SpringMVC+Spring Data JPA+Shiro+EasyUI简单权限管理系统

概述

一直想做一个管理系统，希望它简洁，能做一个demo使用。以后在研究学习的时候，可以在此基础上增加代码。我觉得权限管理系统很值得做，因为涉及关系数据库模式的设计，能学到很多东西。万事开头难，先做个简单的，以后再慢慢完善的。任何事情关键是要做，不能停留在想。

前端

由于之前没有多少前端编程经验，所以做起前端比较吃力。之前前端使用Bootstrap，发现需要自己编写很多前端代码，虽然花费了很多时间，但是页面做起来还是很难看。后来前端选择了EasyUI，发现特别适合做管理页面，也容易上手。当然每个框架都有其局限性，后面使用多了就知道了，就是EasyUI不够灵活，但是现在先用着，以后再选择换其他的。EasyUI官网http://www.jeasyui.com/

MVC

使用主流的SpringMVC，不但功能强大，用起来比较简单方便。
SpringMVC推荐学习网站http://www.iteye.com/blogs/subjects/kaitao-springmvc

持久化

使用Spring Data JPA。这个框架真的很赞，对于简单的业务逻辑，基本不用些SQL代码。最重要的是可以根据接口名自动生成SQL代码，极大的提高了开发效率。参考http://www.ibm.com/developerworks/cn/opensource/os-cn-spring-jpa
同时也配置了Hibernate，虽然现在还没是用，但准备后期和Spring Data JPA配合是用。

权限管理

选择Shiro，简单好用，容易上手。推荐学习网站http://www.iteye.com/blogs/subjects/shiro
权限模型了解http://blog.csdn.net/painsonline/article/details/7183613/

使用预览

注册

登录

管理后台

设置角色

授权

实体层

以下只是展示了部分关键代码

用户

用户和角色是N-N的关系。

@Entity@Table(name = "sys_user")public class User implements Serializable {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id; // 编号    // 这里不能用CascadeType.ALL    @ManyToMany(targetEntity = Role.class, cascade = CascadeType.MERGE, fetch = FetchType.EAGER)    @JoinTable(name = "sys_user_role", joinColumns = @JoinColumn(name = "user_id", referencedColumnName = "id") , inverseJoinColumns = @JoinColumn(name = "role_id", referencedColumnName = "id") )    private Set<Role> roles = new HashSet<>();    @Column(unique = true)    private String username; // 用户名    private String password; // 密码    private String salt; // 加密密码的盐    private Boolean locked = Boolean.FALSE;    private String email;    @Column(name = "create_date")    @Temporal(TemporalType.TIMESTAMP)    private Date createDate = new Date();....

角色

@Entity@Table(name = "sys_role")public class Role implements Serializable {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id; // 编号    @OneToMany(targetEntity = Permission.class, cascade = CascadeType.REFRESH, fetch = FetchType.EAGER)    @JoinTable(name = "sys_role_permission", joinColumns = @JoinColumn(name = "role_id", referencedColumnName = "id") , inverseJoinColumns = @JoinColumn(name = "permission_id", referencedColumnName = "id", unique = true) )    private List<Permission> permissions = new ArrayList<>();    private String name;    @Column(unique = true)    private String role; // 角色标识 程序中判断使用,如"admin"    private String description; // 角色描述,UI界面显示使用  

权限

权限是资源和操作的组合。也就是说一个权限意味着对一个资源的多个操作。

@Entity@Table(name = "sys_permission")public class Permission implements Serializable {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id;    @OneToOne(targetEntity = Resource.class, cascade = CascadeType.REFRESH, fetch = FetchType.EAGER)    @JoinColumn(name = "resource_id", referencedColumnName = "id")    private Resource resource;    @ManyToMany(targetEntity = Operation.class, cascade = CascadeType.REFRESH, fetch = FetchType.EAGER)    @JoinTable(name = "sys_permission_operation", joinColumns = @JoinColumn(name = "permission_id", referencedColumnName = "id") , inverseJoinColumns = @JoinColumn(name = "operation_id", referencedColumnName = "id") )    private Set<Operation> operations = new HashSet<>();    private String name;    private String description; 

