ssm整合shiro通过自定义Realm实现认证登录、权限处理、自定义role拦截、MD5加密

整合后实现功能

1.登录认证
2.权限处理
3.自定义role拦截
4.md5加密

ssm整合shiro步骤

ssm框架整合链接:https://blog.csdn.net/IManiy/article/details/81393256
开发工具:IDEA
Demo框架:Spring+SpringMVC+Mybatis+Maven

先看看整合完成后的项目结构
在这里插入图片描述

新建一个maven项目

配置pom.xml文件

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>top.maniy</groupId>
    <artifactId>shiro-ssm</artifactId>
    <version>1.0-SNAPSHOT</version>
    <properties>
        <junit.version>4.12</junit.version>
        <spring.version>4.1.3.RELEASE</spring.version>
        <mybatis.version>3.2.8</mybatis.version>
        <mybatis.spring.version>1.2.2</mybatis.spring.version>
        <mybatis.paginator.version>1.2.15</mybatis.paginator.version>
        <mysql.version>5.1.32</mysql.version>
        <slf4j.version>1.6.4</slf4j.version>
        <jackson.version>2.4.2</jackson.version>
        <druid.version>1.0.9</druid.version>
        <jstl.version>1.2</jstl.version>
        <servlet-api.version>2.5</servlet-api.version>
        <jsp-api.version>2.0</jsp-api.version>
        <commons-lang3.version>3.3.2</commons-lang3.version>
        <commons-io.version>1.3.2</commons-io.version>
        <commons-net.version>3.3</commons-net.version>
        <pagehelper.version>3.4.1</pagehelper.version>
        <shiro-spring>1.2.3</shiro-spring>
        <shiro-core>1.2.3</shiro-core>
    </properties>
    <dependencies>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>${druid.version}</version>
        </dependency>
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>${mysql.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-beans</artifactId>
            <version>${spring.version}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-aspects</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jms</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context-support</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <!-- Mybatis -->
        <dependency>
            <groupId>org.mybatis</groupId>
            <artifactId>mybatis</artifactId>
            <version>${mybatis.version}</version>
        </dependency>
        <dependency>
            <groupId>org.mybatis</groupId>
            <artifactId>mybatis-spring</artifactId>
            <version>${mybatis.spring.version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.miemiedev</groupId>
            <artifactId>mybatis-paginator</artifactId>
            <version>${mybatis.paginator.version}</version>
        </dependency>
        <dependency>
            <groupId>com.github.pagehelper</groupId>
            <artifactId>pagehelper</artifactId>
            <version>${pagehelper.version}</version>
        </dependency>
        <!-- Apache工具组件 -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>${commons-lang3.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-io</artifactId>
            <version>${commons-io.version}</version>
        </dependency>
        <dependency>
            <groupId>commons-net</groupId>
            <artifactId>commons-net</artifactId>
            <version>${commons-net.version}</version>
        </dependency>
        <!-- Jackson Json处理工具包 -->
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>${jackson.version}</version>
        </dependency>
        <!-- 单元测试 -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>${junit.version}</version>
            <scope>test</scope>
        </dependency>
        <!-- 日志处理 -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
            <version>${slf4j.version}</version>
        </dependency>
        <!-- JSP相关 -->
        <dependency>
            <groupId>jstl</groupId>
            <artifactId>jstl</artifactId>
            <version>${jstl.version}</version>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>servlet-api</artifactId>
            <version>${servlet-api.version}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jsp-api</artifactId>
            <version>${jsp-api.version}</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${shiro-core}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>${shiro-spring}</version>
        </dependency>
    </dependencies>

</project>

进行SSM框架整合

通过project Structure新建webpp及其下面目录

在这里插入图片描述

新建项目结构文件夹及文件

在这里插入图片描述

sqlMapConfig.xml、spring-service、spring-dao、jdbc.properites与下面链接相同

ssm框架整合链接:https://blog.csdn.net/IManiy/article/details/81393256

spring-shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
       http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-2.0.xsd">

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="login.html"/>
        <property name="unauthorizedUrl" value="403.html" />
        <property name="filterChainDefinitions">
            <value>
                <!-- 这里顺序执行 anon不要认证 authc需要认证,一般情况下 /*放在最下面-->
                <!--加载静态资源 /js/** = anon-->

                /login.html = anon
                /subLogin = anon
                /testRole2=roles["admin"]
                /testRole3=rolesOr["admin","admin1"]
                /testPerms =perms[user:select]
                /testPerms1 =perms["user:select","user:update"]
                /* = authc
            </value>
        </property>
        <property name="filters">
            <util:map>
                <entry key="rolesOr" value-ref="rolesOrFilter"/>
            </util:map>


        </property>
    </bean>

    <bean class="top.maniy.demo.filter.RolesOrFilter" id="rolesOrFilter"/>
    <!--创建SecurityManager对象 -->
    <bean class="org.apache.shiro.web.mgt.DefaultWebSecurityManager" id="securityManager">
        <property name="realm" ref="realm"/>
    </bean>

