• shiro认证（ssm）

    目录

    1、shiro认证

    1.1、pom依赖

    1.2、web.xml配置

    1.3、Mapper中新增

    1.4、Service层

    2、盐加密

    1、shiro认证

    1.1、pom依赖

    1. <dependency>
    2.     <groupId>org.apache.shiro</groupId>
    3.     <artifactId>shiro-core</artifactId>
    4.     <version>1.3.2</version>
    5. </dependency>
    6.  
    7. <dependency>
    8.     <groupId>org.apache.shiro</groupId>
    9.     <artifactId>shiro-web</artifactId>
    10.     <version>1.3.2</version>
    11. </dependency>
    12.  
    13. <dependency>
    14.     <groupId>org.apache.shiro</groupId>
    15.     <artifactId>shiro-spring</artifactId>
    16.     <version>1.3.2</version>
    17. </dependency>

    1.2、web.xml配置

    1. <!-- shiro过滤器定义 -->
    2. <filter>
    3.   <filter-name>shiroFilter</filter-name>
    4.   <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    5.   <init-param>
    6.     <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->
    7.     <param-name>targetFilterLifecycle</param-name>
    8.     <param-value>true</param-value>
    9.   </init-param>
    10. </filter>
    11. <filter-mapping>
    12.   <filter-name>shiroFilter</filter-name>
    13.   <url-pattern>/*</url-pattern>
    14. </filter-mapping>

    1.3、Mapper中新增

    1.  <select id="queryByName" resultType="com.ssr.model.User" parameterType="java.lang.String">
    2.     select
    3.     <include refid="Base_Column_List" />
    4.     from t_shiro_user
    5.     where userName = #{userName}
    6.   </select>

    1.4、Service层

    UserBiz.java

    1. package com.ssr.biz;
    2.  
    3. import com.ssr.model.User;
    4. import org.apache.ibatis.annotations.Param;
    5.  
    6. public interface UserBiz {
    7.     int deleteByPrimaryKey(Integer userid);
    8.  
    9.     int insert(User record);
    10.  
    11.     int insertSelective(User record);
    12.  
    13.     User selectByPrimaryKey(Integer userid);
    14.  
    15.     User queryByName(@Param("userName") String uname);
    16.  
    17.     int updateByPrimaryKeySelective(User record);
    18.  
    19.     int updateByPrimaryKey(User record);
    20.  
    21. }

    UserBizImpl .java

    1. package com.ssr.biz.impl;
    2.  
    3. import com.ssr.biz.UserBiz;
    4. import com.ssr.mapper.UserMapper;
    5. import com.ssr.model.User;
    6. import org.springframework.beans.factory.annotation.Autowired;
    7. import org.springframework.stereotype.Service;
    8.  
    9. @Service("useBiz")
    10. public class UserBizImpl implements UserBiz {
    11.     @Autowired
    12.     private UserMapper userMapper;
    13.  
    14.     @Override
    15.     public int deleteByPrimaryKey(Integer userid) {
    16.         return userMapper.deleteByPrimaryKey(userid);
    17.     }
    18.  
    19.     @Override
    20.     public int insert(User record) {
    21.         return userMapper.insert(record);
    22.     }
    23.  
    24.     @Override
    25.     public int insertSelective(User record) {
    26.         return userMapper.insertSelective(record);
    27.     }
    28.  
    29.     @Override
    30.     public User selectByPrimaryKey(Integer userid) {
    31.         return  userMapper.selectByPrimaryKey(userid);
    32.     }
    33.  
    34.     @Override
    35.     public User queryByName(String uname) {
    36.         return userMapper.queryByName(uname);
    37.     }
    38.  
    39.     @Override
    40.     public int updateByPrimaryKeySelective(User record) {
    41.         return userMapper.updateByPrimaryKeySelective(record);
    42.     }
    43.  
    44.     @Override
    45.     public int updateByPrimaryKey(User record) {
    46.         return userMapper.updateByPrimaryKey(record);
    47.     }
    48. }

    Myrealm.java

     

