用java语言开发集成springBoot+shiro框架做的后台管理系统 shiro默认登录怎么获取到shiro自动生成的token

在Shiro中，登录成功后会生成一个token，可以通过以下代码获取：

Subject currentUser = SecurityUtils.getSubject();
Session session = currentUser.getSession();
Object token = session.getAttribute(DefaultSubjectContext.AUTHENTICATED_SESSION_KEY);

其中，`DefaultSubjectContext.AUTHENTICATED_SESSION_KEY`是Shiro中用于存储token的key值，通过getSession()方法获取当前用户的Session对象，再通过getAttribute()方法获取token即可。

相关问题

springboot+shiro+jwt+mybatisplus框架

这个框架整合可以分为以下几个步骤：

1. 集成 Spring Boot：在 pom.xml 文件中添加 Spring Boot 依赖，创建 Spring Boot 启动类。

2. 集成 MyBatis Plus：在 pom.xml 文件中添加 MyBatis Plus 依赖，配置数据源和 MyBatis Plus 相关配置。

3. 集成 Shiro：在 pom.xml 文件中添加 Shiro 依赖，创建 Shiro 配置类，配置 Shiro 的 Realm 和 SecurityManager。

4. 集成 JWT：在 pom.xml 文件中添加 jjwt 依赖，创建 JWT 工具类，用于生成和解析 JWT。

下面是一个简单的示例代码，你可以根据你的实际需求进行调整：

1. pom.xml 文件中添加依赖：

<!-- Spring Boot -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<!-- MyBatis Plus -->
<dependency>
    <groupId>com.baomidou</groupId>
    <artifactId>mybatis-plus-boot-starter</artifactId>
    <version>${mybatis-plus.version}</version>
</dependency>

<!-- Shiro -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>${shiro.version}</version>
</dependency>

<!-- jjwt -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>${jjwt.version}</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>${jjwt.version}</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>${jjwt.version}</version>
    <scope>runtime</scope>
</dependency>

2. 创建 Spring Boot 启动类：

@SpringBootApplication
public class Application {

    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }

}

3. 配置 MyBatis Plus：

@Configuration
@MapperScan("com.example.mapper")
public class MyBatisPlusConfig {

    @Bean
    public PaginationInterceptor paginationInterceptor() {
        return new PaginationInterceptor();
    }

}

4. 配置 Shiro：

@Configuration
public class ShiroConfig {

    @Bean
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
        shiroFilter.setSecurityManager(securityManager);
        shiroFilter.setUnauthorizedUrl("/401");

        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/401", "anon");
        filterChainDefinitionMap.put("/**", "jwt");
        shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap);

        Map<String, Filter> filters = new LinkedHashMap<>();
        filters.put("jwt", new JwtFilter());
        shiroFilter.setFilters(filters);

        return shiroFilter;
    }

    @Bean
    public DefaultWebSecurityManager securityManager(Realm realm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(realm);
        return securityManager;
    }

    @Bean
    public Realm realm() {
        return new UserRealm();
    }

}

5. 创建 JWT 工具类：

public class JwtUtil {

    private static final String SECRET_KEY = "your_secret_key";
    private static final long EXPIRATION_TIME = 3600_000; // 1 hour

    public static String generateToken(String username) {
        Date now = new Date();
        Date expiration = new Date(now.getTime() + EXPIRATION_TIME);

        return Jwts.builder()
                .setSubject(username)
                .setIssuedAt(now)
                .setExpiration(expiration)
                .signWith(SignatureAlgorithm.HS512, SECRET_KEY)
                .compact();
    }

    public static String getUsernameFromToken(String token) {
        Claims claims = Jwts.parser()
                .setSigningKey(SECRET_KEY)
                .parseClaimsJws(token)
                .getBody();

        return claims.getSubject();
    }

    public static boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token);
            return true;
        } catch (JwtException e) {
            return false;
        }
    }

}

6. 创建 JwtFilter：

public class JwtFilter extends AuthenticatingFilter {

    @Override
    protected AuthenticationToken createToken(ServletRequest servletRequest, ServletResponse servletResponse) {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String token = request.getHeader("Authorization");
        if (StringUtils.isBlank(token)) {
            return null;
        }
        return new JwtToken(token);
    }

    @Override
    protected boolean onAccessDenied(ServletRequest servletRequest, ServletResponse servletResponse) throws Exception {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/json; charset=utf-8");
        response.setStatus(HttpStatus.UNAUTHORIZED.value());
        response.getWriter().write("{\"code\":401,\"message\":\"未登录或登录已过期，请重新登录\"}");
        return false;
    }

