Shiro 学习:
本次学习需要的依赖jar 包:
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>3.8.1</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-nop</artifactId>
<version>1.7.2</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>6.0.5</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.0.28</version>
</dependency>
一 . iniRealm 学习 : 读取ini文件中定义的认证信息和权限信息进行判断
1. 创建ini文件:
[users]
Mark=123456,admin
[roles]
2. 获取ini,判断:
package imooc_shiro.AuthenticationTest;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;
/**
* @Description:
* @author 01391056
* @date 2018年12月24日下午2:54:44
* IniRealmTest
*
*/
public class IniRealmTest {
@Test
public void authenticationTest(){
IniRealm ini = new IniRealm("classpath:resources/user.ini");
//1.构建SecurityManager环境
DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
defaultSecurityManager.setRealm(ini);
//2.主体提交
SecurityUtils.setSecurityManager(defaultSecurityManager);
Subject subject= SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken("Mark","123456");
//登录
subject.login(token);
System.out.println("authenticationTest:"+subject.isAuthenticated());
//角色
subject.checkRole("admin");
//权限
subject.checkPermission("user:delete");
subject.checkPermissions("user:update","user:delete");
}
}
二 . JdbcRealm 学习: 读取数据库中的认证信息和权限信息
1. jdbc 使用内部的sql进行查询获取:
package imooc_shiro.AuthenticationTest;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;
import com.alibaba.druid.pool.DruidDataSource;
/**
* @Description:
* @author 01391056
* @date 2018年12月25日上午8:57:21
* JdbcRealmTest
*
*/
public class JdbcRealmTest {
DruidDataSource dataSource = new DruidDataSource();
{
dataSource.setUrl("jdbc:mysql://127.0.0.1:3306/test?serverTimezone=UTC&useUnicode=true&characterEncoding=utf-8&useSSL=false&allowMultiQueries=true");
dataSource.setUsername("root");
dataSource.setPassword("root");
}
@Test
public void authenticationTest(){
JdbcRealm jdbcReaml = new JdbcRealm();
jdbcReaml.setDataSource(dataSource);
//设置jdbcReaml 的权限开关,默认为false 关闭状态
jdbcReaml.setPermissionsLookupEnabled(true);
//1.构建SecurityManager环境
DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
defaultSecurityManager.setRealm(jdbcReaml);
//2.主体提交
SecurityUtils.setSecurityManager(defaultSecurityManager);
Subject subject= SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken("Mark","283538989cef48f3d7d8a1c1bdf2008f");
//登录
subject.login(token);
System.out.println("authenticationTest:"+subject.isAuthenticated());
//角色
subject.checkRole("admin");
subject.checkRole("user");
//权限
subject.checkPermission("user:select");
subject.checkPermissions("user:select","user:delete");
}
}
2. 使用自定义的sql (适用于数据库的表明和列名与JdbcRealm源码中的表名列名不同)
package imooc_shiro.AuthenticationTest;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;
import com.alibaba.druid.pool.DruidDataSource;
/**
* @Description:
* @author 01391056
* @date 2018年12月25日上午11:33:19
* JdbcCustomizeRealmTest 自定义sql
*
*/
public class JdbcCustomizeRealmTest {
DruidDataSource dataSource = new DruidDataSource();
{
dataSource.setUrl("jdbc:mysql://127.0.0.1:3306/test?serverTimezone=UTC&useUnicode=true&characterEncoding=utf-8&useSSL=false&allowMultiQueries=true");
dataSource.setUsername("root");
dataSource.setPassword("root");
}
@Test
public void authenticationTest(){
JdbcRealm jdbcReaml = new JdbcRealm();
jdbcReaml.setDataSource(dataSource);
//设置jdbcReaml 的权限开关,默认为false 关闭状态
jdbcReaml.setPermissionsLookupEnabled(true);
//自定义sql 用户
String sql= "select password from test_user where user_name = ?";
jdbcReaml.setAuthenticationQuery(sql);
//自定义 sql 角色
String roleSql = "select role_name from test_user_roles where user_name = ?";
