Dubbo 用户权限管理设计
Dubbo 用户权限数据库设计
根据RBAC角色权限方案来满足我们实际的业务情况作出表的调整
以下是表结构
CREATE TABLE `upms_organization` (
`organization_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`pid` int(10) DEFAULT NULL COMMENT '所属上级',
`fid` int(10) DEFAULT NULL COMMENT '所属最上级',
`name` varchar(20) DEFAULT NULL COMMENT '组织名称',
`description` varchar(1000) DEFAULT NULL COMMENT '组织描述',
`ctime` bigint(20) DEFAULT NULL COMMENT '创建时间',
`code` varchar(255) DEFAULT NULL COMMENT '编码',
PRIMARY KEY (`organization_id`)
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=utf8mb4 COMMENT='组织';
CREATE TABLE `upms_permission` (
`permission_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`system_id` int(10) unsigned NOT NULL COMMENT '所属系统',
`pid` int(10) DEFAULT NULL COMMENT '所属上级',
`name` varchar(20) DEFAULT NULL COMMENT '名称',
`type` tinyint(4) DEFAULT NULL COMMENT '类型(1:目录,2:菜单,3:按钮)',
`permission_value` varchar(50) DEFAULT NULL COMMENT '权限值',
`uri` varchar(100) DEFAULT NULL COMMENT '路径',
`icon` varchar(50) DEFAULT NULL COMMENT '图标',
`status` tinyint(4) DEFAULT NULL COMMENT '状态(0:禁止,1:正常)',
`ctime` bigint(20) DEFAULT NULL COMMENT '创建时间',
`orders` bigint(20) DEFAULT NULL COMMENT '排序',
PRIMARY KEY (`permission_id`)
) ENGINE=InnoDB AUTO_INCREMENT=95 DEFAULT CHARSET=utf8mb4 COMMENT='权限';
CREATE TABLE `upms_role` (
`role_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`name` varchar(20) DEFAULT NULL COMMENT '角色名称',
`title` varchar(20) DEFAULT NULL COMMENT '角色标题',
`data_scope` char(1) DEFAULT NULL COMMENT '数据范围',
`description` varchar(1000) DEFAULT NULL COMMENT '角色描述',
`ctime` bigint(20) NOT NULL COMMENT '创建时间',
`orders` bigint(20) NOT NULL COMMENT '排序',
PRIMARY KEY (`role_id`)
) ENGINE=InnoDB AUTO_INCREMENT=10 DEFAULT CHARSET=utf8mb4 COMMENT='角色';
CREATE TABLE `upms_role_permission` (
`role_permission_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`role_id` int(10) unsigned NOT NULL COMMENT '角色编号',
`permission_id` int(10) unsigned NOT NULL COMMENT '权限编号',
PRIMARY KEY (`role_permission_id`),
KEY `FK_Reference_23` (`role_id`),
CONSTRAINT `FK_Reference_23` FOREIGN KEY (`role_id`) REFERENCES `upms_role` (`role_id`)
) ENGINE=InnoDB AUTO_INCREMENT=135 DEFAULT CHARSET=utf8mb4 COMMENT='角色权限关联表';
CREATE TABLE `upms_system` (
`system_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`icon` varchar(50) DEFAULT NULL COMMENT '图标',
`banner` varchar(50) DEFAULT NULL COMMENT '背景',
`theme` varchar(50) DEFAULT NULL COMMENT '主题',
`basepath` varchar(100) DEFAULT NULL COMMENT '根目录',
`status` tinyint(4) DEFAULT NULL COMMENT '状态(-1:黑名单,1:正常)',
`name` varchar(20) DEFAULT NULL COMMENT '系统名称',
`title` varchar(20) DEFAULT NULL COMMENT '系统标题',
`description` varchar(300) DEFAULT NULL COMMENT '系统描述',
`ctime` bigint(20) DEFAULT NULL COMMENT '创建时间',
`orders` bigint(20) DEFAULT NULL COMMENT '排序',
PRIMARY KEY (`system_id`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8mb4 COMMENT='系统';
CREATE TABLE `upms_user` (
`user_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`username` varchar(20) NOT NULL COMMENT '帐号',
`password` varchar(32) NOT NULL COMMENT '密码MD5(密码+盐)',
`salt` varchar(32) DEFAULT NULL COMMENT '盐',
`realname` varchar(20) DEFAULT NULL COMMENT '姓名',
`avatar` varchar(50) DEFAULT NULL COMMENT '头像',
`phone` varchar(20) DEFAULT NULL COMMENT '电话',
`email` varchar(50) DEFAULT NULL COMMENT '邮箱',
`sex` tinyint(4) DEFAULT NULL COMMENT '性别',
`locked` tinyint(4) DEFAULT NULL COMMENT '状态(0:正常,1:锁定)',
