuthenticationToken authcToken) throws AuthenticationException {
90. ??????// 获取基于用户名和密码的令牌
91. ??????// 实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的
92. ??????// 两个token的引用都是一样的
93. ??????UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
94. ??????System.out.println("验证当前Subject时获取到token为"
95. ????????????+ ReflectionToStringBuilder.toString(token,
96. ??????????????????ToStringStyle.MULTI_LINE_STYLE));
97. ??????User user = userManager.getByUsername(token.getUsername());
98. ??????if (null != user) {
99. ?????????AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(
100. ???????????????user.getUserName(), user.getPass(), user.getNickName());
101. ?????????this.setSession("currentUser", user);
102. ?????????return authcInfo;
103. ??????} else {
104. ?????????return
     null;
105. ??????}
106. ???}
107. ?
108. ???/**
109. ????* 将一些数据放到ShiroSession中,以便于其它地方使用
110. ????* @see 比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到
111. ????*/
112. ???private
     void setSession(Object key, Object value) {
113. ??????Subject currentUser = SecurityUtils.getSubject();
114. ??????if (null != currentUser) {
115. ?????????Session session = currentUser.getSession();
116. ?????????if (null != session) {
117. ????????????session.setAttribute(key, value);
118. ?????????}
119. ??????}
120. ???}
121. ?
122. }

?

?