1.shiro通过自定义ini文件初始化.
package cai.shiro.test1;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.junit.Assert;
import org.junit.Test;
public class LoginTest1 {
@Test
public void test() {
//iniSecurity--指定ini文件进行工厂的初始化
Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager securityManager = factory.getInstance();
//将安全管理器进行绑定
SecurityUtils.setSecurityManager(securityManager);
//获取当前用户.
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken("zhang","1223");
try {
subject.login(token);
} catch (Exception e) {
System.out.println("登录失败");
}
//断言
Assert.assertEquals(true, subject.isAuthenticated());
subject.logout();
}
}
shiro.ini
[users]
zhang=123
wang=123
此时,无需配置realm数据源
指定单realm进行shiro认证
安全数据源
package cai.shiro.realm;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.realm.Realm;
public class MyRealm implements Realm{
public String getName() {
return MyRealm.class.getName();
}
public boolean supports(AuthenticationToken token) {
return token instanceof UsernamePasswordToken;
}
public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
String username = (String) token.getPrincipal();
String password = new String((char[])token.getCredentials());
System.out.println(username);
System.out.println(password);
return new SimpleAuthenticationInfo(username, password, getName());
}
}
shiro.ini
myRealm1=cai.shiro.realm.MyRealm
#指定securityManager的realms实现
securityManager.realms=$myRealm1
继承通用的authorizingRealm以及使用jdbc
public class MyRealm3 extends AuthorizingRealm{
private static Connection conn;
private static PreparedStatement statement;
static {
try {
Class.forName("com.mysql.jdbc.Driver");
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/shiro_kaitao",
"root", "root");
} catch (Exception e) {
e.printStackTrace();
}
}
/**
* 认证
*/
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken tok = (UsernamePasswordToken) token;
String username = (String) tok.getPrincipal();
String password = new String((char[])tok.getCredentials());
String user = tok.getUsername();
//两者完全一样...
String pwd = new String(tok.getPassword());
System.out.println(username+" : "+password);
System.out.println(user+" : "+pwd);
try {
statement = conn.prepareStatement("select * from t_user where username = ? and password = ?");
statement.setString(1, "root");
statement.setString(2, "root");
ResultSet set = statement.executeQuery();
while(set.next()) {
int id = set.getInt("id");
String name = set.getString("username");
String word = set.getString("password");
System.out.println(name +" : : " + word);
}
} catch (Exception e) {
e.printStackTrace();
}
return new SimpleAuthenticationInfo(username, password,getName());
}
/**
* 授权
*/
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
return null;
}
}
配置多个realm以及AuthenticationStrategy
思路 : 1. 需要注册多个realm. 并且在每个realm中进行逻辑业务操作.
2.需要配置shiro的验证策略.默认策略是AtLeastOneSuccessfulStrateg
#指定securityManager的authenticator实现
authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator
securityManager.authenticator=$authenticator
#指定securityManager.authenticator的authenticationStrategy
allSuccessfulStrategy=org.apache.shiro.authc.pam.AllSuccessfulStrategy
securityManager.authenticator.authenticationStrategy=$allSuccessfulStrategy
myRealm=cai.shiro.realm.MyRealm
myRealm2=cai.shiro.realm.MyRealm2
myRealm3=cai.shiro.realm.MyRealm3
#指定securityManager的realms实现
securityManager.realms=$myRealm3,$myRealm2,$myRealm