    1. package com.ssr.shiroo;
    2.  
    3. import com.ssr.biz.UserBiz;
    4. import com.ssr.model.User;
    5. import org.apache.shiro.authc.AuthenticationException;
    6. import org.apache.shiro.authc.AuthenticationInfo;
    7. import org.apache.shiro.authc.AuthenticationToken;
    8. import org.apache.shiro.authc.SimpleAuthenticationInfo;
    9. import org.apache.shiro.authz.AuthorizationInfo;
    10. import org.apache.shiro.realm.AuthorizingRealm;
    11. import org.apache.shiro.subject.PrincipalCollection;
    12. import org.apache.shiro.util.ByteSource;
    13.  
    14. public class Myrealm extends AuthorizingRealm {
    15.  
    16.     private UserBiz userBiz;
    17.  
    18.     public UserBiz getUserBiz() {
    19.         return userBiz;
    20.     }
    21.  
    22.     public void setUserBiz(UserBiz userBiz) {
    23.         this.userBiz = userBiz;
    24.     }
    25.  
    26.     @Override
    27.     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    28.         return null;
    29.     }
    30.  
    31.     @Override
    32.     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    33.         System.out.println("身份认证...");
    34.         String username = token.getPrincipal().toString();
    35.         String password = token.getCredentials().toString();
    36.         User user = userBiz.queryByName(username);
    37. //        拿到数据库中的用户信息，放入token凭证中，用于controler进行对比
    38.         AuthenticationInfo info = new SimpleAuthenticationInfo(
    39.                 user.getUsername(),
    40.                 user.getPassword(),
    41.                 ByteSource.Util.bytes(user.getSalt()),
    42.                 this.getName()
    43.         );
    44.         return info;
    45.     }
    46.  
    47. }

     applicationContext-shiro.xml

    1. "1.0" encoding="UTF-8"?>
    2. <beans xmlns="http://www.springframework.org/schema/beans"
    3.        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    4.        xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    5.  
    6.     
    7.     <bean id="shiroRealm" class="com.ssr.shiroo.Myrealm">
    8.         <property name="userBiz" ref="useBiz" />
    9.         
    10.         
    11.         
    12.         
    13.         <property name="credentialsMatcher">
    14.             <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
    15.                 
    16.                 <property name="hashAlgorithmName" value="md5"/>
    17.                 
    18.                 <property name="hashIterations" value="1024"/>
    19.                 
    20.                 <property name="storedCredentialsHexEncoded" value="true"/>
    21.             bean>
    22.         property>
    23.     bean>
    24.  
    25.     
    26.     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    27.         <property name="realm" ref="shiroRealm" />
    28.     bean>
    29.  
    30.     
    31.     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    32.         
    33.         <property name="securityManager" ref="securityManager" />
    34.         
    35.         <property name="loginUrl" value="/login"/>
    36.         
    37.         
    38.         
    39.         <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
    40.         
    41.         <property name="filterChainDefinitions">
    42.             <value>
    43.                 
    44.                 
    45.                 
    46.                 
    47.                 /user/login=anon
    48.                 /user/updatePwd.jsp=authc
    49.                 /admin/*.jsp=roles[admin]
    50.                 /user/teacher.jsp=perms["user:update"]
    51.                 
    52.             value>
    53.         property>
    54.     bean>
    55.  
    56.     
    57.     <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    58. beans>

    LoginController .java

    1. package com.ssr.controller;
    2.  
    3. import org.apache.shiro.SecurityUtils;
    4. import org.apache.shiro.authc.UsernamePasswordToken;
    5. import org.apache.shiro.subject.Subject;
    6. import org.springframework.stereotype.Controller;
    7. import org.springframework.web.bind.annotation.RequestMapping;
    8.  
    9. import javax.servlet.ServletException;
    10. import javax.servlet.http.HttpServletRequest;
    11. import javax.servlet.http.HttpServletResponse;
    12. import java.io.IOException;
    13.  
    14. @Controller
    15. public class LoginController {
    16.     @RequestMapping("/login")
    17.     public String login(HttpServletRequest req, HttpServletResponse resp){
    18.         String username = req.getParameter("username");
    19.         String password = req.getParameter("password");
    20.         UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
    21.         Subject subject = SecurityUtils.getSubject();
    22.         try {
    23.             subject.login(usernamePasswordToken);
    24.             req.getRequestDispatcher("main.jsp").forward(req, resp);
    25.         } catch (Exception e) {
    26.             req.setAttribute("message", "您的用户名密码输入有误！！！");
    27.             try {
    28.                 req.getRequestDispatcher("login.jsp").forward(req, resp);
    29.             } catch (ServletException e1) {
    30.                 e1.printStackTrace();
    31.             } catch (IOException e1) {
    32.                 e1.printStackTrace();
    33.             }
    34.         }
    35.         return null;
    36.     }
    37.  
    38.     @RequestMapping("/logout")
    39.     public String logout(HttpServletRequest req, HttpServletResponse resp){
    40.         Subject subject = SecurityUtils.getSubject();
    41.         subject.logout();
    42.         try {
    43.             resp.sendRedirect(req.getContextPath()+"/login.jsp");
    44.         } catch (IOException e) {
    45.             e.printStackTrace();
    46.         }
    47.         return null;
    48.     }
    49. }