    <!--自定义realm -->
    <bean class="top.maniy.demo.shiro.realm.CustomRealm" id="realm">
        <property name="credentialsMatcher" ref="credentialsMatcher" />
    </bean>
    <!--md5 加密-->
    <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher" id="credentialsMatcher">
        <property name="hashAlgorithmName" value="md5" />
        <property name="hashIterations" value="1"/>

    </bean>

</beans>

springmvc.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
		xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"
		xmlns:context="http://www.springframework.org/schema/context"
	    xmlns:aop="http://www.springframework.org/schema/aop"
	    xmlns:mvc="http://www.springframework.org/schema/mvc"
	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
        http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-4.0.xsd
        http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd">
	<!-- 配置Controller扫描 -->
	<context:component-scan base-package="top.maniy.demo.controller" />
<!-- 配置注解驱动 -->
	<mvc:annotation-driven />
	
	<!-- 对静态资源放行 -->
	<!--<mvc:resources location="/css/" mapping="/css/**"/>
	<mvc:resources location="/js/" mapping="/js/**"/>
	<mvc:resources location="/fonts/" mapping="/fonts/**"/>-->
	<!-- 2.静态资源默认servlet配置 (1)加入对静态资源的处理:js,gif,png (2)允许使用"/"做整体映射 -->
	<mvc:resources mapping="/*" location="WEB-INF/" />



	<!-- 配置视图解析器 -->
	<bean	class="org.springframework.web.servlet.view.InternalResourceViewResolver">
		<property name="viewClass" value="org.springframework.web.servlet.view.JstlView"/>

		<!-- 前缀 -->
		<property name="prefix" value="/WEB-INF/page/" />
		<!-- 后缀 -->
		<property name="suffix" value=".jsp" />
	</bean>


	<aop:config proxy-target-class="true"/>

	<!--Shiro配置-->
	<!--
        1.配置lifecycleBeanPostProcessor,可以在Spring IOC容器中调用shiro的生命周期方法.
    -->
	<bean class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

	<!--
       2.开启Spring AOC Shiro注解支持
   -->
	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
		<property name="securityManager" ref="securityManager"/>
	</bean>
</beans>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
         version="4.0">
    <welcome-file-list>
        <welcome-file>login.html</welcome-file>
    </welcome-file-list>

    <!--配置shiro-->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>

    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 配置spring -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>classpath:spring/spring-*.xml</param-value>
    </context-param>

    <!-- 配置监听器加载spring -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <!-- 配置过滤器,解决post的乱码问题 -->
    <filter>
        <filter-name>encoding</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>encoding</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>


    <!-- 配置SpringMVC -->
    <servlet>
        <servlet-name>SpringMVC</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring/springmvc.xml</param-value>
        </init-param>
        <!-- 配置springmvc什么时候启动,参数必须为整数 -->
        <!-- 如果为0或者大于0,则springMVC随着容器启动而启动 -->
        <!-- 如果小于0,则在第一次请求进来的时候启动 -->
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>SpringMVC</servlet-name>
        <!-- 所有的请求都进入springMVC -->
        <url-pattern>/</url-pattern>
    </servlet-mapping>
</web-app>

自定义role拦截RolesOrFilter

/**
 * @author liuzonghua
 * @Package top.maniy.filter
 * @Description:自定义role拦截,定义:如果有一个权限存在就可以跳转
 * @date 2018/10/9 12:57
 */
public class RolesOrFilter extends AuthorizationFilter{

    protected boolean isAccessAllowed(ServletRequest servletRequest, ServletResponse servletResponse, Object o) throws Exception {
        Subject subject =getSubject(servletRequest,servletResponse);
        String[] roles =(String[])  o;
        if(roles ==null || roles.length == 0){
            return true;
        }
        for (String role:roles){
            if(subject.hasRole(role)){
                return  true;
            }
        }
        return false;
    }
}

UserMapper.java

public interface UserMapper {
    //查询根据username用户信息
    User getUserByUserName(String userName);
    //根据username查询角色
    List<String> queryRolesByUserName(String userName);
    //根据username查询权限
    List<String> queryPermissionByUserName(String userName);
}

UserMapper.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper
PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace ="top.maniy.demo.mapper.UserMapper">


	<select id="getUserByUserName" resultType="User">
		SELECT * FROM users WHERE username=#{username}
	</select>
	<select id="queryRolesByUserName" resultType="String">
		SELECT role_name FROM user_roles WHERE username=#{username}
	</select>
	<select id="queryPermissionByUserName" resultType="String">
		SELECT permission FROM roles_permissions WHERE role_name=#{role_name}
	</select>
</mapper>

