Shiro安全框架

最新推荐文章于 2022-08-24 03:17:53 发布

相信光的奥特王小懒

最新推荐文章于 2022-08-24 03:17:53 发布

阅读量199

点赞数

文章标签： shiro log4j slf4j

本文链接：https://blog.csdn.net/weixin_51415327/article/details/118934921

版权

1.shiro官网：https://shiro.apache.org/
shiro是一个功能强大且易于使用的 Java 安全框架，可执行身份验证、授权、加密和会话管理。
2.源码下载地址：https://github.com/apache/shiro
3. 10分钟入门shiro

3.1 pom的导入

<dependencies>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.5.3</version>
        </dependency>

        <!-- configure logging -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
            <version>1.7.26</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-log4j12</artifactId>
            <version>1.7.26</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
    </dependencies>

3.2 日志配置文件

log4j.rootLogger=INFO, stdout

log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n

# General Apache libraries
log4j.logger.org.apache=WARN

# Spring
log4j.logger.org.springframework=WARN

# Default Shiro logging
log4j.logger.org.apache.shiro=INFO

# Disable verbose logging
log4j.logger.org.apache.shiro.util.ThreadContext=WARN
log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

3.3 在Quickstart中用到的相关重要代码

Subject currentUser = SecurityUtils.getSubject();
Session session = currentUser.getSession();
currentUser.isAuthenticated()
currentUser.getPrincipal()
currentUser.hasRole("schwartz")
currentUser.isPermitted("lightsaber:wield")
currentUser.logout();

shiro中重点的三大模块
在这里插入图片描述

第一步：shiro整合spring时所使用的依赖（导入架包）

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.5.2</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.whx</groupId>
    <artifactId>springboot-shiro-1</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>springboot-shiro-1</name>
    <description>Demo project for Spring Boot</description>
    <properties>
        <java.version>1.8</java.version>
    </properties>
    <dependencies>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
        </dependency>


        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid-spring-boot-starter</artifactId>
            <version>1.2.6</version>
        </dependency>
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.23</version>
        </dependency>
        <dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.2.0</version>
        </dependency>



<!--        shiro整合spring的包-->

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.7.1</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>


<!--thymeleaf的依赖-->
        <dependency>
            <groupId>org.thymeleaf</groupId>
            <artifactId>thymeleaf-spring5</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-java8time</artifactId>
        </dependency>

    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>

</project>

第二步：编写配置类
1.第一个文件为ShiroConfig文件：

package com.whx.config;


import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;
import java.util.Map;


@Configuration
public class ShiroConfig {

//    1. shiroFilterFactoryBean  2. DefaultWebSecurityManager  3. realm对象  需要自定义类


//第三步   shiroFilterFactoryBean  然后关联DefaultWebSecurityManager
   @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager){

        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();

//设置安全管理器
        bean.setSecurityManager(defaultWebSecurityManager);
//内置过滤器
//       anno:无需认证即可访问
//       authc:必须认证才可访问
//       user:必须拥有记住我功能才可以使用
//       perms:拥有对某个资源的权限才可以访问
//       role:拥有某个角色权限才可以访问
       Map<String, String> filterMap=new LinkedHashMap<>();
//       给add页面添加权限
       filterMap.put("/user/add","authc");
       filterMap.put("/user/*","authc");
       bean.setFilterChainDefinitionMap(filterMap);
//如果没有权限则返回登录页面
       bean.setLoginUrl("/toLogin");
       return  bean;
    }
//第二步 DefaultWebSecurityManager然后对realm进行关联,通过（@Qualifier("userRealm") UserRealm userRealm）将UserRealm关联起来

    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
//关联 UserRealm
        securityManager.setRealm(userRealm);


        return securityManager;
    }
//    第一步，将自定义类UserRealm拿过来用
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }
}

2.第一个文件为UserRealm文件：

package com.whx.config;


import com.whx.pojo.User;
import com.whx.service.UserService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

public class UserRealm  extends AuthorizingRealm {

    @Autowired
    UserService userService;
//    授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了>=doGetAuthorizationInfo()");
        return null;
    }


//    认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了>=doGetAuthenticationInfo()");

        用户名和密码从数据库中取,此处先伪造一些数据方便验证
//        String name="root";
//        String password="123456";
//        UsernamePasswordToken userToken=(UsernamePasswordToken)authenticationToken;
用户名验证
//        if(!userToken.getUsername().equals(name)){
//            return null;
//        }


//        通过数据库连接
        UsernamePasswordToken userToken=(UsernamePasswordToken)authenticationToken;
        User user = userService.queryUserByName(userToken.getUsername());
        if(user==null){
            return null;
        }

//        密码验证,有shiro自己做,可以加密MD5以及MD5延值加密
        return new SimpleAuthenticationInfo("",user.getPwd(),"");
    }
}

用假数据写用户名和密码时，可以通过以下进行测试是否书写正确。

package com.whx;

import com.whx.service.UserServiceImpl;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;

@SpringBootTest
class SpringbootShiro1ApplicationTests {

    @Autowired
    UserServiceImpl userService;
    @Test
    void contextLoads() {

        System.out.println(userService.queryUserByName("小儿"));

    }

}

在shiro配置文件中设置了权限，怎么赋值给用户呐？
在这里插入图片描述
死数据取值：

通过从数据库取值，在数据库中添加一条perms属性：

在这里插入图片描述

1.shiro与thymeleaf的整合

1.1 首先导入依赖

  <dependency>
      <groupId>com.github.theborakompanioni</groupId>
      <artifactId>thymeleaf-extras-shiro</artifactId>
      <version>2.0.0</version>
  </dependency>

1.2 完成使用前的配置

在这里插入图片描述
在ShiroConfig文件中进行配置：

  @Bean
    public ShiroDialect getShiroDialect(){
       return new ShiroDialect();

1.3相关的应用实例

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro">
<head>
    <meta charset="UTF-8">
    <title>首页</title>
</head>
<body>
<h1>首页</h1>

<div >
    <a th:href="@{/toLogin}">登录</a>
<div/>

<p th:text="${msg}"></p>
<hr>



<div shiro:hasPermission="user:add">
    <a th:href="@{/user/add}">add</a>
</div>

<div shiro:hasPermission="user:update">
    <a th:href="@{/user/update}">update</a>
</div>

</body>
</html>

相信光的奥特王小懒

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
Shiro安全框架

1.shiro官网：https://shiro.apache.org/shiro是一个功能强大且易于使用的 Java 安全框架，可执行身份验证、授权、加密和会话管理。2.源码下载地址：https://github.com/apache/shiro3. 10分钟入门shiro3.1 pom的导入<dependencies> <dependency> <groupId>org.apache.shiro</groupI
复制链接

扫一扫