SpringBoot整合Shiro的方法详解

# Users and their assigned roles

#

# Each line conforms to the format defined in the

# org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc

# -----------------------------------------------------------------------------

[users]

# user 'root' with password 'secret' and the 'admin' role

root = secret, admin

# user 'guest' with the password 'guest' and the 'guest' role

guest = guest, guest

# user 'presidentskroob' with password '12345' ("That's the same combination on

# my luggage!!!" ;)), and role 'president'

presidentskroob = 12345, president

# user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz'

darkhelmet = ludicrousspeed, darklord, schwartz

# user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz'

lonestarr = vespa, goodguy, schwartz

# -----------------------------------------------------------------------------

# Roles with assigned permissions

#

# Each line conforms to the format defined in the

# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc

# -----------------------------------------------------------------------------

[roles]

# 'admin' role has all permissions, indicated by the wildcard '*'

admin = *

# The 'schwartz' role can do anything (*) with any lightsaber:

schwartz = lightsaber:*

# The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with

# license plate 'eagle5' (instance specific id)

goodguy = winnebago:drive:eagle5

<? xml version = "1.0" encoding = "UTF-8" ?>

< project xmlns = "http://maven.apache.org/POM/4.0.0"

          xmlns:xsi = "http://HdhCmsTestw3.org/2001/XMLSchema-instance"

          xsi:schemaLocation = "http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" >

     < parent >

         < artifactId >Shiro</ artifactId >

         < groupId >com.nuist</ groupId >

         < version >1.0-SNAPSHOT</ version >

     </ parent >

     < modelVersion >4.0.0</ modelVersion >

     < artifactId >hello-shiro</ artifactId >

     < properties >

         < maven测试数据piler.source >8</ maven测试数据piler.source >

         < maven测试数据piler.target >8</ maven测试数据piler.target >

     </ properties >

     < dependencies >

         < dependency >

             < groupId >org.apache.shiro</ groupId >

             < artifactId >shiro-core</ artifactId >

             < version >1.4.1</ version >

         </ dependency >

         <!-- configure logging -->

         < dependency >

             < groupId >org.slf4j</ groupId >

             < artifactId >jcl-over-slf4j</ artifactId >

             < version >1.7.21</ version >

         </ dependency >

         < dependency >

             < groupId >org.slf4j</ groupId >

             < artifactId >slf4j-log4j12</ artifactId >

             < version >1.7.12</ version >

         </ dependency >

         < dependency >

             < groupId >log4j</ groupId >

             < artifactId >log4j</ artifactId >

             < version >1.2.17</ version >

         </ dependency >

     </ dependencies >

</ project >

log4j.rootLogger=INFO, stdout

log4j.appender.stdout=org.apache.log4j.ConsoleAppender

log4j.appender.stdout.layout=org.apache.log4j.PatternLayout

log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m%n

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.*;

import org.apache.shiro.mgt.DefaultSecurityManager;

import org.apache.shiro.mgt.SecurityManager;

import org.apache.shiro.realm.text.IniRealm;

import org.apache.shiro.session.Session;

import org.apache.shiro.subject.Subject;

import org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import javax.naming.InitialContext;

public class Quickstart {

     private static final transient Logger log = LoggerFactory.getLogger(Quickstart. class );

     public static void main(String[] args) {

         // 旧方法，由于shiro更新无法正常使用

         // Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");

         // SecurityManager securityManager = factory.getInstance();

         // 新方法 shiro更新问题 解决正常运行

         DefaultSecurityManager securityManager = new DefaultSecurityManager();

         IniRealm iniRealm = new IniRealm( "classpath:shiro.ini" );

         securityManager.setRealm(iniRealm);

         SecurityUtils.setSecurityManager(securityManager);

         // Now that a simple Shiro environment is set up, let's see what you can do:

         // 获取当前用户对象

         Subject currentUser = SecurityUtils.getSubject();

         // 通过当前用户拿到session

         Session session = currentUser.getSession();

         session.setAttribute( "someKey" , "aValue" );

         String value = (String) session.getAttribute( "someKey" );

         if (value.equals( "aValue" )) {

             log.info( "subject =>! [" + value + "]" );

         }

         // 判断当前用户是否被认证

         if (!currentUser.isAuthenticated()) {

             UsernamePasswordToken token = new UsernamePasswordToken( "lonestarr" , "vespa" );

             token.setRememberMe( true );  // 设置记住我

             try {

                 currentUser.login(token);

             } catch (UnknownAccountException uae) {

                 log.info( "There is no user with username of " + token.getPrincipal());

             } catch (IncorrectCredentialsException ice) {

                 log.info( "Password for account " + token.getPrincipal() + " was incorrect!" );

             } catch (LockedAccountException lae) {

                 log.info( "The account for username " + token.getPrincipal() + " is locked.  " +

                         "Please contact your administrator to unlock it." );

             }

             // 最重要的一个异常，认证异常

             catch (AuthenticationException ae) {

                 //unexpected condition?  error?

