spring springmvc shiro 实现单点登录demo

一.数据库建表

CREATE TABLE `demo_member` (
  `id` bigint(20) NOT NULL AUTO_INCREMENT,
  `account` varchar(20) NOT NULL DEFAULT '',
  `password` varchar(32) NOT NULL DEFAULT '',
  `email` varchar(40) NOT NULL DEFAULT '',
  `qq` varchar(11) NOT NULL DEFAULT '',
  `mobile` varchar(11) NOT NULL DEFAULT '',
  `nickname` varchar(20) NOT NULL DEFAULT '',
  `realname` varchar(10) NOT NULL DEFAULT '',
  `avatar` varchar(200) NOT NULL DEFAULT '',
  `gender` smallint(2) NOT NULL DEFAULT '-1' COMMENT '1:M 0:F',
  `auth_token` varchar(40) NOT NULL DEFAULT '',
  `token_expire` int(11) NOT NULL DEFAULT '0',
  `salt` char(6) NOT NULL DEFAULT '',
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8;

二.mybatis

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="MemberMapper">
	<!-- 登录 -->
	<select id="memberLogin" parameterType="Map" resultType="Map">
		SELECT nickname,avatar,gender,auth_token,token_expire,salt FROM demo_member
		<where>
			account =#{account} AND password=#{password}
		</where>
		union
		SELECT nickname,avatar,gender,auth_token,token_expire,salt FROM demo_member
		<where>
			email =#{account} AND password=#{password}
		</where>
	</select>
	<!-- 获取验证token -->
	<select id="authToken" parameterType="String" resultType="Map">
		SELECT auth_token,token_expire FROM demo_member
		<where>
			account =#{account} 
		</where>
		union
		SELECT auth_token,token_expire FROM demo_member
		<where>
			email =#{account} 
		</where>
	</select>
	<!-- 登录更新 token 相关字段 salt：加密用 token_expire：token过期时间  -->
	<update id="updateToken" parameterType="Map">
		update demo_member set salt=#{salt},auth_token=#{auth_token},token_expire=#{token_expire} where account =#{account}
	</update>
	
	<!-- 每次请求接口 更新token过期时间 -->
 <update id="updateTokenExpire" parameterType="Map">update demo_member set token_expire=#{token_expire} where account =#{account}</update></mapper>


三.shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
	xmlns:context="http://www.springframework.org/schema/context"
	xsi:schemaLocation="http://www.springframework.org/schema/beans 
						http://www.springframework.org/schema/beans/spring-beans-4.3.xsd
       					http://www.springframework.org/schema/context 
       					http://www.springframework.org/schema/context/spring-context-4.3.xsd"
	default-lazy-init="true">
	
	<!-- ================ Shiro start ================ -->
		<!-- 自定义Realm -->
	    <bean id="ShiroRealm" class="com.demo.interceptors.shiro.ShiroRealm" ></bean>
		<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
			<property name="realm" ref="ShiroRealm" />
		</bean>
		<!-- Shiro Filter -->
		<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
			<!-- Shiro的核心安全接口，这个属性是必须的 -->  
	        <property name="securityManager" ref="securityManager"></property>  
	        <!-- 要求登录时的链接(登录页面地址)，非必须的属性，默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->  
	        <property name="loginUrl" value="/"></property>  
	        <!-- 登录成功后要跳转的连接(本例中此属性用不到，因为登录成功后的处理逻辑在LoginController里硬编码) -->  
	        <!-- <property name="successUrl" value="/" ></property> -->  
	        <!-- 用户访问未对其授权的资源时，所显示的连接 -->  
	        <property name="unauthorizedUrl" value="/"></property> 
			
			<property name="filterChainDefinitions">
				<value>
					<!-- anon:地址不需要任何权限即可访问 -->
					/admin/index = anon
					<!-- perms["admin:product"] 需要权限为admin:product的用户-->
					
