六、整合SpringBoot项目实战

6.1 整合思路

03、shiro-整合springboot - 图1

6.2 配置环境

1.创建项目

03、shiro-整合springboot - 图2

2.引入依赖

  1. <!--引入JSP解析依赖-->
  2. <dependency>
  3.      <groupId>org.apache.tomcat.embed</groupId>
  4.      <artifactId>tomcat-embed-jasper</artifactId>
  5.      </dependency>
  6. <dependency>
  7.      <groupId>jstl</groupId>
  8.      <artifactId>jstl</artifactId>
  9.      <version>1.2</version>
  10. </dependency>
  1. <!--引入shiro整合Springboot依赖-->
  2. <dependency>
  3.   <groupId>org.apache.shiro</groupId>
  4.   <artifactId>shiro-spring-boot-starter</artifactId>
  5.   <version>1.5.3</version>
  6. </dependency>

3.修改视图

application.properties 文件

  1. server.port=8080
  2. server.servlet.context-path=/shiro
  3. spring.application.name=shiro
  5. spring.mvc.view.prefix=/
  6. spring.mvc.view.suffix=.jsp

4.修改配置

JSP 与IDEA 与SpringBoot存在一定的不兼容，修改此配置即可解决

03、shiro-整合springboot - 图3

03、shiro-整合springboot - 图4

6.3 简单使用

1.创建配置类

用来整合shiro框架相关的配置类

  1. package com.lut.config;
  3. import com.lut.shiro.realms.CustomerRealm;
  4. import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
  5. import org.apache.shiro.realm.Realm;
  6. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
  7. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
  8. import org.springframework.context.annotation.Bean;
  9. import org.springframework.context.annotation.Configuration;
  11. import java.util.HashMap;
  12. import java.util.Map;
  14. /**
  15.  * 用来整合shiro框架相关的配置类
  16.  */
  17. @Configuration
  18. public class ShiroConfig {
  20.     //1.创建shiroFilter  //负责拦截所有请求
  21.     @Bean
  22.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager){
  24.         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  25.         //给filter设置安全管理器
  26.         shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
  28.         //配置系统受限资源
  29.         //配置系统公共资源
  30.         Map<String,String> map = new HashMap<String,String>();
  32.         map.put("/index.jsp","authc");//authc 请求这个资源需要认证和授权
  34.         //默认认证界面路径---当认证不通过时跳转
  35.         shiroFilterFactoryBean.setLoginUrl("/login.jsp");
  36.         shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
  38.         return shiroFilterFactoryBean;
  39.     }
  41.     //2.创建安全管理器
  42.     @Bean
  43.     public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm){
  44.         DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
  45.         //给安全管理器设置
  46.         defaultWebSecurityManager.setRealm(realm);
  48.         return defaultWebSecurityManager;
  49.     }
  51.     //3.创建自定义realm
  52.     @Bean
  53.     public Realm getRealm(){
  54.         CustomerRealm customerRealm = new CustomerRealm();
  56.         return customerRealm;
  57.     }
  59. }

2.自定义realm

  1. package com.lut.shiro.realms;
  2. import org.apache.shiro.authc.AuthenticationException;
  3. import org.apache.shiro.authc.AuthenticationInfo;
  4. import org.apache.shiro.authc.AuthenticationToken;
  5. import org.apache.shiro.authc.SimpleAuthenticationInfo;
  6. import org.apache.shiro.authz.AuthorizationInfo;
  7. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  8. import org.apache.shiro.realm.AuthorizingRealm;
  9. import org.apache.shiro.subject.PrincipalCollection;
  10. import org.springframework.util.CollectionUtils;
  11. import org.springframework.util.ObjectUtils;
  13. import java.util.List;
  16. //自定义realm
  17. public class CustomerRealm extends AuthorizingRealm {
  19.     @Override
  20.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  21.         return null;
  22.     }
  24.     @Override
  25.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  26.         return null;
  27.     }
  29. }

3.JSP文件

index.jsp

  1. <%@page contentType="text/html;utf-8" pageEncoding="utf-8" isELIgnored="false" %>
  2. <!doctype html>
  3. <html lang="en">
  4. <head>
  5.     <meta charset="UTF-8">
  6.     <meta name="viewport"
  7.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  8.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  9.     <title>Document</title>
  10. </head>
  11. <body>
  12. <%--    受限资源--%>
  13.     <h1>系统主页</h1>
  14.     <ul>
  15.         <li><a href="#">用户管理</a></li>
  16.         <li><a href="#">商品管理</a></li>
  17.         <li><a href="#">订单管理</a></li>
  18.         <li><a href="#">物流管理</a></li>
  19.     </ul>
  20. </body>
  21. </html>

login.jsp

  1. <%@page contentType="text/html;utf-8" pageEncoding="utf-8" isELIgnored="false" %>
  2. <!doctype html>
  3. <html lang="en">
  4. <head>
  5.     <meta charset="UTF-8">
  6.     <meta name="viewport"
  7.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  8.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  9.     <title>Document</title>
  10. </head>
  11. <body>
  12.     <h1>登录界面</h1>
  13.     <form action="${pageContext.request.contextPath}/user/login" method="post">
  14.         用户名:<input type="text" name="username" > <br/>
  15.         密码  : <input type="text" name="password"> <br>
  16.         <input type="submit" value="登录">
  17.     </form>
  18. </body>
  19. </html>

4.简单测试

访问：http://localhost:8080/shiro/index.jsp
由于没有验证成功，会跳转到登录页面

03、shiro-整合springboot - 图5

目前项目结构：

03、shiro-整合springboot - 图6

6.4 常见过滤器

  • 注意: shiro提供和多个默认的过滤器，我们可以用这些过滤器来配置控制指定url的权限：

image.png

6.5 认证和退出实现

6.5.1 登录实现

1.login.jsp

  1. <%@page contentType="text/html;utf-8" pageEncoding="utf-8" isELIgnored="false" %>
  2. <!doctype html>
  3. <html lang="en">
  4. <head>
  5.     <meta charset="UTF-8">
  6.     <meta name="viewport"
  7.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  8.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  9.     <title>Document</title>
  10. </head>
  11. <body>
  12.     <h1>登录界面</h1>
  13.     <form action="${pageContext.request.contextPath}/user/login" method="post">
  14.         用户名:<input type="text" name="username" > <br/>
  15.         密码  : <input type="text" name="password"> <br>
  16.         <input type="submit" value="登录">
  17.     </form>
  18. </body>
  19. </html>

03、shiro-整合springboot - 图8

2.UserController

  1. package com.lut.controller;
  3. import org.apache.shiro.SecurityUtils;
  4. import org.apache.shiro.authc.IncorrectCredentialsException;
  5. import org.apache.shiro.authc.UnknownAccountException;
  6. import org.apache.shiro.authc.UsernamePasswordToken;
  7. import org.apache.shiro.subject.Subject;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.stereotype.Controller;
  10. import org.springframework.web.bind.annotation.RequestMapping;
  12. import javax.servlet.ServletOutputStream;
  13. import javax.servlet.http.HttpServletResponse;
  14. import javax.servlet.http.HttpSession;
  15. import java.io.IOException;
  17. @Controller
  18. @RequestMapping("user")
  19. public class UserController {
  21.     /**
  22.      * 用来处理身份认证
  23.      * @param username
  24.      * @param password
  25.      * @return
  26.      */
  27.     @RequestMapping("login")
  28.     public String login(String username, String password) {
  29.         try {
  30.             //获取主体对象
  31.             Subject subject = SecurityUtils.getSubject();
  32.             subject.login(new UsernamePasswordToken(username, password));
  33.             return "redirect:/index.jsp";
  34.         } catch (UnknownAccountException e) {
  35.             e.printStackTrace();
  36.             System.out.println("用户名错误!");
  37.         } catch (IncorrectCredentialsException e) {
  38.             e.printStackTrace();
  39.             System.out.println("密码错误!");
  40.         } catch (Exception e) {
  41.             e.printStackTrace();
  42.             System.out.println(e.getMessage());
  43.         }
  45.         return "redirect:/login.jsp";
  46.     }
  49. }
  • 在认证过程中使用subject.login进行认证


