shiro认证以及盐加密

1、pom依赖

<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-core</artifactId>
  <version>1.3.2</version>
</dependency>

<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-web</artifactId>
  <version>1.3.2</version>
</dependency>

<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-spring</artifactId>
  <version>1.3.2</version>
</dependency>

2、web.xml配置

<!-- shiro过滤器定义 -->
<filter>
  <filter-name>shiroFilter</filter-name>
  <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
  <init-param>
    <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->
    <param-name>targetFilterLifecycle</param-name>
    <param-value>true</param-value>
  </init-param>
</filter>
<filter-mapping>
  <filter-name>shiroFilter</filter-name>
  <url-pattern>/*</url-pattern>
</filter-mapping>

3、自定义Realm

public class MyRealm extends AuthorizingRealm {
    private UserService userService;

    public UserService getUserService() {
        return userService;
    }

    public void setUserService(UserService userService) {
        this.userService = userService;
    }

@Service("userService")
public class UserServiceImpl implements UserService {
    @Autowired
    private UserMapper userMapper;
    @Override
    public Set<String> getRolesByUserId(Integer userId) {
        return userMapper.getRolesByUserId(userId);
    }

    @Override
    public Set<String> getPersByUserId(Integer userId) {
        return userMapper.getPersByUserId(userId);
    }

    @Override
    public User queryByName(String userName) {
        return userMapper.queryByName(userName);
    }
}

@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("身份认证...");
        String username = token.getPrincipal().toString();
        String password = token.getCredentials().toString();
        User user = userService.queryByName(username);
//        拿到数据库中的用户信息，放入token凭证中，用于controler进行对比
        AuthenticationInfo info = new SimpleAuthenticationInfo(
                user.getUsername(),
                user.getPassword(),
                ByteSource.Util.bytes(user.getSalt()),
                this.getName()
        );
        return info;
    }

4、application-shiro配置

<!--配置自定义的Realm-->
    <bean id="shiroRealm" class="com.zking.ssm.shiro.MyRealm">
        <property name="userService" ref="userService" />
        <!--以下三个配置告诉shiro将如何对用户传来的明文密码进行加密-->
        <property name="credentialsMatcher">
            <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                <!--指定hash算法为MD5-->
                <property name="hashAlgorithmName" value="md5"/>
                <!--指定散列次数为1024次-->
                <property name="hashIterations" value="1024"/>
                <!--true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储-->
                <property name="storedCredentialsHexEncoded" value="true"/>
            </bean>
        </property>
    </bean>

    <!--注册安全管理器-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroRealm" />
    </bean>

    <!--Shiro核心过滤器-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- Shiro的核心安全接口,这个属性是必须的 -->
        <property name="securityManager" ref="securityManager" />
        <!-- 身份验证失败，跳转到登录页面 -->
        <property name="loginUrl" value="/login"/>
        <!-- 身份验证成功，跳转到指定页面 -->
        <!--<property name="successUrl" value="/index.jsp"/>-->
        <!-- 权限验证失败，跳转到指定页面 -->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
        <!-- Shiro连接约束配置,即过滤链的定义 -->
        <property name="filterChainDefinitions">
            <value>
                <!--
                注：anon，authcBasic，auchc，user是认证过滤器
                    perms，roles，ssl，rest，port是授权过滤器
                -->
                <!--anon 表示匿名访问，不需要认证以及授权-->
                <!--authc表示需要认证 没有进行身份认证是不能进行访问的-->
                <!--roles[admin]表示角色认证，必须是拥有admin角色的用户才行-->
                /user/login=anon
                /user/updatePwd.jsp=authc
                /admin/*.jsp=roles[4]
                /user/teacher.jsp=perms["user:update"]
               <!-- /css/**               = anon
                /images/**            = anon
                /js/**                = anon
                /                     = anon
                /user/logout          = logout
                /user/**              = anon
                /userInfo/**          = authc
                /dict/**              = authc
                /console/**           = roles[admin]
                /**                   = anon-->
            </value>
        </property>
    </bean>

    <!-- Shiro生命周期，保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

5、运行结果

在不登陆的情况下只能访问login.jsp

zs用户登录只能看到个人密码修改界面

ls用户登录，比zs多看到老师简介界面

 

6、数据库脚本

/*
SQLyog v10.2 
MySQL - 5.5.36 : Database - mybatis_ssm
*********************************************************************
*/


/*!40101 SET NAMES utf8 */;

/*!40101 SET SQL_MODE=''*/;

/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;
CREATE DATABASE /*!32312 IF NOT EXISTS*/`mybatis_ssm` /*!40100 DEFAULT CHARACTER SET utf8 */;

USE `mybatis_ssm`;

/*Table structure for table `t_shiro_permission` */

DROP TABLE IF EXISTS `t_shiro_permission`;

CREATE TABLE `t_shiro_permission` (
  `perid` int(11) NOT NULL AUTO_INCREMENT COMMENT 'ID,主键',
  `pername` varchar(100) NOT NULL COMMENT '权限名称',
  `pid` int(11) DEFAULT NULL COMMENT '父编号',
  `permission` varchar(100) NOT NULL COMMENT '权限字符串：例如：system:user:create:1',
  PRIMARY KEY (`perid`)
) ENGINE=InnoDB AUTO_INCREMENT=7 DEFAULT CHARSET=utf8;

/*Data for the table `t_shiro_permission` */

insert  into `t_shiro_permission`(`perid`,`pername`,`pid`,`permission`) values (1,'书籍新增',-1,'user:create'),(2,'书籍修改',-1,'user:update'),(3,'书籍删除',-1,'user:delete'),(4,'书籍列表',-1,'user:view'),(5,'书籍详情',-1,'user:load'),(6,'书籍信息导出',-1,'user:export');

