密码加密器

清疚 2024-03-17 17:03 28阅读 0赞

本文为shiro框架后续内容，详细内容请参考[http://t.csdn.cn/AJvi4][http_t.csdn.cn_AJvi4]

**实际情况下我们在数据库中存储的密码是一个密文。**

![d3e68b7f0991467ea8dfccd810d701b6.png][]

## 1.shiro帮我们提供很多种加密器。---如果没有指定加密器，那么都使用默认的无加密器。 ##

package demo;
    
    import org.apache.shiro.crypto.hash.Md5Hash;
    import org.apache.shiro.crypto.hash.SimpleHash;
    
    
    public class Test {
        public static void main(String[] args) {
    //        Md5Hash md5Hash1=new Md5Hash("123456");
    //        System.out.println(md5Hash1); //别人会把一些场景的明文加密后的密文存储的一个很大的数据库。
    //        Md5Hash md5Hash2=new Md5Hash("123456","cgm"); //盐
    //        System.out.println(md5Hash2);
    //        Md5Hash md5Hash=new Md5Hash("123456","cgm",3);//3:表示加密次数
    //        System.out.println(md5Hash);
    
            SimpleHash simpleHash=new SimpleHash("SHA","123456","cgm",110);
            SimpleHash simpleHash2=new SimpleHash("MD5","123456","cgm",110);
            System.out.println(simpleHash);
            System.out.println(simpleHash2);
        }
    }

### 2 把密码匹配器使用在shiro ###

(1)修改userService中的代码

public class UserService {
        public User findByUsername(String username) {
            if ("admin".equals(username)) {
                return new User(1, "admin", "8283f559f957e34cc00408bbd78af70e", "管理员","cgm");
            } else if ("lisi".equals(username)) {
                return new User(2, "lisi", "8283f559f957e34cc00408bbd78af70e", "李四","cgm");
            } else if ("zhangsan".equals(username)) {
                return new User(3, "zhangsan", "8283f559f957e34cc00408bbd78af70e", "张三","cgm");
            }
            return null;
        }

(2)修改测试代码

public class Test {
        public static void main(String[] args) {
            DefaultSecurityManager securityManager = new DefaultSecurityManager();
            MyRealm myRealm = new MyRealm();
    
            HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
            credentialsMatcher.setHashAlgorithmName("MD5");
            credentialsMatcher.setHashIterations(110);
            myRealm.setCredentialsMatcher(credentialsMatcher);
    
            securityManager.setRealm(myRealm);
            SecurityUtils.setSecurityManager(securityManager);
    
    
            Subject subject = SecurityUtils.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken("admin", "123456");
            try {
                subject.login(token);
                System.out.println("登陆成功");
                System.out.println("~~~~~~~~~~~权限校验~~~~~~~~~~~~~~~~");
                boolean permitted = subject.isPermitted("user:query");
                System.out.println(token.getUsername()+"具有的的权限为"+permitted);
                boolean[] permitted1 = subject.isPermitted("user:query", "user:update");
                System.out.println(token.getUsername()+"具有的的权限为"+ Arrays.toString(permitted1));
                boolean permittedAll = subject.isPermittedAll("user:query", "user:update");
                System.out.println(token.getUsername()+"具有的的全部权限为"+permittedAll);
            }catch (Exception e){
                e.printStackTrace();
                System.out.println("登录失败");
            }
        }
    }

（3）myRealm代码

public class MyRealm extends AuthorizingRealm {
        private UserService userService =new UserService();
        @Override
        //权限
        protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
            System.out.println("———————权限分配————————");
            String user =principals.getPrimaryPrincipal().toString();
            List<String> permission = userService.findPermissionByUsername(user);
            if(permission.size()!=0){
                SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
                info.addStringPermissions(permission);
                return  info;
            }
            return null;
        }
        @Override
        //认证
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            System.out.println("~~~~~~~登录认证~~~~~~~");
            //获取当前登录的账号
            String username =token.getPrincipal().toString();
            //根据账号查询数据库中是否存在对应的记录。
            User user=userService.findByUsername(username);
            if(user!=null){
                //Object principal  账号
                // Object credentials 数据库中查询到的该用户密码
                // String realmName:realm的名称---随便起---内置一个方法getName
                ByteSource salt = ByteSource.Util.bytes(user.getSalt());
                SimpleAuthenticationInfo info=new SimpleAuthenticationInfo(username,user.getPassword(),salt,this.getName());
                return info;
            }
            return null;
        }
    }

[http_t.csdn.cn_AJvi4]: http://t.csdn.cn/AJvi4
[d3e68b7f0991467ea8dfccd810d701b6.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/03/15/7041454b95ea479f8afb157023a6ac6a.png