• Shiro认证

    目录

    一，Shiro认证

    二，盐加密

    一，Shiro认证

    步骤：

           1. pom依赖
           2.web配置
           3.  自定义Realm（重点）
           4.对应mapper编写
           5.Spring与shiro整合（注意）
           6.登录测试
      

    导入pom依赖

    2.     <groupId>org.apache.shirogroupId>
    3.     <artifactId>shiro-coreartifactId>
    4.     <version>1.3.2version>
    6.  
    7. <dependency>
    8.     <groupId>org.apache.shirogroupId>
    9.     <artifactId>shiro-webartifactId>
    10.     <version>1.3.2version>
    11. dependency>
    12.  
    13. <dependency>
    14.     <groupId>org.apache.shirogroupId>
    15.     <artifactId>shiro-springartifactId>
    16.     <version>1.3.2version>
    17. dependency>

    web.xml配置

    2. <filter>
    3.   <filter-name>shiroFilterfilter-name>
    4.   <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
    5.   <init-param>
    6.     
    7.     <param-name>targetFilterLifecycleparam-name>
    8.     <param-value>trueparam-value>
    9.   init-param>
    10. filter>
    11. <filter-mapping>
    12.   <filter-name>shiroFilterfilter-name>
    13.   <url-pattern>/*url-pattern>
    14. filter-mapping>

    逆向生成对应的代码

     在UserMapper.xml中新增

    建立业务逻辑层

    1. package com.dengxiyan.ssm.Biz;
    2.  
    3. import com.dengxiyan.ssm.model.User;
    4. import org.apache.ibatis.annotations.Param;
    5.  
    6. public interface UserBiz {
    7.     int deleteByPrimaryKey(Integer userid);
    8.  
    9.     int insert(User record);
    10.  
    11.     int insertSelective(User record);
    12.  
    13.     User selectByPrimaryKey(Integer userid);
    14.  
    15.     User queryByName(String userName);
    16.  
    17.     int updateByPrimaryKeySelective(User record);
    18.  
    19.     int updateByPrimaryKey(User record);
    20. }

    实现类

    1. package com.dengxiyan.ssm.Biz.impl;
    2.  
    3. import com.dengxiyan.ssm.Biz.UserBiz;
    4. import com.dengxiyan.ssm.mapper.UserMapper;
    5. import com.dengxiyan.ssm.model.User;
    6. import org.springframework.beans.factory.annotation.Autowired;
    7. import org.springframework.stereotype.Service;
    8.  
    9. /**
    10.  * @author dxy
    11.  * @site www.javadxy.com
    12.  * @company ds公司
    13.  * @create  2022-08-25 13:49
    14.  */
    15. @Service("userBiz")
    16. public class UserBizImpl implements UserBiz {
    17.    @Autowired
    18.    private UserMapper userMapper;
    19.  
    20.     @Override
    21.     public int deleteByPrimaryKey(Integer userid) {
    22.         return userMapper.deleteByPrimaryKey(userid);
    23.     }
    24.  
    25.     @Override
    26.     public int insert(User record) {
    27.         return userMapper.insert(record);
    28.     }
    29.  
    30.     @Override
    31.     public int insertSelective(User record) {
    32.         return userMapper.insertSelective(record);
    33.     }
    34.  
    35.     @Override
    36.     public User selectByPrimaryKey(Integer userid) {
    37.         return userMapper.selectByPrimaryKey(userid);
    38.     }
    39.  
    40.     @Override
    41.     public User queryByName(String userName) {
    42.         return userMapper.queryByName(userName);
    43.     }
    44.  
    45.     @Override
    46.     public int updateByPrimaryKeySelective(User record) {
    47.         return userMapper.updateByPrimaryKeySelective(record);
    48.     }
    49.  
    50.     @Override
    51.     public int updateByPrimaryKey(User record) {
    52.         return updateByPrimaryKey(record);
    53.     }
    54. }

     Myrealm

    MyRealm要使用业务层，因为realm是属于shiro的，这样使得没办法使用Spring里面的@Autowired注解，同时也没办法直接交给Spring进行管理，所以我们需要通过实现类里的@Service里面添加标记（biz中的属性名）

