springboot整合shiro

shiro是什么

Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码学和会话管理。使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。（百度百科）

主要功能

三个核心组件：Subject, SecurityManager 和 Realms.

Subject：即“当前操作用户”。但是，在Shiro中，Subject这一概念并不仅仅指人，也可以是第三方进程、后台帐户（Daemon Account）或其他类似事物。它仅仅意味着“当前跟软件交互的东西”。但考虑到大多数目的和用途，你可以把它认为是Shiro的“用户”概念。
　　Subject代表了当前用户的安全操作，SecurityManager则管理所有用户的安全操作。
　　
SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro通过SecurityManager来管理内部组件实例，并通过它来提供安全管理的各种服务。
　　
Realm： Realm充当了Shiro与应用安全数据间的“桥梁”或者“连接器”。也就是说，当对用户执行认证（登录）和授权（访问控制）验证时，Shiro会从应用配置的Realm中查找用户及其权限信息。
　　从这个意义上讲，Realm实质上是一个安全相关的DAO：它封装了数据源的连接细节，并在需要时将相关数据提供给Shiro。当配置Shiro时，你必须至少指定一个Realm，用于认证和（或）授权。配置多个Realm是可以的，但是至少需要一个。
　　Shiro内置了可以连接大量安全数据源（又名目录）的Realm，如LDAP、关系数据库（JDBC）、类似INI的文本配置资源以及属性文件等。如果缺省的Realm不能满足需求，你还可以插入代表自定义数据源的自己的Realm实现。

springboot+shiro的dome

maven依赖

<!-- Apache Shiro版本号 -->
		<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
		<java.version>1.8</java.version>
		<shiro.version>1.4.0</shiro.version>
		<shiro-redis.version>3.1.0</shiro-redis.version>
		</properties>
		
		<!-- Apache Shiro依赖 -->
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-spring</artifactId>
			<version>1.4.0</version>
		</dependency>

		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-core</artifactId>
			<version>${shiro.version}</version>
		</dependency>

		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-ehcache</artifactId>
			<version>${shiro.version}</version>
		</dependency>
		
		<dependency>
			<groupId>org.crazycake</groupId>
			<artifactId>shiro-redis</artifactId>
			<version>${shiro-redis.version}</version>
		</dependency>

shiro配置类

package com.fc.test.system.config;
import java.util.Collection;
import java.util.LinkedHashMap;
import java.util.Map;
import javax.servlet.Filter;
import com.fc.test.common.constant.ConstantConfig;
import com.fc.test.system.shiro.StatelessDefaultSubjectFactory;
import com.fc.test.system.shiro.auth.AuthRealm;
import com.fc.test.system.shiro.filter.AuthenticationFilter;
import com.fc.test.system.shiro.filter.JcaptchaValidateFilter;
import com.fc.test.system.shiro.session.ShiroSessionManager;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.mgt.DefaultWebSubjectFactory;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.crazycake.shiro.RedisCacheManager;
import org.crazycake.shiro.RedisManager;
import org.crazycake.shiro.RedisSessionDAO;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.boot.web.servlet.FilterRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.DependsOn;
import org.springframework.web.filter.DelegatingFilterProxy;

/**
 * [简要描述]: shiro配置<br/> [详细描述]:
 *
 * @author zzc
 * @time 2019/10/31
 * @since V0.1
 */
@Configuration
public class ShiroConfig {
  //将自己的验证方式加入容器
  @Bean
  public AuthRealm myShiroRealm() {
    AuthRealm authRealm = new AuthRealm();
    return authRealm;
  }
  @Bean
  public FilterRegistrationBean<DelegatingFilterProxy> delegatingFilterProxy() {
    FilterRegistrationBean<DelegatingFilterProxy> filterRegistrationBean = new FilterRegistrationBean<>();
    DelegatingFilterProxy proxy = new DelegatingFilterProxy();
    proxy.setTargetFilterLifecycle(true);
    proxy.setTargetBeanName("shiroFilter");
    filterRegistrationBean.setFilter(proxy);
    filterRegistrationBean.setOrder(2);
    return filterRegistrationBean;
  }

  /*
  * shiro放行url
  */
  
  @Bean("shiroFilter")
  @DependsOn("securityManager")
  public ShiroFilterFactoryBean shiroFilter(DefaultSecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);
    // 拦截器
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    // 允许用户匿名访问/login(登录接口)
    filterChainDefinitionMap.put("/api/v1/login", "anon");
    // 允许注册接口匿名
    filterChainDefinitionMap.put("/api/v1/reg", "anon");
    filterChainDefinitionMap.put("/druid/**", "anon");
    filterChainDefinitionMap.put("/api-docs", "anon");
    filterChainDefinitionMap.put("/v2/api-docs", "anon");
    filterChainDefinitionMap.put("/favicon.ico", "anon");
    filterChainDefinitionMap.put("/swagger-ui.html", "anon");
    filterChainDefinitionMap.put("/webjars/**", "anon");
    filterChainDefinitionMap.put("/swagger-resources/**", "anon");
    filterChainDefinitionMap.put("/static/**", "anon");
    shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilter;
  }
  
