SpringBoot整合Shiro完成认证

三、`SpringBoot`整合`Shiro`思路

首先从客户端发来的所有请求都经过Shiro过滤器，如果用户没有认证的都打回去进行认证，认证成功的，再判断是否具有访问某类资源(公有资源，私有资源)的权限，如果没有权限，访问失败;如果有权限访问成功。注意：客户端传来的token要和realm中的认证信息进行相同规则的比较（加密算法要一致）。

shiro常见的过滤器

Filter Name	Class	功能
anon	org.apache.shiro.web.filter.authc.AnonymousFilter	指定url可以匿名访问
authc	org.apache.shiro.web.filter.authc.FormAuthenticationFilter	指定url需要form表单登录，默认会请求username、password。rememberMe等参数并尝试登录，如果登录不了就会跳转到loginUrl配置的路径。我们也可以用这个过滤器设置默认的路径。
authcBasic	org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter	指定url需要http认证
authcBearer	org.apache.shiro.web.filter.authc.BearerHttpAuthenticationFilter	需要用户认证成功才能访资源否则就通过http请求登录
logout	org.apache.shiro.web.filter.authc.LogoutFilter	登出过滤器，配置URL实现退出登录的功能。
noSessionCreation	org.apache.shiro.web.filter.session.NoSessionCreationFilter	禁止创建会话
perms	org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter	指定权限才能访问
port	org.apache.shiro.web.filter.authz.PortFilter	指定端口才能访问
rest	org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter	将HTPP请求方法转化成权限字符串
roles	org.apache.shiro.web.filter.authz.RolesAuthorizationFilter	指定角色才能访问
ssl	org.apache.shiro.web.filter.authz.SslFilter	需要https请求才能访问
user	org.apache.shiro.web.filter.authc.UserFilter	需要已登录或者`记住我`的用户才能访问

`SpringBoot`整合`Shiro`实现认证

没有加密版

1、首先创建SpringBoot应用，勾选web模块

2、然后导入SpringBoot与shiro整合的依赖

<dependencies>

    <dependency>

        <groupId>org.apache.tomcat.embed</groupId>

        <artifactId>tomcat-embed-jasper</artifactId>

    </dependency>

    <dependency>

        <groupId>jstl</groupId>

        <artifactId>jstl</artifactId>

        <version>1.2</version>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>

    <!--引入SpringBoot与shiro整合的依赖-->

    <dependency>

        <groupId>org.apache.shiro</groupId>

        <artifactId>shiro-spring-boot-starter</artifactId>

        <version>1.5.3</version>

    </dependency>

    <dependency>

        <groupId>org.projectlombok</groupId>

        <artifactId>lombok</artifactId>

        <optional>true</optional>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-test</artifactId>

        <scope>test</scope>

        <exclusions>

            <exclusion>

                <groupId>org.junit.vintage</groupId>

                <artifactId>junit-vintage-engine</artifactId>

            </exclusion>

        </exclusions>

    </dependency>

</dependencies>

3、创建Shiro的配置类。

@Configuration

public class ShiroConfig {

    @Bean

    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager) {

        // 创建ShiroFilterFactoryBean

        ShiroFilterFactoryBean filterFactoryBean = new ShiroFilterFactoryBean();

        //设置安全管理器

        filterFactoryBean.setSecurityManager(defaultWebSecurityManager);

        //配置受限资源,index是受限资源，authc

        Map<String, String> map = new HashMap<String, String>();

        // /**代表匹配所有url

        map.put("/**", "authc");

        // /user/login 是可以匿名访问的也就是公有资源

        map.put("/user/login", "anon");

        filterFactoryBean.setFilterChainDefinitionMap(map);

        // 设置默认认证路径 其实shiro默认的认证路径就是login.jsp

        filterFactoryBean.setLoginUrl("/login.jsp");

        return filterFactoryBean;

    }

    @Bean

    public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {

        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();

        defaultWebSecurityManager.setRealm(realm);

        return defaultWebSecurityManager;

    }

    @Bean

    public Realm getRealm() {

        CustomRelam customRelam = new CustomRelam();

        return customRelam;

    }

}

4、创建自定义realm。

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

public class CustomRelam extends AuthorizingRealm {

    // 授权

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        return null;

    }

    //认证

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        String principal = (String) authenticationToken.getPrincipal();

