shiro的配置详解

心已赠人 2022-05-15 04:06 482阅读 0赞

1.下载shiro

[http://shiro.apache.org/download.html][http_shiro.apache.org_download.html]

2.shiro架构的核心内容介绍

**①****Subject*****：***应用代码直接交互的对象是 Subject，**与**** Subject****的所有交互都会委托给 SecurityManager**；

**②SecurityManager*****：***安全管理器；**即所有与安全有关的操作都会与****SecurityManager** **交互**；且其管理着所有 Subject

**③Realm*****：***Shiro 从 **Realm 获取安全数据（如用户、角色、权限），**就是说  SecurityManager 要验证用户身份，那么它需要从 Realm 获取相应的用户进行比较以确定用户身份是否合法；也需要从 Realm 得到用户相应的角色/权限进行验证用户是否能进行操作.

3.引入shiro依赖

<properties>
    		<shiro.version>1.2.3</shiro.version>
    	</properties>
    
    		<dependency>
    			<groupId>net.sf.ehcache</groupId>
    			<artifactId>ehcache-core</artifactId>
    			<version>2.6.6</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-ehcache</artifactId>
    			<version>${shiro.version}</version>
    		</dependency>
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-core</artifactId>
    			<version>${shiro.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-web</artifactId>
    			<version>${shiro.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-spring</artifactId>
    			<version>${shiro.version}</version>
    		</dependency>

4.首先在web.xml中加入shiro过滤器

<filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
          <param-name>targetFilterLifecycle</param-name>
          <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
        <dispatcher>ERROR</dispatcher>
        <dispatcher>INCLUDE</dispatcher>
    </filter-mapping>

5.添加shiro与spring集成的配置文件application-shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="
           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd">
    
    	
    	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    		
    		<property name="cacheManager" ref="cacheManager" />
    		
    		
    		
    		<property name="realm" ref="jdbcRealm" />
    	</bean>
    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO"/>
    	<bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
    		<property name="sessionDAO" ref="sessionDAO"></property>
    	</bean>
    	
    	<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
    		<property name="cacheManagerConfigFile" value="classpath:ehcache.xml" />
    	</bean>
    
    	
    	<bean id="jdbcRealm" class="com.plat.shiro.CustomJdbcRealm">
    		
    		<property name="dataSource" ref="dataSource"></property>
    		
    		<property name="permissionsLookupEnabled" value="true"></property>
    		
    		<property name="authenticationQuery"
    			value="SELECT su.password FROM sys_user su WHERE su.account = ? and su.is_use =1"></property>
    		
    		<property name="userRolesQuery"
    			value="SELECT sr.rkey FROM sys_role sr,sys_user su,sys_user_role sur  WHERE su.user_code = sur.user_code and sur.role_code = sr.rcode  and su.account=?"></property>
    		
    		<property name="permissionsQuery"
    			value="SELECT sp.pkey FROM sys_permission sp ,sys_role sr,sys_role_permission srp WHERE sr.rcode = srp.role_code and sp.pcode = srp.permission_code and sr.rkey=?"></property>
    	</bean>
    
    	
    	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
    	
    	<bean
    		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
    		depends-on="lifecycleBeanPostProcessor" />
    	<bean
    		class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    		<property name="securityManager" ref="securityManager" />
    	</bean>
    
        
    	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    		<property name="securityManager" ref="securityManager" />
    		<property name="loginUrl" value="/login" />
    		<property name="successUrl" value="/index" />
    		
    
    		
    		<property name="filterChainDefinitions">
    			<value>
    				/**/*login*/**=anon
    				/resources/**=anon
    				/**/*logout*/**=logout
    				/**=user
    			</value>
    		</property>
    	</bean>
    
    </beans>

6.缓存管理器ehcache.xml

<?xml version = "1.0" encoding = "UTF-8"?>
    <ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:noNamespaceSchemaLocation="http://ehcache.org/ehcache.xsd">
    
    	
    	<diskStore path="java.io.tmpdir" />
    	<defaultCache maxElementsInMemory="10000" eternal="false"
    		timeToIdleSeconds="30" timeToLiveSeconds="30" overflowToDisk="false" />
    	    
    	<cache name="shopCache" maxElementsInMemory="10000" eternal="true"
    		overflowToDisk="false" timeToIdleSeconds="0" timeToLiveSeconds="600"
    		memoryStoreEvictionPolicy="LFU" />
    </ehcache>

7.自定义realm

package com.plat.shiro;
    
    import javax.annotation.Resource;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.LockedAccountException;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UnknownAccountException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.realm.jdbc.JdbcRealm;
    import org.apache.shiro.session.Session;
    
    import com.plat.commons.model.SysUser;
    import com.plat.service.SysUserService;
    
    public class CustomJdbcRealm extends JdbcRealm {
    
    	@Resource
    	private SysUserService sysUserService;
    	
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    		System.out.println("------doGetAuthenticationInfo-------");
    		/**
    		 * js --> sysUser/login --> Subject.login(UsernamepasswordToken) --> CustomJdbcRealm
    		 */
    		
    		UsernamePasswordToken usernamePasswordToken =(UsernamePasswordToken) token;
    		//获取登录账号
    		String account=usernamePasswordToken.getUsername();
    		SysUser sysUser=sysUserService.findByAccount(account);
    		if(sysUser==null) {
    			throw new UnknownAccountException();
    		}
    		//判断用户名和密码是否正确
    		if(!sysUser.getPassword().equals(new String (usernamePasswordToken.getPassword()))) {
    			throw new IncorrectCredentialsException();
    		}
    		//判断用户是否被禁用
    		if(sysUser.getIsUse()==0) {
    			throw new LockedAccountException();
    		}
    		