    @Override
    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String token = request.getHeader("Authorization");
        if (StringUtils.isBlank(token)) {
            return false;
        }
        return JwtUtil.validateToken(token);
    }

}

7. 创建 JwtToken：

public class JwtToken implements AuthenticationToken {

    private final String token;

    public JwtToken(String token) {
        this.token = token;
    }

    @Override
    public Object getPrincipal() {
        return JwtUtil.getUsernameFromToken(token);
    }

    @Override
    public Object getCredentials() {
        return token;
    }

}

8. 创建 UserRealm：

public class UserRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String username = (String) authenticationToken.getPrincipal();
        User user = userService.getByUsername(username);
        if (user == null) {
            throw new UnknownAccountException("账号不存在");
        }
        return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
    }

}

这样，简单的 Spring Boot + Shiro + JWT + MyBatis Plus 整合就完成了。你可以根据具体的需求，对代码进行修改和优化。

springboot+shiro权限管理怎么实现的

Spring Boot 和 Shiro 都是非常流行的Java开发框架。其中，Spring Boot是一个快速开发框架，能够快速地搭建一个Web应用程序；而Shiro是一个强大的安全框架，提供了认证、授权、加密、会话管理等安全相关的功能。

下面是实现Spring Boot和Shiro权限管理的步骤：

1. 引入依赖

在pom.xml文件中引入Spring Boot和Shiro的依赖。

<!-- Spring Boot -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-web</artifactId>
</dependency>

<!-- Shiro -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.0</version>
</dependency>

2. 编写Shiro配置类

编写一个Shiro配置类，用于配置Shiro的安全管理器、Realm、过滤器等。

@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        
        // 设置过滤器链
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/logout", "logout");
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        
        // 登录页面
        shiroFilterFactoryBean.setLoginUrl("/login");
        // 认证成功后跳转页面
        shiroFilterFactoryBean.setSuccessUrl("/index");
        // 未授权页面
        shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
        
        return shiroFilterFactoryBean;
    }
    
    @Bean
    public SecurityManager securityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setRealm(realm());
        return securityManager;
    }
    
    @Bean
    public Realm realm() {
        return new MyRealm();
    }
}

3. 编写Realm

编写一个Realm类，用于进行认证和授权。

public class MyRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;
    
    // 认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        String username = token.getUsername();
        User user = userService.getUserByUsername(username);
        if (user == null) {
            throw new UnknownAccountException("用户不存在");
        }
        return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
    }
    
    // 授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String username = (String) principalCollection.getPrimaryPrincipal();
        User user = userService.getUserByUsername(username);
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.addRoles(user.getRoles());
        authorizationInfo.addStringPermissions(user.getPermissions());
        return authorizationInfo;
    }
}

4. 编写Controller

编写一个Controller类，用于处理用户登录、登出等请求。

@Controller
public class LoginController {
    @GetMapping("/login")
    public String login() {
        return "login";
    }
    
    @PostMapping("/login")
    public String doLogin(String username, String password, boolean rememberMe) {
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        token.setRememberMe(rememberMe);
        try {
            subject.login(token);
            return "redirect:/index";
        } catch (AuthenticationException e) {
            return "login";
        }
    }
    
    @GetMapping("/logout")
    public String logout() {
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        return "redirect:/login";
    }
    
    @GetMapping("/index")
    public String index() {
        return "index";
    }
    
    @GetMapping("/unauthorized")
    public String unauthorized() {
        return "unauthorized";
    }
}

5. 编写页面

编写登录页面、首页、未授权页面等页面。

<!-- 登录页面 -->
<form method="post" action="/login">
    <input type="text" name="username" placeholder="用户名" required>
    <input type="password" name="password" placeholder="密码" required>
    <div>
        <input type="checkbox" name="rememberMe" id="rememberMe">
        <label for="rememberMe">记住我</label>
    </div>
    <button type="submit">登录</button>
</form>

<!-- 首页 -->
<h1>欢迎访问首页</h1>

<!-- 未授权页面 -->
<h1>您没有访问该页面的权限</h1>

以上就是Spring Boot和Shiro权限管理的实现步骤。通过配置Shiro的安全管理器、Realm、过滤器等，可以实现用户认证和授权。同时，通过在Controller中处理用户登录、登出等请求，可以实现用户的登录和退出功能。