`ctime` bigint(20) DEFAULT NULL COMMENT '创建时间',
PRIMARY KEY (`user_id`)
) ENGINE=InnoDB AUTO_INCREMENT=13 DEFAULT CHARSET=utf8mb4 COMMENT='用户';
CREATE TABLE `upms_user_organization` (
`user_organization_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`user_id` int(10) unsigned NOT NULL COMMENT '用户编号',
`organization_id` int(10) unsigned NOT NULL COMMENT '组织编号',
PRIMARY KEY (`user_organization_id`)
) ENGINE=InnoDB AUTO_INCREMENT=34 DEFAULT CHARSET=utf8mb4 COMMENT='用户组织关联表';
CREATE TABLE `upms_user_permission` (
`user_permission_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`user_id` int(10) unsigned NOT NULL COMMENT '用户编号',
`permission_id` int(10) unsigned NOT NULL COMMENT '权限编号',
`type` tinyint(4) NOT NULL COMMENT '权限类型(-1:减权限,1:增权限)',
PRIMARY KEY (`user_permission_id`)
) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4 COMMENT='用户权限关联表';
CREATE TABLE `upms_user_role` (
`user_role_id` int(10) unsigned NOT NULL AUTO_INCREMENT COMMENT '编号',
`user_id` int(10) unsigned NOT NULL COMMENT '用户编号',
`role_id` int(10) DEFAULT NULL COMMENT '角色编号',
PRIMARY KEY (`user_role_id`)
) ENGINE=InnoDB AUTO_INCREMENT=21 DEFAULT CHARSET=utf8mb4 COMMENT='用户角色关联表';
权限在 Shiro 中的配置
上篇中已经说明 Shiro 权限赋予类 UpmsRealm
/**
* 用户认证和授权
*/
public class UpmsRealm extends AuthorizingRealm {
private static Logger _log = LoggerFactory.getLogger(UpmsRealm.class);
@Autowired
private UpmsApiService upmsApiService;
/**
* 授权：验证权限时调用
* @param principalCollection
* @return
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
String username = (String) principalCollection.getPrimaryPrincipal();
UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);
// 当前用户所有角色
List<UpmsRole> upmsRoles = upmsApiService.selectUpmsRoleByUpmsUserId(upmsUser.getUserId());
Set<String> roles = new HashSet<>();
for (UpmsRole upmsRole : upmsRoles) {
if (StringUtils.isNotBlank(upmsRole.getName())) {
roles.add(upmsRole.getName());
}
}
// 当前用户所有权限(包括权限资源表的增加和减少的资源赋权)
List<UpmsPermission> upmsPermissions = upmsApiService.selectUpmsPermissionByUpmsUserId(upmsUser.getUserId());
Set<String> permissions = new HashSet<>();
for (UpmsPermission upmsPermission : upmsPermissions) {
if (StringUtils.isNotBlank(upmsPermission.getPermissionValue())) {
permissions.add(upmsPermission.getPermissionValue());
}
}
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
simpleAuthorizationInfo.setStringPermissions(permissions);
simpleAuthorizationInfo.setRoles(roles);
return simpleAuthorizationInfo;
}
/**
* 认证：登录时调用
* @param authenticationToken
* @return
* @throws AuthenticationException
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
String username = (String) authenticationToken.getPrincipal();
String password = new String((char[]) authenticationToken.getCredentials());
// client无密认证
String upmsType = PropertiesFileUtil.getInstance("tudou-upms-client").get("tudou.upms.type");
if ("client".equals(upmsType)) {
return new SimpleAuthenticationInfo(username, password, getName());
}
// 查询用户信息
UpmsUser upmsUser = upmsApiService.selectUpmsUserByUsername(username);
if (null == upmsUser) {
throw new UnknownAccountException();
}
String md5 = MD5Util.MD5(password + upmsUser.getSalt());
if (!upmsUser.getPassword().equals(md5)) {
throw new IncorrectCredentialsException();
}
if (upmsUser.getLocked() == 1) {
throw new LockedAccountException();
}
return new SimpleAuthenticationInfo(username, password, getName());
}
}
效果
