Shiro整合SpringBoot

1.Shiro

• Apache Shiro 是一个java安全(权限)框架.
• Shiro可以非常容易的开发出足够好的应用,其不仅可以用在javaSE环境,也可用用在javaEE环境
• Shiro可以完成,认证,授权,加密,会话管理,Web集成,缓存等.
• 下载地址:https://shiro.apache.org/
• GitHub地址:https://github.com/apache/shiro

配置

导入依赖：

<dependencies>
    <!-- shiro安全框架 -->
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.9.0</version>
    </dependency>
    <!-- 日志 -->
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>slf4j-simple</artifactId>
        <version>1.7.36</version>
    </dependency>
    <dependency>
        <groupId>org.slf4j</groupId>
        <artifactId>jcl-over-slf4j</artifactId>
        <version>1.7.36</version>
    </dependency>
</dependencies>

导入完成后还需要在resources下配置shiro.ini

# =============================================================================
# Tutorial INI configuration
#
# Usernames/passwords are based on the classic Mel Brooks' film "Spaceballs" :)
# =============================================================================

# -----------------------------------------------------------------------------
# Users and their (optional) assigned roles
# username = password, role1, role2, ..., roleN
# -----------------------------------------------------------------------------
[users]
root = secret, admin
guest = guest, guest
presidentskroob = 12345, president
darkhelmet = ludicrousspeed, darklord, schwartz
lonestarr = vespa, goodguy, schwartz

# -----------------------------------------------------------------------------
# Roles with assigned permissions
# roleName = perm1, perm2, ..., permN
# -----------------------------------------------------------------------------
[roles]
admin = *
schwartz = lightsaber:*
goodguy = winnebago:drive:eagle5

到这里基本配置就成功了,可以进行编码了.

基本方法

shiro的一些基本实例如下:

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class Quickstart {

    private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);
    
    public static void main(String[] args) {
        //加载用户配置的配置文件
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        ///互殴去实例并添加到安全管理器
        SecurityManager securityManager = factory.getInstance();
        SecurityUtils.setSecurityManager(securityManager);


        //获取当前的用户
        Subject currentUser = SecurityUtils.getSubject();
        //获取当前用户的Session
        Session session = currentUser.getSession();
        session.setAttribute("someKey", "aValue");

        String value = (String) session.getAttribute("someKey");
        if (value.equals("aValue")) {
            log.info("Retrieved the correct value! [" + value + "]");
        }

        //判断当前用户是否被认证
        if (!currentUser.isAuthenticated()) {
            //设置令牌
            UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
            //开启记住我功能
            token.setRememberMe(true);
            try {
                currentUser.login(token);//执行登录操作
            } catch (UnknownAccountException uae) { //未知账户异常
                log.info("There is no user with username of " + token.getPrincipal());
            } catch (IncorrectCredentialsException ice) { //不正确凭据异常
                log.info("Password for account " + token.getPrincipal() + " was incorrect!");
            } catch (LockedAccountException lae) { //账户锁定异常
                log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                        "Please contact your administrator to unlock it.");
            } catch (AuthenticationException ae) {
                //身份验证异常
            }
        }

        //是否拥有角色
        if (currentUser.hasRole("schwartz")) {
            log.info("May the Schwartz be with you!");
        } else {
            log.info("Hello, mere mortal.");
        }

        //是否允许访问
        if (currentUser.isPermitted("lightsaber:wield")) {
            log.info("You may use a lightsaber ring.  Use it wisely.");
        } else {
            log.info("Sorry, lightsaber rings are for schwartz masters only.");
        }

        //是否允许访问
        if (currentUser.isPermitted("winnebago:drive:eagle5")) {
            log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
                    "Here are the keys - have fun!");
        } else {
            log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
        }

        //退出登录
        currentUser.logout();

        System.exit(0);
    }
}

提取方法:

//获取当前用户
SecurityUtils.getSubject();
//获取当前用户的Session(session的取值赋值这里不在叙述)
currentUser.getSession();
//判断当前用户是否认证
currentUser.isAuthenticated()
//执行登录操作
currentUser.login(这里为登录的令牌);
//是否拥有角色
currentUser.hasRole(“schwartz”)
//是否允许访问
currentUser.isPermitted(“lightsaber:wield”)
//退出登录
currentUser.logout();

Shiro三大对象

• Subject 用户
• SecurityManager 管理所有用户
• Realm 连接数据
  #Shiro与SpringBoot整合
  导入与Shiro与SpringBoot整合的jar包

        <!-- shiro整合SpirngBoot启动器 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring-boot-web-starter</artifactId>
            <version>1.9.0</version>
        </dependency>

编写配置类进行配置如:

package com.example.springbootshiro.config;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfig {

    //ShiroFilterFactoryBean(过滤工厂)
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
        return shiroFilterFactoryBean;
    }

    //DefaultWebSecurityManager(默认网络安全管理器)
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("getUserRealm") UserRealm userRealm){
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(userRealm);
        return defaultWebSecurityManager;
    }

    //创建AuthorizingRealm对象,(这里需要自定义)
    @Bean
    public UserRealm getUserRealm(){
        return new UserRealm();
    }

}

创建的对象如下:

package com.example.springbootshiro.config;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class UserRealm extends AuthorizingRealm {

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("进入了UserRealm授权doGetAuthorizationInfo方法");
        return null;
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("进入了UserRealm认证doGetAuthenticationInfo方法");
        return null;
    }
}

Shiro的内置过滤器

• onon:无需认证都可以访问
• authc: 必须认证了才能让访问
• user: 必须有记住我功能才能用
• perms: 拥有对某个资源的权限才能访问
  
  在ShiroFilterFactoryBean里添加过滤器实现用户拦截如:
  

    //ShiroFilterFactoryBean(过滤工厂)
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
        //添加过滤器
        HashMap<String, String> filter = new HashMap<>();
        //k：访问路径 v:访问权限
        filter.put("/add","authc");
        filter.put("/update","authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filter);
        //设置登录请求
        shiroFilterFactoryBean.setLoginUrl("/toLogin");

        return shiroFilterFactoryBean;
    }

登录测试如:

    @PostMapping("/log")
    public String log(String username, String password, Model model){
        //获取当前用户
        Subject subject = SecurityUtils.getSubject();
        //将登录的用户进行封装
        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
        
        try {
            subject.login(usernamePasswordToken);
        } catch (UnknownAccountException e) {//账户不存在异常
            model.addAttribute("msg","用户名错误!");
            return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密码错误");
            return "login";
        }

        return "index";
    }

再在自己写的Real中进行账号密码认证如:

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("进入了UserRealm认证doGetAuthenticationInfo方法");
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
        String username="admin";
        String password="admin";
        System.out.println(usernamePasswordToken.getUsername());
        if (!usernamePasswordToken.getUsername().equals(username)){
            return null;
        }
        //密码认证,Shiro做
        return new SimpleAuthenticationInfo("",password,"");
    }

然后进行授权:

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("进入了UserRealm授权doGetAuthorizationInfo方法");
        //这这里进行添加权限
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.addRole("dd");
        return simpleAuthorizationInfo;
    }   

设置有某个权限才能访问的路径示例:

//prems[所需权限字符串]
filter.put("/update","perms[add]");

###Shiro整合Thymeleaf
导入依赖

<dependency>
    <groupId>com.github.theborakompanioni</groupId>
    <artifactId>thymeleaf-extras-shiro</artifactId>
    <version>2.1.0</version>
</dependency>

我们还需要在SpringBoot的配置文件(配置类)中加入一个bean如:

    //用来征尔和Shiro和thymeleaf
    @Bean
    public ShiroDialect getShiroDialect(){
        return new ShiroDialect();
    }

配置好之后就可以直接在前端使用了,在前端还徐声明命名空间:

<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/extras/spring-security"
      xmlns:shiro="http://www.pollix.at/thymeleaf/shiro">

示例:

<!--验证当前是否拥有add权限-->
<div shiro:hasPermission="add">
    <a href="/add">新增用户页面</a>
</div>