3.自定义Realm

  1. package com.lut.shiro.realms;
  2. import org.apache.shiro.authc.AuthenticationException;
  3. import org.apache.shiro.authc.AuthenticationInfo;
  4. import org.apache.shiro.authc.AuthenticationToken;
  5. import org.apache.shiro.authc.SimpleAuthenticationInfo;
  6. import org.apache.shiro.authz.AuthorizationInfo;
  7. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  8. import org.apache.shiro.realm.AuthorizingRealm;
  9. import org.apache.shiro.subject.PrincipalCollection;
  10. import org.springframework.util.CollectionUtils;
  11. import org.springframework.util.ObjectUtils;
  13. import java.util.List;
  16. //自定义realm
  17. public class CustomerRealm extends AuthorizingRealm {
  19.     @Override
  20.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  21.         return null;
  22.     }
  24.     @Override
  25.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  27.         System.out.println("=============");
  29.         //从传过来的token获取到的用户名
  30.         String principal = (String) token.getPrincipal();
  31.         System.out.println("用户名"+principal);
  33.         //假设是从数据库获得的 用户名，密码
  34.         String password_db="123";
  35.         String username_db="zhangsan";
  37.         if (username_db.equals(principal)){
  38. //            SimpleAuthenticationInfo simpleAuthenticationInfo =
  39.             return new SimpleAuthenticationInfo(principal,"123", this.getName());
  40.         }
  42.         return null;
  43.     }
  45. }

4.ShiroConfig

主要的Shiro配置类中声明：哪些是需要验证的资源，哪些是公开的资源
注意：先配置公共资源，后配置需要认证/授权的资源
此时认证功能没有md5和随机盐的认证

  1. package com.lut.config;
  2. import com.lut.shiro.realms.CustomerRealm;
  3. import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
  4. import org.apache.shiro.realm.Realm;
  5. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
  6. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Configuration;
  10. import java.util.HashMap;
  11. import java.util.Map;
  13. /**
  14.  * 用来整合shiro框架相关的配置类
  15.  */
  16. @Configuration
  17. public class ShiroConfig {
  19.     //1.创建shiroFilter  //负责拦截所有请求
  20.     @Bean
  21.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager){
  23.         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  24.         //给filter设置安全管理器
  25.         shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
  27.         //配置系统受限资源
  28.         //配置系统公共资源
  29.         Map<String,String> map = new HashMap<String,String>();
  30.         map.put("/user/login","anon");//anon 设置为公共资源  放行资源放在下面
  31.         map.put("/user/register","anon");//anon 设置为公共资源  放行资源放在下面
  32.         map.put("/register.jsp","anon");//anon 设置为公共资源  放行资源放在下面
  33.         map.put("/user/getImage","anon");
  35.         map.put("/**","authc");//authc 请求这个资源需要认证和授权
  37.         //默认认证界面路径---当认证不通过时跳转
  38.         shiroFilterFactoryBean.setLoginUrl("/login.jsp");
  39.         shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
  41.         return shiroFilterFactoryBean;
  42.     }
  44.     //2.创建安全管理器
  45.     @Bean
  46.     public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm){
  47.         DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
  48.         //给安全管理器设置
  49.         defaultWebSecurityManager.setRealm(realm);
  51.         return defaultWebSecurityManager;
  52.     }
  54.     //3.创建自定义realm
  55.     @Bean
  56.     public Realm getRealm(){
  57.         CustomerRealm customerRealm = new CustomerRealm();
  58.         return customerRealm;
  59.     }
  61. }

6.5.2 退出认证

1.index.jsp

添加登出链接

  1. <%@page contentType="text/html;utf-8" pageEncoding="utf-8" isELIgnored="false" %>
  2. <!doctype html>
  3. <html lang="en">
  4. <head>
  5.     <meta charset="UTF-8">
  6.     <meta name="viewport"
  7.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  8.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  9.     <title>Document</title>
  10. </head>
  11. <body>
  12. <%--受限资源--%>
  13. <h1>系统主页</h1>
  14. <a href="${pageContext.request.contextPath}/user/logout">退出登录</a>
  15. <ul>
  16.     <li><a href="#">用户管理</a></li>
  17.     <li><a href="#">商品管理</a></li>
  18.     <li><a href="#">订单管理</a></li>
  19.     <li><a href="#">物流管理</a></li>
  20. </ul>
  21. </body>
  22. </html>

2.UserController

  1. package com.lut.controller;
  3. import org.apache.shiro.SecurityUtils;
  4. import org.apache.shiro.authc.IncorrectCredentialsException;
  5. import org.apache.shiro.authc.UnknownAccountException;
  6. import org.apache.shiro.authc.UsernamePasswordToken;
  7. import org.apache.shiro.subject.Subject;
  8. import org.springframework.beans.factory.annotation.Autowired;
  9. import org.springframework.stereotype.Controller;
  10. import org.springframework.web.bind.annotation.RequestMapping;
  12. import javax.servlet.ServletOutputStream;
  13. import javax.servlet.http.HttpServletResponse;
  14. import javax.servlet.http.HttpSession;
  15. import java.io.IOException;
  17. @Controller
  18. @RequestMapping("user")
  19. public class UserController {
  22.     /**
  23.      * 退出登录
  24.      */
  25.     @RequestMapping("logout")
  26.     public String logout() {
  27.         Subject subject = SecurityUtils.getSubject();
  28.         subject.logout();//退出用户
  29.         return "redirect:/login.jsp";
  30.     }
  32.     /**
  33.      * 用来处理身份认证
  34.      * @param username
  35.      * @param password
  36.      * @return
  37.      */
  38.     @RequestMapping("login")
  39.     public String login(String username, String password) {
  40.         try {
  41.             //获取主体对象
  42.             Subject subject = SecurityUtils.getSubject();
  43.             subject.login(new UsernamePasswordToken(username, password));
  44.             return "redirect:/index.jsp";
  45.         } catch (UnknownAccountException e) {
  46.             e.printStackTrace();
  47.             System.out.println("用户名错误!");
  48.         } catch (IncorrectCredentialsException e) {
  49.             e.printStackTrace();
  50.             System.out.println("密码错误!");
  51.         } catch (Exception e) {
  52.             e.printStackTrace();
  53.             System.out.println(e.getMessage());
  54.         }
  56.         return "redirect:/login.jsp";
  57.     }
  60. }

3.测试

登录正常，登出正常，未登录和登出后不能访问index.jsp

6.7 MD5、Salt的认证实现

6.7.1 用户注册+随机盐处理

1.导入依赖

  1. <!--mybatis相关依赖-->
  2. <dependency>
  3.   <groupId>org.mybatis.spring.boot</groupId>
  4.   <artifactId>mybatis-spring-boot-starter</artifactId>
  5.   <version>2.1.2</version>
  6. </dependency>
  8. <!--mysql-->
  9. <dependency>
  10.   <groupId>mysql</groupId>
  11.   <artifactId>mysql-connector-java</artifactId>
  12.   <version>5.1.38</version>
  13. </dependency>
  16. <!--druid-->
  17. <dependency>
  18.   <groupId>com.alibaba</groupId>
  19.   <artifactId>druid</artifactId>
  20.   <version>1.1.19</version>
  21. </dependency>

2.application.properties

  1. spring.datasource.type=com.alibaba.druid.pool.DruidDataSource
  2. spring.datasource.driver-class-name=com.mysql.jdbc.Driver
  3. spring.datasource.url=jdbc:mysql://localhost:3306/shiro?characterEncoding=UTF-8
  4. spring.datasource.username=root
  5. spring.datasource.password=88888888
  7. mybatis.type-aliases-package=com.lut.entity
  8. mybatis.mapper-locations=classpath:mapper/*.xml

3.创建数据库

  1. SET NAMES utf8mb4;
  2. SET FOREIGN_KEY_CHECKS = 0;
  3. -- ----------------------------
  4. -- Table structure for t_user
  5. -- ----------------------------
  6. DROP TABLE IF EXISTS `t_user`;
  7. CREATE TABLE `t_user` (
  8.   `id` int(6) NOT NULL AUTO_INCREMENT,
  9.   `username` varchar(40) DEFAULT NULL,
  10.   `password` varchar(40) DEFAULT NULL,
  11.   `salt` varchar(255) DEFAULT NULL,
  12.   PRIMARY KEY (`id`)
  13. ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;
  15. SET FOREIGN_KEY_CHECKS = 1;

