Shiro是什么？
Spring security 重量级安全框架
Apache shiro 轻量级安全框架
Shiro是一个强大且易用的Java权限框架
四大基石
身份验证，授权，密码学，会话管理
/*** String algorithmName, Object source, Object salt, int hashIterations)* 第一个参数algorithmName:加密算法名称* 第二个参数source:加密原密码 * 第三个参数salt:盐值 * 第四个参数hashIterations:加密次数 */ SimpleHash hash = new SimpleHash("MD5","123456","itsource",10); System.out.println(hash.toHex()); 4.自定义Realm
继承AuthorizingRealm
实现两个方法：doGetAuthorizationInfo(授权) /doGetAuthenticationInfo(登录认证)
//身份认证
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { //1.拿用户名与密码 UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken; String username = token.getUsername(); //2.根据用户名拿对应的密码 String password = getByName(username); if(password==null){ return null; //返回空代表用户名有问题 } //返回认证信息 //准备盐值 ByteSource salt = ByteSource.Util.bytes("itsource"); //密码是shiro自己进行判断 SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(username,password,salt,getName()); return authenticationInfo; } //授权
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) { //拿到用户名 Principal:主体(用户对象/用户名) String username = (String)principalCollection.getPrimaryPrincipal(); //拿到角色 Set<String> roles = findRolesBy(username); //拿到权限 Set<String> permis = findPermsBy(username); //把角色权限交给用户 SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(); authorizationInfo.setRoles(roles); authorizationInfo.setStringPermissions(permis); return authorizationInfo; } 注意:如果我们的密码加密，应该怎么判断(匹配器)
//一.创建我们自己的Realm
MyRealm myRealm = new MyRealm(); //创建一个凭证匹配器(无法设置盐值) HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(); // 使用MD5的方式比较密码 matcher.setHashAlgorithmName("md5"); // 设置编码的迭代次数 matcher.setHashIterations(10); //设置凭证匹配器(加密方式匹配) myRealm.setCredentialsMatcher(matcher); 5.集成Spring
去找：shiro-root-1.4.0-RC2\samples\spring
5.1 导包
<!-- shiro的支持包 --><dependency><groupId>org.apache.shiro</groupId> <artifactId>shiro-all</artifactId> <version>1.4.0</version> <type>pom</type> </dependency> <!-- shiro与Spring的集成包 --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.4.0</version> </dependency> 5.2 web.xml
这个过滤器是一个代码(只关注它的名称)
<filter><filter-name>shiroFilter</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> <init-param> <param-name>targetFilterLifecycle</param-name> <param-value>true</param-value> </init-param> </filter> <filter-mapping> <filter-name>shiroFilter</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> 5.3 application-shiro.xml
在咱们的application引入
<import resource="classpath:applicationContext-shiro.xml" />
是从案例中拷备过来，进行了相应的修改
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"> <!-- 创建securityManager这个核心对象 --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <!-- 设置一个realm进去 --> <property name="realm" ref="jpaRealm"/> </bean> <!-- 被引用的realm(一定会写一个自定义realm) --> <bean id="jpaRealm" class="cn.itsource.aisell.shiro.JpaRealm"> <!-- 为这个realm设置相应的匹配器 --> <property name="credentialsMatcher"> <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"> <!-- 设置加密方式 --> <property name="hashAlgorithmName" value="md5"/> <!-- 设置加密次数 --> <property name="hashIterations" value="10" /> </bean> </property> </bean> <!-- 可以让咱们的权限判断支持【注解】方法 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager"/> </bean> <!-- 真正实现权限的过滤器 它的id名称和web.xml中的过滤器名称一样 --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager"/> <!-- 登录路径:如果没有登录，就会跳到这里来 --> <property name="loginUrl" value="/s/login.jsp"/> <!-- 登录成功后的跳转路径 --> <property name="successUrl" value="/s/main.jsp"/> <!-- 没有权限跳转的路径 --> <property name="unauthorizedUrl" value="/s/unauthorized.jsp"/> <!-- anon:这个路径不需要登录也可以访问 authc:需要登录才可以访问 perms[depts:index]:做权限拦截 咱们以后哪些访问有权限拦截,需要从数据库中读取 --> <!-- <property name="filterChainDefinitions"> <value> /s/login.jsp = anon /login = anon /s/permission.jsp = perms[user:index] /depts/index = perms[depts:index] /** = authc </value> </property> --> <property name="filterChainDefinitionMap" ref="filterChainDefinitionMap" /> </bean> <!-- 实例工厂设置 --> <bean id="filterChainDefinitionMap" factory-bean="filterChainDefinitionMapFactory" factory-method="createFilterChainDefinitionMap" /> <!-- 创建可以拿到权限map的bean --> <bean id="filterChainDefinitionMapFactory" class="cn.itsource.aisell.shiro.FilterChainDefinitionMapFactory" /> </beans> 5.4 获取Map过滤
注意，返回的Map必需是有序的（LinkedHashMap）
public class FilterChainDefinitionMapFactory {/*** 后面这个值会从数据库中来拿* /s/login.jsp = anon* /login = anon* /s/permission.jsp = perms[user:index]* /depts/index = perms[depts:index]* /** = authc*/public Map<String,String> createFilterChainDefinitionMap(){ //注:LinkedHashMap是有序的 Map<String,String> filterChainDefinitionMap = new LinkedHashMap<>(); filterChainDefinitionMap.put("/s/login.jsp", "anon"); filterChainDefinitionMap.put("/login", "anon"); filterChainDefinitionMap.put("/s/permission.jsp", "perms[user:index]"); filterChainDefinitionMap.put("/depts/index", "perms[depts:index]"); filterChainDefinitionMap.put("/**", "authc"); return filterChainDefinitionMap; } }