    1. package com.dengxiyan.ssm.shiro;
    2.  
    3. import com.dengxiyan.ssm.Biz.UserBiz;
    4. import com.dengxiyan.ssm.mapper.UserMapper;
    5. import com.dengxiyan.ssm.model.User;
    6. import org.apache.shiro.authc.AuthenticationException;
    7. import org.apache.shiro.authc.AuthenticationInfo;
    8. import org.apache.shiro.authc.AuthenticationToken;
    9. import org.apache.shiro.authc.SimpleAuthenticationInfo;
    10. import org.apache.shiro.authz.AuthorizationInfo;
    11. import org.apache.shiro.realm.AuthorizingRealm;
    12. import org.apache.shiro.subject.PrincipalCollection;
    13. import org.apache.shiro.util.ByteSource;
    14.  
    15. /**
    16.  * @author dxy
    17.  * @site www.javadxy.com
    18.  * @company ds公司
    19.  * @create  2022-08-25 13:56
    20.  */
    21. public class MyRealm extends AuthorizingRealm {
    22.  
    23.     private UserBiz userBiz;
    24.  
    25.  
    26.     public UserBiz getUserBiz() {
    27.         return userBiz;
    28.     }
    29.  
    30.     public void setUserBiz(UserBiz userBiz) {
    31.         this.userBiz = userBiz;
    32.     }
    33.  
    34.     /**
    35.      * 授权
    36.      * @param principals
    37.      * @return
    38.      */
    39.     @Override
    40.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    41.         return null;
    42.     }
    43.  
    44.     /**
    45.      * 认证
    46.      * @param token
    47.      * @return
    48.      * @throws AuthenticationException
    49.      */
    50.     @Override
    51.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    52.        //拿到用户名
    53.        String username = token.getPrincipal().toString();
    54.        //拿到密码
    55.        String password = token.getCredentials().toString();
    56.         User user = userBiz.queryByName(username);
    57.         //拿到数据库的用户信息，放入token凭证中，用于controler进行对比
    58. //        需要进行传参
    59.         SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(
    60.         user.getUsername(),//用户
    61.         user.getPassword(),//密码
    62.         ByteSource.Util.bytes(user.getSalt()),//拿到盐
    63.         this.getName()//realm的名字
    64.     );
    65.         return info;
    66.     }
    67. }

    LoginController

    1. package com.dengxiyan.ssm.controller;
    2.  
    3. import org.apache.shiro.SecurityUtils;
    4. import org.apache.shiro.authc.UsernamePasswordToken;
    5. import org.apache.shiro.subject.Subject;
    6. import org.springframework.stereotype.Controller;
    7. import org.springframework.web.bind.annotation.RequestMapping;
    8.  
    9. import javax.servlet.ServletException;
    10. import javax.servlet.http.HttpServletRequest;
    11. import javax.servlet.http.HttpServletResponse;
    12. import java.io.IOException;
    13.  
    14. /**
    15.  * @author dxy
    16.  * @site www.javadxy.com
    17.  * @company ds公司
    18.  * @create  2022-08-19 19:18
    19.  */
    20. @Controller
    21. public class LoginController {
    22.     @RequestMapping("/login")
    23.     public String login(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
    24.         //登入成功 需要保存用户信息
    25. //        String uname = request.getParameter("uname");
    26. //        if ("dengxiyan".equals(uname)) {
    27. //            System.out.println("jsdjsa:"+uname);
    28. //            request.getSession().setAttribute("uname", uname);
    29. //        }
    30.  
    31.         try {
    32.             //拿到用户名及密码
    33.             String username = request.getParameter("username");
    34.             String password = request.getParameter("password");
    35.             UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
    36.             Subject subject = SecurityUtils.getSubject();
    37.             subject.login(usernamePasswordToken);
    38. //            request.getRequestDispatcher("main.jsp").forward(request,response);
    39.             return "mian";
    40.         }catch (Exception e){
    41.             request.setAttribute("message","用户名或密码错误");
    42. //          request.getRequestDispatcher("login.jsp").forward(request,response);
    43.             return "login";
    44.         }
    45.     }
    46.  
    47.  
    48.     @RequestMapping("/logout")
    49.     public String logout(HttpServletRequest request,HttpServletResponse response) {
    50. //        request.getSession().invalidate();
    51. //        return "index";
    52.         Subject subject = SecurityUtils.getSubject();
    53.         subject.logout();
    54.         try{
    55.             response.sendRedirect(request.getContextPath()+"/login.jsp");
    56.         }catch (Exception e){
    57.             e.printStackTrace();
    58.         }
    59.         return null;
    60.     }
    61. }

     将所需界面自行搭建好之后运行即可。

    《效果图》

     

