package realm;
?
import java.util.ArrayList;
import java.util.List;
?
import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
import org.apache.commons.lang3.builder.ToStringStyle;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
?
import utils.StrUtils;
?
import com.jxzg.mvc.web.entitys.user.Role;
import com.jxzg.mvc.web.entitys.user.RoleRight;
import com.jxzg.mvc.web.entitys.user.User;
import com.jxzg.mvc.web.service.user.IUserManager;
?
public
class MyRealm extends AuthorizingRealm {
?
???@Autowired
???private IUserManager userManager;
?
???/**
????* 为当前登录的Subject授予角色和权限
????* @see 经测试:本例中该方法的调用时机为用户登录后,被调用
????*/
???@Override
???protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
??????// 获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()
??????String currentUsername = (String) super.getAvailablePrincipal(principals);
??????List<String> roleList = new ArrayList<String>();
??????List<String> permissionList = new ArrayList<String>();
??????// 从数据库中获取当前登录用户的详细信息
??????User user = userManager.getByUsername(currentUsername);
??????if (null != user) {
?????????// 实体类User中包含有用户角色的实体类信息
?????????if (null != user.getRole()) {
????????????// 获取当前登录用户的角色
????????????Role role = user.getRole();
????????????roleList.add(role.getName());
????????????//如果是超级管理员直接赋予所有权限
????????????if(role.getName().equals("admin")){
???????????????permissionList.add("user");
???????????????permissionList.add("school");
????????????}
?
????????????else{
???????????????// 实体类Role中包含有角色权限的实体类信息
???????????????if (null != role.getRights() && role.getRights().size() > 0) {
??????????????????// 获取权限
??????????????????for (RoleRight pmss : role.getRights()) {
?????????????????????if(pmss.isFlag()){
????????????????????????if (!StrUtils.isNullOrEmpty(pmss.getRight())) {
???????????????????????????permissionList.add(pmss.getRight().getName());
????????????????????????}
?????????????????????}
??????????????????}
???????????????}
????????????}
?????????}
??????} else {
?????????throw
new AuthorizationException();
??????}
??????// 为当前用户设置角色和权限
??????SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();
??????simpleAuthorInfo.addRoles(roleList);
??????simpleAuthorInfo.addStringPermissions(permissionList);
??????return simpleAuthorInfo;
???}
?
???/**
????* 验证当前登录的Subject
????* @see 经测试:本例中该方法的调用时机为LoginController.login()方法中执行Subject.login()时
????*/
???@Override
???protected AuthenticationInfo doGetAuthenticationInfo(
?????????AuthenticationToken authcToken) throws AuthenticationException {
??????// 获取基于用户名和密码的令牌
??????// 实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的
??????// 两个token的引用都是一样的
??????UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
??????System.out.println("验证当前Subject时获取到token为"
????????????+ ReflectionToStringBuilder.toString(token,
??????????????????ToStringStyle.MULTI_LINE_STYLE));
??????User user = userManager.getByUsername(token.getUsername());
??????if (null != user) {
?????????AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(
???????????????user.getUserName(), user.getPass(), user.getNickName());
?????????this.setSession("currentUser", user);
?????????return authcInfo;
??????} else {
?????????return
null;
??????}
???}
?
???/**
????* 将一些数据放到ShiroSession中,以便于其它地方使用
????* @see 比如Controller,使用时直接用HttpSession.getAttribute(key
)就可以取到
????*/
???private
void setSession(Object key, Object value) {
??????Subject currentUser = SecurityUtils.getSubject();
??????if (null != currentUser) {
?????????Session session = currentUser.getSession();
?????????if (null != session) {
????????????session.setAttribute(key, value);
?????????}
??????}
???}
?
}