03、shiro-整合springboot - 图9

4.创建entity

  1. package com.lut.entity;
  3. import lombok.AllArgsConstructor;
  4. import lombok.Data;
  5. import lombok.NoArgsConstructor;
  6. import lombok.experimental.Accessors;
  8. @Data
  9. @Accessors(chain = true)
  10. @AllArgsConstructor
  11. @NoArgsConstructor
  12. public class User {
  13.     private String  id;
  14.     private String username;
  15.     private String password;
  16.     private String salt;
  17. }

5.创建DAO接口

  1. package com.lut.dao;
  2. import com.lut.entity.User;
  3. import org.apache.ibatis.annotations.Mapper;
  5. @Mapper
  6. public interface UserDao {
  8.     void save(User user);
  10. }

6.开发mapper配置文件

注意：mapper文件的位置要在 application.properties配置的目录下面
注意：mapper文件的命名 与 Dao接口保持一致

  1. <?xml version="1.0" encoding="UTF-8" ?>
  2. <!DOCTYPE mapper
  3.         PUBLIC "-//mybatis.org//DTD Config 3.0//EN"
  4.         "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
  6. <mapper namespace="com.lut.dao.UserDao">
  8.     <insert id="save" parameterType="User" useGeneratedKeys="true" keyProperty="id">
  9.         insert into t_user values(#{id},#{username},#{password},#{salt})
  10.     </insert>
  12. </mapper>

在图中，标红的地方要保持命名一致，不然会有莫名其妙的BUG
03、shiro-整合springboot - 图10

7.开发service接口

  1. package com.lut.service;
  3. import com.lut.entity.User;
  5. public interface UserService {
  6.     //注册用户方法
  7.     void register(User user);
  8. }

8.创建salt工具类

  1. package com.lut.utils;
  3. import java.util.Random;
  5. public class SaltUtils {
  6.     /**
  7.      * 生成salt的静态方法
  8.      * @param n
  9.      * @return
  10.      */
  11.     public static String getSalt(int n){
  12.         char[] chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567890!@#$%^&*()".toCharArray();
  13.         StringBuilder sb = new StringBuilder();
  14.         for (int i = 0; i < n; i++) {
  15.             char aChar = chars[new Random().nextInt(chars.length)];
  16.             sb.append(aChar);
  17.         }
  18.         return sb.toString();
  19.     }
  20. }

9.开发service实现类

  1. package com.lut.service;
  3. import com.lut.dao.UserDao;
  4. import com.lut.entity.User;
  5. import com.lut.utils.SaltUtils;
  6. import org.apache.shiro.crypto.hash.Md5Hash;
  7. import org.springframework.beans.factory.annotation.Autowired;
  8. import org.springframework.transaction.annotation.Transactional;
  9. import org.springframework.stereotype.Service;
  11. @Service
  12. @Transactional
  13. public class UserServiceImpl implements UserService {
  15.     @Autowired
  16.     private UserDao userDAO;
  18.     @Override
  19.     public void register(User user) {
  20.         //处理业务调用dao
  21.         //1.生成随机盐
  22.         String salt = SaltUtils.getSalt(8);
  23.         //2.将随机盐保存到数据
  24.         user.setSalt(salt);
  25.         //3.明文密码进行md5 + salt + hash散列
  26.         Md5Hash md5Hash = new Md5Hash(user.getPassword(),salt,1024);
  27.         user.setPassword(md5Hash.toHex());
  29.         userDAO.save(user);
  30.     }
  31. }

10.开发Controller

  1. @Controller
  2. @RequestMapping("user")
  3. public class UserController {
  5.     @Autowired
  6.     private UserService userService;
  8.     /**
  9.      * 用户注册
  10.      */
  11.     @RequestMapping("register")
  12.     public String register(User user) {
  13.         try {
  14.             userService.register(user);
  15.             return "redirect:/login.jsp";
  16.         }catch (Exception e){
  17.             e.printStackTrace();
  18.             return "redirect:/register.jsp";
  19.         }
  20.     }
  21. }

11.设置公共资源

在ShiroConfig中添加

  1. map.put("/user/register","anon");//anon 设置为公共资源 
  2. map.put("/register.jsp","anon");//anon 设置为公共资源

12.测试

添加成功
03、shiro-整合springboot - 图11

6.7.2 开发数据库认证

1.开发DAO

  1. @Mapper
  2. public interface UserDAO {
  4.     void save(User user);
  5.     //根据身份信息认证的方法
  6.     User findByUserName(String username);
  7. }

2.开发mapper配置文件

  1. <select id="findByUserName" parameterType="String" resultType="User">
  2.   select id,username,password,salt from t_user
  3.   where username = #{username}
  4. </select>

3.开发Service接口

  1. public interface UserService {
  2.     //注册用户方法
  3.     void register(User user);
  4.     //根据用户名查询业务的方法
  5.     User findByUserName(String username);
  6. }

4.开发Service实现类

注意：一定别忘记添加注解：@Service(“userService”)

  1. @Service("userService")
  2. @Transactional
  3. public class UserServiceImpl implements UserService {
  4.     @Autowired
  5.     private UserDAO userDAO;
  6.     @Override
  7.     public User findByUserName(String username) {
  8.         return userDAO.findByUserName(username);
  9.     }
  10. }

5.开发工厂工具类

在工厂中获取bean对象的工具类
ApplicationContextUtils

  1. package com.lut.utils;
  3. import org.springframework.beans.BeansException;
  4. import org.springframework.context.ApplicationContext;
  5. import org.springframework.context.ApplicationContextAware;
  6. import org.springframework.stereotype.Component;
  8. @Component
  9. public class ApplicationContextUtils implements ApplicationContextAware {
  11.     private static ApplicationContext context;
  13.     @Override
  14.     public void setApplicationContext(ApplicationContext applicationContext) throws BeansException {
  15.         this.context = applicationContext;
  16.     }
  18.     //根据bean名字获取工厂中指定bean 对象
  19.     public static Object getBean(String beanName){
  20.         System.out.println("beanName"+beanName);
  21.         Object object=context.getBean(beanName);
  22.         System.out.println("object"+object);
  23.         return context.getBean(beanName);
  24.     }
  25. }

6.修改自定义realm

  1. //自定义realm
  2. public class CustomerRealm extends AuthorizingRealm {
  4.     @Override
  5.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  6.         return null;
  7.     }
  9.     @Override
  10.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  12.         //根据身份信息//从传过来的token获取到的用户名
  13.         String principal = (String) token.getPrincipal();
  15.         //在工厂中获取service对象
  16.         UserService userService = (UserService) ApplicationContextUtils.getBean("userService");
  18.         //根据身份信息查询
  19.         User user = userService.findByUserName(principal);
  20.         System.out.println("User:"+user);
  22.         //用户不为空
  23.         if(!ObjectUtils.isEmpty(user)){
  24.             //返回数据库信息
  25.             SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(),
  26.                     ByteSource.Util.bytes(user.getSalt()), this.getName());
  27.             return simpleAuthenticationInfo;
  28.         }
  30.         return null;
  31.     }
  33. }

7.修改ShiroConfig中realm

使用凭证匹配器以及hash散列
以及在 getShiroFilterFactoryBean 中添加公共资源

  1. package com.lut.config;
  2. import com.lut.shiro.realms.CustomerRealm;
  3. import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
  4. import org.apache.shiro.realm.Realm;
  5. import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
  6. import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
  7. import org.springframework.context.annotation.Bean;
  8. import org.springframework.context.annotation.Configuration;
  10. import java.util.HashMap;
  11. import java.util.Map;
  13. /**
  14.  * 用来整合shiro框架相关的配置类
  15.  */
  16. @Configuration
  17. public class ShiroConfig {
  19.     //1.创建shiroFilter  //负责拦截所有请求
  20.     @Bean
  21.     public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager){
  23.         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  24.         //给filter设置安全管理器
  25.         shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
  27.         //配置系统受限资源
  28.         //配置系统公共资源
  29.         Map<String,String> map = new HashMap<String,String>();
  30.         map.put("/user/login","anon");//anon 设置为公共资源  放行资源放在下面
  31.         map.put("/user/register","anon");//anon 设置为公共资源  放行资源放在下面
  32.         map.put("/register.jsp","anon");//anon 设置为公共资源  放行资源放在下面
  33.         map.put("/user/getImage","anon");
  35.         map.put("/**","authc");//authc 请求这个资源需要认证和授权
  37.         //默认认证界面路径---当认证不通过时跳转
  38.         shiroFilterFactoryBean.setLoginUrl("/login.jsp");
  39.         shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
  41.         return shiroFilterFactoryBean;
  42.     }
  44.     //2.创建安全管理器
  45.     @Bean
  46.     public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm){
  47.         DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
  48.         //给安全管理器设置
  49.         defaultWebSecurityManager.setRealm(realm);
  51.         return defaultWebSecurityManager;
  52.     }
  54.     @Bean
  55.     public Realm getRealm(){
  56.         CustomerRealm customerRealm = new CustomerRealm();
  58.         //设置hashed凭证匹配器
  59.         HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
  61.         //设置md5加密
  62.         credentialsMatcher.setHashAlgorithmName("md5");
  64.         //设置散列次数
  65.         credentialsMatcher.setHashIterations(1024);
  66.         customerRealm.setCredentialsMatcher(credentialsMatcher);
  67.         return customerRealm;
  68.     }
  70. }