jdbcReaml.setUserRolesQuery(roleSql);
//自定义 sql 权限
String perSql = "select permission from test_roles_permissions where role_name = ?";
jdbcReaml.setPermissionsQuery(perSql);
//1.构建SecurityManager环境
DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
defaultSecurityManager.setRealm(jdbcReaml);
//2.主体提交
SecurityUtils.setSecurityManager(defaultSecurityManager);
Subject subject= SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken("xiaoming","654321");
//登录
subject.login(token);
System.out.println("authenticationTest:"+subject.isAuthenticated());
//角色
subject.checkRole("admin");
subject.checkRole("users");
//权限
subject.checkPermission("user:delete");
subject.checkPermissions("user:select","user:delete");
}
}
三 . 自定义Realm
里面的map,set 模拟数据库,没有真实连接数据库;
1. 定义 自定义Realm
package imooc_shiro.AuthenticationTest;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
/**
* @Description:
* @author 01391056
* @date 2018年12月25日下午2:08:47
* CustomRealm 自定义Realm
*
*/
public class CustomRealm extends AuthorizingRealm{
Map<String,String> userMap = new HashMap<String,String>();
{
userMap.put("Mark", "123456");
super.setName("customRealm");
}
/**
* doGetAuthorizationInfo 授权
* @author 01391056
* @date 2018年12月25日下午2:09:41
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
String userName = (String) principals.getPrimaryPrincipal();
//获取角色
Set<String>roles = getRoalsByUserName(userName);
//获取权限
Set<String> permissions = getPermissionByUserName(userName);
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
simpleAuthorizationInfo.setRoles(roles);
simpleAuthorizationInfo.setStringPermissions(permissions);
return simpleAuthorizationInfo;
}
/**
*
* @author 01391056
* @date 2018年12月25日下午2:47:10
* Set<String>
*
*/
private Set<String> getPermissionByUserName(String userName) {
Set<String> set = new HashSet<String>();
set.add("user:delete");
set.add("user:select");
return set;
}
/**
*
* @author 01391056
* @date 2018年12月25日下午2:45:14
* Set<String>
*
*/
private Set<String> getRoalsByUserName(String userName) {
Set<String> set = new HashSet<String>();
set.add("admin");
set.add("users");
return set;
}
/**
* doGetAuthenticationInfo 认证
* @author 01391056
* @date 2018年12月25日下午2:09:41
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
//通过主体传过来的认证信息获取用户名
String userName = (String) token.getPrincipal();
//通过用户名到数据库认证信息
String password = getPasswordByUserName(userName);
if(password == null){
return null;
}
SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(userName,password,"customRealm");
return simpleAuthenticationInfo;
}
/**
*
* @author 01391056
* @date 2018年12月25日下午2:13:28
* String 模拟数据库方法
*
*/
private String getPasswordByUserName(String userName) {
return userMap.get(userName);
}
}
2.测试 自定义Realm
package imooc_shiro.AuthenticationTest;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;
/**
* @Description:
* @author 01391056
* @date 2018年12月25日下午2:22:06
* CustomRealmTest
*
*/
public class CustomRealmTest {
@Test
public void authenticationTest(){
//自定义Realm
CustomRealm customRealm = new CustomRealm();
//1.构建SecurityManager环境
DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
defaultSecurityManager.setRealm(customRealm);
//2.主体提交
SecurityUtils.setSecurityManager(defaultSecurityManager);
Subject subject= SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken("Mark","123456");
//登录
subject.login(token);
System.out.println("authenticationTest:"+subject.isAuthenticated());
//角色
subject.checkRole("admin");
subject.checkRole("users");
//权限
subject.checkPermission("user:delete");
subject.checkPermissions("user:select","user:delete");
}
}