    运行效果：

     

    2、盐加密

    盐加密工具类，在做新增用户的时候使用，将加密后的密码、及加密时候的盐放入数据库；

    本篇博客中的表数据是现成的，暂时用不上这个工具类去生成数据；

    盐加密的发展史

     盐加密发展史
        第一阶段：明文密码
        第二阶段：md5加密
        第三阶段：md5加密加盐
        第四阶段：md5加盐加密加次数

     PasswordHelper .java

    1. package com.javaxl.ssm.util;
    2.  
    3. import org.apache.shiro.crypto.RandomNumberGenerator;
    4. import org.apache.shiro.crypto.SecureRandomNumberGenerator;
    5. import org.apache.shiro.crypto.hash.SimpleHash;
    6.  
    7. public class PasswordHelper {
    8.  
    9.     /**
    10.      * 随机数生成器
    11.      */
    12.     private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();
    13.  
    14.     /**
    15.      * 指定hash算法为MD5
    16.      */
    17.     private static final String hashAlgorithmName = "md5";
    18.  
    19.     /**
    20.      * 指定散列次数为1024次，即加密1024次
    21.      */
    22.     private static final int hashIterations = 1024;
    23.  
    24.     /**
    25.      * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
    26.      */
    27.     private static final boolean storedCredentialsHexEncoded = true;
    28.  
    29.     /**
    30.      * 获得加密用的盐
    31.      *
    32.      * @return
    33.      */
    34.     public static String createSalt() {
    35.         return randomNumberGenerator.nextBytes().toHex();
    36.     }
    37.  
    38.     /**
    39.      * 获得加密后的凭证
    40.      *
    41.      * @param credentials 凭证(即密码)
    42.      * @param salt        盐
    43.      * @return
    44.      */
    45.     public static String createCredentials(String credentials, String salt) {
    46.         SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
    47.                 salt, hashIterations);
    48.         return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    49.     }
    50.  
    51.  
    52.     /**
    53.      * 进行密码验证
    54.      *
    55.      * @param credentials        未加密的密码
    56.      * @param salt               盐
    57.      * @param encryptCredentials 加密后的密码
    58.      * @return
    59.      */
    60.     public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
    61.         return encryptCredentials.equals(createCredentials(credentials, salt));
    62.     }
    63.  
    64.     public static void main(String[] args) {
    65.         //盐
    66.         String salt = createSalt();
    67.         System.out.println(salt);
    68.         System.out.println(salt.length());
    69.         //凭证+盐加密后得到的密码
    70.         String credentials = createCredentials("123", salt);
    71.         System.out.println(credentials);
    72.         System.out.println(credentials.length());
    73.         boolean b = checkCredentials("123", salt, credentials);
    74.         System.out.println(b);
    75.     }
    76. }

  • 相关阅读:
    day5_redis学习
    R语言计算两个向量成对元素的最大值：计算两个向量的平行最大值（parallel maximum）
    Flask学习一：概述
    并查集理论及常见面试题
    maven 无法下载依赖 poi-scratchpad
    设计模式——策略模式
    【Midjourney入门教程2】Midjourney的基础操作和设置
    电脑重装系统后如何查看电脑内存信息的方法
    Qt信号槽与事件循环学习笔记
    Spring-IOC-@Value和@PropertySource用法
  • 原文地址：https://blog.csdn.net/m0_65774688/article/details/126577488