    		//用户登录成功,将用户保存到session中
    		Session session= SecurityUtils.getSubject().getSession();
    		session.setAttribute("sysUser", sysUser);
    		
    		//参数1:Subject.getPrincipal()获取到的就是参数一传入的内容
    		//参数2:shiro进行用户信息比对的时候使用的密码
    		//参数3:realm名称,getName方法自动生成一个realm的名称
    		return new SimpleAuthenticationInfo(account,sysUser.getPassword(),getName());
    	}
    }

8.登录方法

@RequestMapping("/login")
    	@ResponseBody
    	public String login(String account,String password) {
    		//返回信息
    		String message = "";
    		if(!isNotNull(account)) {
    			message="登录账号不能为空";
    		}
    		
    		if(message=="" && !isNotNull(password)) {
    			message="登录密码不能为空";
    		}
    		//登录
    		if(!isNotNull(message)) {
    			Subject currentUser=SecurityUtils.getSubject();
    			
    			//加密密码
    			String md5Password = DigestUtil.hmacSign(password, DigestUtil.digest("heheda"));
    			
    			UsernamePasswordToken upToken=
    					new UsernamePasswordToken(account,md5Password);
    			//记住我
    			//upToken.setRememberMe(true);
    			try {
                    //进入shiro的登录,此时将进入自定义的realm中进行安全验证
    				currentUser.login(upToken);
    				message="success";
    			}catch (UnknownAccountException uae) {
    				message="账号不存在";
    			}catch (IncorrectCredentialsException ice) {
    				message="用户名或者密码错误";
    			}catch (LockedAccountException lae) {
    				message="账号已被锁定";
    			} catch (AuthenticationException e) {
    				message="登录异常,请稍后再试!!";
    				e.printStackTrace();
    			}
    		}
    		return message;
    	}

9.MD5

package com.plat.commons.util;
    
    import java.io.UnsupportedEncodingException;
    import java.security.MessageDigest;
    import java.security.NoSuchAlgorithmException;
    import java.util.Arrays;
    
    public class DigestUtil {
    
    	private static String encodingCharset = "UTF-8";
    
    	/**
    	 * @param aValue
    	 * @param aKey
    	 * @return
    	 */
    	public static String hmacSign(String aValue, String aKey) {
    		byte k_ipad[] = new byte[64];
    		byte k_opad[] = new byte[64];
    		byte keyb[];
    		byte value[];
    		try {
    			keyb = aKey.getBytes(encodingCharset);
    			value = aValue.getBytes(encodingCharset);
    		} catch (UnsupportedEncodingException e) {
    			keyb = aKey.getBytes();
    			value = aValue.getBytes();
    		}
    
    		Arrays.fill(k_ipad, keyb.length, 64, (byte) 54);
    		Arrays.fill(k_opad, keyb.length, 64, (byte) 92);
    		for (int i = 0; i < keyb.length; i++) {
    			k_ipad[i] = (byte) (keyb[i] ^ 0x36);
    			k_opad[i] = (byte) (keyb[i] ^ 0x5c);
    		}
    
    		MessageDigest md = null;
    		try {
    			md = MessageDigest.getInstance("MD5");
    		} catch (NoSuchAlgorithmException e) {
    
    			return null;
    		}
    		md.update(k_ipad);
    		md.update(value);
    		byte dg[] = md.digest();
    		md.reset();
    		md.update(k_opad);
    		md.update(dg, 0, 16);
    		dg = md.digest();
    		return toHex(dg);
    	}
    
    	public static String toHex(byte input[]) {
    		if (input == null)
    			return null;
    		StringBuffer output = new StringBuffer(input.length * 2);
    		for (int i = 0; i < input.length; i++) {
    			int current = input[i] & 0xff;
    			if (current < 16)
    				output.append("0");
    			output.append(Integer.toString(current, 16));
    		}
    
    		return output.toString();
    	}
    
    	/**
    	 * 
    	 * @param args
    	 * @param key
    	 * @return
    	 */
    	public static String getHmac(String[] args, String key) {
    		if (args == null || args.length == 0) {
    			return (null);
    		}
    		StringBuffer str = new StringBuffer();
    		for (int i = 0; i < args.length; i++) {
    			str.append(args[i]);
    		}
    		return (hmacSign(str.toString(), key));
    	}
    
    	/**
    	 * @param aValue
    	 * @return
    	 */
    	public static String digest(String aValue) {
    		aValue = aValue.trim();
    		byte value[];
    		try {
    			value = aValue.getBytes(encodingCharset);
    		} catch (UnsupportedEncodingException e) {
    			value = aValue.getBytes();
    		}
    		MessageDigest md = null;
    		try {
    			md = MessageDigest.getInstance("SHA");
    		} catch (NoSuchAlgorithmException e) {
    			e.printStackTrace();
    			return null;
    		}
    		return toHex(md.digest(value));
    
    	}
    
    	public static void main(String[] args) {
            // 参数1: 明文(要加密的数据) 参数2: 密钥
    		System.out.println(DigestUtil.hmacSign("11111", "dddd"));
    	}
    }

[http_shiro.apache.org_download.html]: http://shiro.apache.org/download.html