   /**
   * Subject工厂管理器
   */
  @Bean
  public DefaultWebSubjectFactory subjectFactory() {
    return new StatelessDefaultSubjectFactory();
  }
  
  /*
   * 开启shiro aop注解支持 使用代理方式;所以需要开启代码支持;
   */
  @Bean
  public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {
    AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();
    authorizationAttributeSourceAdvisor.setSecurityManager(securityManager());
    return authorizationAttributeSourceAdvisor;
  }
  
 
  /**
   * 安全管理器
   */
  @Bean("securityManager")
  public DefaultWebSecurityManager securityManager() {
    DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    securityManager.setRealm(myShiroRealm());
    SecurityUtils.setSecurityManager(securityManager);
    return securityManager;
  }

  /**
   * Session Manager 使用的是shiro-redis开源插件
   */
  @Bean
  public SessionManager sessionManager() {
    SimpleCookie simpleCookie = new SimpleCookie("Token");
    simpleCookie.setPath("/");
    simpleCookie.setHttpOnly(false);
    ShiroSessionManager sessionManager = new ShiroSessionManager();
    sessionManager.setSessionDAO(redisSessionDAO());
    sessionManager.setSessionIdCookieEnabled(false);
    sessionManager.setSessionIdUrlRewritingEnabled(false);
    sessionManager.setDeleteInvalidSessions(true);
    sessionManager.setSessionIdCookie(simpleCookie);
    return sessionManager;
  }

  /**
   * RedisSessionDAO shiro sessionDao层的实现 通过redis 使用的是shiro-redis开源插件
   */
  @Bean
  public RedisSessionDAO redisSessionDAO() {
    RedisSessionDAO redisSessionDAO = new RedisSessionDAO();
    redisSessionDAO.setRedisManager(redisManager());
    return redisSessionDAO;
  }

  /**
   * Shiro生命周期处理器 此方法需要用static作为修饰词，否则无法通过@Value()注解的方式获取配置文件的值
   */
  @Bean(name = "lifecycleBeanPostProcessor")
  public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
    return new LifecycleBeanPostProcessor();
  }

  /**
   * 开启Shiro注解(如@RequiresRoles,@RequiresPermissions)
   */
  @Bean
  @DependsOn("lifecycleBeanPostProcessor")
  public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
    DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
    advisorAutoProxyCreator.setProxyTargetClass(true);
    return advisorAutoProxyCreator;
  }


  /**
   * 配置shiro redisManager 使用的是shiro-redis开源插件
   */
  @Bean
  public RedisCacheManager cacheManager() {
    RedisCacheManager redisCacheManager = new RedisCacheManager();
    redisCacheManager.setRedisManager(redisManager());
    //设置前缀
    return redisCacheManager;
  }

  /**
   * 配置shiro redisManager 使用的是shiro-redis开源插件
   */
  public RedisManager redisManager() {
    RedisManager redisManager = new RedisManager();
    //redis地址
    redisManager.setHost(ConstantConfig.springRedisHost);
    //redis端口
    redisManager.setPort(ConstantConfig.springRedisPort);
    //设置过期时间
    redisManager.setTimeout(1800);
    redisManager.setPassword(ConstantConfig.springRedisPassword);
    return redisManager;
  }
}

自定义Realm认证授权

package com.fc.test.system.shiro.auth;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;


/**
 * 自定义realm
 * @author zzc
 */
@Slf4j
public class AuthRealm extends AuthorizingRealm {

  public AuthRealm() {}

  /** authorization 权限授予 */
  @Override
  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    log.info("=============shiro权限授权=============");
    //获取登录时认证的用户名
    String username = String.valueOf(principals);
    Set<String> roles = new HashSet<>();
    Set<String> permissions = new HashSet<>();
    //给用户添加user权限 (没有进行判断、对所有的用户给user权限)
    if("user".equals(username)){
      roles.add("user");
      permissions.add("user:detail");
    }
   //当用户名为admin时 为用户添加权限admin  两个admin可以理解为连个字段
    if ("admin".equals(username)) {
      roles.add("admin");
      permissions.add("admin:add");
      permissions.add("admin:detele");
      permissions.add("admin:detail");
      permissions.add("admin:list");
      permissions.add("admin:update");
    }
    SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roles);
    //添加权限
    //permissions里包含@RequiresPermissions("admin:update")传来的值则认证成功
    info.setStringPermissions(permissions);
    info.setRoles(roles);
    return info;
  }
  