资源

@Entity@Table(name = "sys_resource")public class Resource implements Serializable {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id; // 编号    private String name; // 资源名称    @Column(unique = true)    private String identity;// 资源类型 

操作

@Entity@Table(name = "sys_operation")public class Operation implements Serializable {    @Id    @GeneratedValue(strategy = GenerationType.IDENTITY)    private Long id; // 编号    private String name; // 操作名称    @Column(unique = true)    private String operation;// 操作标识    private String description;  

简洁易用的Spring Data JPA

Spring Data可以通过解析方法名创建查询。比如方法是findByUsername(String username),则Spring Data会自动生成SQL语句select * from 表名 where username= username.所以你对于简单的操作，你只要按照Srping Data约定写出对应的方法名，Spring Data就能自动创建SQL语句，基本不需要你写SQL语句。

一般定义DAO层时，继承一个Spring Data的基本接口，比如JpaRepository，该接口能可以帮你实现增删查改的功能外，还可以帮你做分页查询和排序。

import org.springframework.data.jpa.repository.JpaRepository;import com.myweb.entity.User;public interface UserDao extends JpaRepository<User, Long> {    User findByUsername(String username);} 

使用时，直接注入就可以了

    @Inject    private UserDao userDao; 

Shiro认证与授权

shiro比Spring Security简单，在实现认证授权的时候，继承一个Realm类然后扩展，这里使用AuthorizingRealm。
Realm在shiro中类似数据源，认证和授权的数据就依靠它。

public class UserRealm extends AuthorizingRealm {    @Inject    private UserService userService;    @Inject    private UserDao userDao;    @Override    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {        // 授权        String username = (String) principals.getPrimaryPrincipal();        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();        authorizationInfo.setRoles(userService.getStringRoles(username));        authorizationInfo.setStringPermissions(userService.getStringPermissions(username));        return authorizationInfo;    }    @Override    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)            throws AuthenticationException {        // 认证        String username = (String) authenticationToken.getPrincipal();        User user = userDao.findByUsername(username);        // 查出是否有此用户        if (user == null) {            throw new UnknownAccountException();// 没找到帐号        }        if (Boolean.TRUE.equals(user.getLocked())) {            throw new LockedAccountException(); // 帐号锁定        }        // 交给AuthenticatingRealm使用CredentialsMatcher进行密码匹配，如果觉得人家的不好可以自定义实现        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user.getUsername(),                user.getPassword(), ByteSource.Util.bytes(user.getCredentialsSalt()), getName());        return authenticationInfo;    }} 

认证

需要SecurityUtils返回一个Subject，然后通过用户名和密码创建Token，使用这个Token登录验证。Subject 是 Shiro 的核心对象，基本所有身份验证、授权都是通过 Subject 完成。

  @RequestMapping(value = "/login", method = RequestMethod.POST)    public ModelAndView login(User user) {        ModelAndView mv = new ModelAndView();        try {            Subject subject = SecurityUtils.getSubject();            UsernamePasswordToken authenticationToken = new UsernamePasswordToken(user.getUsername(),                    user.getPassword());            subject.login(authenticationToken);        } catch (AuthenticationException e) {            e.printStackTrace();            mv.setViewName("redirect:/unauthorized");            return mv;        }        mv.setViewName("redirect:/index");        return mv;    } 

授权

采用注解形式，简单方便

    @RequiresPermissions("user:create")    @RequestMapping(value = "/save", method = RequestMethod.POST)    @ResponseBody    public String saveUser(@RequestParam String username, @RequestParam String password, @RequestParam String email,            @RequestParam(value = "roles", required = false) List<Long> roleIds) {        User user = new User();        user.setUsername(username);        user.setPassword(password);        user.setEmail(email);        List<Role> roles = roleDao.findAll(roleIds);        user.setRoles(new HashSet<>(roles));        userService.save(user);        return "OK";    }

支持注解需要配置

    <!-- Enable Shiro Annotations for Spring-configured beans. Only run after -->    <!-- the lifecycleBeanProcessor has run: -->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">        <property name="securityManager" ref="securityManager" />    </bean> 

XML配置

项目整体配置

web.xml:

<?xml version="1.0" encoding="UTF-8"?><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"    id="WebApp_ID" version="3.0">    <display-name>myweb</display-name>    <welcome-file-list>        <welcome-file>/WEB-INF/jsp/login.jsp</welcome-file>    </welcome-file-list>    <!-- 加载所有的配置文件 -->    <context-param>        <param-name>contextConfigLocation</param-name>        <param-value>classpath*:config/spring-*.xml</param-value>    </context-param>    <!-- 配置Spring监听 -->    <listener>        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>    </listener>    <!-- 配置字符集 -->    <filter>        <filter-name>encodingFilter</filter-name>        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>        <init-param>            <param-name>encoding</param-name>            <param-value>UTF-8</param-value>        </init-param>        <init-param>            <param-name>forceEncoding</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>encodingFilter</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping>    <!-- 配置Session -->    <filter>        <filter-name>openSession</filter-name>        <filter-class>org.springframework.orm.hibernate4.support.OpenSessionInViewFilter</filter-class>        <init-param>            <param-name>singleSession</param-name>            <param-value>true</param-value>        </init-param>        <init-param>            <param-name>flushMode</param-name>            <param-value>AUTO</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>openSession</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping>    <!-- 配置SpringMVC -->    <servlet>        <description>myweb</description>        <display-name>myweb</display-name>        <servlet-name>springMVC</servlet-name>        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>        <init-param>            <param-name>contextConfigLocation</param-name>            <param-value>classpath*:config/spring-mvc.xml</param-value>        </init-param>        <load-on-startup>1</load-on-startup>    </servlet>    <servlet-mapping>        <servlet-name>springMVC</servlet-name>        <url-pattern>/</url-pattern>    </servlet-mapping>    <!-- 配置shiro -->    <filter>        <filter-name>shiroFilter</filter-name>        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>        <init-param>            <param-name>targetFilterLifecycle</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>shiroFilter</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping></web-app> 

配置SpringMVC

spring-mvc.xml:

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context" xmlns:mvc="http://www.springframework.org/schema/mvc"    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx" xmlns:jpa="http://www.springframework.org/schema/data/jpa"    xsi:schemaLocation="http://www.springframework.org/schema/beans     http://www.springframework.org/schema/beans/spring-beans.xsd    http://www.springframework.org/schema/context     http://www.springframework.org/schema/context/spring-context-3.0.xsd    http://www.springframework.org/schema/aop    http://www.springframework.org/schema/aop/spring-aop-3.0.xsd    http://www.springframework.org/schema/tx     http://www.springframework.org/schema/tx/spring-tx-3.0.xsd    http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc.xsd    http://www.springframework.org/schema/data/jpa    http://www.springframework.org/schema/data/jpa/spring-jpa.xsd">    <!-- 开启Spring MVC注解 -->    <mvc:annotation-driven />    <!-- 静态资源映射 -->    <mvc:resources mapping="/static/**" location="/WEB-INF/static/" />    <mvc:resources mapping="/html/**" location="/WEB-INF/html/" />    <!-- 打开Spring的Annotation支持 -->    <context:annotation-config />    <!-- 注解扫描包 -->    <context:component-scan base-package="com.myweb.controller" />    <context:component-scan base-package="com.myweb.dao.imp" />    <context:component-scan base-package="com.myweb.service.imp" />    <context:component-scan base-package="com.myweb.security.util" />    <!-- 配置SessionFactory -->    <bean id="sessionFactory" class="org.springframework.orm.hibernate4.LocalSessionFactoryBean">        <!-- <property name="dataSource" ref="dataSource" /> -->        <property name="configLocation" value="classpath:config/hibernate.cfg.xml" />        <property name="packagesToScan" value="com.myweb.entity" />    </bean>    <!-- 配置Dao要注入的hibernateTemplate -->    <bean id="hibernateTemplate" class="org.springframework.orm.hibernate4.HibernateTemplate">        <property name="sessionFactory" ref="sessionFactory" />    </bean>    <!-- 配置Spring的事务处理 -->    <!-- 创建事务管理器 -->    <bean id="txManager" class="org.springframework.orm.hibernate4.HibernateTransactionManager">        <property name="sessionFactory" ref="sessionFactory" />    </bean>    <!-- 配置AOP，Spring是通过AOP来进行事务管理的 -->    <aop:config>        <!-- 设置pointCut表示哪些方法要加入事务处理 -->        <!-- 以下的事务是声明在DAO中，但是通常都会在Service来处理多个业务对象逻辑的关系，注入删除，更新等，此时如果在执行了一个步骤之后抛出异常 就会导致数据不完整，所以事务不应该在DAO层处理，而应该在service，这也就是Spring所提供的一个非常方便的工具，声明式事务 -->        <aop:pointcut id="allMethods" expression="execution(* com.myweb.service.imp.*.*(..))" />        <!-- 通过advisor来确定具体要加入事务控制的方法 -->        <aop:advisor advice-ref="txAdvice" pointcut-ref="allMethods" />    </aop:config>    <!-- 配置哪些方法要加入事务控制 -->    <tx:advice id="txAdvice" transaction-manager="txManager">        <tx:attributes>            <!-- 让所有的方法都加入事务管理，为了提高效率，可以把一些查询之类的方法设置为只读的事务 -->            <tx:method name="find*" propagation="REQUIRED" read-only="true" />            <!-- 以下方法都是可能设计修改的方法，就无法设置为只读 -->            <tx:method name="add*" propagation="REQUIRED" />            <tx:method name="del*" propagation="REQUIRED" />            <tx:method name="update*" propagation="REQUIRED" />            <tx:method name="save*" propagation="REQUIRED" />        </tx:attributes>    </tx:advice>    <!-- 开启事务注解 -->    <tx:annotation-driven />    <!-- 默认的视图解析器ViewResolver -->    <bean id="defaultViewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver">        <property name="prefix" value="/WEB-INF/jsp/" />        <property name="suffix" value=".jsp" />    </bean>    <!-- JPA -->    <jpa:repositories base-package="com.myweb.dao" repository-impl-postfix="Impl" entity-manager-factory-ref="entityManagerFactory" transaction-manager-ref="transactionManager">    </jpa:repositories>    <bean id="entityManagerFactory" class="org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean">        <property name="dataSource" ref="dataSource" />        <property name="packagesToScan" value="com.myweb.entity" />        <property name="persistenceProvider">            <bean class="org.hibernate.ejb.HibernatePersistence" />        </property>        <property name="jpaVendorAdapter">            <bean class="org.springframework.orm.jpa.vendor.HibernateJpaVendorAdapter">                <property name="generateDdl" value="false" />                <property name="database" value="MYSQL" />                <property name="databasePlatform" value="org.hibernate.dialect.MySQL5InnoDBDialect" />                <property name="showSql" value="true" />            </bean>        </property>        <property name="jpaDialect">            <bean class="org.springframework.orm.jpa.vendor.HibernateJpaDialect" />        </property>        <property name="jpaPropertyMap">            <map>                <entry key="hibernate.query.substitutions" value="true 1, false 0" />                <entry key="hibernate.default_batch_fetch_size" value="16" />                <entry key="hibernate.max_fetch_depth" value="2" />                <entry key="hibernate.generate_statistics" value="true" />                <entry key="hibernate.bytecode.use_reflection_optimizer" value="true" />                <entry key="hibernate.cache.use_second_level_cache" value="false" />                <entry key="hibernate.cache.use_query_cache" value="false" />            </map>        </property>    </bean>    <!--事务管理器配置 -->    <bean id="transactionManager" class="org.springframework.orm.jpa.JpaTransactionManager">        <property name="entityManagerFactory" ref="entityManagerFactory" />    </bean>    <bean name="dataSource" class="org.apache.commons.dbcp.BasicDataSource">        <property name="driverClassName">            <value>com.mysql.jdbc.Driver</value>        </property>        <property name="url">            <value>jdbc:mysql://localhost:3306/myweb</value>        </property>        <property name="username">            <value>root</value>        </property>        <property name="password" value="jiangyu" />    </bean>    <bean class="org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter">        <property name="messageConverters">            <list>                <ref bean="mappingJacksonHttpMessageConverter" />            </list>        </property>    </bean>    <bean id="mappingJacksonHttpMessageConverter" class="org.springframework.http.converter.json.MappingJackson2HttpMessageConverter">        <property name="supportedMediaTypes">            <list>                <value>apolication/json; charset=UTF-8</value>            </list>        </property>    </bean>    <mvc:annotation-driven>        <mvc:argument-resolvers>            <bean class="com.myweb.controller.CurrentUserMethodArgumentResolver" />        </mvc:argument-resolvers>    </mvc:annotation-driven></beans> 

shiro在Spring配置

spring-shiro-web.xml:

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans" xmlns:util="http://www.springframework.org/schema/util" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xsi:schemaLocation="       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd       http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">   <!-- 凭证匹配器 -->    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">        <property name="hashAlgorithmName" value="md5" />        <property name="hashIterations" value="2" />        <property name="storedCredentialsHexEncoded" value="true" />    </bean>    <!-- Realm实现 -->    <bean id="userRealm" class="com.myweb.security.realm.UserRealm">        <property name="credentialsMatcher" ref="credentialsMatcher" />    </bean>    <!-- 安全管理器 -->    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">        <property name="realm" ref="userRealm" />    </bean>    <!-- Shiro的Web过滤器 ,id要与web.xml一致 -->    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">        <property name="securityManager" ref="securityManager" />        <property name="loginUrl" value="/api/user/login.page" />        <property name="successUrl" value="/index" />        <property name="unauthorizedUrl" value="/unauthorized" />        <property name="filterChainDefinitions">            <value>                /static/** = anon                /api/user/login = anon                /api/user/register* = anon                /unauthorized = anon                /** = authc            </value>        </property>    </bean>    <!-- Shiro生命周期处理器 -->    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />    <!-- Enable Shiro Annotations for Spring-configured beans. Only run after -->    <!-- the lifecycleBeanProcessor has run: -->    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">        <property name="securityManager" ref="securityManager" />    </bean></beans> 

hibernate配置

hibernate.cfg.xml

<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE hibernate-configuration PUBLIC        "-//Hibernate/Hibernate Configuration DTD 3.0//EN"        "http://www.hibernate.org/dtd/hibernate-configuration-3.0.dtd"><hibernate-configuration>    <session-factory>        <property name="hibernate.dialect">            org.hibernate.dialect.MySQLDialect        </property>        <property name="hibernate.connection.driver_class">            com.mysql.jdbc.Driver        </property>        <property name="hibernate.connection.url">            jdbc:mysql://localhost/myweb        </property>        <property name="hibernate.connection.username">            root        </property>        <property name="hibernate.connection.password">            jiangyu        </property>        <property name="hibernate.temp.use_jdbc_metadata_defaults">false</property>        <!-- ddl语句自动建表 -->        <property name="hbm2ddl.auto">update</property>        <property name="show_sql">true</property>        <property name="format_sql">true</property>        <property name="jdbc.fetch_size">50</property>        <property name="jdbc.batch_size">30</property>        <property name="hibernate.connection.provider_class">org.hibernate.connection.C3P0ConnectionProvider</property>        <property name="hibernate.c3p0.acquireRetryAttempts">30</property>        <property name="hibernate.c3p0.acquireIncrement">2</property>        <property name="hibernate.c3p0.checkoutTimeout">30000</property>        <property name="hibernate.c3p0.idleConnectionTestPeriod">120</property>        <property name="hibernate.c3p0.maxIdleTime">180</property>        <property name="hibernate.c3p0.initialPoolSize">3</property>        <property name="hibernate.c3p0.maxPoolSize">50</property>        <property name="hibernate.c3p0.minPoolSize">1</property>        <property name="hibernate.c3p0.maxStatements">0</property>        <!-- XML配置映射关系 <mapping resource="Employee.hbm.xml" /> -->        <!-- 注册ORM映射文件 -->        <!-- spring不起作用 <mapping package="com.myweb.entity"/> -->    </session-factory></hibernate-configuration> 

其他说明

超级管理员用户名/密码：admin/123456。
数据库导入文件：/myweb/src/main/resources/SQL/myweb.sql
源码：https://github.com/Jdoing/myweb