• 盐加密的了解和shiro认证-SSM

    目录

    本次目标：

    一、盐加密

    1. 什么是盐加密

    2. 数据库密码的发展史

    二、Shiro认证

    1. 配置环境

    2.完成登录的方法 Mapper层的编写，接着biz层

    3. 完成自定义realm（重点）

    4.Spring与shiro的整合（注意）

    本次目标：

    1. 盐加密
    2. shiro认证

    一、盐加密

    1. 什么是盐加密

    加盐加密是一种对系统登录口令的加密方式，它实现的方式是将每一个口令同一个叫做”盐“（salt）的n位随机数相关联。

    无论何时只要口令改变，随机数就改变。随机数以未加密的方式存放在口令文件中，这样每个人都可以读。

    不再只保存加密过的口令，而是先将口令和随机数连接起来然后一同加密，加密后的结果放在口令文件中。

    2. 数据库密码的发展史

    (md5就是一种信息摘要加密算法。)

    第一个阶段：明文密码
    第二个阶段：md5加密
    第三个阶段：md5加盐加密
    第四个阶段：md5加盐加密加次数

    盐是随机器生成的，次数是自己定义的。 

    加密地址：md5解密加密

    示例：

    PasswordHelper ：

    1. package com.ps.shiro;
    2.  
    3.  
    4. import org.apache.shiro.crypto.RandomNumberGenerator;
    5. import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    6. import org.apache.shiro.crypto.hash.SimpleHash;
    7.  
    8. /**
    9.  * 用于shiro权限认证的密码工具类
    10.  */
    11. public class PasswordHelper {
    12.  
    13.     /**
    14.      * 随机数生成器
    15.      */
    16.     private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    17.  
    18.     /**
    19.      * 指定hash算法为MD5
    20.      */
    21.     private static final String hashAlgorithmName = "md5";
    22.  
    23.     /**
    24.      * 指定散列次数为1024次，即加密1024次
    25.      */
    26.     private static final int hashIterations = 1024;
    27.  
    28.     /**
    29.      * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
    30.      */
    31.     private static final boolean storedCredentialsHexEncoded = true;
    32.  
    33.     /**
    34.      * 获得加密用的盐
    35.      *
    36.      * @return
    37.      */
    38.     public static String createSalt() {
    39.         return randomNumberGenerator.nextBytes().toHex();
    40.     }
    41.  
    42.     /**
    43.      * 获得加密后的凭证
    44.      *
    45.      * @param credentials 凭证(即密码)
    46.      * @param salt        盐
    47.      * @return
    48.      */
    49.     public static String createCredentials(String credentials, String salt) {
    50.         SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
    51.                 salt, hashIterations);
    52.         return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    53.     }
    54.  
    55.  
    56.     /**
    57.      * 进行密码验证
    58.      *
    59.      * @param credentials        未加密的密码
    60.      * @param salt               盐
    61.      * @param encryptCredentials 加密后的密码
    62.      * @return
    63.      */
    64.     public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
    65.         return encryptCredentials.equals(createCredentials(credentials, salt));
    66.     }
    67.  
    68.     public static void main(String[] args) {
    69.         //盐
    70.         String salt = createSalt();
    71.         System.out.println(salt);
    72.         System.out.println(salt.length());
    73.         //凭证+盐加密后得到的密码
    74.         String credentials = createCredentials("123456", salt);
    75.         System.out.println(credentials);
    76.         System.out.println(credentials.length());
    77.         boolean b = checkCredentials("123456", salt, credentials);
    78.         System.out.println(b);
    79.     }
    80. }

    运行结果：

    二、Shiro认证

    1. 配置环境

    pom依赖：

    1. <dependency>
    2.     <groupId>org.apache.shirogroupId>
    3.     <artifactId>shiro-coreartifactId>
    4.     <version>1.3.2version>
    5. dependency>
    6.  
    7. <dependency>
    8.     <groupId>org.apache.shirogroupId>
    9.     <artifactId>shiro-webartifactId>
    10.     <version>1.3.2version>
    11. dependency>
    12.  
    13. <dependency>
    14.     <groupId>org.apache.shirogroupId>
    15.     <artifactId>shiro-springartifactId>
    16.     <version>1.3.2version>
    17. dependency>
    18.  
    19.

