Shiro安全框架

Shiro官网

一、shiro快速开始

1、导入依赖

	<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.4.1</version>
    </dependency>

2、配置文件（shiro.ini）

3、HelloWorld

二、springBoot整合shiro

1、导入依赖

<dependency>
     <groupId>org.apache.shiro</groupId>
     <artifactId>shiro-spring</artifactId>
     <version>1.4.1</version>
</dependency>

2、编写Shiro配置类

package com.kuang.config;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

/**
 * @author xzt
 * @create 2020-11-18 14:09
 */
@Configuration
public class ShiroConfig {

    //3、ShiroFilterFactoryBean（Subject）
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager manager){

        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(manager);

        return bean;
    }

    //2、DefaultWebSecurityManager（shiro Security Manager）
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();

        //关联Realm
        defaultWebSecurityManager.setRealm(userRealm);

        return defaultWebSecurityManager;
    }

    //1、创建realm对象， 需要自定义类（Realm）
    @Bean(name = "userRealm")
    public UserRealm userRealm(){
        return new UserRealm();
    }

}

在编写配置类时需要我们自定义Realm类

package com.kuang.config;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

/**
 * 自定义的Realm
 * @author xzt
 * @create 2020-11-18 14:11
 */
public class UserRealm extends AuthorizingRealm {

    //授权方法
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了授权");
        return null;
    }

    //认证方法
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了认证");
        return null;
    }
}

三、拦截

在ShiroFilterFactoryBean方法中添加shiro的内置过滤器

anon: 无需认证就可以访问
authc: 必须认证了才能访问
user: 必须拥有 记住我 功能才能用
perms: 拥有对某个资源的权限才能访问
role: 拥有某个角色权限才能访问

Map<String, String> filterMap = new LinkedHashMap<>();
//拦截
filterMap.put("/user/add","authc");
filterMap.put("/user/update","authc");
//filterMap.put("/user/*","authc"); 支持通配符，拦截user下的所有
bean.setFilterChainDefinitionMap(filterMap )//设置过滤器

//设置登录的请求
bean.setLoginUrl("/toLogin");

四、Shiro整合MyBatis

1、正常整合springBoot和MyBatis
2、在自定义类中，自动装配Service进行数据库使用

	@Autowired
    private UserServiceImp userService;
    
    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("执行了认证");

        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken userToken = (UsernamePasswordToken)token;

        //连接真实数据库
        User user = userService.queryUserByName(userToken.getUsername());

        if(user == null ){
            return null; //抛异常UnknownAccountException
        }

        //密码认证，shiro做
        //把密码丢给了SimpleAuthenticationInfo
        return new SimpleAuthenticationInfo(user,user.getPassword(),"");
    }

五、认证和授权

实现认证和授权功能应该在Realm对象中，Shiro会在ShiroConfig和我们自定义创建的Realm类之间进行联动，我们需要在自定义创建的Realm类中编写认证和授权功能。

认证（以用户登录为例）
1、登录表单

<p th:text="${msg}" style="color: red"></p>

<form th:action="@{/login}">
    用户名: <input type="text" name="username"></br>
    密码: <input type="password" name="password"></br>
    <input type="submit" value="登录">
</form>

2、用户登录controller

@RequestMapping("/login")
    public String login(String username, String password,Model model){
        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();
        System.out.println(username);
        //封装用户的登录数据
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);//将用户名和密码放成一个令牌，加密

        try {
            subject.login(token);//执行登录的方法，如果没有异常就说明ok
            return "index";
        } catch (UnknownAccountException e) {//用户名不存在
            model.addAttribute("msg","用户名错误");
            return "login";
        }catch (IncorrectCredentialsException e){ //密码不存在
            model.addAttribute("msg","密码错误");
            return "login";
        }
    }

3、在自定义的Realm的doGetAuthenticationInfo()方法中实现认证

	//认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("执行了认证");

        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken userToken = (UsernamePasswordToken)token;

        //连接真实数据库
        User user = userService.queryUserByName(userToken.getUsername());

        if(user == null ){
            return null; //抛异常UnknownAccountException
        }

        //密码认证，shiro做
        //把密码丢给了SimpleAuthenticationInfo
        return new SimpleAuthenticationInfo(user,user.getPassword(),"");
    }

授权（以用户登录为例）
1、在ShiroConfig类的getShiroFilterFactoryBean()方法中定义授权规则,并设置未授权页面

	//未经授权跳转到此
	@RequestMapping("/noauth")
    @ResponseBody
    public String unauthorized(){
        return "未经授权，不能访问此页面";
    }

 	@Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager manager){

        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(manager);

        //添加shiro的内置过滤器
        /*
            anon:   无需认证就可以访问
            authc:  必须认证了才能访问
            user:   必须拥有 记住我 功能才能用
            perms:  拥有对某个资源的权限才能访问
            role:   拥有某个角色权限才能访问
         */

        Map<String, String> filterMap = new LinkedHashMap<>();
        //拦截
        filterMap.put("/user/add","authc");
        filterMap.put("/user/update","authc");

        //授权,正常情况下，没有授权会跳转到未授权页面
        filterMap.put("/user/add","perms[user:add]");
        filterMap.put("/user/update","perms[user:update]");

        bean.setFilterChainDefinitionMap(filterMap);
        //设置未授权页面
        bean.setUnauthorizedUrl("/noauth");
        //设置登录的请求
        bean.setLoginUrl("/toLogin");

        return bean;
    }

2、在自定义的Realm类中的doGetAuthorizationInfo()方法中进行授权。

//授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了授权");

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

//        info.addStringPermission("user:add");

        //拿到当前登录的对象
        //之所以可以通过SecurityUtils拿到当前登录的对象时因为认证方法doGetAuthenticationInfo()中将user对象传给了返回的SimpleAuthenticationInfo对象
        //return new SimpleAuthenticationInfo(user,user.getPassword(),"");return new SimpleAuthenticationInfo(user,user.getPassword(),"");
        Subject subject = SecurityUtils.getSubject();
        User currentUser = (User)subject.getPrincipal();//拿到user对象

        //设置当前用户的权限
        info.addStringPermission(currentUser.getPerms());
        //return null;
        return info;
    }

六、Shiro整合Thymeleaf

 	<dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
	</dependency>

命名空间

xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro"

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<h1>首页</h1>

<p>
    <a th:href=" @{/toLogin}">登录</a>
</p>

<h1 th:text="${msg}"></h1>

<hr>
<!-- 判断是否有次权限,有则显示 -->
<div shiro:hasPermission="user:add">
<a th:href="@{/user/add}">add</a>
</div>

<div shiro:hasPermission="user:update">
<a th:href="@{/user/update}">update</a>
</div>
</body>
</html>