8.启动测试

03、shiro-整合springboot - 图12

6.8 授权实现

6.8.1 没有数据库

1.页面资源授权

  1. <%@page contentType="text/html;utf-8" pageEncoding="utf-8" isELIgnored="false" %>
  2. <%@taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
  3. <!doctype html>
  4. <html lang="en">
  5. <head>
  6.     <meta charset="UTF-8">
  7.     <meta name="viewport"
  8.           content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
  9.     <meta http-equiv="X-UA-Compatible" content="ie=edge">
  10.     <title>Document</title>
  11. </head>
  12. <body>
  13. <%--    受限资源--%>
  14. <h1>系统主页</h1>
  15. <a href="${pageContext.request.contextPath}/user/logout">退出登录</a>
  16. <ul>
  19.     <shiro:hasAnyRoles name="user_manager,admin,addinfo_manager">
  20.         <li><a href="">用户管理</a>
  21.             <ul>
  22.                 <shiro:hasPermission name="user:add:*">
  23.                     <li><a href="">添加</a></li>
  24.                 </shiro:hasPermission>
  25.                 <shiro:hasPermission name="user:delete:*">
  26.                     <li><a href="">删除</a></li>
  27.                 </shiro:hasPermission>
  28.                 <shiro:hasPermission name="user:update:*">
  29.                     <li><a href="">修改</a></li>
  30.                 </shiro:hasPermission>
  31.                 <shiro:hasPermission name="user:find:*">
  32.                     <li><a href="">查询</a></li>
  33.                 </shiro:hasPermission>
  34.             </ul>
  35.         </li>
  36.     </shiro:hasAnyRoles>
  37.     <shiro:hasAnyRoles name="order_manager,admin,addinfo_manager">
  38.         <li><a href="">订单管理</a></li>
  39.         <ul>
  40.             <shiro:hasPermission name="order:add:*">
  41.                 <li><a href="">添加</a></li>
  42.             </shiro:hasPermission>
  43.             <shiro:hasPermission name="order:delete:*">
  44.                 <li><a href="">删除</a></li>
  45.             </shiro:hasPermission>
  46.             <shiro:hasPermission name="order:update:*">
  47.                 <li><a href="">修改</a></li>
  48.             </shiro:hasPermission>
  49.             <shiro:hasPermission name="order:find:*">
  50.                 <li><a href="">查询</a></li>
  51.             </shiro:hasPermission>
  52.         </ul>
  53.     </shiro:hasAnyRoles>
  54.     <shiro:hasRole name="admin">
  55.         <li><a href="">商品管理</a></li>
  56.         <li><a href="">物流管理</a></li>
  57.     </shiro:hasRole>
  59.     <shiro:hasRole name="user">
  60.         <li><a href="">仅普通用户可见</a></li>
  61.         <li><a href="">公共资源</a></li>
  62.     </shiro:hasRole>
  63. </ul>
  64. </body>
  65. </html>

2.代码方式授权

  1. @RequestMapping("save")
  2. public String save(){
  3.   System.out.println("进入方法");
  5.   //基于角色
  6.   //获取主体对象
  7.   Subject subject = SecurityUtils.getSubject();
  8.   //代码方式
  9.   if (subject.hasRole("admin")) {
  10.     System.out.println("保存订单!");
  11.   }else{
  12.     System.out.println("无权访问!");
  13.   }
  14.   //基于权限字符串
  15.   //....
  16.   return "redirect:/index.jsp";
  17. }

3.方法调用授权

  • @RequiresRoles 用来基于角色进行授权
  • @RequiresPermissions 用来基于权限进行授权 ```java import org.apache.shiro.authz.annotation.RequiresPermissions; import org.apache.shiro.authz.annotation.RequiresRoles; import org.springframework.stereotype.Controller; import org.springframework.web.bind.annotation.RequestMapping;

@Controller @RequestMapping(“order”) public class OrderController {

  1. @RequiresRoles(value={"admin","user"})//用来判断角色  同时具有 admin user
  2. @RequiresPermissions("user:update:01") //用来判断权限字符串
  3. @RequestMapping("save")
  4. public String save(){
  5.     System.out.println("进入方法");
  6.     return "redirect:/index.jsp";
  7. }

}

  1. <a name="xVBHj"></a>
  2. ### 6.8.2 连接数据库
  4. <a name="xtO0f"></a>
  5. #### 4.授权数据持久化
  7. ![](https://cdn.nlark.com/yuque/0/2021/png/12558654/1617111130720-8cfe6178-d206-4db6-99ad-508b6a25090f.png#crop=0&crop=0&crop=1&crop=1&height=802&id=ewgKl&originHeight=802&originWidth=2190&originalType=binary&ratio=1&rotation=0&showTitle=false&size=0&status=done&style=none&title=&width=2190)
  9. ```sql
  10. SET NAMES utf8mb4;
  11. SET FOREIGN_KEY_CHECKS = 0;
  13. -- ----------------------------
  14. -- Table structure for t_perms
  15. -- ----------------------------
  16. DROP TABLE IF EXISTS `t_perms`;
  17. CREATE TABLE `t_pers` (
  18.   `id` int(6) NOT NULL AUTO_INCREMENT,
  19.   `name` varchar(80) DEFAULT NULL,
  20.   `url` varchar(255) DEFAULT NULL,
  21.   PRIMARY KEY (`id`)
  22. ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
  24. -- ----------------------------
  25. -- Table structure for t_role
  26. -- ----------------------------
  27. DROP TABLE IF EXISTS `t_role`;
  28. CREATE TABLE `t_role` (
  29.   `id` int(6) NOT NULL AUTO_INCREMENT,
  30.   `name` varchar(60) DEFAULT NULL,
  31.   PRIMARY KEY (`id`)
  32. ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
  34. -- ----------------------------
  35. -- Table structure for t_role_perms
  36. -- ----------------------------
  37. DROP TABLE IF EXISTS `t_role_perms`;
  38. CREATE TABLE `t_role_perms` (
  39.   `id` int(6) NOT NULL,
  40.   `roleid` int(6) DEFAULT NULL,
  41.   `permsid` int(6) DEFAULT NULL,
  42.   PRIMARY KEY (`id`)
  43. ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
  45. -- ----------------------------
  46. -- Table structure for t_user
  47. -- ----------------------------
  48. DROP TABLE IF EXISTS `t_user`;
  49. CREATE TABLE `t_user` (
  50.   `id` int(6) NOT NULL AUTO_INCREMENT,
  51.   `username` varchar(40) DEFAULT NULL,
  52.   `password` varchar(40) DEFAULT NULL,
  53.   `salt` varchar(255) DEFAULT NULL,
  54.   PRIMARY KEY (`id`)
  55. ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;
  57. -- ----------------------------
  58. -- Table structure for t_user_role
  59. -- ----------------------------
  60. DROP TABLE IF EXISTS `t_user_role`;
  61. CREATE TABLE `t_user_role` (
  62.   `id` int(6) NOT NULL,
  63.   `userid` int(6) DEFAULT NULL,
  64.   `roleid` int(6) DEFAULT NULL,
  65.   PRIMARY KEY (`id`)
  66. ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
  68. SET FOREIGN_KEY_CHECKS = 1;

03、shiro-整合springboot - 图13

5.创建实体类

User

  1. @Data
  2. @Accessors(chain = true)
  3. @AllArgsConstructor
  4. @NoArgsConstructor
  5. public class User implements Serializable {
  6.     private String id;
  7.     private String username;
  8.     private String password;
  9.     private String salt;
  11.     //定义角色集合
  12.     private List<Role> roles;
  14. }