    web.xml配置：

    2. <filter>
    3.   <filter-name>shiroFilterfilter-name>
    4.   <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
    5.   <init-param>
    6.     
    7.     <param-name>targetFilterLifecycleparam-name>
    8.     <param-value>trueparam-value>
    9.   init-param>
    10. filter>
    11. <filter-mapping>
    12.   <filter-name>shiroFilterfilter-name>
    13.   <url-pattern>/*url-pattern>
    14. filter-mapping>

    2.完成登录的方法 Mapper层的编写，接着biz层

    （逆向生成的表是放在generatorConfig.xml中）

    UserMapper.xml

    2.   <select id="queryUserByUserName" resultType="com.ps.ssm.model.User" parameterType="java.lang.String" >
    3.     select
    4.     <include refid="Base_Column_List" />
    5.     from t_shiro_user
    6.     where username = #{userName}
    7.   select>

    UserMapper.java

      User queryUserByUserName(@Param("userName") String userName);

    UserBiz.java

    1. package com.ps.ssm.biz;
    2.  
    3. import com.ps.ssm.model.User;
    4. import org.apache.ibatis.annotations.Param;
    5.  
    6. public interface UserBiz {
    7.     int deleteByPrimaryKey(Integer userid);
    8.  
    9.     int insert(User record);
    10.  
    11.     int insertSelective(User record);
    12.  
    13.     User selectByPrimaryKey(Integer userid);
    14.  
    15.     User queryUserByUserName(@Param("userName") String userName);
    16.  
    17.     int updateByPrimaryKeySelective(User record);
    18.  
    19.     int updateByPrimaryKey(User record);
    20. }

    UserBizImpl.java

    1. package com.ps.ssm.biz.imp;
    2.  
    3. import com.ps.ssm.biz.UserBiz;
    4. import com.ps.ssm.mapper.UserMapper;
    5. import com.ps.ssm.model.User;
    6. import org.springframework.beans.factory.annotation.Autowired;
    7. import org.springframework.stereotype.Service;
    8.  
    9. /**
    10.  * @author 彭于晏
    11.  * @site www.pengyuyan.com
    12.  * @company 玉渊工作室
    13.  * @create 2022-08-26 12:19
    14.  */
    15. @Service
    16. public class UserBizImpl implements UserBiz {
    17.     @Autowired
    18.     private UserMapper userMapper;
    19.     @Override
    20.     public int deleteByPrimaryKey(Integer userid) {
    21.         return userMapper.deleteByPrimaryKey(userid);
    22.     }
    23.  
    24.     @Override
    25.     public int insert(User record) {
    26.         return userMapper.insert(record);
    27.     }
    28.  
    29.     @Override
    30.     public int insertSelective(User record) {
    31.         return userMapper.insertSelective(record);
    32.     }
    33.  
    34.     @Override
    35.     public User selectByPrimaryKey(Integer userid) {
    36.         return userMapper.selectByPrimaryKey(userid);
    37.     }
    38.  
    39.     @Override
    40.     public User queryUserByUserName(String userName) {
    41.         return userMapper.queryUserByUserName(userName);
    42.     }
    43.  
    44.     @Override
    45.     public int updateByPrimaryKeySelective(User record) {
    46.         return userMapper.updateByPrimaryKeySelective(record);
    47.     }
    48.  
    49.     @Override
    50.     public int updateByPrimaryKey(User record) {
    51.         return userMapper.updateByPrimaryKey(record);
    52.     }
    53. }

    3. 完成自定义realm（重点）

    • Shiro从Realm获取安全数据（如用户、角色、权限），就是说SecurityManager要验证用户身份，那么它需要从Realm获取相应的用户进行比较以确定用户身份是否合法；
    • 也需要从Realm得到用户相应的角色/权限进行验证用户是否能进行操作；可以把Realm看成DataSource，即安全数据源。
    • 最基础的是Realm接口，CachingRealm负责缓存处理，AuthenticationRealm负责认证，AuthorizingRealm负责授权。

