作为两个java 安全框架大佬,大家对他可能或多或少得熟悉,这里做一个使用对比方便记忆
1,引入pom 配置
shiro (apache 得项目)
security
<!-- spring security 安全认证 --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>
第二步:
自定义配置类
** * spring security配置 * * @author syxl */ @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true) public class SecurityConfig extends WebSecurityConfigurerAdapter { /** * 自定义用户认证逻辑 */ @Autowired private UserDetailsService userDetailsService; /** * 认证失败处理类 */ @Autowired private AuthenticationEntryPointImpl unauthorizedHandler; /** * 退出处理类 */ @Autowired private LogoutSuccessHandlerImpl logoutSuccessHandler; /** * token认证过滤器 */ @Autowired private JwtAuthenticationTokenFilter authenticationTokenFilter; /** * 跨域过滤器 */ @Autowired private CorsFilter corsFilter; /** * 解决 无法直接注入 AuthenticationManager * * @return * @throws Exception */ @Bean @Override public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } /** * anyRequest | 匹配所有请求路径 * access | SpringEl表达式结果为true时可以访问 * anonymous | 匿名可以访问 * denyAll | 用户不能访问 * fullyAuthenticated | 用户完全认证可以访问(非remember-me下自动登录) * hasAnyAuthority | 如果有参数,参数表示权限,则其中任何一个权限可以访问 * hasAnyRole | 如果有参数,参数表示角色,则其中任何一个角色可以访问 * hasAuthority | 如果有参数,参数表示权限,则其权限可以访问 * hasIpAddress | 如果有参数,参数表示IP地址,如果用户IP和参数匹配,则可以访问 * hasRole | 如果有参数,参数表示角色,则其角色可以访问 * permitAll | 用户可以任意访问 * rememberMe | 允许通过remember-me登录的用户访问 * authenticated | 用户登录后可访问 */ @Override protected void configure(HttpSecurity httpSecurity) throws Exception { httpSecurity // CSRF禁用,因为不使用session .csrf().disable() // 认证失败处理类 .exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() // 基于token,所以不需要session .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).and() // 过滤请求 .authorizeRequests() // 对于登录login 验证码captchaImage 允许匿名访问 .antMatchers("/login", "/captchaImage").anonymous() .antMatchers( HttpMethod.GET, "/*.html", "/**/*.html", "/**/*.css", "/**/*.js" ).permitAll() .antMatchers("/business/contract/**").permitAll() .antMatchers("/profile/**").anonymous() .antMatchers("/common/download**").anonymous() .antMatchers("/common/download/resource**").anonymous() .antMatchers("/swagger-ui.html").anonymous() .antMatchers("/swagger-resources/**").anonymous() .antMatchers("/webjars/**").anonymous() .antMatchers("/*/api-docs").anonymous() .antMatchers("/druid/**").anonymous() // 除上面外的所有请求全部需要鉴权认证 .anyRequest().authenticated() .and() .headers().frameOptions().disable(); httpSecurity.logout().logoutUrl("/logout").logoutSuccessHandler(logoutSuccessHandler); // 添加JWT filter httpSecurity.addFilterBefore(authenticationTokenFilter, UsernamePasswordAuthenticationFilter.class); // 添加CORS filter httpSecurity.addFilterBefore(corsFilter, JwtAuthenticationTokenFilter.class); httpSecurity.addFilterBefore(corsFilter, LogoutFilter.class); } /** * 强散列哈希加密实现 */ @Bean public BCryptPasswordEncoder bCryptPasswordEncoder() { return new BCryptPasswordEncoder(); } /** * 身份认证接口 */ @Override protected void configure(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder()); } }
对比shiro 配置类
@Configuration //从下往上写 public class ShiroConfig { @Bean public ShiroFileterFactoryBean getShiroFileterFactoryBean(@Qualifier("securityManage") DefaultWebSecurityManager defaultWebSecurityManager){ ShiroFileterFactoryBean bean = new ShiroFileterFactoryBean(); bean.setSerurtiyManage(getDefaultSecurityManager(defaultWebSecurityManager)); /** * anon 无需认证就可以访问 * authc 必须认证访问 * user 必须有 记住我 访问 * perms 有某个权限访问 * role 有某个角色访问 */ Map<String ,String> fiterMap = new LinkedHashMap<>(); fiterMap.put("/user/add","authc") return bean; } @Bean(name = "securityManage") public DefaultWebSecurityManager getDefaultSecurityManager(@Qualifier("userRealm") UserRealm userRealm){ DefaultWebSecurityManager sercurityMangeer = new DefaultWebSecurityManage(); //关联usereaml sercurityMangeer.setRealm(userRealm); return sercurityMangeer; } @Bean public UserRealm userRealm(){ return new UerRealm; } }
第二个类
public class UserRealm extends AuthroizingRealm { // 授权 protected AuthenticationInfo doGetAuthenticationInfo(PrincipalCollection principalCollection){ // SimpleAuthenticationInfo info = new SimpleAuthenticationInfo () // 获取当前用户 Subject subject = SecurityUtils.getSubject(); Iser currener = (user) subject.getPrimncipal(); //设置但钱用户 info.seassStringPermion (CurreentUSer.setgetPermis()) return info; } // 认证 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException{ //认证 从数据库获取username password UsernamePasswordToken token1 = new UsernamePasswordToken(username,password); if (!userToken.getUsername().equals(name)){ return null } //密码 return new SimpleAuthenticationInfo("user",password,""); } } public login(){ // 获取当前用户 Subject subject = SecurityUtils.getSubject(); // 封装用户登录得数据 UsernamePasswordToken token1 = new UsernamePasswordToken(username,password); try{ subject.login(token1); }catch (UnKnowAccountExecption e){ // 用户名错 return "login"; }catch (IncorrectionCredentialsExcpetion e){ //密码错 return "login"; } }