Role

  1. @Data
  2. @Accessors(chain = true)
  3. @AllArgsConstructor
  4. @NoArgsConstructor
  5. public class Perms implements Serializable {
  6.     private String id;
  7.     private String name;
  8.     private String url;
  9. }

6.创建dao方法

  1. //根据用户名查询所有角色
  2. User findRolesByUserName(String username);
  3. //根据角色id查询权限集合
  4. List<Perms> findPermsByRoleId(String id);

7.mapper实现

  1. <resultMap id="userMap" type="User">
  2.   <id column="uid" property="id"/>
  3.   <result column="username" property="username"/>
  4.   <!--角色信息-->
  5.   <collection property="roles" javaType="list" ofType="Role">
  6.     <id column="id" property="id"/>
  7.     <result column="rname" property="name"/>
  8.   </collection>
  9. </resultMap>
  11. <select id="findRolesByUserName" parameterType="String" resultMap="userMap">
  12.   SELECT u.id uid,u.username,r.id,r.NAME rname
  13.   FROM t_user u
  14.   LEFT JOIN t_user_role ur
  15.   ON u.id=ur.userid
  16.   LEFT JOIN t_role r
  17.   ON ur.roleid=r.id
  18.   WHERE u.username=#{username}
  19. </select>
  21. <select id="findPermsByRoleId" parameterType="String" resultType="Perms">
  22.   SELECT p.id,p.NAME,p.url,r.NAME
  23.   FROM t_role r
  24.   LEFT JOIN t_role_perms rp
  25.   ON r.id=rp.roleid
  26.   LEFT JOIN t_perms p ON rp.permsid=p.id
  27.   WHERE r.id=#{id}
  28. </select>

8.Service接口

  1. //根据用户名查询所有角色
  2. User findRolesByUserName(String username);
  3. //根据角色id查询权限集合
  4. List<Perms> findPermsByRoleId(String id);

9.Service实现

  1. @Override
  2. public List<Perms> findPermsByRoleId(String id) {
  3.   return userDAO.findPermsByRoleId(id);
  4. }
  6. @Override
  7. public User findRolesByUserName(String username) {
  8.   return userDAO.findRolesByUserName(username);
  9. }

10.修改自定义realm

注意：如果你创建了一个用户，并为这个用户授予了一个角色，但这个角色并未关联任何的 授权字符串，那么调用数据库获得的结果是 List perms=[null]，此时 perms已经被初始化，里面只有一个属性null，使用判空的方法无法判别，此时继续遍历会报出空指针异常，此时应当添加判断条件 perms.get(0)!=null

  1. package com.lut.shiro.realms;
  2. import com.lut.entity.Perms;
  3. import com.lut.entity.User;
  4. import com.lut.service.UserService;
  5. import com.lut.utils.ApplicationContextUtils;
  6. import org.apache.shiro.authc.AuthenticationException;
  7. import org.apache.shiro.authc.AuthenticationInfo;
  8. import org.apache.shiro.authc.AuthenticationToken;
  9. import org.apache.shiro.authc.SimpleAuthenticationInfo;
  10. import org.apache.shiro.authz.AuthorizationInfo;
  11. import org.apache.shiro.authz.SimpleAuthorizationInfo;
  12. import org.apache.shiro.realm.AuthorizingRealm;
  13. import org.apache.shiro.subject.PrincipalCollection;
  14. import org.apache.shiro.util.ByteSource;
  15. import org.springframework.util.CollectionUtils;
  16. import org.springframework.util.ObjectUtils;
  18. import java.util.List;
  21. //自定义realm
  22. public class CustomerRealm extends AuthorizingRealm {
  24.     @Override
  25.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
  26.         //获取身份信息
  27.         String primaryPrincipal = (String) principals.getPrimaryPrincipal();
  28.         System.out.println("调用授权验证: "+primaryPrincipal);
  29.         //根据主身份信息获取角色 和 权限信息
  30.         UserService userService = (UserService) ApplicationContextUtils.getBean("userService");
  31.         User user = userService.findRolesByUserName(primaryPrincipal);
  33.         System.out.println("user:"+user);
  35.         //授权角色信息
  36.         if(!CollectionUtils.isEmpty(user.getRoles())){
  38.             SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
  40.             user.getRoles().forEach(role->{
  41.                 simpleAuthorizationInfo.addRole(role.getName()); //添加角色信息
  43.                 //权限信息
  44.                 List<Perms> perms = userService.findPermsByRoleId(role.getId());
  45.                 System.out.println("perms:"+perms);
  47.                 if(!CollectionUtils.isEmpty(perms) && perms.get(0)!=null ){
  48.                     perms.forEach(perm->{
  49.                         simpleAuthorizationInfo.addStringPermission(perm.getName());
  50.                     });
  51.                 }
  52.             });
  53.             return simpleAuthorizationInfo;
  54.         }
  55.         return null;
  56.     }
  58.     @Override
  59.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  61.         //根据身份信息//从传过来的token获取到的用户名
  62.         String principal = (String) token.getPrincipal();
  64.         //在工厂中获取service对象
  65.         UserService userService = (UserService) ApplicationContextUtils.getBean("userService");
  67.         //根据身份信息查询
  68.         User user = userService.findByUserName(principal);
  69.         System.out.println("User:"+user);
  71.         //用户不为空
  72.         if(!ObjectUtils.isEmpty(user)){
  73.             //返回数据库信息
  74.             SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(),
  75.                     ByteSource.Util.bytes(user.getSalt()), this.getName());
  76.             return simpleAuthenticationInfo;
  77.         }
  79.         return null;
  80.     }
  82. }

11.向数据库添加信息

03、shiro-整合springboot - 图14

简单来说：

用户 admin 具有 admin的角色，具有 对于 user，order的所有权限

用户 zhangsan 具有 user的角色，没有权限，只能访问公共资源

用户 usermanager 具有 user_manager的角色，具有 对于 user的所有权限

用户 ordermanager 具有 order_manager的角色，具有 对于 order的所有权限

用户 addinfomanager 具有 addinfo_manager的角色，具有 对于 user,order 的添加权限

12.启动测试

03、shiro-整合springboot - 图15

6.9 使用CacheManager

6.9.1 Cache 作用

  • Cache 缓存: 计算机内存中一段数据
  • 作用: 用来减轻DB的访问压力,从而提高系统的查询效率
  • 流程:

03、shiro-整合springboot - 图16

6.9.2 使用shiro中默认EhCache实现缓存

1.引入依赖

  1. <!--引入shiro和ehcache-->
  2. <dependency>
  3.   <groupId>org.apache.shiro</groupId>
  4.   <artifactId>shiro-ehcache</artifactId>
  5.   <version>1.5.3</version>
  6. </dependency>

2.开启缓存

  1. //3.创建自定义realm
  2.     @Bean
  3.     public Realm getRealm(){
  4.         CustomerRealm customerRealm = new CustomerRealm();
  5.         //修改凭证校验匹配器
  6.         HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
  7.         //设置加密算法为md5
  8.         credentialsMatcher.setHashAlgorithmName("MD5");
  9.         //设置散列次数
  10.         credentialsMatcher.setHashIterations(1024);
  11.         customerRealm.setCredentialsMatcher(credentialsMatcher);
  13.         //开启缓存管理器
  14.         customerRealm.setCachingEnabled(true);
  15.         customerRealm.setAuthorizationCachingEnabled(true);
  16.         customerRealm.setAuthorizationCachingEnabled(true);
  17.         customerRealm.setCacheManager(new EhCacheManager());
  18.         return customerRealm;
  19.     }

3.启动刷新页面进行测试

  • 注意:如果控制台没有任何sql展示说明缓存已经开启

6.9.3 shiro中使用Redis作为缓存实现

1.引入redis依赖

  1. <!--redis整合springboot-->
  2. <dependency>
  3.   <groupId>org.springframework.boot</groupId>
  4.   <artifactId>spring-boot-starter-data-redis</artifactId>
  5. </dependency>

2.配置redis连接

  1. spring.redis.port=6379
  2. spring.redis.host=localhost
  3. spring.redis.database=0