自定义CustomRealm

public class CustomRealm extends AuthorizingRealm{

    @Autowired
    private UserMapper userMapper;
//    Map<String,String> userMap =new HashMap<String, String>(16);
//    {
//        userMap.put("maniy","993121f227e2cef658c392549708d60c");
//        super.setName("customRealm");
//    }
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String userName = (String) principalCollection.getPrimaryPrincipal();
        Set<String> roles =getRolesByUserName(userName);

        Set<String> permissions = getPermissionByUserName(userName);
        SimpleAuthorizationInfo simpleAuthorizationInfo =new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    private Set<String> getPermissionByUserName(String userName) {
        List<String> listR =userMapper.queryRolesByUserName(userName);
        List<String>listP=new ArrayList<String>();
        for(String str:listR){
             listP.addAll(userMapper.queryPermissionByUserName(str));
        }

        Set<String> sets =new HashSet<String>(listP);
//     Set<String> sets =new HashSet<String>();
//     sets.add("user:delete");
//     sets.add("user:add");
     return sets;
    }

    private Set<String> getRolesByUserName(String userName) {
        System.out.println("从数据库中获取授权数据");
        List<String> list =userMapper.queryRolesByUserName(userName);

        Set<String> sets=new HashSet<String>(list);
//        Set<String> sets =new HashSet<String>();
//        sets.add("admin");
//        sets.add("user");
        return sets;
    }

       protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {
        //1.从主体传过来额认证信息中,获得用户名
        String userName = (String) authenticationToken.getPrincipal();
        //2.通过用户名到数据库中获取凭证
        String password = getPasswordByUserName(userName);
        if(password == null){
            return null;
        }
        SimpleAuthenticationInfo simpleAuthenticationInfo =new SimpleAuthenticationInfo
                (userName,password,"customRealm");
        //shiro需要知道用了什么盐,在去解析密码
        simpleAuthenticationInfo.setCredentialsSalt(ByteSource.Util.bytes(userName));

        return simpleAuthenticationInfo;
    }

    /**
     * 模拟数据库查询认证
     * @param username
     * @return
     */
    private String getPasswordByUserName(String username){
        //
        User user =userMapper.getUserByUserName(username);
        if(user!=null){
            System.out.println(user.getPassword());
            return user.getPassword();
        }else {
            return null;
        }
        //return userMap.get(username);
    }

    public static void main(String[] args) {
        //单一的是密码加密容易破解,这时候就需要 加盐
        Md5Hash md5Hash= new Md5Hash("1234567","Mark");
        System.out.println(md5Hash.toString());
    }
}

UserController

@Controller
public class UserController {
    @RequestMapping(value = "/subLogin" ,method = RequestMethod.POST,
    produces = "application/json;charset=utf-8")
    @ResponseBody
    public String subLogin(User user){
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token =new UsernamePasswordToken(user.getUsername(),
                user.getPassword());
        try {
            token.setRememberMe(user.isRememberMe());
            subject.login(token);
        } catch (AuthenticationException e) {
            return  e.getMessage();
        }
        if(subject.hasRole("admin")){
            if (subject.isPermitted("user:select")){
                return "权限为user:select";
            }
            return "有admin权限";
        }
        return "无admin权限";
    }

    /**
     * 通过注解配置授权
     * 用户角色必须具备admin权限才能访问
     * @return
     */
    @RequiresRoles("admin")
    //@RequiresPermissions("xxxx")
    @RequestMapping(value = "/testRole",method = RequestMethod.GET)
    @ResponseBody
    public String TestRole(){
        return "testRole success";
    }

    /**
     * 通过注解配置授权
     * 用户角色必须具备admin权限才能访问
     * @return
     */
    @RequiresRoles("admin1")
    @RequestMapping(value = "/testRole1",method = RequestMethod.GET)
    @ResponseBody
    public String TestRole1(){
        return "testRole1 success";
    }

    @RequestMapping(value = "/testRole2",method = RequestMethod.GET)
    @ResponseBody
    public String TestRole2(){
        return "testRole2 success";
    }
    @RequestMapping(value = "/testRole3",method = RequestMethod.GET)
    @ResponseBody
    public String TestRole3(){
        return "testRole3 success";
    }

    @RequestMapping(value = "/testPerms",method = RequestMethod.GET)
    @ResponseBody
    public String TestPerms(){
        return "testPerms success";
    }
    @RequestMapping(value = "/testPerms1",method = RequestMethod.GET)
    @ResponseBody
    public String TestPerms1(){
        return "testPerms1 success";
    }
}

login.html

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>登录</title>
</head>
<body>
<form action="subLogin" method="post">
    <input type="text" name="username" /><br>
    <input type="password" name="password"/><br>
    <input type="checkbox" name="rememberMe" />记住我
    <input type="submit" value="登录">
</form>
</body>
</html>

数据库

在这里插入图片描述

项目demo下载:https://download.csdn.net/download/imaniy/10713477

  • 0
    点赞
  • 5
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值