一、SimpleAccountRealm

public class AuthenticationTest {

SimpleAccountRealm sar=new SimpleAccountRealm();

@Before

public void addUser() {

sar.addAccount("mark", "123456","admin","user");

}

@Test

public void testAuthentication() {

//1.构建seruritymanager环境

DefaultSecurityManager dsm=new DefaultSecurityManager();

dsm.setRealm(sar);

//2.主题提交认证请求

SecurityUtils.setSecurityManager(dsm);

Subject subject=SecurityUtils.getSubject();

UsernamePasswordToken token=new UsernamePasswordToken("mark","123456");

subject.login(token);

System.out.println("isAuthenticated:"+subject.isAuthenticated());

subject.checkRoles("admin","user");

}

二.IniRealm

public class IniRealmTest {

@Test

public void testIniRealm() {

IniRealm realm=new IniRealm("classpath:user.ini");

DefaultSecurityManager defaultSerurityManager=new DefaultSecurityManager();

defaultSerurityManager.setRealm(realm);

SecurityUtils.setSecurityManager(defaultSerurityManager);

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken upt=new UsernamePasswordToken("mark","123456");

subject.login(upt);

System.out.println("isAuthentication:"+subject.isAuthenticated());

subject.checkRole("admin");

subject.checkPermission("user:update");

}

三、JDBCRealm

public class JDBCRealmTest {

DruidDataSource dataSource=new DruidDataSource();

{

dataSource.setUrl("jdbc:mysql://localhost:3306/xxxx");

dataSource.setUsername("root");

dataSource.setPassword("root");

}

@Test

public void testJDBCRealm() {

JdbcRealm realm=new JdbcRealm();

realm.setDataSource(dataSource);

realm.setPermissionsLookupEnabled(true);

//如果不用自己的sql，数据库表名必须与shiro默认的查询语句中的一致，一般情况下都是使用自定义的sql，如下：

String sql="select password from test_user where user_name=?";

realm.setAuthenticationQuery(sql);

String roleSql="select role_name from test_user_roles where user_name=?";

realm.setUserRolesQuery(roleSql);

String permissionSql="select permission from test_roles_permissions where role_name=?";

realm.setPermissionsQuery(permissionSql);

DefaultSecurityManager dsm=new DefaultSecurityManager();

dsm.setRealm(realm);

SecurityUtils.setSecurityManager(dsm);

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token=new UsernamePasswordToken("xm","123");

subject.login(token);

System.out.println("isAuthencation:"+subject.isAuthenticated());

subject.checkRole("admin");

subject.checkRoles("admin","user");

subject.checkPermission("user:delete");

}

四、自定义Realm

public class customRealmTest {

@Test

public void testCustomRealm() {

CustomRealm realm=new CustomRealm();

DefaultSecurityManager sdm=new DefaultSecurityManager();

sdm.setRealm(realm);

HashedCredentialsMatcher hcm=new HashedCredentialsMatcher();

hcm.setHashAlgorithmName("md5");

hcm.setHashIterations(1);

realm.setCredentialsMatcher(hcm);

SecurityUtils.setSecurityManager(sdm);

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token=new UsernamePasswordToken("mark","123456");

subject.login(token);

System.out.println("isAuthencation:"+subject.isAuthenticated());

subject.checkRole("admin");

subject.checkRoles("admin","user");

subject.checkPermission("user:delete");

}

public class CustomRealm extends AuthorizingRealm {

Map<String, String> userMap=new HashMap<>();

{

//模拟数据库中查询出的数据

userMap.put("mark", "73bea81c6c06bacab41a995495239545");

super.setName("customReal");

}

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String userName = (String) principals.getPrimaryPrincipal();

//通过用户名获取数据库或缓存中的角色

Set<String> roles=getRolesByUserName(userName);

Set<String> premissions=getpremissionsByUserName(userName);

SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();

info.setStringPermissions(premissions);

info.setRoles(roles);

return info;

}

private Set<String> getpremissionsByUserName(String userName) {

Set<String> permission=new HashSet<>();

permission.add("user:delete");

return permission;

}

private Set<String> getRolesByUserName(String userName) {

Set<String> roles=new HashSet<>();

roles.add("admin");

roles.add("user");

return roles;

}

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

//1.通过主体传过来的信息获取用户名

String userName=(String) token.getPrincipal();

//2.通过用户名去数据库获取凭证

String password=getPassowrdByUserName(userName);

if(password==null) {

return null;

}

SimpleAuthenticationInfo info=new SimpleAuthenticationInfo("mark",password,"customReal");

//加盐--如果数据库中密码是加盐密文，此处应该设置盐的值

info.setCredentialsSalt(ByteSource.Util.bytes("mark"));

return info;

}

private String getPassowrdByUserName(String userName) {

//实际中去查数据库这个方便演示

return userMap.get(userName);

}

public static void main(String[] args) {

System.out.println((int)(1+Math.random()*10));

// Md5Hash hsh=new Md5Hash("123456"); //md5加密

Md5Hash hsh=new Md5Hash("123456","mark"); //MD5加密并加盐更安全

System.out.println(hsh);

}

巴特西

shiro权限认证Realm的四大用法

一、SimpleAccountRealm

二.IniRealm

三、JDBCRealm

四、自定义Realm

最新文章

热门文章