3.启动redis服务

03、shiro-整合springboot - 图17

4.开发RedisCacheManager

自定义shiro缓存管理器

  1. package com.lut.shiro.cache;
  3. import org.apache.shiro.cache.Cache;
  4. import org.apache.shiro.cache.CacheException;
  5. import org.apache.shiro.cache.CacheManager;
  7. //自定义shiro缓存管理器
  8. public class RedisCacheManager implements CacheManager {
  10.     //参数1:认证或者是授权缓存的统一名称
  11.     @Override
  12.     public <K, V> Cache<K, V> getCache(String cacheName) throws CacheException {
  13.         System.out.println(cacheName);
  14.         return new RedisCache<K,V>(cacheName);
  15.     }
  16. }

5.开RedisCache实现

自定义redis缓存的实现

  1. package com.lut.shiro.cache;
  3. import com.lut.utils.ApplicationContextUtils;
  4. import org.apache.shiro.cache.Cache;
  5. import org.apache.shiro.cache.CacheException;
  6. import org.springframework.data.redis.core.RedisTemplate;
  7. import org.springframework.data.redis.serializer.StringRedisSerializer;
  9. import java.util.Collection;
  10. import java.util.Set;
  12. //自定义redis缓存的实现
  13. public class RedisCache<k,v> implements Cache<k,v> {
  15.     private String cacheName;
  17.     public RedisCache() {
  18.     }
  20.     public RedisCache(String cacheName) {
  21.         this.cacheName = cacheName;
  22.     }
  24.     @Override
  25.     public v get(k k) throws CacheException {
  26.         System.out.println("get key:"+k);
  27.         return (v) getRedisTemplate().opsForHash().get(this.cacheName,k.toString());
  28.     }
  30.     @Override
  31.     public v put(k k, v v) throws CacheException {
  32.         System.out.println("put key: "+k);
  33.         System.out.println("put value:"+v);
  34.         getRedisTemplate().opsForHash().put(this.cacheName,k.toString(),v);
  35.         return null;
  36.     }
  38.     @Override
  39.     public v remove(k k) throws CacheException {
  40.         System.out.println("=============remove=============");
  41.         return (v) getRedisTemplate().opsForHash().delete(this.cacheName,k.toString());
  42.     }
  44.     @Override
  45.     public void clear() throws CacheException {
  46.         System.out.println("=============clear==============");
  47.         getRedisTemplate().delete(this.cacheName);
  48.     }
  50.     @Override
  51.     public int size() {
  52.         return getRedisTemplate().opsForHash().size(this.cacheName).intValue();
  53.     }
  55.     @Override
  56.     public Set<k> keys() {
  57.         return getRedisTemplate().opsForHash().keys(this.cacheName);
  58.     }
  60.     @Override
  61.     public Collection<v> values() {
  62.         return getRedisTemplate().opsForHash().values(this.cacheName);
  63.     }
  65.     private RedisTemplate getRedisTemplate(){
  66.         RedisTemplate redisTemplate = (RedisTemplate) ApplicationContextUtils.getBean("redisTemplate");
  67.         redisTemplate.setKeySerializer(new StringRedisSerializer());
  68.         redisTemplate.setHashKeySerializer(new StringRedisSerializer());
  69.         return redisTemplate;
  70.     }
  71. }

6.启动项目测试发现报错

03、shiro-整合springboot - 图18

03、shiro-整合springboot - 图19

  • 错误解释: 由于shiro中提供的simpleByteSource实现没有实现序列化,所有在认证时出现错误信息
  • 解决方案:需要自动salt实现序列化
    • 实现 实体类 序列化
    • 自定义salt实现 实现序列化接口


  1. package com.lut.shiro.salt;
  3. import org.apache.shiro.codec.Base64;
  4. import org.apache.shiro.codec.CodecSupport;
  5. import org.apache.shiro.codec.Hex;
  6. import org.apache.shiro.util.ByteSource;
  7. import java.io.File;
  8. import java.io.InputStream;
  9. import java.io.Serializable;
  10. import java.util.Arrays;
  12. //自定义salt实现 实现序列化接口
  13. public class MyByteSource implements ByteSource, Serializable {
  14.   private  byte[] bytes;
  15.   private String cachedHex;
  16.   private String cachedBase64;
  18.   public MyByteSource(){
  20.   }
  22.   public MyByteSource(byte[] bytes) {
  23.       this.bytes = bytes;
  24.   }
  26.   public MyByteSource(char[] chars) {
  27.       this.bytes = CodecSupport.toBytes(chars);
  28.   }
  30.   public MyByteSource(String string) {
  31.       this.bytes = CodecSupport.toBytes(string);
  32.   }
  34.   public MyByteSource(ByteSource source) {
  35.       this.bytes = source.getBytes();
  36.   }
  38.   public MyByteSource(File file) {
  39.       this.bytes = (new com.lut.shiro.salt.MyByteSource.BytesHelper()).getBytes(file);
  40.   }
  42.   public MyByteSource(InputStream stream) {
  43.       this.bytes = (new com.lut.shiro.salt.MyByteSource.BytesHelper()).getBytes(stream);
  44.   }
  46.   public static boolean isCompatible(Object o) {
  47.       return o instanceof byte[] || o instanceof char[] || o instanceof String || o instanceof ByteSource || o instanceof File || o instanceof InputStream;
  48.   }
  50.   public byte[] getBytes() {
  51.       return this.bytes;
  52.   }
  54.   public boolean isEmpty() {
  55.       return this.bytes == null || this.bytes.length == 0;
  56.   }
  58.   public String toHex() {
  59.       if (this.cachedHex == null) {
  60.           this.cachedHex = Hex.encodeToString(this.getBytes());
  61.       }
  63.       return this.cachedHex;
  64.   }
  66.   public String toBase64() {
  67.       if (this.cachedBase64 == null) {
  68.           this.cachedBase64 = Base64.encodeToString(this.getBytes());
  69.       }
  71.       return this.cachedBase64;
  72.   }
  74.   public String toString() {
  75.       return this.toBase64();
  76.   }
  78.   public int hashCode() {
  79.       return this.bytes != null && this.bytes.length != 0 ? Arrays.hashCode(this.bytes) : 0;
  80.   }
  82.   public boolean equals(Object o) {
  83.       if (o == this) {
  84.           return true;
  85.       } else if (o instanceof ByteSource) {
  86.           ByteSource bs = (ByteSource)o;
  87.           return Arrays.equals(this.getBytes(), bs.getBytes());
  88.       } else {
  89.           return false;
  90.       }
  91.   }
  93.   private static final class BytesHelper extends CodecSupport {
  94.       private BytesHelper() {
  95.       }
  97.       public byte[] getBytes(File file) {
  98.           return this.toBytes(file);
  99.       }
  101.       public byte[] getBytes(InputStream stream) {
  102.           return this.toBytes(stream);
  103.       }
  104.   }
  2. - 在realm中使用自定义salt
  4. ```java
  5. @Override
  6. protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
  7.   System.out.println("==========================");
  8.   //根据身份信息
  9.   String principal = (String) token.getPrincipal();
  10.   //在工厂中获取service对象
  11.   UserService userService = (UserService) ApplicationContextUtils.getBean("userService");
  12.   User user = userService.findByUserName(principal);
  13.   if(!ObjectUtils.isEmpty(user)){
  14.     return new SimpleAuthenticationInfo(user.getUsername(),user.getPassword(), 
  15.                                       new MyByteSource(user.getSalt()),this.getName());
  16.   }
  17.   return null;
  18. }

