进阶SpringBoot之 Shiro（3）实现登录拦截和用户认证

m0_58838332

已于 2024-09-02 20:17:51 修改

阅读量365

点赞数 1

文章标签： spring boot 后端 java

于 2024-08-31 23:45:00 首次发布

本文链接：https://blog.csdn.net/m0_58838332/article/details/141759841

版权

Config 配置类添加 Shiro 的内置过滤器

anon：无需认证就能访问

authc：认证才能访问

user：拥有“记住我”功能才能使用

perms：拥有对某个资源的权限才能访问

role：拥有某个角色权限才能访问

package com.demo.shirospringboot.config;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Controller;

import java.util.LinkedHashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {

    //第三步：ShiroFilterFactoryBean
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager) {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(defaultWebSecurityManager);

        /*添加Shiro的内置过滤器
            anon：无需认证就能访问
            authc：认证才能访问
            user：拥有“记住我”功能才能使用
            perms：拥有对某个资源的权限才能访问
            role：拥有某个角色权限才能访问
         */
        Map<String,String> filterMap = new LinkedHashMap<>();

        filterMap.put("/user/*","authc");

        bean.setFilterChainDefinitionMap(filterMap);
        
        //设置登录的请求
        bean.setLoginUrl("/toLogin");

        return bean;
    }

    //第二步：DefaultWebSecurityManager
    @Bean(name="securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联UserRealm
        securityManager.setRealm(userRealm);
        return securityManager;
    }

    //第一步：创建realm对象，需自定义类
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }
}

设置了 authc 未认证无法访问（拦截），需跳转到登录页

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>

<div align="center">
    <h1>登录</h1>
    <hr>

    <p th:text="${msg}"></p>
    <form th:action="@{/login}">
        <p>用户名：<input type="text" name="username"></p>
        <p>密码：<input type="text" name="password"></p>
        <p><input type="submit"></p>
    </form>
</div>

</body>
</html>

Controller 类实现用户认证

SecurityUtils.getSubject() 获取当前用户

new 一个 UsernamePasswordToken，封装登录数据

捕获异常，判断用户名和密码是否存在，成功则进入首页，错误则返回登录页

package com.demo.shirospringboot.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

@Controller
public class MyController {
    @RequestMapping("/index")
    public String toIndex(Model model){
        model.addAttribute("msg","Hello,Shiro!");
        return "index";
    }

    @RequestMapping("/user/add")
    public String add(){
        return "user/add";
    }

    @RequestMapping("/user/update")
    public String update(){
        return "user/update";
    }

    @RequestMapping("/toLogin")
    public String toLogin(){
        return "login";
    }

    @RequestMapping("/login")
    public String login(String username,String password,Model model){
        //获取当前用户
        Subject subject = SecurityUtils.getSubject();
        //封装用户的登录数据
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);

        try{
            subject.login(token); //执行登录方法
            return "index";
        }catch (UnknownAccountException e){ //用户名不存在
            model.addAttribute("msg","用户名错误");
            return "login";
        }catch (IncorrectCredentialsException e){ //密码不存在
            model.addAttribute("msg","密码错误");
            return "login";
        }
    }

}

Realm 类继承 AuthorizingRealm，重写认证方法

设置用户数据，完善 Controller 类

package com.demo.shirospringboot.config;

import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

//自定义UserRealm
public class UserRealm extends AuthorizingRealm {

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("授权");
        return null;
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("认证");

        String name = "admin";
        String password = "123456";

        UsernamePasswordToken userToken = (UsernamePasswordToken) authenticationToken;

        if(!userToken.getUsername().equals(name)){
            return null; //抛出异常 UnknownAccountException
        }

        //密码认证
        return new SimpleAuthenticationInfo("",password,"");
    }
}