springboot+shiro权限管理怎么实现的

Spring Boot 和 Shiro 都是非常流行的Java开发框架。其中，Spring Boot是一个快速开发框架，能够快速地搭建一个Web应用程序；而Shiro是一个强大的安全框架，提供了认证、授权、加密、会话管理等安全相关的功能。

下面是实现Spring Boot和Shiro权限管理的步骤：

1. 引入依赖

在pom.xml文件中引入Spring Boot和Shiro的依赖。

<!-- Spring Boot -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<!-- Shiro -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.0</version>
</dependency>

2. 编写Shiro配置类

编写一个Shiro配置类，用于配置Shiro的安全管理器、Realm、过滤器等。

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        
        // 设置过滤器链
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        
        // 登录页面
        shiroFilterFactoryBean.setLoginUrl("/login");
        // 认证成功后跳转页面
        shiroFilterFactoryBean.setSuccessUrl("/index");
        // 未授权页面
        shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
        
        return shiroFilterFactoryBean;
    }
    
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(realm());
        return securityManager;
    }
    
    @Bean
    public Realm realm() {
        return new MyRealm();
    }
}

3. 编写Realm

编写一个Realm类，用于进行认证和授权。

public class MyRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
    
    // 认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username = token.getUsername();
        User user = userService.getUserByUsername(username);
        if (user == null) {
            throw new UnknownAccountException("用户不存在");
        }
        return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
    }
    
    // 授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String username = (String) principalCollection.getPrimaryPrincipal();
        User user = userService.getUserByUsername(username);
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.addRoles(user.getRoles());
        authorizationInfo.addStringPermissions(user.getPermissions());
        return authorizationInfo;
    }
}

4. 编写Controller

编写一个Controller类，用于处理用户登录、登出等请求。

@Controller
public class LoginController {
    @GetMapping("/login")
    public String login() {
        return "login";
    }
    
    @PostMapping("/login")
    public String doLogin(String username, String password, boolean rememberMe) {
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        token.setRememberMe(rememberMe);
        try {
            subject.login(token);
            return "redirect:/index";
        } catch (AuthenticationException e) {
            return "login";
        }
    }
    
    @GetMapping("/logout")
    public String logout() {
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        return "redirect:/login";
    }
    
    @GetMapping("/index")
    public String index() {
        return "index";
    }
    
    @GetMapping("/unauthorized")
    public String unauthorized() {
        return "unauthorized";
    }
}

5. 编写页面

编写登录页面、首页、未授权页面等页面。

<!-- 登录页面 -->
<form method="post" action="/login">
    <input type="text" name="username" placeholder="用户名" required>
    <input type="password" name="password" placeholder="密码" required>
    <div>
        <input type="checkbox" name="rememberMe" id="rememberMe">
        <label for="rememberMe">记住我</label>
    </div>
    <button type="submit">登录</button>
</form>

<!-- 首页 -->
<h1>欢迎访问首页</h1>

<!-- 未授权页面 -->
<h1>您没有访问该页面的权限</h1>

以上就是Spring Boot和Shiro权限管理的实现步骤。通过配置Shiro的安全管理器、Realm、过滤器等，可以实现用户认证和授权。同时，通过在Controller中处理用户登录、登出等请求，可以实现用户的登录和退出功能。