   /** authentication 身份验证 */
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
      throws AuthenticationException {
    log.info("=============shiro开始认证=============");
    // 将AuthenticationToken强转为UsernamePasswordToken对象
    UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken;
    // 获得从表单传过来的用户名
    String username = upToken.getUsername();
    //通用mapper查询
    Condition condition = new Condition(TSysUser.class);
    condition.createCriteria().andEqualTo("username",username);
    List<TSysUser> tSysUserList = tSysUserMapper.selectByCondition(condition);
    if(tSysUserList==null || tSysUserList.isEmpty()){
      throw new UnknownAccountException();
    }
    TSysUser tSysUser = tSysUserList.get(0);
    //用户名和密码跟subject.login(usernamePasswordToken);传来的一致则认证成功
    return new SimpleAuthenticationInfo(username,tSysUser.getPassword(), getName());
  }
  
  @Override
  public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
    super.clearCachedAuthorizationInfo(principals);
  }

  @Override
  public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
    super.clearCachedAuthenticationInfo(principals);
  }

  @Override
  public void clearCache(PrincipalCollection principals) {
    super.clearCache(principals);
  }

  private void clearAllCachedAuthorizationInfo() {
    getAuthorizationCache().clear();
  }

  private void clearAllCachedAuthenticationInfo() {
    getAuthenticationCache().clear();
  }

  public void clearAllCache() {
    clearAllCachedAuthenticationInfo();
    clearAllCachedAuthorizationInfo();
  }
}

控制层shiro认证

package com.fc.test.controller.user;
import com.fc.test.util.CommonUtil;
import io.swagger.annotations.Api;
import io.swagger.annotations.ApiOperation;
import io.swagger.annotations.ApiResponse;
import io.swagger.annotations.ApiResponses;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

/**
 * [简要描述]:Restful控制器 <br/>
 * [详细描述]:
 *
 * @author zzc
 * @time   2019/10/25
 * @since V0.1
 */
@Slf4j
@Api(value = "用户登录", tags = {"用户登录"})
@RestController
@RequestMapping("/api/v1")
public class LoginControllet {
    /**
     * 用户登录 1. userName 登录名(非必须) 2. passWord 密码凭证
     */
    @ApiOperation(value = "登录", notes = "请注意请求参数!")
    @ApiResponses({
            @ApiResponse(code = 200, message = "成功", response = String.class),
            @ApiResponse(code = 999, message = "失败"),
    })
    @PostMapping("/login")
    public String userLogin(String userName,String passWord) {
        //密码通过md5+用户名加密
        String pwd = CommonUtil.encryptMD5(userName+passWord);
        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(userName,pwd);
        String token = CommonUtil.generateToken();
        //主体
        Subject subject = SecurityUtils.getSubject();
        //调用自定义的Realm的doGetAuthenticationInfo认证,传入的账号密码跟doGetAuthenticationInfo返回的账号密码一致则认证成功
        subject.login(usernamePasswordToken);
        //认证成功返回token
        return token;
    }
}

控制层shiro授权过程

@ApiOperation(value = "获取数据列表")
    @ApiResponses({
            @ApiResponse(code = 200, message = "成功", response = TSysUser.class),
            @ApiResponse(code = 101, message = "数据校验未通过"),
            @ApiResponse(code = 999, message = "失败"),
            @ApiResponse(code = 1501, message = "用户令牌过期"),
    })
    @ApiImplicitParams({
            @ApiImplicitParam(name = "page", value = "页数 "),
            @ApiImplicitParam(name = "size", value = "每页数量 "),
    })
    @GetMapping
    //该注解调用Realm的doGetAuthorizationInfo进行授权,
    @RequiresPermissions("admin:list")
    public RestResponse list(@RequestParam(defaultValue = "1") Integer page, @RequestParam(defaultValue = "10") Integer size) {
        PageInfo pageInfo = tSysUserService.findTSysUserList(page, size);
        return RestResponse.builder().respStatus(RespStatus.SUCCESS).respData(pageInfo).build();
    }

代码执行

登录
这里正确账号密码是账号：admin 密码：123456
输入正确账号密码返回token

shiro进行认证，账号密码跟数据库一致认证成功

输出错误账号或密码，接口返回的自定义异常是根据shiro抛出的异常自己自定义的


shiro进行授权验证
admin账号有查询列表的权限请求成功


user账号进行登录查询用户列表

这就是shiro整个认证授予过程
数据库密码是使用用户名+密码md5加密组成