SSM整合Shiro 身份验证及密码加密简单实现

1.导入maven的相关依赖

　　　　<!-- shiro -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-all</artifactId>
            <version>1.3.2</version>
        </dependency>
        
        <dependency>
        <groupId>net.sf.ehcache</groupId>
        <artifactId>ehcache-core</artifactId>
        <version>2.5.7</version>
        </dependency>

2.web.xml中配置DelegatingFilterProxy

 1 <!-- shiro -->
 2     <filter>
 3         <filter-name>shiroFilter</filter-name>
 4         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 5         <!-- 设置true由servlet容器控制filter的生命周期 -->
 6         <init-param>
 7           <param-name>targetFilterLifecycle</param-name>
 8           <param-value>true</param-value>
 9         </init-param>
10     </filter>
11 
12     <filter-mapping>
13         <filter-name>shiroFilter</filter-name>
14         <url-pattern>/*</url-pattern>
15     </filter-mapping>

 

3. 跟spring IOC容器组合部分

 

 

 1 <!--配置securityManager（安全管理）  -->
 2     <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
 3         <property name="cacheManager" ref="cacheManager"/>
 4          <property name="authenticator" ref="authenticator"></property>
 5          <property name="realm" ref="jdbcRealm"></property>
 6         <!-- 改变remember 的时间-->
 7         <property name="rememberMeManager.cookie.maxAge" value="10"></property>
 8     </bean>
 9      <!-- 缓存管理器
10     <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
11              <!-- 加入ehcache jar包和配置文件 -->
12         <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
13     </bean>-->
14  <bean id="authenticator" 
15      class="org.apache.shiro.authc.pam.ModularRealmAuthenticator">
16      <property name="authenticationStrategy">
17       <bean class="org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy"></bean>
18      </property>
19     </bean>
20      <!--配置 realm（范围）      实现了Realm的bean -->
21     <bean id="jdbcRealm" class="com.tx.shiro.realm.MyShiroRealm">
22         <property name="credentialsMatcher">
23          <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
24           <property name="hashAlgorithmName" value="MD5"></property>
25           <property name="hashIterations" value="1024"></property>
26          </bean>
27         </property>
28     </bean>
29     <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
30 　　　　 <!--这里根据项目制定路径 -->
31         <property name="securityManager" ref="securityManager"/>
32         <property name="loginUrl" value="/"/>
33         <property name="successUrl" value="/customer/customer.action"/>
34         <property name="filterChainDefinitions">
35             <value>
36              　　#允许匿名访问的url
37                 /sysUser/login = anon
38 　　　　　　　　　　#登出
39                 /sysUser/loginout = logout
40                 #不允许匿名访问的url
41                 /** = authc
42             </value>
43         </property>
44     </bean>

 

　Warning：下一步配置com.tx.shiro.realm.MyShiroRealm

4.编写MyShiroRealm

 1 import javax.servlet.http.HttpServletRequest;
 2 
 3 import org.apache.shiro.authc.AuthenticationException;
 4 import org.apache.shiro.authc.AuthenticationInfo;
 5 import org.apache.shiro.authc.AuthenticationToken;
 6 import org.apache.shiro.authc.SimpleAuthenticationInfo;
 7 import org.apache.shiro.authc.UsernamePasswordToken;
 8 import org.apache.shiro.authz.AuthorizationInfo;
 9 import org.apache.shiro.realm.AuthorizingRealm;
10 import org.apache.shiro.subject.PrincipalCollection;
11 import org.apache.shiro.util.ByteSource;
12 import org.springframework.beans.factory.annotation.Autowired;
13 
14 import com.baomidou.mybatisplus.mapper.EntityWrapper;
15 import com.baomidou.mybatisplus.mapper.Wrapper;
16 import com.tx.beans.SysUser;
17 import com.tx.service.SysUserService;
18 
19 public class MyShiroRealm extends AuthorizingRealm{
20     
21     @Autowired
22     SysUserService sysUserService;
23     
24     @Autowired
25     HttpServletRequest request;
26     
27     @Override//这里可以配置角色权限
28     protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
29         
30         return null;
31     }
32 
33     @Override
34     protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
35         UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken)token;
36         String username = usernamePasswordToken.getUsername();
37         
38         Wrapper<SysUser> wrapper = new EntityWrapper<SysUser>().eq("user_name", username);
39         SysUser user  = sysUserService.selectOne(wrapper);
40         
41         request.getSession().setAttribute("loginUser", user);
42         
43         //使用MD5盐值加密  
44         ByteSource credentialsSalt = ByteSource.Util.bytes(username);
45         
46         return new SimpleAuthenticationInfo(username,  user.getUserPassword(), credentialsSalt, getName());
47         
48     }
49 
50 }

 

5.登录Controller编写

 1 @ResponseBody
 2     @PostMapping("/login")
 3     public AJAXResult login(@RequestParam(value="rememberMe",required=false) String rememberMe, SysUser sysUser ,HttpSession session) {
 4         AJAXResult result = new AJAXResult();
 5         try {
 6             
 7             Subject currentUser = SecurityUtils.getSubject();
 8             if (!currentUser.isAuthenticated()) {
 9                 UsernamePasswordToken token = new UsernamePasswordToken(sysUser.getUserName(), sysUser.getUserPassword());
10                 // rememberme 
11                 if("remember-me".equals(rememberMe)) {
12                     token.setRememberMe(true);
13                 }
14                 try {
15                     // 执行登录. 
16                     currentUser.login(token);
17                 } catch (AuthenticationException ae) {
18                     System.out.println("登录失败! " +ae );
19                 }
20             }
21             result.setResult(true);
22             
23         } catch (Exception e) {
24             e.printStackTrace();
25             result.setMsg("服务器内部错误！！");
26         }
27         
28         
29         return result;
30     }

本代码只是部分代码，具体逻辑根据项目情况编写！

---

 

6.Other

ehcache.xml

<?xml version="1.0" encoding="UTF-8"?>
<ehcache name="shirocache">
    <diskStore path="java.io.tmpdir" />
    
    <cache name="passwordRetryCache"
           maxEntriesLocalHeap="2000"
           eternal="false"
           timeToIdleSeconds="1800"
           timeToLiveSeconds="0"
           overflowToDisk="false"
           statistics="true">
    </cache>
</ehcache>

 

转载于:https://www.cnblogs.com/tmlh/p/9306189.html