参考狂神笔记
一 、简介
shiro好像是用传统Token的,不是jwt
Subject:用户(负责拦截请求)
SecurityManger:管理所以用户
Realm:连接数据(负责对哪些用户授权)
Subject的常用方法:
二、SpringBoot整合shiro (先实现验证,没绑定数据库,账号和密码显示静态root)
直接新建springboot的项目,不再弄maven的无骨架了:
就完事了:
一开始:
完事时:
(1)pom.xml:
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.4.5</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<groupId>com.itheima</groupId>
<artifactId>shiro-springboot</artifactId>
<version>0.0.1-SNAPSHOT</version>
<name>shiro-springboot</name>
<description>Demo project for Spring Boot</description>
<properties>
<java.version>1.8</java.version>
</properties>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<!--thymeleaf模板-->
<dependency>
<groupId>org.thymeleaf</groupId>
<artifactId>thymeleaf-spring5</artifactId>
</dependency>
<dependency>
<groupId>org.thymeleaf.extras</groupId>
<artifactId>thymeleaf-extras-java8time</artifactId>
</dependency>
<!--Shiro 和 spring整合的依赖-->
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.1</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
</plugins>
</build>
</project>
(2)自定义UserRealm
(含认证账号密码的方法,也要controller传过来的token的)实现AuthorizingRealm 也是给ShiroConfig用的
package com.itheima.config;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Component;
/**
* @author QLBF
* @version 1.0
* @date 2021/5/5 17:04
*/
//自定义Realm 必须要的 给ShrioConfig第三步用的
public class UserRealm extends AuthorizingRealm{
//执行授权逻辑
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
System.out.println("执行了=>授权逻辑PrincipalCollection");
return null;
}
//执行认证逻辑
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
System.out.println("执行了=>认证逻辑AuthenticationToken");
//假设数据库的用户名和密码
String name="root";
String password="root";
//1.判断用户名
//把token转为我们认识的,也是从controller那个token来的
UsernamePasswordToken userToken = (UsernamePasswordToken) token;
if (!userToken.getUsername().equals(name)){
//用户名不存在
return null; //shiro底层就会抛出 UnknownAccountException
}
//2. 验证密码,我们可以使用一个AuthenticationInfo实现类 SimpleAuthenticationInfo
// shiro会自动帮我们验证!重点是第二个参数就是要验证的密码!
//第一个参数是传给上面的授权方法获得当前用户的,现在暂时设置为空先
return new SimpleAuthenticationInfo("",password,"");
}
}
(3)com.itheima.config.ShiroConfig:
package com.itheima.config;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.LinkedHashMap;
import java.util.Map;
/**
* @author QLBF
* @version 1.0
* @date 2021/5/5 17:02
*/
//声明为配置类
@Configuration
public class ShiroConfig {
//创建 ShiroFilterFactoryBean 3
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
//设置安全管理器
shiroFilterFactoryBean.setSecurityManager(securityManager);
/*
添加Shiro内置过滤器,常用的有如下过滤器:
anon: 无需认证就可以访问
authc: 必须认证才可以访问
user: 如果使用了记住我功能就可以直接访问
perms: 拥有某个资源权限才可以访问
role: 拥有某个角色权限才可以访问
*/
Map<String,String> filterMap=new LinkedHashMap<String, String>();
//设置过滤器,还没登录前要想访问controller的add和update必须通过登录认证才允许访问
filterMap.put("/user/add","authc"); //这里user/*可以通配符的
filterMap.put("/user/update","authc");
shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
//修改到要跳转的login页面(shrio没security会帮你自动生成一个登录的,得自己写);
shiroFilterFactoryBean.setLoginUrl("/toLogin"); //toLogin是controller的一个跳到登录页面的方法
return shiroFilterFactoryBean;
}
//创建 DefaultWebSecurityManager 2
@Bean(name = "securityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
//关联Realm
securityManager.setRealm(userRealm);
return securityManager;
}
//创建 realm 对象 1
@Bean
public UserRealm userRealm(){
return new UserRealm();
}
}
一些前端:
templates/user/add.html:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>add</title>
</head>
<body>
<h1>add</h1>
</body>
</html>
templates/user/update.html:
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>update</title>
</head>
<body>
<h1>update</h1>
</body>
</html>
index.html:
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
<meta charset="UTF-8">
<title>Title</title>
</head>
<body>
<h1>首页</h1>
<p th:text="${msg1}"></p>
<!--/user/add是controller的一个路径-->
<a th:href="@{/user/add}">add</a>
<a th:href="@{/user/update}">update</a>
</body>
</html>
templates/login.html:
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
<meta charset="UTF-8">
<title>登录页面</title>
</head>
<body>
<p style="color: red" th:text="${msg}"></p>
<!--login是controller使用shiro做登录验证的方法-->
<form th:action="@{/login}">
<p>
用户名:<input type="text" name="username">
</p>
<p>
密码:<input type="text" name="password">
</p>
<p><input type="submit"></p>
</form>
</body>
</html>
(4)com.itheima.controller.MyController
package com.itheima.controller;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
/**
* @author QLBF
* @version 1.0
* @date 2021/5/5 16:58
*/
@Controller
public class MyController {
// 加/代表默认跳到这
@RequestMapping({"/","/index"})
public String toIndex(Model model){
model.addAttribute("msg1","hello,Shiro");
return "index";
}
@RequestMapping("/user/add")
public String toAdd(){
return "user/add";
}
@RequestMapping("/user/update")
public String toUpdate(){
return "user/update";
}
//跳到登录登录页面的方法
@RequestMapping("/toLogin")
public String toLogin(){
return "login";
}
//登录操作
@RequestMapping("/login")
public String login(String username,String password,Model model){
//使用shiro,编写认证操作
//1. 获取Subject
Subject subject = SecurityUtils.getSubject();
//2. 封装用户的数据,token是根据用户名和密码生成的
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
//token.setRememberMe(true); //记住我
//3. 执行登录的方法,只要没有异常就代表登录成功!
try {
subject.login(token); //执行登录,shiro帮我们弄的,很麻烦的,会跳到UserRealm的认证方法认证的
//登录成功!返回首页
return "index";
}catch (UnknownAccountException e){
//用户名不存在
model.addAttribute("msg","用户名不存在");
return "login";
}catch (IncorrectCredentialsException e) {
//密码错误
model.addAttribute("msg","密码错误");
return "login";
}
}
}
运行springboot启动类:
点击其中add或者update那么它就会跳到ShiroConfig过滤器要求你登录先:
然后你输入的账号密码经过controller新建了token后传到UserRealm的认证方法看你账号密码是否正确才进一步然你操作:
只要输入了root和root才正确才能跳到主页再访问资源,因为我在UserRealm把它设置定了。
成功访问:
本项目代码源自狂神