        // 实际开发中 先确认传来的token用户名是否存在，如果存在，然后根据有户名查询密码返回，进而判断密码是否正确

        // 这里假设从数据库中查到的用户名是 xiaozhang

        String username = "xiaozhang";

        if (username.equals(principal)) {

            // 密码还没加密，下一步会加盐并加密

            SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal,

                    "123", this.getName());

            // 用户名和面都判断完成后可以返回

            return simpleAuthenticationInfo;

        }

        return null;

    }

}

5、编写controller，处理登录和退出的请求

package club.qy.datao.controller;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.IncorrectCredentialsException;

import org.apache.shiro.authc.UnknownAccountException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.subject.Subject;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.PostMapping;

import org.springframework.web.bind.annotation.RequestMapping;

/**

 * @author 胡

 */

@Controller

@RequestMapping("/user")

public class UserController {

	// 退出操作

    @RequestMapping("/logout")

    public String logout() {

        Subject subject = SecurityUtils.getSubject();

        subject.logout();

        return "redirect:/login.jsp";

    }

	// 登录请求

    @PostMapping("/login")

    public String login(String username, String password) {

        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken passwordToken = new UsernamePasswordToken(username, password);

        try {

            subject.login(passwordToken);

            return "redirect:/index.jsp";

        } catch (UnknownAccountException e) {

            System.out.println("用户名错误" + e.getMessage());

        } catch (IncorrectCredentialsException e) {

            System.out.println("密码错误" + e.getMessage());

        }

        return "redirect:/login.jsp";

    }

}

下面开始连接数据库MySQL，MD5+salt验证登录的认证

数据库表的创建

DROP TABLE IF EXISTS `t_user`;

CREATE TABLE `t_user` (

  `id` int(11) NOT NULL AUTO_INCREMENT,

  `username` varchar(40) DEFAULT NULL,

  `password` varchar(40) DEFAULT NULL,

  `salt` varchar(40) DEFAULT NULL,

  PRIMARY KEY (`id`)

) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8mb4;

注册页面

<%@page contentType="text/html; UTF-8" pageEncoding="UTF-8" %>

<html lang="en">

<head>

    <meta charset="UTF-8">

    <meta name="viewport"

          content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">

    <meta http-equiv="X-UA-Compatible" content="ie=edge">

    <title>Document</title>

</head>

<body>

        <h1 class="">注册页</h1>

        <form action="${pageContext.request.contextPath}/user/register" method="post">

            用户名：<input type="text" name="username"><br/>

            密码: <input type="password" name="password"><br/>

             <input type="submit" value="注册">

        </form>

</body>

</html>

导入依赖

<dependencies>

    <dependency>

        <groupId>org.apache.tomcat.embed</groupId>

        <artifactId>tomcat-embed-jasper</artifactId>

    </dependency>

    <dependency>

        <groupId>jstl</groupId>

        <artifactId>jstl</artifactId>

        <version>1.2</version>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-web</artifactId>

