前言
Springboot和Shiro的基本介绍我就不多说了,能看到这篇文章的相信也都会用。这篇文章主要是分享一下我在学习Shiro和Springboot的整合的小阶段。目前是复习,很感谢B站的up主——编程不良人的视频让我有了一个学习Shiro的基本方向。
目前是实现了用户认证的功能。
依赖
整合的时候使用的是jsp,其实和thymeleaf一个道理,而且不涉及到作用域传值。我们需要导入的依赖有:mysql、mybatis、jsp、jstl、shiro-springboot、test、web、lombok以及热部署
我就直接贴代码了。
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<scope>runtime</scope>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
<optional>true</optional>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring-boot-starter</artifactId>
<version>1.5.3</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
</dependency>
<dependency>
<groupId>org.mybatis.spring.boot</groupId>
<artifactId>mybatis-spring-boot-starter</artifactId>
<version>2.1.4</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid-spring-boot-starter</artifactId>
<version>1.1.24</version>
</dependency>
<!--引入jsp的依赖-->
<dependency>
<groupId>org.apache.tomcat.embed</groupId>
<artifactId>tomcat-embed-jasper</artifactId>
</dependency>
<dependency>
<groupId>jstl</groupId>
<artifactId>jstl</artifactId>
<version>1.2</version>
</dependency>
上面的依赖就不多解释了,应该都认识。
数据库建表
DROP TABLE IF EXISTS `t_user`;
CREATE TABLE `t_user` (
`id` int(6) NOT NULL AUTO_INCREMENT,
`username` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
`password` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
`salt` varchar(255) CHARACTER SET utf8 COLLATE utf8_general_ci NULL DEFAULT NULL,
PRIMARY KEY (`id`) USING BTREE
) ENGINE = InnoDB AUTO_INCREMENT = 1 CHARACTER SET = utf8 COLLATE = utf8_general_ci ROW_FORMAT = Compact;
SET FOREIGN_KEY_CHECKS = 1;
思路设计
首先得先准备三个页面:登录、注册以及主页
设计的思路是我们需要去拦截主页,不让用户直接访问到,并且跳转到登录页面。那我们就需要去拦截这个路由。
在注册时候,通过我们写的加盐工具类,用随机生成的盐去将密码加密保存在数据库中,并且设置好散列的次数。
登录时,需要手动设置realm的加盐策略以及散列的次数。
话不多说直接上代码。
yml配置
spring:
application:
name: shiro
mvc:
view:
prefix: /
suffix: .jsp
datasource:
driver-class-name: com.mysql.jdbc.Driver
type: com.alibaba.druid.pool.DruidDataSource
url: jdbc:mysql:///shiro?characterEncoding=UTF-8&serverTimezone=GMT
username: root
password: 1234
server:
port: 8080
servlet:
context-path: /shiro
mybatis:
type-aliases-package: com.zxy.pojo
mapper-locations: classpath:mapper/*.xml
盐工具类
public static String getSalt(int n){
char[] chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()".toCharArray();
StringBuilder sb = new StringBuilder();
for (int i = 0; i < n; i++) {
char aChar = chars[new Random().nextInt(chars.length)];
sb.append(aChar);
}
return sb.toString();
}
模拟界面
index.jsp
<%@page contentType="text/html; UTF-8" pageEncoding="UTF-8" isELIgnored="false"%>
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport"
content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>Document</title>
</head>
<body>
<h1>系统主页v1.0</h1>
<a href="${pageContext.request.contextPath}/user/logout">退出登录</a>
<ul>
<li><a href="">用户管理</a></li>
<li><a href="">商品管理</a></li>
<li><a href="">订单管理</a></li>
<li><a href="">物流管理</a></li>
</ul>
</body>
</html>
login.jsp
<%@page contentType="text/html; UTF-8" pageEncoding="UTF-8" isELIgnored="false" %>
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport"
content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>登录</title>
</head>
<body>
<h2>用户登录</h2>
<form action="${pageContext.request.contextPath}/user/login" method="post">
用户名:<input type="text" name="username"><br>
密码:<input type="password" name="password"><br>
<input type="submit" value="登录">
</form>
</body>
</html>
register.jsp
<%@page contentType="text/html; UTF-8" pageEncoding="UTF-8" isELIgnored="false" %>
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport"
content="width=device-width, user-scalable=no, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0">
<meta http-equiv="X-UA-Compatible" content="ie=edge">
<title>注册</title>
</head>
<body>
<h2>用户注册</h2>
<form action="${pageContext.request.contextPath}/user/register" method="post">
用户名:<input type="text" name="username"><br>
密码:<input type="password" name="password"><br>
<input type="submit" value="注册">
</form>
</body>
</html>
实体类
package com.zxy.pojo;
import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import lombok.experimental.Accessors;
/**
* @Author Zxy
* @Date 2021/1/8 17:31
* @Version 1.0
*/
@Data
@AllArgsConstructor
@NoArgsConstructor
@Accessors(chain = true)
public class User {
private Integer id;
private String username;
private String password;
