Shiro权限控制,获取当前登录用户信息

怼烎@ 2023-01-01 14:48 461阅读 0赞

1.在自定义 UserRealm，doGetAuthenticationInfo 方法中 ，设置 登录用户userInfo

return new SimpleAuthenticationInfo(userInfo, token, "userRealm");

>  
> 
>     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {
>         // 获取到token
>         String token = (String) auth.getCredentials();
>         String account = JwtUtil.getClaim(token, CommonConstant.ACCOUNT);
>         if (StringUtils.isEmpty(account)) {
>             throw new AuthenticationException("token错误!");
>         }
>         User user = userService.getByUserName(account);
>         UserInfo userInfo = new UserInfo();
>         userInfo.setUserName(user.getUserName());
>         userInfo.setId(user.getId());
>         userInfo.setTel(user.getTel());
>         if (user == null) {
>             throw new UnknownAccountException("账号不存在！");
>         }
>         if (user.getStatus() != null && "0".equals(user.getStatus())) {
>             throw new LockedAccountException("帐号已被锁定，禁止登录！");
>         }
>         try {
>             // 开始认证，要AccessToken认证通过，且Redis中存在RefreshToken，且两个Token时间戳一致
>             if (JwtUtil.verify(token) && RedisUtil.hasKey(CommonConstant.PREFIX_SHIRO_REFRESH_TOKEN + account)) {
>                 // Redis中RefreshToken还存在，获取RefreshToken的时间戳
>                 Object currentTimeMillisRedis = RedisUtil.get(CommonConstant.PREFIX_SHIRO_REFRESH_TOKEN + account);
>                 // 获取AccessToken时间戳，与RefreshToken的时间戳对比
>                 if (JwtUtil.getClaim(token, CommonConstant.CURRENT_TIME_MILLIS).equals(currentTimeMillisRedis.toString())) {
>                     return new SimpleAuthenticationInfo(userInfo, token, "userRealm");
>                 } else {
>                     throw new AuthenticationException("token认证失败!");
>                 }
>             } else {
>                 throw new AuthenticationException("token认证失败!");
>             }
>         } catch (TokenExpiredException e) {
>             throw new AuthenticationException("token已过期!");
>         } catch (SignatureVerificationException e) {
>             throw new AuthenticationException("密码不正确!");
>         }
>     
>     }

2. UserInfo login = (UserInfo) SecurityUtils.getSubject().getPrincipal(); 获取 登录对象

>  
> 
>     /**
>      * 添加
>      *
>      * @param resource
>      * @return
>      */
>     @PostMapping("/add")
>     public RestResponse<Resource> addOne(@RequestBody Resource resource) {
>         UserInfo login = (UserInfo) SecurityUtils.getSubject().getPrincipal();
>         resource.setCreateBy(login.getUserName());
>         try {
>             return RestResponse.success(resourceService.addOne(resource));
>         } catch (Exception e) {
>             e.printStackTrace();
>             log.error(e.getMessage());
>             return RestResponse.fail(e.getMessage());
>         }
>     
>     }
> 
>