    AuthorizationInfo：授权信息
    AuthenticationInfo：认证信息 

    Realm体系结构：

    自定义Realm—MyRealm

    1. package com.ps.ssm.shiro;
    2.  
    3. import com.ps.ssm.biz.UserBiz;
    4. import com.ps.ssm.model.User;
    5. import org.apache.shiro.authc.AuthenticationException;
    6. import org.apache.shiro.authc.AuthenticationInfo;
    7. import org.apache.shiro.authc.AuthenticationToken;
    8. import org.apache.shiro.authc.SimpleAuthenticationInfo;
    9. import org.apache.shiro.authz.AuthorizationInfo;
    10. import org.apache.shiro.realm.AuthorizingRealm;
    11. import org.apache.shiro.subject.PrincipalCollection;
    12. import org.apache.shiro.util.ByteSource;
    13.  
    14. /**
    15.  * @author 彭于晏
    16.  * @site www.pengyuyan.com
    17.  * @company 玉渊工作室
    18.  * @create 2022-08-26 12:45
    19.  */
    20. public class MyRealm extends AuthorizingRealm {
    21.  
    22.     public UserBiz userBiz;
    23.  
    24.     public UserBiz getUserBiz() {
    25.         return userBiz;
    26.     }
    27.  
    28.     public void setUserBiz(UserBiz userBiz) {
    29.         this.userBiz = userBiz;
    30.     }
    31.  
    32.     /**
    33.      * 授权
    34.      * @param principals
    35.      * @return
    36.      * 替代shiro-web-ini
    37.      */
    38.     @Override
    39.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    40.         return null;
    41.     }
    42.  
    43.  
    44.     /**
    45.      * 认证
    46.      * @param token
    47.      * @return
    48.      * @throws AuthenticationException
    49.      * 替代shiro.ini
    50.      */
    51.     @Override
    52.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    53.         //调用查询方法
    54.         String userName = token.getPrincipal().toString();
    55.         User user = userBiz.queryUserByName(userName);
    56.         AuthenticationInfo info = new SimpleAuthenticationInfo(
    57.                 user.getUsername(),
    58.                 user.getPassword(),
    59.                 ByteSource.Util.bytes(user.getSalt()),
    60.                 this.getName()//realm的名字
    61.         );
    62.         return info;
    63.     }
    64. }
    65.

    application-shiro配置

    1. "1.0" encoding="UTF-8"?>
    2. <beans xmlns="http://www.springframework.org/schema/beans"
    3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    5.  
    6.     
    7.     <bean id="shiroRealm" class="com.ps.ssm.shiro.MyRealm">
    8.         <property name="userBiz" ref="userBiz" />
    9.         
    10.         
    11.         
    12.         
    13.         <property name="credentialsMatcher">
    14.             <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    15.                 
    16.                 <property name="hashAlgorithmName" value="md5"/>
    17.                 
    18.                 <property name="hashIterations" value="1024"/>
    19.                 
    20.                 <property name="storedCredentialsHexEncoded" value="true"/>
    21.             bean>
    22.         property>
    23.     bean>
    24.  
    25.     
    26.     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    27.         <property name="realm" ref="shiroRealm" />
    28.     bean>
    29.  
    30.     
    31.     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    32.         
    33.         <property name="securityManager" ref="securityManager" />
    34.         
    35.         <property name="loginUrl" value="/login"/>
    36.         
    37.         
    38.         
    39.         <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    40.         
    41.         <property name="filterChainDefinitions">
    42.             <value>
    43.                 
    44.                 
    45.                 
    46.                 
    47.                 /user/login=anon
    48.                 /user/updatePwd.jsp=authc
    49.                 /admin/*.jsp=roles[admin]
    50.                 /user/teacher.jsp=perms["user:update"]
    51.                 
    52.             value>
    53.         property>
    54.     bean>
    55.  
    56.     
    57.     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    58. beans>
    59.

    applicationContext.xml：

    1. "1.0" encoding="UTF-8"?>
    2. <beans xmlns="http://www.springframework.org/schema/beans"
    3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.        xmlns:context="http://www.springframework.org/schema/context" xmlns:tx="http://www.springframework.org/schema/tx"
    5.        xmlns:aop="http://www.springframework.org/schema/aop"
    6.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
    7.     <import resource="applicationContext-mybatis.xml">import>
    8.     <import resource="applicationContext-shiro.xml">import>
    9. beans>