             }

         }

         //say who they are:

         //print their identifying principal (in this case, a username):

         log.info( "User [" + currentUser.getPrincipal() + "] logged in successfully." );

         //test a role:

         if (currentUser.hasRole( "schwartz" )) {

             log.info( "May the Schwartz be with you!" );

         } else {

             log.info( "Hello, mere mortal." );

         }

         // 测试一个简单的权限

         // 粗粒度的一个权限限制

         if (currentUser.isPermitted( "lightsaber:wield" )) {

             log.info( "You may use a lightsaber ring.  Use it wisely." );

         } else {

             log.info( "Sorry, lightsaber rings are for schwartz masters only." );

         }

         //a (very powerful) Instance Level permission:

         if (currentUser.isPermitted( "winnebago:drive:eagle5" )) {

             log.info( "You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +

                     "Here are the keys - have fun!" );

         } else {

             log.info( "Sorry, you aren't allowed to drive the 'eagle5' winnebago!" );

         }

         //注销功能

         currentUser.logout();

         System.exit( 0 );

     }

}

// 新方法 shiro更新问题 解决正常运行

DefaultSecurityManager securityManager = new DefaultSecurityManager();

IniRealm iniRealm = new IniRealm( "classpath:shiro.ini" );

securityManager.setRealm(iniRealm);

SecurityUtils.setSecurityManager(securityManager);

Subject currentUser = SecurityUtils.getSubject();

!currentUser.isAuthenticated()

currentUser.hasRole( "schwartz" )

currentUser.isPermitted( "lightsaber:wield" )

currentUser.logout();

<!--

subject  用户

SecurityManager 管理所有用户

Realm 连接数据

-->

<!--shiro与springboot-->

< dependency >

< groupId >org.apache.shiro</ groupId >

< artifactId >shiro-spring</ artifactId >

< version >1.6.0</ version >

</ dependency >

package com.nuist.shirospringboot.config;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.subject.PrincipalCollection;

/**

  * @author liuhuanhuan

  * @version 1.0

  * @date 2022/5/8 17:59

  * @Description

  */

public class UserRealm extends AuthorizingRealm {

     @Override

     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

         System.out.println( "执行了=》授权doGetAuthorizationInfo方法" );

         return null ;

     }

     @Override

     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

         System.out.println( "执行了-》认证doGetAuthenticationInfo" );

         return null ;

     }

}

package com.nuist.shirospringboot.config;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;

import org.apache.shiro.web.mgt.DefaultWebSecurityManager;

import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;

import org.springframework.beans.factory.annotation.Qualifier;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

/**

  * @author liuhuanhuan

  * @version 1.0

  * @date 2022/5/8 17:58

  * @Description

  */

@Configuration

public class ShiroConfig {

     // shiroFilterConfiguere

     @Bean

     public ShiroFilterFactoryBean getShiroFilterFactoryBean( @Qualifier ( "getDefaultWebSecurityManager" ) DefaultWebSecurityManager securityManager) {

         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

         // 设置用户管理器

         shiroFilterFactoryBean.setSecurityManager(securityManager);

         return shiroFilterFactoryBean;

     }

     // defaultWebSecurity

     // 通过@Qualifier 是USerRealm进行绑定

     @Bean

     public DefaultWebSecurityManager getDefaultWebSecurityManager( @Qualifier ( "userReaml" ) UserRealm userReaml) {

         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

         // 关联Realm

         securityManager.setRealm(userReaml);

         return securityManager;

     }

     // 创建realm对象  需要去进行自定义，这样就可以交给spring去进行托管了

     @Bean

     public UserRealm userReaml(){

         return new UserRealm();

     }

}

package com.nuist.shirospringboot.controller;

import org.springframework.stereotype.Controller;

import org.springframework.ui.Model;

import org.springframework.web.bind.annotation.RequestMapping;