					<!-- roles["admin"] 需要角色为admin的用户
						/admin/index roles["admin"]-->
					
					/index/index = authc
					/basic/** = authc
					<!-- /admin/ = anon
					/admin/index.jsp = anon
					/admin/login.jsp = authc
					/admin/logout.jsp = logout
					/admin/common/captcha.jhtml = anon
	
					/admin/product/** = perms["admin:product"]
	
					/admin/** = authc  -->
					
				</value>
			</property>
		</bean>
	<!-- ================ Shiro end ================ -->
	
</beans>
针对以上shiro配置相应的ShiroRealm.java如下

public class ShiroRealm extends AuthorizingRealm{
	/** 
     	 *  权限认证，获取登录用户的权限 （此处对笔者要实现的功能无关紧要，可忽略）
     	 */ 
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
	   
		return null;
	}
	
	/** 
         * 登录认证，创建用户的登录信息
         */ 
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		//获取基于用户名和密码的令牌  
        //实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的  
        //两个token的引用都是一样的
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken)token;
        String username = usernamePasswordToken.getUsername();
        String password = MD5.md5_1(new String(usernamePasswordToken.getPassword()));
        Map<String, Object> params = new HashMap<>();
        params.put("account", username);
        params.put("password", password);
        Map<String, Object> member = null;
        try
        {
            member = memberService.memberLogin(params);
        }
        catch (Exception e)
        {
            e.printStackTrace();
            return null;
        }
        if(member!=null){
            String salt = Salt.salting();
            System.out.println("salt:"+salt);
            String auth_token = SHA.sha(salt+username,"SHA-1");
            System.out.println(auth_token);
            long token_expire = System.currentTimeMillis()/1000+10;
            System.out.println(token_expire);
            params.put("salt", salt);
            params.put("auth_token", auth_token);
            params.put("token_expire", token_expire);
            try
            {
                memberService.updateToken(params);
                
            }
            catch (Exception e)
            {
                e.printStackTrace();
                return null; 
            }
	    //后期可以memcached、redis做缓存 存储 以减小服务器压力
            this.setSession("currentUser", username);
            this.setSession("auth_token", auth_token);
            //this.setSession("token_expire", token_expire);
            return new SimpleAuthenticationInfo(username, usernamePasswordToken.getPassword(),getName());
        }
		return null;
	}
	/** 
     * 将一些数据放到ShiroSession中,以便于其它地方使用 
     * @see  比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到 
     */  
    private void setSession(Object key, Object value){  
        Subject currentUser = SecurityUtils.getSubject(); 
        if(null != currentUser){  
            Session session = currentUser.getSession();  
            if(null != session){  
                session.setAttribute(key, value);  
            }  
        }  
    }  
}

四.Salt文件
public class Salt
{
    private static final String salt[] = { "1", "2", "3", "4", "5", "6", "7", "8", "9", "0", "A", "B", "C", "D", "E", "F", "G", "H", "I", "J", "K", "L", "M", "N", "O", "P", "Q", "R", "S", "T", "U", "V", "W", "X", "Y", "Z" };

    public static String salting()
    {
        StringBuffer s = new StringBuffer();
        Random r = new Random();
        for (int i = 0; i < 6; i++)
        {
          s.append(salt[r.nextInt(salt.length)]);
        }
        return s.toString();
    }
    
    public static void main(String[] args)
    {
        salting();
    }
}


五.MD5以及SHA 文件

public class MD5 {

	public static String md5(String str) {
		try {
			MessageDigest md = MessageDigest.getInstance("MD5");
			md.update(str.getBytes());
			byte b[] = md.digest();

			int i;

			StringBuffer buf = new StringBuffer("");
			for (int offset = 0; offset < b.length; offset++) {
				i = b[offset];
				if (i < 0)
					i += 256;
				if (i < 16)
					buf.append("0");
				buf.append(Integer.toHexString(i));
			}
			str = buf.toString();
		} catch (Exception e) {
			e.printStackTrace();

