shiro

简介

配置

认证

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;
public class AuthenticationTest {
    @Test
    public void testAuth() {
        //1.构建SecurityManager工厂
        IniSecurityManagerFactory securityManagerFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //2.通过securityManagerFactory工厂获取SecurityManager实例
        SecurityManager securityManager = securityManagerFactory.getInstance();
        //3.将securityManager设置到运行环境当中
        SecurityUtils.setSecurityManager(securityManager);
        //4.获取subject实例
        Subject subject = SecurityUtils.getSubject();
        //5.创建用户名密码验证令牌Token
        UsernamePasswordToken token = new UsernamePasswordToken("victor","123456");
        //6.进行身份验证
        subject.login(token);
        //7.判断是否认证通过
        System.out.println(subject.isAuthenticated());
    }
}

//shiro.ini
[users]
victor=123456

Realm

表名：users

id username password

表名和字段必须和上面一致

[main]
#配置Realm
jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm

#配置数据源
dataSource = com.mchange.v2.c3p0.ComboPooledDataSource
dataSource.driverClass = com.mysql.jdbc.Driver
dataSource.jdbcUrl = jdbc:mysql://118.24.175.34:3306/java_test
dataSource.user = root
dataSource.password = p@ssw0rd

jdbcRealm.dataSource = $dataSource

#将Realm注入给SecurityManager
securityManager.realm = $jdbcRealm

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class AuthenticationTest {

    @Test
    public void testAuth() {
        //1.构建SecurityManager工厂
        IniSecurityManagerFactory securityManagerFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //2.通过securityManagerFactory工厂获取SecurityManager实例
        SecurityManager securityManager = securityManagerFactory.getInstance();
        //3.将securityManager设置到运行环境当中
        SecurityUtils.setSecurityManager(securityManager);
        //4.获取subject实例
        Subject subject = SecurityUtils.getSubject();
        //5.创建用户名密码验证令牌Token
        UsernamePasswordToken token = new UsernamePasswordToken("niliv","123456");
        //6.进行身份验证
        subject.login(token);
        //7.判断是否认证通过
        System.out.println(subject.isAuthenticated());
    }
}

[main]
#配置Realm
customRealm = com.niliv.realms.CustomRealm

#将Realm注入给SecurityManager
securityManager.realm = $customRealm

package com.niliv.realms;

import java.net.ConnectException;
import java.security.interfaces.RSAKey;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.realm.AuthenticatingRealm;

import com.mysql.jdbc.Driver;

public class CustomRealm extends AuthenticatingRealm {

    private String principal;
    private String credentials;
    private ResultSet rs;
    private Statement state;
    private Connection conn;

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //使用JDBC,从数据库获取数据
        try {
            //1.注册驱动
            Driver driver = new Driver();
            DriverManager.registerDriver(driver);
            //2.获取连接对象
            String url ="jdbc:mysql://118.24.175.34:3306/java_test";
            String user = "root";
            String password = "p@ssw0rd";
            conn = DriverManager.getConnection(url , user , password );
            state = conn.createStatement();
            //4.执行sql语句
            String sql = "select userName,passwd from starLogin";
            rs = state.executeQuery(sql );
            //5.处理结果集
            while (rs.next()) {
                principal = rs.getString("userName");
                credentials = rs.getString("passwd");
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }finally{
            if(rs != null){
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(state != null){
                try {
                    state.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(conn != null){
                try {
                    conn.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }

        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal, credentials, "customRealm");
        return simpleAuthenticationInfo;
    }

}

public class AuthenticationTest {

    @Test
    public void testAuth() {
        //1.构建SecurityManager工厂
        IniSecurityManagerFactory securityManagerFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //2.通过securityManagerFactory工厂获取SecurityManager实例
        SecurityManager securityManager = securityManagerFactory.getInstance();
        //3.将securityManager设置到运行环境当中
        SecurityUtils.setSecurityManager(securityManager);
        //4.获取subject实例
        Subject subject = SecurityUtils.getSubject();
        //5.创建用户名密码验证令牌Token
        UsernamePasswordToken token = new UsernamePasswordToken("niliv","123456");
        //6.进行身份验证
        subject.login(token);
        //7.判断是否认证通过
        System.out.println(subject.isAuthenticated());
    }
}

加密

@Test
    public void testMD5(){
        //md5加密
        Md5Hash md5 = new Md5Hash("123456");
        System.out.println(md5);
        //加盐
        md5 = new Md5Hash("123456", "bjsxt");
        System.out.println(md5);
        //迭代
        md5 = new Md5Hash("123456", "bjsxt", 2);
        System.out.println(md5);
    }

凭证匹配器

[main]

#配置凭证匹配器
credentialsMatcher=org.apache.shiro.authc.credential.HashedCredentialsMatcher

#设置凭证匹配器的相关属性
credentialsMatcher.hashAlgorithmName=MD5
credentialsMatcher.hashIterations=2

#配置Realm
customRealm=com.bjsxt.realms.CustomRealm

#配置Realm的凭证匹配器属性
customRealm.credentialsMatcher=$credentialsMatcher

#将Realm注入给SecurityManager
securityManager.realm=$customRealm

package com.bjsxt.realms;

import java.net.ConnectException;
import java.security.interfaces.RSAKey;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.realm.AuthenticatingRealm;
import org.apache.shiro.util.ByteSource;

import com.mysql.jdbc.Driver;

public class CustomRealm extends AuthenticatingRealm {

    private String principal;
    private String credentials;
    private ResultSet rs;
    private Statement state;
    private Connection conn;
    private String salt;