/**

  * @author liuhuanhuan

  * @version 1.0

  * @date 2022/5/8 17:52

  * @Description

  */

@Controller

public class Mycontrollrt

{

     @RequestMapping ({ "/" , "/index" })

     public String toIndex(Model model) {

         model.addAttribute( "msg" , "hello shiro" );

         return "index" ;

     }

     @RequestMapping ( "/user/add" )

     public String add() {

         return "user/add" ;

     }

     @RequestMapping ( "/user/update" )

     public String update() {

         return "user/update" ;

     }

}

<!DOCTYPE html>

< html lang = "en" xmlns:th = "http://HdhCmsTestthymeleaf.org" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >首页</ h1 >

< p th:text = "${msg}" ></ p >

< hr >

< a th:href = "@{/user/add}" >add </ a >  |  < a th:href = "@{/user/update}" >update</ a >

</ body >

</ html >

<!DOCTYPE html>

< html lang = "en" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >add</ h1 >

</ body >

</ html >

<!DOCTYPE html>

< html lang = "en" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >update</ h1 >

</ body >

</ html >

         Map<String,String> filterMap = new LinkedHashMap<>();

//        filterMap.put("/user/add","authc");

//        filterMap.put("/user/update","authc");

         filterMap.put( "/user/*" , "authc" );

         shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);

         shiroFilterFactoryBean.setLoginUrl( "/toLogin" );

<!DOCTYPE html>

< html lang = "en" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >login</ h1 >

< hr >

< form action = "" >

     < p >用户名：< input type = "text" name = "username" ></ p >

     < p >密码：< input type = "password" name = "password" ></ p >

     < p >< input type = "submit" ></ p >

</ form >

</ body >

</ html >

@RequestMapping ( "/login" )

public String login(String username,String password,Model model) {

     // 获取当前用户

     Subject subject = SecurityUtils.getSubject();

     // 封装当前用户

     UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);

     try {

         subject.login(usernamePasswordToken); // 执行登录的方法，有异常进行处理

         return "index" ;

     } catch (UnknownAccountException e){

         model.addAttribute( "msg" , "用户名错误" );

         return "login" ;

     } catch (IncorrectCredentialsException e) { // 密码不存在

         model.addAttribute( "msg" , "密码错误" );

         return "login" ;

     }

}

<!DOCTYPE html>

< html lang = "en" xmlns:th = "http://HdhCmsTestthymeleaf.org" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >login</ h1 >

< hr >

< p th:text = "${msg}" style = "color: red" ></ p >

< form th:action = "@{/login}" >

     < p >用户名：< input type = "text" name = "username" ></ p >

     < p >密码：< input type = "password" name = "password" ></ p >

     < p >< input type = "submit" ></ p >

</ form >

</ body >

</ html >

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

     System.out.println( "执行了-》认证doGetAuthenticationInfo" );

     String name = "root" ;

     String password = "123456" ;

     UsernamePasswordToken authenticationToken1 = (UsernamePasswordToken) authenticationToken;

     if (!authenticationToken1.getUsername().equals(name)) {

         return null ;   // 抛出异常

     }

     // 密码认证  shiro去做

     return new SimpleAuthenticationInfo( "" ,password, "" );

}

filterMap.put( "/user/add" , "perms[user:add]" );

@RequestMapping ( "/noauth" )   

@ResponseBody                 

public String noauth() {     

     return "未经过授权无法进行访问" ;    

}                            

<!DOCTYPE html>

< html lang = "en" xmlns:th = "http://HdhCmsTestthymeleaf.org"

       xmlns:shiro = "http://HdhCmsTestthymeleaf.org/thymeleaf-extras-shiro" >

< head >

     < meta charset = "UTF-8" >

     < title >Title</ title >

</ head >

< body >

< h1 >首页</ h1 >

< p >

     < a th:href = "@{/toLogin}" >登录</ a >

</ p >

< p th:text = "${msg}" ></ p >

< hr >

< div shiro:hasPermission = "user:add" >

     < a th:href = "@{/user/add}" >add </ a >

</ div >

  |

< div shiro:hasPermission = "user:update" >

     < a th:href = "@{/user/update}" >update</ a >

</ div >

</ body >

</ html >

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

     System.out.println( "执行了=》授权doGetAuthorizationInfo方法" );

     SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();

     // 新增授权页面

     authorizationInfo.addStringPermission( "user:add" );

     // 拿到当前对象 ,然后通过对象中的授权方式进行判断

     return authorizationInfo;

}