shiro—MD5盐值加密

落日映苍穹つ 2024-04-17 20:08 64阅读 0赞

本例为在idea下shiro集成springMVC。仅有一个认证加密方式（一个realm

）

为什么是MD5盐值加密呢？shiro用密码匹配，密码一样，就ok。如果两个用户的密码一样，则就会造成麻烦。所以使用MD5盐值加密。盐值加密简单来说就是：两个一样的西红柿，加不同的盐炒出来的味道不一样。什么适合作为盐值呢？肯定是惟一的东西。

比如用户名（一般采用手机号，或者邮箱等等）（用户id也ok）。下面来详细说明。

1.idea中新建立spring-springMVC项目。（建立方法可以参考之前的文章）

2.需要导入shiro的jar包。shiro的所有的包可以去http:shiro.apache.org网站下载。里面也有一些实例项目可以参考。

这里需要这么四个包：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70][]

在idea中的lib中导入这些包，注意一定要右键add as library和在program structure中put into。关于如何导入，可以参考我之前的文章。

3.配置ss的文件。

web.xml:

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
             version="4.0">
        <context-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>/WEB-INF/applicationContext.xml</param-value>
        </context-param>
        <listener>
            <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
        </listener>
        <servlet>
            <servlet-name>dispatcher</servlet-name>
            <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
            <load-on-startup>1</load-on-startup>
        </servlet>
        <servlet-mapping>
            <servlet-name>dispatcher</servlet-name>
            <url-pattern>/</url-pattern>
        </servlet-mapping>
        
        <filter>
            <filter-name>shiroFilter</filter-name>
            <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
            <init-param>
                <param-name>targetFilterLifecycle</param-name>
                <param-value>true</param-value>
            </init-param>
        </filter>
    
        <filter-mapping>
            <filter-name>shiroFilter</filter-name>
            <url-pattern>/*</url-pattern>
        </filter-mapping>
    </web-app>

dispatcher-servler.xml:

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
           xmlns:tx="http://www.springframework.org/schema/tx" xmlns:context="http://www.springframework.org/schema/context"
           xmlns:mvc="http://www.springframework.org/schema/mvc" xmlns:aop="http://www.springframework.org/schema/aop"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd
           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
           http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
        
        <context:component-scan base-package="com.atguigu.shiro"/>
        <mvc:annotation-driven/>
        <mvc:default-servlet-handler/>
        
        <bean class="org.springframework.web.servlet.view.InternalResourceViewResolver">
            <property name="prefix" value="/"/>
            <property name="suffix" value=".jsp"/>
        </bean>
    
    
    
    
    </beans>

applicationContext.xml:

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    
        
        
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            <property name="cacheManager" ref="cacheManager"/>
            
           <property name="realm" ref="jdbcRealm"></property>
        </bean>
    
        
        
        <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
            
            
            <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
        </bean>
    
    
       
        
        
        <bean id="jdbcRealm" class="com.atguigu.shiro.realms.ShiroRealm">
            <property name="credentialsMatcher">
                <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                    <property name="hashAlgorithmName" value="MD5"></property>
                    <property name="hashIterations" value="1024"></property>
                </bean>
            </property>
        </bean>
      
        
        
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
        
        
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
              depends-on="lifecycleBeanPostProcessor"/>
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager"/>
        </bean>
    
        
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager"/>
            <property name="loginUrl" value="/login.jsp"/>
            <property name="successUrl" value="/list.jsp"/>
            <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
            
    
            <property name="filterChainDefinitions">
                <value>
                    /login.jsp = anon
                    /shiro/login = anon
                    /shiro/logout = logout
                    # everything else requires authentication:
                    /** = authc
                </value>
            </property>
        </bean>
    
    
    </beans>

web 目录下的文件：

![20190831105152345.png][]

建立realm：

package com.atguigu.shiro.realms;
    
    import org.apache.shiro.authc.*;
    import org.apache.shiro.crypto.hash.SimpleHash;
    import org.apache.shiro.realm.AuthenticatingRealm;
    import org.apache.shiro.realm.Realm;
    import org.apache.shiro.util.ByteSource;
    