    </dependency>

    <!--引入SpringBoot与shiro整合的依赖-->

    <dependency>

        <groupId>org.apache.shiro</groupId>

        <artifactId>shiro-spring-boot-starter</artifactId>

        <version>1.5.3</version>

    </dependency>

    <dependency>

        <groupId>org.projectlombok</groupId>

        <artifactId>lombok</artifactId>

        <optional>true</optional>

    </dependency>

    <!--mysql-->

    <dependency>

        <groupId>mysql</groupId>

        <artifactId>mysql-connector-java</artifactId>

        <version>5.1.8</version>

    </dependency>

    <!--mybatis-->

    <dependency>

        <groupId>org.mybatis.spring.boot</groupId>

        <artifactId>mybatis-spring-boot-starter</artifactId>

        <version>2.1.2</version>

    </dependency>

    <!--druid-->

    <dependency>

        <groupId>com.alibaba</groupId>

        <artifactId>druid</artifactId>

        <version>1.1.19</version>

    </dependency>

    <dependency>

        <groupId>org.springframework.boot</groupId>

        <artifactId>spring-boot-starter-test</artifactId>

        <scope>test</scope>

        <exclusions>

            <exclusion>

                <groupId>org.junit.vintage</groupId>

                <artifactId>junit-vintage-engine</artifactId>

            </exclusion>

        </exclusions>

    </dependency>

</dependencies>

配置文件

server.port=8081

server.servlet.context-path=/shiro

spring.application.name=shiro

spring.mvc.view.suffix=.jsp

spring.mvc.view.prefix=/

spring.datasource.type=com.alibaba.druid.pool.DruidDataSource

spring.datasource.url=jdbc:mysql://localhost:3309/shiro?characterEncoding=UTF-8

spring.datasource.driver-class-name=com.mysql.jdbc.Driver

spring.datasource.username=root

spring.datasource.password=123456

mybatis.type-aliases-package=club.qy.datao.entity

mybatis.mapper-locations=classpath:mapper/*.xml

创建实体类

@Data

@Accessors(chain = true)

@AllArgsConstructor

@NoArgsConstructor

public class User {

    private String username;

    private String password;

    private Integer id;

    private String salt;

}

创建UserDao

@Repository

@Mapper

public interface UserDao {

    void saveUser(User user);

}

UserDaoMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="club.qy.datao.dao.UserDao">

    <insert id="saveUser" parameterType="club.qy.datao.entity.User" useGeneratedKeys="true" keyProperty="id">

        insert into t_user values (#{id},#{username},#{password},#{salt})

    </insert>

</mapper>

service实现

@Service

@Transactional

public class UserServiceImpl implements UserService {

    @Autowired

    private UserDao userDao;

    @Override

    public void register(User user) {

        //1。生成随机盐

        String saltString = SaltUtil.getSaltString(9);

        //2、给用户设置盐

        user.setSalt(saltString);

        //3、明文密码进行散列算法1024次，并加盐

        Md5Hash md5Hash = new Md5Hash(user.getPassword(), saltString, 1024);

        //4、将转成16进制的密码封装到user对象中

        user.setPassword(md5Hash.toHex());

        //5、插入数据库

        userDao.saveUser(user);

    }

}

SaltUtil工具类

public class SaltUtil {

    public static String getSaltString(int n){

        StringBuilder stringBuilder = new StringBuilder();

        char[] array = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ!@~><?abcdefghijklmnopqrstuvwxyz".toCharArray();

        for (int i = 0; i < n; i++) {

            char ch = array[new Random().nextInt(array.length)];

            stringBuilder.append(ch);

        }

        return stringBuilder.toString();

    }

}

ShiroConfig类

@Configuration

public class ShiroConfig {

    @Bean

    public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager) {

        // 创建ShiroFilterFactoryBean

        ShiroFilterFactoryBean filterFactoryBean = new ShiroFilterFactoryBean();

        //设置安全管理器

        filterFactoryBean.setSecurityManager(defaultWebSecurityManager);

        //配置受限资源,index是受限资源，authc

        Map<String, String> map = new HashMap<String, String>();

        // /**代表匹配所有url

        map.put("/**", "authc");

        // /user/login 是可以匿名访问的也就是公有资源

        map.put("/user/**", "anon");

        map.put("/register.jsp", "anon");

        filterFactoryBean.setFilterChainDefinitionMap(map);

        // 设置默认认证路径 其实shiro默认的认证路径就是login.jsp

        filterFactoryBean.setLoginUrl("/login.jsp");

        return filterFactoryBean;

    }

     @Bean

    public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {

        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();

        defaultWebSecurityManager.setRealm(realm);

        return defaultWebSecurityManager;

    }

    @Bean

    public Realm getRealm() {

        CustomRelam customRelam = new CustomRelam();

        return customRelam;

    }

}

巴特西

SpringBoot整合Shiro完成认证

三、`SpringBoot`整合`Shiro`思路

shiro常见的过滤器

`SpringBoot`整合`Shiro`实现认证

数据库表的创建

注册页面

导入依赖

配置文件

创建实体类

创建UserDao

UserDaoMapper.xml

service实现

SaltUtil工具类

ShiroConfig类

最新文章

热门文章

巴特西

SpringBoot整合Shiro完成认证

三、SpringBoot整合Shiro思路

shiro常见的过滤器

SpringBoot整合Shiro实现认证

数据库表的创建

注册页面

导入依赖

配置文件

创建实体类

创建UserDao

UserDaoMapper.xml

service实现

SaltUtil工具类

ShiroConfig类

最新文章

热门文章

三、`SpringBoot`整合`Shiro`思路

`SpringBoot`整合`Shiro`实现认证