shrio认证功能实例

shrio认证功能实例

一、书写登录方法

    public void checkUser() {
        try {
            /*
             * shiro认证
             */
            //1.创建令牌
            UsernamePasswordToken token = new UsernamePasswordToken();
            token.setUsername(username);
            token.setPassword(pwd.toCharArray());
            //2.创建操作主题
            Subject subject = SecurityUtils.getSubject();
            //
            /*
             * 3.执行login，这个方法会调用Realm中的认证方法进行认证
             *          认证成功，继续执行
             *          认证失败，则抛出异常
             */
            subject.login(token);
            //返回成功
            ajaxReturn(true, null);
        } catch (Exception ex) {
            ex.printStackTrace();
            ajaxReturn(false, "登陆失败");
        }
    }

二、书写自定义Realm

package cn.itcast.erp.realm;

import cn.itcast.erp.biz.IEmpBiz;
import cn.itcast.erp.biz.impl.EmpBiz;
import cn.itcast.erp.entity.Emp;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

/**
 * erp系统认证
 * Author xushuai
 * Description
 */
public class ErpRealm extends AuthorizingRealm {

    private IEmpBiz empBiz;

    /**
     * 认证方法
     *
     * @param authenticationToken 需要被认证的令牌
     * @return org.apache.shiro.authc.AuthenticationInfo 认证结果
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {
        //我们这里使用的是username和password进行认证
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        //调用业务层进行校验
        Emp user = empBiz.findByUsernameAndPwd(token.getUsername(), new String(token.getPassword()));
        //判断user是否存在
        if(user == null) {//用户不存在
            //认证失败
            return null;
        }
        /*
         * 参数1：将user带回，用于后续操作
         * 参数2：需要认证的密码，授权码
         * 参数3：当前realm的名称
         */
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, new String(token.getPassword()), getName());

        return info;
    }


    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }


    public void setEmpBiz(IEmpBiz empBiz) {
        this.empBiz = empBiz;
    }

}

三、配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://www.springframework.org/schema/beans
						http://www.springframework.org/schema/beans/spring-beans.xsd">


	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl" value="/login.html" />
		<property name="unauthorizedUrl" value="/error.html" />
		<property name="filterChainDefinitions">
			<value>
				/error.html = anon
				/login_*.action = anon
				/login_* = anon
				/*.html = authc
				/*.action = authc
			</value>
		</property>
	</bean>

	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="erpRealm"></property>
	</bean>

	<!-- 配置自定的Realm -->
	<bean id="erpRealm" class="cn.itcast.erp.realm.ErpRealm">
		<property name="empBiz" ref="empBiz"></property>
 	</bean>

</beans>

注意：后续如果需要获取当前登录用户，将直接从subject中获取。