    public class ShiroRealm extends AuthenticatingRealm {
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            System.out.println("[FirstRealm]+doGetAuthenticationInfo");
            //1.把AuthenticationToken对象装换为UsernamePasswordToken
            UsernamePasswordToken upToken= (UsernamePasswordToken) token;
            //2.从UsernamePasswordToken中来获取username
            String username = upToken.getUsername();
            //3.调用数据库的方法，从数据库中查询username对应的记录
            System.out.println("从数据库中获取username："+username+"所对应的信息");
            //4.若用户不存在，则可以抛出UnKnownAccountException异常
            if("unknown".equals(username))
            {
                throw new UnknownAccountException("用户不存在！");
            }
            //5.根据用户信息的情况，决定是否需要抛出其他的AuthenticationException异常
            if("monster".equals(username))
            {
                throw new LockedAccountException("用户被锁定！");
            }
            //6.根据用户的情况，来构建AuthenticationInfo对象并且返回
            //通常使用的实现类是SimpleAuthenticationInfo
            //以下信息从数据库中获取
            //<1.principal:认证的实体信息，可以是username也可以是数据表对应的实体类对象
            Object principal=username;
            //<2.credentials:密码
            Object credentials=null;
            if("admin".equals(username))
            {
                credentials="038bdaf98f2037b31f1e75b5b4c9b26e";
            }else if("user".equals(username))
            {
                credentials="098d2c478e9c11555ce2823231e02ec1";
            }
            //<3.realName：当前realm对象的name，调用父类对象的getName（）方法即可
            String realmName=getName();
            //<4 盐值 这个盐值要唯一，我们假设这里用户名是唯一的，我们使用用户名作为盐值
            //盐值的作用：如果两个人的密码一样的话，就要盐值，就像西红柿，家不同的盐味道不一样！
            ByteSource credentialsSalt=ByteSource.Util.bytes(username);
            SimpleAuthenticationInfo info=null;
            info=new SimpleAuthenticationInfo(principal,credentials,credentialsSalt,realmName);
            return info;
        }
    
        public static void main(String[] args) {
            String algorithmName="MD5";
            Object credentials="123456";
            Object salt=ByteSource.Util.bytes("user");
            int hashIterations=1024;
            Object result = new SimpleHash(algorithmName, credentials, salt, hashIterations);
            System.out.println(result);
        }
    }

注意，实际项目中，这个credentials是从数据库中拿到的。不是用下面的main方法现成加密的哈！

编写controller：

package com.atguigu.shiro.controller;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.*;
    import org.apache.shiro.subject.Subject;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    
    @Controller
    @RequestMapping("/shiro")
    public class ShiroHandler {
    
        @RequestMapping(value = "/login",method = RequestMethod.POST)
        public String login(String username,String password){
            // 获取当前的 Subject. 调用 SecurityUtils.getSubject();
            Subject currentUser = SecurityUtils.getSubject();
            // let's login the current user so we can check against roles and permissions:
            // 测试当前的用户是否已经被认证. 即是否已经登录.
            // 调动 Subject 的 isAuthenticated()
            if (!currentUser.isAuthenticated()) {
                // 把用户名和密码封装为 UsernamePasswordToken 对象
                UsernamePasswordToken token = new UsernamePasswordToken(username, password);
                // rememberme
                token.setRememberMe(true);
                try {
                    // 执行登录.
                    //这个token其实就传到了shiroRealm里面的那个token
                    currentUser.login(token);
                }
                // 所有认证时异常的父类.
                catch (AuthenticationException ae) {
                    //unexpected condition?  error?
                    System.out.println("登录失败:"+ae.getMessage());
                }
            }
            return "redirect:/list.jsp";
        }
    }

注意这里一定要写上method。

<%--
      Created by IntelliJ IDEA.
      User: lenovo
      Date: 2019/8/30
      Time: 11:27
      To change this template use File | Settings | File Templates.
    --%>
    <%@ page contentType="text/html;charset=UTF-8" language="java" pageEncoding="UTF-8" %>
    <%
        String path = request.getContextPath();
        String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort()
                + path + "/";
    %>
    <html>
    <head>
        <title>login</title>
    </head>
    <body>
    <h4>login page</h4>
    <form action="<%=basePath%>shiro/login" method="post">
        username:<input type="text" name="username">
        <br><br>
        password:<input type="password" name="password">
        <br><br>
        <input type="submit">
    </form>
    </body>
    </html>

需要登出：

在list.jsp中登出：

<%--
      Created by IntelliJ IDEA.
      User: lenovo
      Date: 2019/8/30
      Time: 11:27
      To change this template use File | Settings | File Templates.
    --%>
    <%@ page contentType="text/html;charset=UTF-8" language="java" pageEncoding="utf-8" %>
    <%
        String path = request.getContextPath();
        String basePath = request.getScheme() + "://" + request.getServerName() + ":" + request.getServerPort()
                + path + "/";
    %>
    <html>
    <head>
        <title>list</title>
    </head>
    <body>
    <h4>List Page</h4>
    <a href="<%=basePath%>shiro/logout">Log Out</a>
    </body>
    </html>

完整的代码：

[https://hn.devcloud.huaweicloud.com/codehub/project/db863c4dd09b44e1949853aa22197df3/codehub/7168568/home][https_hn.devcloud.huaweicloud.com_codehub_project_db863c4dd09b44e1949853aa22197df3_codehub_7168568_home]

流程：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70 1][]

ehcache.xml的内容：

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/17/b5b0cd1a96924644b98bd1f665752a02.png
[20190831105152345.png]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/17/5155e01ba5bf49f38674798eb2a850bb.png
[https_hn.devcloud.huaweicloud.com_codehub_project_db863c4dd09b44e1949853aa22197df3_codehub_7168568_home]: https://hn.devcloud.huaweicloud.com/codehub/project/db863c4dd09b44e1949853aa22197df3/codehub/7168568/home
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70 1]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/17/cdf528bd8da142ca9e4d2d2e346fdd5f.png