    二，盐加密

    1.生成加密密码PasswordHelper类（盐加密）

    2.修改applicationContext-shirod的自定义Realm配置

    步骤：

    1.获取用户及密码

    2.传递啊到后台

    3.利用 原始密码+生成随机的盐 得到加密后的密码最后执行insert语句

    PasswordHelper类

    1. package com.dengxiyan.shrio;
    2.  
    3.  
    4. import org.apache.shiro.crypto.RandomNumberGenerator;
    5. import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    6. import org.apache.shiro.crypto.hash.SimpleHash;
    7.  
    8. /**
    9.  * 用于shiro权限认证的密码工具类
    10.  */
    11. public class PasswordHelper {
    12.  
    13.     /**
    14.      * 随机数生成器
    15.      */
    16.     private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    17.  
    18.     /**
    19.      * 指定hash算法为MD5
    20.      */
    21.     private static final String hashAlgorithmName = "md5";
    22.  
    23.     /**
    24.      * 指定散列次数为1024次，即加密1024次
    25.      */
    26.     private static final int hashIterations = 1024;
    27.  
    28.     /**
    29.      * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
    30.      */
    31.     private static final boolean storedCredentialsHexEncoded = true;
    32.  
    33.     /**
    34.      * 获得加密用的盐
    35.      *
    36.      * @return
    37.      */
    38.     public static String createSalt() {
    39.         return randomNumberGenerator.nextBytes().toHex();
    40.     }
    41.  
    42.     /**
    43.      * 获得加密后的凭证
    44.      *
    45.      * @param credentials 凭证(即密码)
    46.      * @param salt        盐
    47.      * @return
    48.      */
    49.     public static String createCredentials(String credentials, String salt) {
    50.         SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
    51.                 salt, hashIterations);
    52.         return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    53.     }
    54.  
    55.  
    56.     /**
    57.      * 进行密码验证
    58.      *
    59.      * @param credentials        未加密的密码
    60.      * @param salt               盐
    61.      * @param encryptCredentials 加密后的密码
    62.      * @return
    63.      */
    64.     public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
    65.         return encryptCredentials.equals(createCredentials(credentials, salt));
    66.     }
    67.  
    68.     public static void main(String[] args) {
    69.         //盐
    70.         String salt = createSalt();
    71.         System.out.println(salt);
    72.         System.out.println(salt.length());
    73.         //凭证+盐加密后得到的密码
    74.         String credentials = createCredentials("123456", salt);
    75.         System.out.println(credentials);
    76.         System.out.println(credentials.length());
    77.         boolean b = checkCredentials("123456", salt, credentials);
    78.         System.out.println(b);
    79.     }
    80. }

    《效果图》

     

     

    解析：

    首先在方法中随机生成盐 ，拿到用户和密码，然后拿到密码进行盐加密，得到的是一个加密过后的盐，再获取长度，最后拿到加密后的密码和盐以及最初的密码进行比较，返回的是true则加密成功

     applicationContext-shirod配置

    1. "1.0" encoding="UTF-8"?>
    2. <beans xmlns="http://www.springframework.org/schema/beans"
    3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    5.  
    6.     
    7.     <bean id="shiroRealm" class="com.javaxl.ssm.shiro.MyRealm">
    8.         <property name="shiroUserService" ref="shiroUserService" />
    9.         
    10.         
    11.         
    12.         
    13.         <property name="credentialsMatcher">
    14.             <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    15.                 
    16.                 <property name="hashAlgorithmName" value="md5"/>
    17.                 
    18.                 <property name="hashIterations" value="1024"/>
    19.                 
    20.                 <property name="storedCredentialsHexEncoded" value="true"/>
    21.             bean>
    22.         property>
    23.     bean>
    24.  
    25.     
    26.     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    27.         <property name="realm" ref="shiroRealm" />
    28.     bean>
    29.  
    30.     
    31.     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    32.         
    33.         <property name="securityManager" ref="securityManager" />
    34.         
    35.         <property name="loginUrl" value="/login"/>
    36.         
    37.         
    38.         
    39.         <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    40.         
    41.         <property name="filterChainDefinitions">
    42.             <value>
    43.                 
    44.                 
    45.                 
    46.                 
    47.                 /user/login=anon
    48.                 /user/updatePwd.jsp=authc
    49.                 /admin/*.jsp=roles[admin]
    50.                 /user/teacher.jsp=perms["user:update"]
    51.                
    52.             value>
    53.         property>
    54.     bean>
    55.  
    56.     
    57.     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    58. beans>

    总结：

           1. pom依赖
           2.web配置
           3.  自定义Realm（重点）
           4.对应mapper编写
           5.Spring与shiro整合（注意）

                    （1）shiro在加载的时候，Spring上下文还没有记载完毕，所以Component与@autowised是不能使用的

                    （2）Spring-shiro,xml文件中，MyRealm需要依赖的业务类

    由于没有被Spring配置，所以需要指定bean的id，通过Service（“具体名”）
           6.登录测试
         结论：doGetAuthorizationInfo认证方法是web层秩序subject.login出发的

  • 相关阅读:
    [golang]在Gin框架中使用JWT鉴权
    2022.03 Kali Linux Maltego工具
    【JavaScript面试题】bind和call、apply有什么作用？它们的区别是什么？
    VS Code 配置 JAVA（总）
    Redis（6）五大数据类型——List（列表）
    MBR40200PT-ASEMI插件肖特基二极管MBR40200PT
    05-Nginx性能调优
    （二）正则表达式——捕获
    【springboot】自定义starter(学习笔记)
    [Java框架] Java常用爬虫框架推荐
  • 原文地址：https://blog.csdn.net/weixin_66202611/article/details/126525738