添加SimpleAuthorizingRealm

添加一个类net.wendal.nutzbook.shiro.realm.SimpleAuthorizingRealm

  1. package net.wendal.nutzbook.shiro.realm;
  3. import org.apache.shiro.authc.AuthenticationException;
  4. import org.apache.shiro.authc.AuthenticationInfo;
  5. import org.apache.shiro.authc.AuthenticationToken;
  6. import org.apache.shiro.authc.LockedAccountException;
  7. import org.apache.shiro.authc.SimpleAccount;
  8. import org.apache.shiro.authc.credential.CredentialsMatcher;
  9. import org.apache.shiro.authz.AuthorizationException;
  10. import org.apache.shiro.authz.AuthorizationInfo;
  11. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  12. import org.apache.shiro.cache.CacheManager;
  13. import org.apache.shiro.realm.AuthorizingRealm;
  14. import org.apache.shiro.subject.PrincipalCollection;
  15. import org.nutz.dao.Dao;
  16. import org.nutz.integration.shiro.SimpleShiroToken;
  17. import org.nutz.mvc.Mvcs;
  19. import net.wendal.nutzbook.bean.Permission;
  20. import net.wendal.nutzbook.bean.Role;
  21. import net.wendal.nutzbook.bean.User;
  23. public class SimpleAuthorizingRealm extends AuthorizingRealm {
  25.     protected Dao dao; // ShiroFilter先于NutFilter初始化化,所以无法使用注入功能
  27.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  28.         // null usernames are invalid
  29.         if (principals == null) {
  30.             throw new AuthorizationException("PrincipalCollection method argument cannot be null.");
  31.         }
  32.         int userId = (Integer) principals.getPrimaryPrincipal();
  33.         User user = dao().fetch(User.class, userId);
  34.         if (user == null)
  35.             return null;
  36.         if (user.isLocked())
  37.             throw new LockedAccountException("Account [" + user.getName() + "] is locked.");
  39.         SimpleAuthorizationInfo auth = new SimpleAuthorizationInfo();
  40.         user = dao().fetchLinks(user, null);
  41.         if (user.getRoles() != null) {
  42.             dao().fetchLinks(user.getRoles(), null);
  43.             for (Role role : user.getRoles()) {
  44.                 auth.addRole(role.getName());
  45.                 if (role.getPermissions() != null) {
  46.                     for (Permission p : role.getPermissions()) {
  47.                         auth.addStringPermission(p.getName());
  48.                     }
  49.                 }
  50.             }
  51.         }
  52.         if (user.getPermissions() != null) { // 特许/临时分配的权限
  53.             for (Permission p : user.getPermissions()) {
  54.                 auth.addStringPermission(p.getName());
  55.             }
  56.         }
  57.         return auth;
  58.     }
  60.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  61.         SimpleShiroToken upToken = (SimpleShiroToken) token;
  62.         // upToken.getPrincipal() 的返回值就是SimpleShiroToken构造方法传入的值
  63.         // 可以是int也可以是User类实例,或任何你希望的值,自行处理一下就好了
  64.         User user = dao().fetch(User.class, ((Integer)upToken.getPrincipal()).longValue());
  65.         if (user == null)
  66.             return null;
  67.         if (user.isLocked())
  68.             throw new LockedAccountException("Account [" + user.getName() + "] is locked.");
  69.         return new SimpleAccount(user.getId(), user.getPassword(), getName());
  70.     }
  72.     /**
  73.      * 覆盖父类的验证,直接pass. 在shiro内做验证的话, 出错了都不知道哪里错
  74.      */
  75.     protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
  76.     }
  78.     public SimpleAuthorizingRealm() {
  79.         this(null, null);
  80.     }
  82.     public SimpleAuthorizingRealm(CacheManager cacheManager, CredentialsMatcher matcher) {
  83.         super(cacheManager, matcher);
  84.         setAuthenticationTokenClass(SimpleShiroToken.class); // 非常非常重要,与SecurityUtils.getSubject().login是对应关系!!!
  85.     }
  87.     public SimpleAuthorizingRealm(CacheManager cacheManager) {
  88.         this(cacheManager, null);
  89.     }
  91.     public SimpleAuthorizingRealm(CredentialsMatcher matcher) {
  92.         this(null, matcher);
  93.     }
  95.     public Dao dao() {
  96.         if (dao == null) {
  97.             dao = Mvcs.ctx().getDefaultIoc().get(Dao.class, "dao");
  98.             return dao;
  99.         }
  100.         return dao;
  101.     }
  103.     public void setDao(Dao dao) {
  104.         this.dao = dao;
  105.     }
  107. }

关键点

  • 这个类也存在于shiro插件中,但切勿直接引用, 因为这个类与实际的权限模型(User-Role-Permission)紧密相关,提供一个通用实现不现实.
    *