本文共 4819 字，大约阅读时间需要 16 分钟。

SpringBoot + Shiro后台管理系统权限配置方案

前言

使用SpringBoot和Shiro搭建后台管理系统时，传统的权限验证方式是通过在HTML页面中嵌入Shiro标签直接验证用户权限。这种方法虽然简单，但在菜单数量较多时容易导致页面臃肿，并且需要手动管理权限标识，容易出错。本文将介绍一种通过动态从数据库获取权限信息的方法，将菜单栏生成到页面中，解决传统方法的不足。

数据库设计

为了实现动态生成菜单栏，我们需要设计一个完整的数据库架构，包含以下表：

系统实现

Controller

@GetMapping("/index")
public String login(Model model) {
    if (!subject.isAuthenticated()) {
        return "/login";
    }
    
    String username = subject.getPrincipal().toString();
    List
   
     menuTree = menuService.findMenuTreeByUsername(username);
    model.addAttribute("menuTree", menuTree);
    return "index";
}
   

Service

public interface MenuService extends IService {
    List
   
     findMenuTreeByUsername(String username);
}
   

Service Implementation

@Service
public class MenuServiceImpl extends ServiceImpl {
    private MenuMapper menuMapper;
    @Override
    public List
   
     findMenuTreeByUsername(String username) {
        return menuMapper.findMenuTreeByUsername(username);
    }
}
   

Mapper

public interface MenuMapper extends BaseMapper {
    List
   
     findMenuTreeByUsername(String username);
}
   

XML映射文件

   
    
    
    
    
    
    
    
    
        
     
        
     
        
     
    
    
   
    select pm.id, pm.menu_name, pm.menu_icon, m.id mid, m.menu_name mname, m.menu_url murl 
    from user u 
    inner join user_role ur on u.id=ur.user_id 
    inner join role r on ur.role_id=r.id 
    inner join role_permission rp on r.id=rp.role_id 
    inner join permission p on rp.permission_id=p.id 
    inner join menu m on p.menu_id=m.id 
    inner join menu pm on m.menu_id=pm.id 
    where u.username=#{username}

VO对象

@Data
public class Menu {
    private Long id;
    private String menuName;
    private String menuUrl;
    private String menuIcon;
    private List
   
     subMenus;
}
   

页面渲染

   
    
    <#list menuTree as menus>
        
    
            
                
                ${menus.menuName}
            
            
     
      
                <#list menus.subMenus as s>
                    
      
                        
       ${s.menuName}
                    
      
                
      
            
     
        
    
    
   

Shiro配置

ShiroConfig

@Bean("shiroFilter")
public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager manager) {
    ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
    bean.setSecurityManager(manager);
    bean.setLoginUrl("/login");
    bean.setSuccessUrl("/index");
    bean.setUnauthorizedUrl("/auth.html");
    
    Map
   
     filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/index", "anon");
    filterChainDefinitionMap.put("/login", "anon");
    filterChainDefinitionMap.put("/static/**", "anon");
    filterChainDefinitionMap.put("/swagger-ui.html", "anon");
    filterChainDefinitionMap.put("/swagger-resources", "anon");
    filterChainDefinitionMap.put("/api/**", "anon");
    
    List
    
      permissionList = permissionMapper.getAll();
    for (Permission permission : permissionList) {
        filterChainDefinitionMap.put(permission.getResource(), "perms["+permission.getSn()+"]");
    }
    filterChainDefinitionMap.put("/**", "anon");
    bean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return bean;
}
    
   

PermissionMapper

public interface PermissionMapper extends BaseMapper {
    List
   
     getAll();
    List
    
      getPermissionsByUserName(String username);
}
    
   

XML映射文件

    select * from permission

RoleMapper

public interface RoleMapper extends BaseMapper {
    List
   
     getRolesByUserName(String username);
}
   

XML映射文件

    select r.id, r.role_name, r.remake 
    from role r 
    left join user_role ur on ur.role_id=r.id 
    left join user u on u.id=ur.user_id 
    where u.username=#{username}

PermissionMapper

@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    log.info("Shiro开始授权操作");
    String username = SecurityUtils.getSubject().getPrincipal().toString();
    SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
    Set
   
     roles = new HashSet<>();
    List
    
      rolesList = roleMapper.getRolesByUserName(username);
    for (Role role : rolesList) {
        roles.add(role.getRoleName());
    }
    List
     
       permissionsList = permissionMapper.getPermissionsByUserName(username);
    for (Permission permission : permissionsList) {
        authorizationInfo.addStringPermission(permission.getSn());
    }
    authorizationInfo.setRoles(roles);
    return authorizationInfo;
}
     
    
   

总结

通过这种方法，动态生成菜单栏的优点非常明显：只需在数据库中添加数据即可，无需手动管理Shiro标签，减少页面臃肿，提高可维护性。如果需要更具体的实现细节，可以参考全文获取完整代码。