/*Table structure for table `t_shiro_role` */

DROP TABLE IF EXISTS `t_shiro_role`;

CREATE TABLE `t_shiro_role` (
  `roleid` int(11) NOT NULL AUTO_INCREMENT COMMENT '角色ID,主键',
  `rolename` varchar(100) NOT NULL COMMENT '角色名称',
  `description` varchar(100) DEFAULT NULL COMMENT '角色描述',
  PRIMARY KEY (`roleid`),
  UNIQUE KEY `rolename` (`rolename`)
) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;

/*Data for the table `t_shiro_role` */

insert  into `t_shiro_role`(`roleid`,`rolename`,`description`) values (1,'普通用户',NULL),(2,'高级用户',NULL),(3,'特权用户',NULL),(4,'管理员',NULL);

/*Table structure for table `t_shiro_role_permission` */

DROP TABLE IF EXISTS `t_shiro_role_permission`;

CREATE TABLE `t_shiro_role_permission` (
  `roleid` int(11) NOT NULL COMMENT '角色ID',
  `perid` int(11) NOT NULL COMMENT '权限ID',
  PRIMARY KEY (`roleid`,`perid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `t_shiro_role_permission` */

insert  into `t_shiro_role_permission`(`roleid`,`perid`) values (1,1),(2,1),(2,2),(3,1),(3,2),(3,3),(3,4),(3,5),(4,1),(4,2),(4,3),(4,4),(4,5),(4,6);

/*Table structure for table `t_shiro_user` */

DROP TABLE IF EXISTS `t_shiro_user`;

CREATE TABLE `t_shiro_user` (
  `userid` int(11) NOT NULL AUTO_INCREMENT COMMENT '用户ID,主键',
  `username` varchar(10) NOT NULL COMMENT '用户账号',
  `PASSWORD` varchar(32) NOT NULL COMMENT '用户密码=MD5+盐加密',
  `salt` varchar(32) NOT NULL COMMENT '盐',
  `createdate` timestamp NULL DEFAULT CURRENT_TIMESTAMP COMMENT '创建日期',
  PRIMARY KEY (`userid`),
  UNIQUE KEY `username` (`username`)
) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;

/*Data for the table `t_shiro_user` */

insert  into `t_shiro_user`(`userid`,`username`,`PASSWORD`,`salt`,`createdate`) values (1,'zs','797b9916091af1463c03bd3d0c433ea7','a88e860b1f70960af7575145247c55ec','2018-12-27 11:47:11'),(2,'ls','60dffbf999e1c613a3ce15a10fdf2d75','7b4bdcce6329281584322e77861c5248','2018-12-27 11:47:11'),(3,'ww','60dffbf999e1c613a3ce15a10fdf2d75','7b4bdcce6329281584322e77861c5248','2018-12-27 11:47:11'),(4,'zdm','60dffbf999e1c613a3ce15a10fdf2d75','7b4bdcce6329281584322e77861c5248','2018-12-27 19:30:36');

/*Table structure for table `t_shiro_user_role` */

DROP TABLE IF EXISTS `t_shiro_user_role`;

CREATE TABLE `t_shiro_user_role` (
  `userid` int(11) NOT NULL COMMENT '用户ID',
  `roleid` int(11) NOT NULL COMMENT '角色ID',
  PRIMARY KEY (`userid`,`roleid`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

/*Data for the table `t_shiro_user_role` */

insert  into `t_shiro_user_role`(`userid`,`roleid`) values (1,1),(2,2),(3,3),(4,1),(4,4);

/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

7、盐加密工具类

/**
 * 用于shiro权限认证的密码工具类
 */
public class PasswordHelper {

    /**
     * 随机数生成器
     */
    private static RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();

    /**
     * 指定hash算法为MD5
     */
    private static final String hashAlgorithmName = "md5";

    /**
     * 指定散列次数为1024次，即加密1024次
     */
    private static final int hashIterations = 1024;

    /**
     * true指定Hash散列值使用Hex加密存. false表明hash散列值用用Base64-encoded存储
     */
    private static final boolean storedCredentialsHexEncoded = true;

    /**
     * 获得加密用的盐
     *
     * @return
     */
    public static String createSalt() {
        return randomNumberGenerator.nextBytes().toHex();
    }

    /**
     * 获得加密后的凭证
     *
     * @param credentials 凭证(即密码)
     * @param salt        盐
     * @return
     */
    public static String createCredentials(String credentials, String salt) {
        SimpleHash simpleHash = new SimpleHash(hashAlgorithmName, credentials,
                salt, hashIterations);
        return storedCredentialsHexEncoded ? simpleHash.toHex() : simpleHash.toBase64();
    }


    /**
     * 进行密码验证
     *
     * @param credentials        未加密的密码
     * @param salt               盐
     * @param encryptCredentials 加密后的密码
     * @return
     */
    public static boolean checkCredentials(String credentials, String salt, String encryptCredentials) {
        return encryptCredentials.equals(createCredentials(credentials, salt));
    }

    public static void main(String[] args) {
        //盐
        String salt = createSalt();
        System.out.println(salt);
        System.out.println(salt.length());
        //凭证+盐加密后得到的密码
        String credentials = createCredentials("123", salt);
        System.out.println(credentials);
        System.out.println(credentials.length());
        boolean b = checkCredentials("123", salt, credentials);
        System.out.println(b);
    }
}

 pom依赖
  web配置
  自定义Realm
  对应mapper编写
  application-shiro配置
  登录测试
  用户名密码加密