Spring boot整合Shiro

创建Shiro-config配置类

package cn.kgc.springboot.config;

import cn.kgc.springboot.shiro.CustomerRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;

/*
@author peng
@date10/8/2022
*/
@Configuration
public class ShiroConfig {
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
       //设置登录页地址
        shiroFilterFactoryBean.setLoginUrl("/login.html");
        //配置受限资源
        HashMap<String, String> map = new HashMap<>();
        //anon 设置资源允许匿名访问
        //authc 资源受限
        map.put("/**","authc");
        map.put("/register.html","anon");
        map.put("/user/login","anon");
        map.put("/user/register","anon");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        return shiroFilterFactoryBean;
    }
    //web管理器
    @Bean
    public DefaultWebSecurityManager defaultWebSecurityManager(){
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(customerRealm());
        return defaultWebSecurityManager;
    }
    @Bean
    public CustomerRealm customerRealm(){
        CustomerRealm customerRealm = new CustomerRealm();
        //创建凭证匹配器对象
        HashedCredentialsMatcher md5 = new HashedCredentialsMatcher("MD5");
        md5.setHashIterations(1024);
        customerRealm.setCredentialsMatcher(md5);
        return customerRealm;
    }

}

创建CustomerRealm类继承AuthorizingRealm进行认证

package cn.kgc.springboot.shiro;

import cn.kgc.springboot.entity.User;
import cn.kgc.springboot.service.UserService;
import com.baomidou.mybatisplus.core.toolkit.ObjectUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

/*
@author peng
@date10/8/2022
*/
public class CustomerRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String principal = (String) authenticationToken.getPrincipal();
        //根据用户的身份信息 查询用户数据
        User user = userService.selectByUserName(principal);
        //判定用户是否存在
        if (ObjectUtils.isNotNull(user)){
            return new SimpleAuthenticationInfo(user.getUsername(),user.getPassword(),ByteSource.Util.bytes(user.getSalt()),this.getName());
        }
        return null;
    }
}

编写Control进行测试

package cn.kgc.springboot.controller;

import cn.hutool.core.util.RandomUtil;
import cn.kgc.springboot.entity.User;
import cn.kgc.springboot.service.UserService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;

import java.util.HashMap;
import java.util.Map;

/*
@author peng
@date10/8/2022
*/
@Controller
@RequestMapping("user")
public class UserController {
    @Autowired
    private UserService userService;

    @RequestMapping("test")
    @ResponseBody
    public String test01() {
        return "ok";
    }

    @RequestMapping("login")
    public String login(String username, String password) {
        UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
        Subject subject = SecurityUtils.getSubject();

        //认证通过
        subject.login(usernamePasswordToken);
        return "redirect:/index.html";
    }
    @RequestMapping("register")
    public String register(String username, String password) {
        //生成随机盐
        String salt = RandomUtil.randomString(5);
        Md5Hash md5Hash = new Md5Hash(password, salt, 1024);
        String newPassword = md5Hash.toHex();

        User user = new User();
        user.setUsername(username).setSalt(salt).setPassword(newPassword);
        userService.addUser(user);
        return "redirect:/login.html";
    }
    @RequestMapping("logout")
    public String logout() {
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        return "redirect:/login.html";
    }
}