03、shiro-整合springboot - 图20

7.再次启动测试,发现可以成功放入redis缓存

03、shiro-整合springboot - 图21

03、shiro-整合springboot - 图22

6.9.4 加入验证码验证

1.验证码工具类

  1. package com.lut.utils;
  3. import javax.imageio.ImageIO;
  4. import java.awt.*;
  5. import java.awt.geom.AffineTransform;
  6. import java.awt.image.BufferedImage;
  7. import java.io.File;
  8. import java.io.FileOutputStream;
  9. import java.io.IOException;
  10. import java.io.OutputStream;
  11. import java.util.Arrays;
  12. import java.util.Random;
  14. /**
  15.  *@创建人  cx
  16.  *@创建时间  2018/11/27 17:36
  17.  *@描述   验证码生成
  18.  */
  19. public class VerifyCodeUtils{
  21.     //使用到Algerian字体，系统里没有的话需要安装字体，字体只显示大写，去掉了1,0,i,o几个容易混淆的字符
  22.     public static final String VERIFY_CODES = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
  23.     private static Random random = new Random();
  26.     /**
  27.      * 使用系统默认字符源生成验证码
  28.      * @param verifySize    验证码长度
  29.      * @return
  30.      */
  31.     public static String generateVerifyCode(int verifySize){
  32.         return generateVerifyCode(verifySize, VERIFY_CODES);
  33.     }
  34.     /**
  35.      * 使用指定源生成验证码
  36.      * @param verifySize    验证码长度
  37.      * @param sources   验证码字符源
  38.      * @return
  39.      */
  40.     public static String generateVerifyCode(int verifySize, String sources){
  41.         if(sources == null || sources.length() == 0){
  42.             sources = VERIFY_CODES;
  43.         }
  44.         int codesLen = sources.length();
  45.         Random rand = new Random(System.currentTimeMillis());
  46.         StringBuilder verifyCode = new StringBuilder(verifySize);
  47.         for(int i = 0; i < verifySize; i++){
  48.             verifyCode.append(sources.charAt(rand.nextInt(codesLen-1)));
  49.         }
  50.         return verifyCode.toString();
  51.     }
  53.     /**
  54.      * 生成随机验证码文件,并返回验证码值
  55.      * @param w
  56.      * @param h
  57.      * @param outputFile
  58.      * @param verifySize
  59.      * @return
  60.      * @throws IOException
  61.      */
  62.     public static String outputVerifyImage(int w, int h, File outputFile, int verifySize) throws IOException{
  63.         String verifyCode = generateVerifyCode(verifySize);
  64.         outputImage(w, h, outputFile, verifyCode);
  65.         return verifyCode;
  66.     }
  68.     /**
  69.      * 输出随机验证码图片流,并返回验证码值
  70.      * @param w
  71.      * @param h
  72.      * @param os
  73.      * @param verifySize
  74.      * @return
  75.      * @throws IOException
  76.      */
  77.     public static String outputVerifyImage(int w, int h, OutputStream os, int verifySize) throws IOException{
  78.         String verifyCode = generateVerifyCode(verifySize);
  79.         outputImage(w, h, os, verifyCode);
  80.         return verifyCode;
  81.     }
  83.     /**
  84.      * 生成指定验证码图像文件
  85.      * @param w
  86.      * @param h
  87.      * @param outputFile
  88.      * @param code
  89.      * @throws IOException
  90.      */
  91.     public static void outputImage(int w, int h, File outputFile, String code) throws IOException{
  92.         if(outputFile == null){
  93.             return;
  94.         }
  95.         File dir = outputFile.getParentFile();
  96.         if(!dir.exists()){
  97.             dir.mkdirs();
  98.         }
  99.         try{
  100.             outputFile.createNewFile();
  101.             FileOutputStream fos = new FileOutputStream(outputFile);
  102.             outputImage(w, h, fos, code);
  103.             fos.close();
  104.         } catch(IOException e){
  105.             throw e;
  106.         }
  107.     }
  109.     /**
  110.      * 输出指定验证码图片流
  111.      * @param w
  112.      * @param h
  113.      * @param os
  114.      * @param code
  115.      * @throws IOException
  116.      */
  117.     public static void outputImage(int w, int h, OutputStream os, String code) throws IOException{
  118.         int verifySize = code.length();
  119.         BufferedImage image = new BufferedImage(w, h, BufferedImage.TYPE_INT_RGB);
  120.         Random rand = new Random();
  121.         Graphics2D g2 = image.createGraphics();
  122.         g2.setRenderingHint(RenderingHints.KEY_ANTIALIASING,RenderingHints.VALUE_ANTIALIAS_ON);
  123.         Color[] colors = new Color[5];
  124.         Color[] colorSpaces = new Color[] { Color.WHITE, Color.CYAN,
  125.                 Color.GRAY, Color.LIGHT_GRAY, Color.MAGENTA, Color.ORANGE,
  126.                 Color.PINK, Color.YELLOW };
  127.         float[] fractions = new float[colors.length];
  128.         for(int i = 0; i < colors.length; i++){
  129.             colors[i] = colorSpaces[rand.nextInt(colorSpaces.length)];
  130.             fractions[i] = rand.nextFloat();
  131.         }
  132.         Arrays.sort(fractions);
  134.         g2.setColor(Color.GRAY);// 设置边框色
  135.         g2.fillRect(0, 0, w, h);
  137.         Color c = getRandColor(200, 250);
  138.         g2.setColor(c);// 设置背景色
  139.         g2.fillRect(0, 2, w, h-4);
  141.         //绘制干扰线
  142.         Random random = new Random();
  143.         g2.setColor(getRandColor(160, 200));// 设置线条的颜色
  144.         for (int i = 0; i < 20; i++) {
  145.             int x = random.nextInt(w - 1);
  146.             int y = random.nextInt(h - 1);
  147.             int xl = random.nextInt(6) + 1;
  148.             int yl = random.nextInt(12) + 1;
  149.             g2.drawLine(x, y, x + xl + 40, y + yl + 20);
  150.         }
  152.         // 添加噪点
  153.         float yawpRate = 0.05f;// 噪声率
  154.         int area = (int) (yawpRate * w * h);
  155.         for (int i = 0; i < area; i++) {
  156.             int x = random.nextInt(w);
  157.             int y = random.nextInt(h);
  158.             int rgb = getRandomIntColor();
  159.             image.setRGB(x, y, rgb);
  160.         }
  162.         shear(g2, w, h, c);// 使图片扭曲
  164.         g2.setColor(getRandColor(100, 160));
  165.         int fontSize = h-4;
  166.         Font font = new Font("Algerian", Font.ITALIC, fontSize);
  167.         g2.setFont(font);
  168.         char[] chars = code.toCharArray();
  169.         for(int i = 0; i < verifySize; i++){
  170.             AffineTransform affine = new AffineTransform();
  171.             affine.setToRotation(Math.PI / 4 * rand.nextDouble() * (rand.nextBoolean() ? 1 : -1), (w / verifySize) * i + fontSize/2, h/2);
  172.             g2.setTransform(affine);
  173.             g2.drawChars(chars, i, 1, ((w-10) / verifySize) * i + 5, h/2 + fontSize/2 - 10);
  174.         }
  176.         g2.dispose();
  177.         ImageIO.write(image, "jpg", os);
  178.     }
  180.     private static Color getRandColor(int fc, int bc) {
  181.         if (fc > 255)
  182.             fc = 255;
  183.         if (bc > 255)
  184.             bc = 255;
  185.         int r = fc + random.nextInt(bc - fc);
  186.         int g = fc + random.nextInt(bc - fc);
  187.         int b = fc + random.nextInt(bc - fc);
  188.         return new Color(r, g, b);
  189.     }
  191.     private static int getRandomIntColor() {
  192.         int[] rgb = getRandomRgb();
  193.         int color = 0;
  194.         for (int c : rgb) {
  195.             color = color << 8;
  196.             color = color | c;
  197.         }
  198.         return color;
  199.     }
  201.     private static int[] getRandomRgb() {
  202.         int[] rgb = new int[3];
  203.         for (int i = 0; i < 3; i++) {
  204.             rgb[i] = random.nextInt(255);
  205.         }
  206.         return rgb;
  207.     }
  209.     private static void shear(Graphics g, int w1, int h1, Color color) {
  210.         shearX(g, w1, h1, color);
  211.         shearY(g, w1, h1, color);
  212.     }
  214.     private static void shearX(Graphics g, int w1, int h1, Color color) {
  216.         int period = random.nextInt(2);
  218.         boolean borderGap = true;
  219.         int frames = 1;
  220.         int phase = random.nextInt(2);
  222.         for (int i = 0; i < h1; i++) {
  223.             double d = (double) (period >> 1)
  224.                     * Math.sin((double) i / (double) period
  225.                     + (6.2831853071795862D * (double) phase)
  226.                     / (double) frames);
  227.             g.copyArea(0, i, w1, 1, (int) d, 0);
  228.             if (borderGap) {
  229.                 g.setColor(color);
  230.                 g.drawLine((int) d, i, 0, i);
  231.                 g.drawLine((int) d + w1, i, w1, i);
  232.             }
  233.         }
  235.     }
  237.     private static void shearY(Graphics g, int w1, int h1, Color color) {
  239.         int period = random.nextInt(40) + 10; // 50;
  241.         boolean borderGap = true;
  242.         int frames = 20;
  243.         int phase = 7;
  244.         for (int i = 0; i < w1; i++) {
  245.             double d = (double) (period >> 1)
  246.                     * Math.sin((double) i / (double) period
  247.                     + (6.2831853071795862D * (double) phase)
  248.                     / (double) frames);
  249.             g.copyArea(i, 0, 1, h1, 0, (int) d);
  250.             if (borderGap) {
  251.                 g.setColor(color);
  252.                 g.drawLine(i, (int) d, i, 0);
  253.                 g.drawLine(i, (int) d + h1, i, h1);
  254.             }
  256.         }
  258.     }
  259.     public static void main(String[] args) throws IOException {
  260.         //获取验证码
  261.         String s = generateVerifyCode(4);
  262.         //将验证码放入图片中
  263.         outputImage(260,60,new File("/Users/chenyannan/Desktop/安工资料/aa.jpg"),s);
  264.         System.out.println(s);
  265.     }
  266. }