		}
		return str;
	}
	public static String md5_1(String str) {
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            md.update(str.getBytes());
            //str =  new BigInteger(1, md.digest()).toString(16);
            BASE64Encoder base64en = new BASE64Encoder();
            str  = base64en.encode(md.digest());
        } catch (Exception e) {
            e.printStackTrace();

        }
        return str;
    }
	
	
}
public class SHA
{
    public static String sha(String str,String type) {
        try {
            MessageDigest md = MessageDigest.getInstance(type);
            md.update(str.getBytes());
            byte byteBuffer[] = md.digest();  
            
            StringBuffer strHexString = new StringBuffer();  
            for (int i = 0; i < byteBuffer.length; i++)  
            {  
              String hex = Integer.toHexString(0xff & byteBuffer[i]);  
              if (hex.length() == 1)  
              {  
                strHexString.append('0');  
              }  
              strHexString.append(hex);  
            }  
            // 得到返回結果  
            str = strHexString.toString();  
        } catch (Exception e) {
            e.printStackTrace();

        }
        return str;
    }
}
六.springmvc.xml
拦截器配置
<!-- 拦截器配置 -->
	<mvc:interceptors>
	        <mvc:interceptor> 
	       		<mvc:mapping path="/"/>
	            	<mvc:mapping path="/v1/**"/>
	            	<bean class="com.demo.interceptors.AuthTokenInterceptor"/>
	        </mvc:interceptor>
	</mvc:interceptors>
七.AuthTokenInterceptor.java

 这里只是做了log
public class AuthTokenInterceptor extends HandlerInterceptorAdapter
{
    protected Logger logger = LoggerFactory.getLogger(getClass());
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception
    {
      HttpSession session = request.getSession();
      
      String account = (String) session.getAttribute("currentUser");
      if(account==null){
          logger.info("{}","请先登录");
          return false;
      }
      Map<String,Object> auth=memberService.authToken(account);
      if(auth==null){
          logger.info("{}","无此账号");
          return false;
      }
      if(auth.get("auth_token").equals(session.getAttribute("auth_token"))){
          long tokenExpire = (System.currentTimeMillis()/1000);
          if((int)auth.get("token_expire")
                  >= tokenExpire){
              Map<String,Object> params = new HashMap<>();
              params.put("account", account);
              params.put("token_expire", tokenExpire);
              memberService.updateTokenExpire(params);
              logger.info("{}","token正常");
              return true;
          }else{
              logger.info("{}","token过期");
              return false;
          }
          
      }else{
          logger.info("{}","token失效");
          return false;
      }
      //return super.preHandle(request, response, handler);
    }
   
   
    
}


八.controller
Controller
@RequestMapping(value="XX")
public class MemberController extends BaseController
{
    
   
    @RequestMapping(value = "/login", method = {RequestMethod.GET,RequestMethod.POST})
    @ResponseBody
    public String memberLogin(@RequestParam(value="account",defaultValue="") String account,
                              @RequestParam(value="password",defaultValue="") String password)
    {
        UsernamePasswordToken token = new UsernamePasswordToken(account, password);
        Subject subject = SecurityUtils.getSubject();
        try {
            subject.login(token);
        } catch (IncorrectCredentialsException ice) {
            // 捕获密码错误异常
            return "{\"message\":\"password error!\"}";
        } catch (UnknownAccountException uae) {
            // 捕获未知用户名异常
            return "{\"message\":\"account error!\"}";
        } 
        return "{\"message\":\"login\"}";
    }
}
以上关于memberService的方法调用都与mybatis中的查询一一对应


九.web.xml
网上有很多关于spring springmvc shiro相关的web.xml配置文件信息 再次就不再赘述
注意shiro需要过滤器过滤即可
十.相关jar包下载
http://download.csdn.net/detail/chundonghan/9824537 这里jar包相对较新 可能会有与低版本不兼容的情况