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //使用JDBC,从数据库获取数据
        try {
            //1.注册驱动
            Driver driver = new Driver();
            DriverManager.registerDriver(driver);
            //2.获取连接对象
            String url ="jdbc:mysql://118.24.175.34:3306/java_test";
            String user = "root";
            String password = "p@ssw0rd";
            conn = DriverManager.getConnection(url , user , password );
            state = conn.createStatement();
            //4.执行sql语句
            String sql = "select userName,passwd,passwd_salt from starLogin";
            rs = state.executeQuery(sql );
            //5.处理结果集
            while (rs.next()) {
                principal = rs.getString("userName");
                credentials = rs.getString("passwd");
                salt = rs.getString("passwd_salt");
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }finally{
            if(rs != null){
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(state != null){
                try {
                    state.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(conn != null){
                try {
                    conn.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }

        ByteSource newSalt = ByteSource.Util.bytes(salt);
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal, credentials,newSalt , "customRealm");
        return simpleAuthenticationInfo;
    }


}

public class AuthenticationTest {
    @Test
    public void testAuthentication(){
        //1.构建SecurityManager工厂
        IniSecurityManagerFactory securityManagerFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //2.通过securityManagerFactory工厂获取SecurityManager实例
        SecurityManager securityManager = securityManagerFactory.getInstance();
        //3.将securityManager设置到运行环境当中
        SecurityUtils.setSecurityManager(securityManager);
        //4.获取subject实例
        Subject subject = SecurityUtils.getSubject();
        //5.创建用户名密码验证令牌Token
        UsernamePasswordToken token = new UsernamePasswordToken("niliv","123456");
        //6.进行身份验证
        subject.login(token);
        //7.判断是否认证通过
        System.out.println(subject.isAuthenticated());
    }
}

授权

package com.bjsxt.realms;

import java.net.ConnectException;
import java.security.interfaces.RSAKey;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthenticatingRealm;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import com.mysql.jdbc.Driver;

public class CustomRealm extends AuthorizingRealm {

    private String principal;
    private String credentials;
    private ResultSet rs;
    private Statement state;
    private Connection conn;
    private String roleName;
    private String remark;

    // 认证方法：获取认证信息
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        // 使用JDBC,从数据库获取数据
        try {
            // 1.注册驱动
            Driver driver = new Driver();
            DriverManager.registerDriver(driver);
            // 2.获取连接对象
            String url ="jdbc:mysql://118.24.175.34:3306/shiro";
            String user = "root";
            String password = "p@ssw0rd";
            conn = DriverManager.getConnection(url, user, password);
            state = conn.createStatement();
            // 4.执行sql语句
            String sql = "select username,password from users";
            rs = state.executeQuery(sql);
            // 5.处理结果集
            if(rs.first()){
                principal = rs.getString("username");
                credentials = rs.getString("password");
            }
        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            if (rs != null) {
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (state != null) {
                try {
                    state.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (conn != null) {
                try {
                    conn.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }

        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal, credentials,
                "customRealm");
        return simpleAuthenticationInfo;
    }

    // 授权方法：获取授权信息
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 使用JDBC,从数据库获取数据
        try {
            // 1.注册驱动
            Driver driver = new Driver();
            DriverManager.registerDriver(driver);
            String url ="jdbc:mysql://118.24.175.34:3306/shiro";
            String user = "root";
            String password = "p@ssw0rd";
            conn = DriverManager.getConnection(url, user, password);
            state = conn.createStatement();
            // 4.执行sql语句
            //String sql = "select name from role";
            String sql = "select remark from permission";
            rs = state.executeQuery(sql);
            // 5.处理结果集
            if(rs.first()){
                //roleName = rs.getString("name");
                remark = rs.getString("remark");
            }
        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            if (rs != null) {
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (state != null) {
                try {
                    state.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (conn != null) {
                try {
                    conn.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //info.addRole(roleName);
        info.addStringPermission(remark);
        return info;
    }

}

package com.bjsxt.test;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

//实现简单认证
public class AuthenticationTest {
    @Test
    public void testAuthentication(){
        //1.构建SecurityManager工厂
        IniSecurityManagerFactory securityManagerFactory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //2.通过securityManagerFactory工厂获取SecurityManager实例
        SecurityManager securityManager = securityManagerFactory.getInstance();
        //3.将securityManager设置到运行环境当中
        SecurityUtils.setSecurityManager(securityManager);
        //4.获取subject实例
        Subject subject = SecurityUtils.getSubject();
        //5.创建用户名密码验证令牌Token
        UsernamePasswordToken token = new UsernamePasswordToken("zhangsan","123456");
        //6.进行身份验证
        subject.login(token);
        //7.判断是否认证通过
        System.out.println(subject.isAuthenticated());

        //认证通过后进行授权：代码触发
        //基于角色授权
        //boolean hasRole = subject.hasRole("管理员");
        //System.out.println(hasRole);
        //基于权限授权
        boolean permitted = subject.isPermitted("一级菜单,基本设置操作权限");
        System.out.println(permitted);
    }
}

[main]
#配置Realm
customRealm = com.bjsxt.realms.CustomRealm

#将Realm注入给SecurityManager
securityManager.realm = $customRealm

Spring整合shiro实现登录认证

登录认证授权

注册