private String salt;
}
数据层
package com.zxy.mapper;
import com.zxy.pojo.User;
/**
* @Author Zxy
* @Date 2021/1/8 17:33
* @Version 1.0
*/
public interface UserMapper {
void save(User user);
User findByUsername(String username);
}
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.zxy.mapper.UserMapper">
<insert id="save">
insert into t_user
values (#{id}, #{username}, #{password}, #{salt})
</insert>
<select id="findByUsername" resultType="com.zxy.pojo.User">
select id,username,password,salt
from t_user
where username = #{username}
</select>
</mapper>
服务层
package com.zxy.service;
import com.zxy.pojo.User;
/**
* @Author Zxy
* @Date 2021/1/8 17:35
* @Version 1.0
*/
public interface UserService {
void register(User user);
User findByUsername(String username);
}
package com.zxy.service;
import com.zxy.mapper.UserMapper;
import com.zxy.pojo.User;
import com.zxy.utils.SaltUtils;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
/**
* @Author Zxy
* @Date 2021/1/8 17:35
* @Version 1.0
*/
@Service
public class UserServiceImpl implements UserService {
@Autowired
private UserMapper mapper;
@Override
public void register(User user) {
// 处理业务
// 明文密码进行md5+salt+hash散列
// 1、生成随机盐
String salt = SaltUtils.getSalt(8);
// 2、将随机盐保存到数据库
user.setSalt(salt);
// 3、明文密码进行md5+salt+hash散列
Md5Hash md5Hash = new Md5Hash(user.getPassword(), salt, 1024);
user.setPassword(md5Hash.toHex());
mapper.save(user);
}
@Override
public User findByUsername(String username) {
return mapper.findByUsername(username);
}
}
控制层
package com.zxy.controller;
import com.zxy.pojo.User;
import com.zxy.service.UserService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
/**
* @Author Zxy
* @Date 2021/1/8 17:05
* @Version 1.0
*/
@Controller
@RequestMapping("user")
public class UserController {
@Autowired
private UserService service;
/*退出登录*/
@RequestMapping("/logout")
public String logout() {
Subject subject = SecurityUtils.getSubject();
subject.logout();
return "redirect:/login.jsp";
}
// 用来处理身份认证(登录)
@RequestMapping("/login")
public String login(String username, String password) {
// 获取主体对象
Subject subject = SecurityUtils.getSubject();
try {
subject.login(new UsernamePasswordToken(username, password));
return "redirect:/index.jsp";
} catch (UnknownAccountException e) {
System.out.println("用户名错误");
e.printStackTrace();
} catch (IncorrectCredentialsException e) {
System.out.println("密码错误");
e.printStackTrace();
}
return "redirect:/login.jsp";
}
/**
* 用户注册
*
* @param user
* @return
*/
@RequestMapping("/register")
public String register(User user) {
try {
service.register(user);
return "redirect:/index.jsp";
} catch (Exception e) {
e.printStackTrace();
return "redirect:/register.jsp";
}
}
}
shiro自定义配置层
package com.zxy.config;
import com.zxy.shiro.realms.CustomerRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.HashMap;
/**
* @Author Zxy
* @Date 2021/1/8 16:21
* @Version 1.0
* 用来整合shiro框架相关的配置类
*/
@Configuration
public class ShiroConfig {
// 创建shiroFilter 负责拦截所有请求
@Bean
public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("defaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
// 给filter设置安全管理器
shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);
// 配置系统的受限资源
HashMap<String, String> map = new HashMap<>();
// 不受限的资源设置成公共资源
map.put("/user/login", "anon");
map.put("/user/register", "anon");
map.put("/register.jsp", "anon");
// 通配符会拦截所有除了setLoginUrl方法的路由
map.put("/**", "authc"); // authc代表请求这个资源需要认证和授权
// 默认的认证界面路径
shiroFilterFactoryBean.setLoginUrl("/login.jsp");
// 配置系统的公共资源
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
return shiroFilterFactoryBean;
}
// 创建安全管理器
@Bean(name = "defaultWebSecurityManager")
public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("realm") Realm realm) {
DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
defaultWebSecurityManager.setRealm(realm);
return defaultWebSecurityManager;
}
// 创建自定义realm 在自定义realm中设置密码凭证匹配器以及哈希散列次数
@Bean(name = "realm")
public Realm getRealm() {
CustomerRealm customerRealm = new CustomerRealm();
// 修改凭证校验匹配器
// 设置realm使用hash凭证
HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
// 设置哈希算法的名字
credentialsMatcher.setHashAlgorithmName("md5");
// 设置散列的次数
credentialsMatcher.setHashIterations(1024);
customerRealm.setCredentialsMatcher(credentialsMatcher);
return customerRealm;
}
}
以上就是所有的源码,需要的小伙伴自取。如果对你有帮助,不妨把你的爱心点一点。