2.开发页面加入验证码

  1.     <form action="${pageContext.request.contextPath}/user/login" method="post">
  2.         用户名:<input type="text" name="username" > <br/>
  3.         密码  : <input type="text" name="password"> <br>
  4.         请输入验证码: <input type="text" name="code"><img src="${pageContext.request.contextPath}/user/getImage" alt=""><br>
  5.         <input type="submit" value="登录">
  6.     </form>

3.开发控制器

  1. @RequestMapping("getImage")
  2. public void getImage(HttpSession session, HttpServletResponse response) throws IOException {
  3.   //生成验证码
  4.   String code = VerifyCodeUtils.generateVerifyCode(4);
  5.   //验证码放入session
  6.   session.setAttribute("code",code);
  7.   //验证码存入图片
  8.   ServletOutputStream os = response.getOutputStream();
  9.   response.setContentType("image/png");
  10.   VerifyCodeUtils.outputImage(220,60,os,code);
  11. }

4.放行验证码

  1. map.put("/user/getImage","anon");//验证码

03、shiro-整合springboot - 图23

5.修改认证流程

  1. @RequestMapping("login")
  2.     public String login(String username, String password,String code,HttpSession session) {
  3.         //比较验证码
  4.         String codes = (String) session.getAttribute("code");
  5.         try {
  6.             if (codes.equalsIgnoreCase(code)){
  7.                 //获取主体对象
  8.                 Subject subject = SecurityUtils.getSubject();
  9.                     subject.login(new UsernamePasswordToken(username, password));
  10.                     return "redirect:/index.jsp";
  11.             }else{
  12.                 throw new RuntimeException("验证码错误!");
  13.             }
  14.         } catch (UnknownAccountException e) {
  15.             e.printStackTrace();
  16.             System.out.println("用户名错误!");
  17.         } catch (IncorrectCredentialsException e) {
  18.             e.printStackTrace();
  19.             System.out.println("密码错误!");
  20.         }catch (Exception e){
  21.             e.printStackTrace();
  22.             System.out.println(e.getMessage());
  23.         }
  24.         return "redirect:/login.jsp";
  25.     }

6.修改salt不能序列化的问题

  1. //自定义salt实现  实现序列化接口
  2. public class MyByteSource implements ByteSource,Serializable {
  4.     private  byte[] bytes;
  5.     private String cachedHex;
  6.     private String cachedBase64;
  8.     //加入无参数构造方法实现序列化和反序列化
  9.     public MyByteSource(){
  11.     }
  13.     public MyByteSource(byte[] bytes) {
  14.         this.bytes = bytes;
  15.     }
  17.     public MyByteSource(char[] chars) {
  18.         this.bytes = CodecSupport.toBytes(chars);
  19.     }
  21.     public MyByteSource(String string) {
  22.         this.bytes = CodecSupport.toBytes(string);
  23.     }
  25.     public MyByteSource(ByteSource source) {
  26.         this.bytes = source.getBytes();
  27.     }
  29.     public MyByteSource(File file) {
  30.         this.bytes = (new MyByteSource.BytesHelper()).getBytes(file);
  31.     }
  33.     public MyByteSource(InputStream stream) {
  34.         this.bytes = (new MyByteSource.BytesHelper()).getBytes(stream);
  35.     }
  37.     public static boolean isCompatible(Object o) {
  38.         return o instanceof byte[] || o instanceof char[] || o instanceof String || o instanceof ByteSource || o instanceof File || o instanceof InputStream;
  39.     }
  41.     public byte[] getBytes() {
  42.         return this.bytes;
  43.     }
  45.     public boolean isEmpty() {
  46.         return this.bytes == null || this.bytes.length == 0;
  47.     }
  49.     public String toHex() {
  50.         if (this.cachedHex == null) {
  51.             this.cachedHex = Hex.encodeToString(this.getBytes());
  52.         }
  54.         return this.cachedHex;
  55.     }
  57.     public String toBase64() {
  58.         if (this.cachedBase64 == null) {
  59.             this.cachedBase64 = Base64.encodeToString(this.getBytes());
  60.         }
  62.         return this.cachedBase64;
  63.     }
  65.     public String toString() {
  66.         return this.toBase64();
  67.     }
  69.     public int hashCode() {
  70.         return this.bytes != null && this.bytes.length != 0 ? Arrays.hashCode(this.bytes) : 0;
  71.     }
  73.     public boolean equals(Object o) {
  74.         if (o == this) {
  75.             return true;
  76.         } else if (o instanceof ByteSource) {
  77.             ByteSource bs = (ByteSource)o;
  78.             return Arrays.equals(this.getBytes(), bs.getBytes());
  79.         } else {
  80.             return false;
  81.         }
  82.     }
  84.     private static final class BytesHelper extends CodecSupport {
  85.         private BytesHelper() {
  86.         }
  88.         public byte[] getBytes(File file) {
  89.             return this.toBytes(file);
  90.         }
  92.         public byte[] getBytes(InputStream stream) {
  93.             return this.toBytes(stream);
  94.         }
  95.     }
  96. }

7.启动测试

03、shiro-整合springboot - 图24

6.9.5 JSP中Shiro常用标签

此模块参考：https://www.cnblogs.com/fancongcong/p/8093258.html

  1. <shiro:guest>
  2.     游客访问 <a href = "login.jsp"></a>
  3. </shiro:guest>
  5. user 标签：用户已经通过认证\记住我 登录后显示响应的内容
  6. <shiro:user>
  7.     欢迎[<shiro:principal/>]登录 <a href = "logout">退出</a>
  8. </shiro:user>
  10. authenticated标签：用户身份验证通过，即 Subjec.login 登录成功 不是记住我登录的
  11. <shiro:authenticted>
  12.     用户[<shiro:principal/>] 已身份验证通过
  13. </shiro:authenticted>
  15. notAuthenticated标签：用户未进行身份验证，即没有调用Subject.login进行登录,包括"记住我"也属于未进行身份验证
  16. <shiro:notAuthenticated>
  17.     未身份验证(包括"记住我")
  18. </shiro:notAuthenticated>
  21. principal 标签：显示用户身份信息，默认调用
  22. Subjec.getPrincipal()获取，即Primary Principal
  23. <shiro:principal property = "username"/>
  25. hasRole标签：如果当前Subject有角色将显示body体内的内容
  26. <shiro:hashRole name = "admin">
  27.     用户[<shiro:principal/>]拥有角色admin
  28. </shiro:hashRole>
  30. hasAnyRoles标签：如果Subject有任意一个角色(或的关系)将显示body体里的内容
  31. <shiro:hasAnyRoles name = "admin,user">
  32.     用户[<shiro:pricipal/>]拥有角色admin 或者 user
  33. </shiro:hasAnyRoles>
  35. lacksRole:如果当前 Subjec没有角色将显示body体内的内容
  36. <shiro:lacksRole name = "admin">
  37.     用户[<shiro:pricipal/>]没有角色admin
  38. </shiro:lacksRole>
  40. hashPermission:如果当前Subject有权限将显示body体内容
  41. <shiro:hashPermission name = "user:create">
  42.     用户[<shiro:pricipal/>] 拥有权限user:create
  43. </shiro:hashPermission>
  45. lacksPermission:如果当前Subject没有权限将显示body体内容
  46. <shiro:lacksPermission name = "org:create">
  47.     用户[<shiro:pricipal/>] 没有权限org:create
  48. </shiro:lacksPermission>