    4.Spring与shiro的整合（注意）

    ShiroUserController

    1. package com.ps.ssm.controller;
    2.  
    3. import org.apache.shiro.SecurityUtils;
    4. import org.apache.shiro.authc.UsernamePasswordToken;
    5. import org.apache.shiro.subject.Subject;
    6. import org.springframework.stereotype.Controller;
    7. import org.springframework.web.bind.annotation.RequestMapping;
    8.  
    9. import javax.servlet.http.HttpServletRequest;
    10.  
    11. /**
    12.  * @author 彭于晏
    13.  * @site www.pengyuyan.com
    14.  * @company 玉渊工作室
    15.  * @create 2022-08-26 13:11
    16.  */
    17. @Controller
    18. public class ShiroUserController {
    19.  
    20.     @RequestMapping("/login")
    21.     public String login(HttpServletRequest request){
    22.         try {
    23.             //传入
    24.             String username = request.getParameter("username");
    25.             String password = request.getParameter("password");
    26.             //令牌
    27.             UsernamePasswordToken token = new UsernamePasswordToken(username,password);
    28.             //拿到当前登录主题
    29.             Subject subject = SecurityUtils.getSubject();
    30.             //通过登录主题进行登录
    31.             subject.login(token);
    32.             return "main";
    33.         }catch (Exception e){
    34.             request.setAttribute("message","账号密码错误");
    35.             return "login";
    36.         }
    37.     }
    38.  
    39.     @RequestMapping("/logout")
    40.     public String logout(HttpServletRequest request){
    41.         //拿到登录主体
    42.         Subject subject = SecurityUtils.getSubject();
    43.         subject.logout();
    44.         return "login";
    45.     }
    46.  
    47. }
    48.

    工具类：PasswordHelper

    1. package com.ps.shiro;
    2.  
    3.  
    4. import org.apache.shiro.crypto.RandomNumberGenerator;
    5. import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    6. import org.apache.shiro.crypto.hash.SimpleHash;
    7.  
    8. /**
    9.  * 用于shiro权限认证的密码工具类
    10.  */
    11. public class PasswordHelper {
    12.  
    13.     /**
    14.      * 随机数生成器(生成盐)
    15.      */
    16.     private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    17.  
    18.     /**
    19.      * 指定hash算法为MD5
    20.      */
    21.     private static final String hashAlgorithmName = "md5";
    22.  
    23.     /**
    24.      * 指定散列次数为1024次，即加密1024次
    25.      */
    26.     private static final int hashIterations = 1024;
    27.  
    28.     /**
    29.      * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
    30.      */
    31.     private static final boolean storedCredentialsHexEncoded = true;
    32.  
    33.     /**
    34.      * 获得加密用的盐(生成一个随机的盐)
    35.      *
    36.      * @return
    37.      */
    38.     public static String createSalt() {
    39.         return randomNumberGenerator.nextBytes().toHex();
    40.     }
    41.  
    42.     /**
    43.      * 获得加密后的凭证
    44.      *
    45.      * @param credentials 凭证(即密码)
    46.      * @param salt        盐
    47.      * @return
    48.      */
    49.     public static String createCredentials(String credentials, String salt) {
    50.         SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
    51.                 salt, hashIterations);
    52.         return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    53.     }
    54.  
    55.  
    56.     /**
    57.      * 进行密码验证
    58.      *
    59.      * @param credentials        未加密的密码
    60.      * @param salt               盐
    61.      * @param encryptCredentials 加密后的密码
    62.      * @return
    63.      */
    64.     public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
    65.         return encryptCredentials.equals(createCredentials(credentials, salt));
    66.     }
    67.  
    68.     public static void main(String[] args) {
    69.         //盐
    70.         String salt = createSalt();
    71.         System.out.println(salt);
    72.         System.out.println(salt.length());
    73.         //凭证+盐加密后得到的密码
    74.         String credentials = createCredentials("123456", salt);
    75.         System.out.println(credentials);
    76.         System.out.println(credentials.length());
    77.         boolean b = checkCredentials("123456", salt, credentials);
    78.         System.out.println(b);
    79.     }
    80. }

    测试：

     

    今天分享的知识就到这里啦！如果喜欢，那就关注博主，了解更多的知识吧！

  • 相关阅读:
    LeetCode-46-全排列
    hbase学习
    Python散点图
    现代企业架构框架-数据架构
    ue4项目运行还可以鼠标点击
    uniapp(uncloud) 使用生态开发接口详情2(使用 schema创建数据, schema2code创建页面, iconfont 引入项目)
    复旦微开发过程中遇到的问题总结（三）
    【Redis】理论进阶篇------浅谈Redis的缓存穿透和雪崩原理
    【C++】日期类的实现
    typeorm 批量插入数据优化和插入冲突操作
  • 原文地址：https://blog.csdn.net/weixin_63531940/article/details/126530554