Shiro框架介绍与使用 -- 知识铺

1

@Test public void authen() { //认证的发起者(subject)， SecurityManager， Realm //1. 准备Realm（基于内存存储用户信息） SimpleAccountRealm realm = new SimpleAccountRealm(); realm.addAccount("admin", "admin", "超级管理员", "商家"); //2. 准备SecurityManager DefaultSecurityManager securityManager = new DefaultSecurityManager(); //3. SecurityManager和Realm建立连接 securityManager.setRealm(realm); //4. subject和SecurityManager建立联系 SecurityUtils.setSecurityManager(securityManager); //5. 声明subject Subject subject = SecurityUtils.getSubject(); //6. 发起认证 subject.login(new UsernamePasswordToken("admin", "admin")); // 如果认证时，用户名错误，抛出：org.apache.shiro.authc.UnknownAccountException异常 // 如果认证时，密码错误，抛出：org.apache.shiro.authc.IncorrectCredentialsException: //7. 判断是否认证成功 System.out.println(subject.isAuthenticated()); //8. 退出登录后再判断 // subject.logout(); // System.out.println("logout方法执行后，认证的状态：" + subject.isAuthenticated()); //9. 授权是在认证成功之后的操作！！！ // SimpleAccountRealm只支持角色的授权 System.out.println("是否拥有超级管理员角色：" + subject.hasRole("超级管理员")); subject.checkRole("商家"); // check方法校验角色时，如果没有指定角色，会抛出异常：org.apache.shiro.authz.UnauthorizedException: Subject does not have role [角色信息] }

1

[users] username=password,role1,role2 admin=admin,超级管理员,运营 [roles] role1=perm1,perm2 超级管理员=user:add,user:update,user:delete

1

@Test public void authen(){ //1. 构建IniRealm IniRealm realm = new IniRealm("classpath:shiro.ini"); //2. 构建SecurityManager绑定Realm DefaultSecurityManager securityManager = new DefaultSecurityManager(); securityManager.setRealm(realm); //3. 基于SecurityUtils绑定SecurityManager并声明subject SecurityUtils.setSecurityManager(securityManager); Subject subject = SecurityUtils.getSubject(); //4. 认证操作 subject.login(new UsernamePasswordToken("admin","admin")); //5. 角色校验 // 超级管理员 System.out.println(subject.hasRole("超级管理员")); subject.checkRole("运营"); //6. 权限校验 System.out.println(subject.isPermitted("user:update")); // 如果没有响应的权限，就抛出异常：UnauthorizedException: Subject does not have permission [user:select] subject.checkPermission("user:delete"); }

1

@Test public void authen(){ //1. 构建IniRealm JdbcRealm realm = new JdbcRealm(); DruidDataSource dataSource = new DruidDataSource(); dataSource.setDriverClassName("com.mysql.jdbc.Driver"); dataSource.setUrl("jdbc:mysql:///shiro"); dataSource.setUsername("root"); dataSource.setPassword("root"); realm.setDataSource(dataSource); realm.setPermissionsLookupEnabled(true); //2. 构建SecurityManager绑定Realm DefaultSecurityManager securityManager = new DefaultSecurityManager(); securityManager.setRealm(realm); //3. 基于SecurityUtils绑定SecurityManager并声明subject SecurityUtils.setSecurityManager(securityManager); Subject subject = SecurityUtils.getSubject(); //4. 认证操作 subject.login(new UsernamePasswordToken("admin","admin")); //5. 授权操作(角色) System.out.println(subject.hasRole("超级管1理员")); //6. 授权操作(权限) System.out.println(subject.isPermitted("user:add")); }

1

DROP TABLE IF EXISTS `roles_permissions`; CREATE TABLE `roles_permissions` ( `id` int(11) NOT NULL AUTO_INCREMENT, `permission` varchar(128) NOT NULL, `role_name` varchar(128) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4; -- ---------------------------- -- Records of roles_permissions -- ---------------------------- INSERT INTO `roles_permissions` VALUES ('1', 'user:add', '超级管理员'); INSERT INTO `roles_permissions` VALUES ('2', 'user:update', '超级管理员'); INSERT INTO `roles_permissions` VALUES ('3', 'user:select', '运营'); -- ---------------------------- -- Table structure for `users` -- ---------------------------- DROP TABLE IF EXISTS `users`; CREATE TABLE `users` ( `id` int(11) NOT NULL AUTO_INCREMENT, `username` varchar(32) NOT NULL, `password` varchar(32) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB AUTO_INCREMENT=2 DEFAULT CHARSET=utf8mb4; -- ---------------------------- -- Records of users -- ---------------------------- INSERT INTO `users` VALUES ('1', 'admin', 'admin'); -- ---------------------------- -- Table structure for `user_roles` -- ---------------------------- DROP TABLE IF EXISTS `user_roles`; CREATE TABLE `user_roles` ( `id` int(11) NOT NULL AUTO_INCREMENT, `role_name` varchar(128) NOT NULL, `username` varchar(32) NOT NULL, PRIMARY KEY (`id`) ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8mb4; -- ---------------------------- -- Records of user_roles -- ---------------------------- INSERT INTO `user_roles` VALUES ('1', '超级管理员', 'admin'); INSERT INTO `user_roles` VALUES ('2', '运营', 'admin');

1

/** 声明POJO类，继承AuthorizingRealm 重写doGetAuthenticationInfo方法（认证） 认证方法，只需要完成用户名校验即可，密码校验由Shiro内部完成 @param token 用户传入的用户名和密码 @return @throws AuthenticationException */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { //1. 基于Token获取用户名 String username = (String) token.getPrincipal(); //2. 判断用户名（非空） if(StringUtils.isEmpty(username)){ // 返回null，会默认抛出一个异常，org.apache.shiro.authc.UnknownAccountException return null; } //3. 如果用户名不为null，基于用户名查询用户信息 User user = this.findUserByUsername(username); //4. 判断user对象是否为null if(user == null){ return null; } //5. 声明AuthenticationInfo对象，并填充用户信息 SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user,user.getPassword(),"CustomRealm!!"); //6. 返回info return info; } // 模拟数据库操作 private User findUserByUsername(String username) { if("admin".equals(username)){ User user = new User(); user.setId(1); user.setUsername("admin"); user.setPassword("admin"); return user; } return null; } * 重写doGetAuthenticationInfo方法（密码加密加盐）java { HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(); matcher.setHashAlgorithmName("MD5"); matcher.setHashIterations(1024); this.setCredentialsMatcher(matcher); } /* * 认证方法，只需要完成用户名校验即可，密码校验由Shiro内部完成 * @param token 用户传入的用户名和密码 * @return * @throws AuthenticationException / @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { //1. 基于Token获取用户名 String username = (String) token.getPrincipal(); //2. 判断用户名（非空） if(StringUtils.isEmpty(username)){ // 返回null，会默认抛出一个异常，org.apache.shiro.authc.UnknownAccountException return null; } //3. 如果用户名不为null，基于用户名查询用户信息 User user = this.findUserByUsername(username); //4. 判断user对象是否为null if(user == null){ return null; } //5. 声明AuthenticationInfo对象，并填充用户信息 SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user,user.getPassword(),"CustomRealm!!"); // 设置盐！ info.setCredentialsSalt(ByteSource.Util.bytes(user.getSalt())); //6. 返回info return info;

1

// 模拟数据库操作 private User findUserByUsername(String username) { if("admin".equals(username)){ User user = new User(); user.setId(1); user.setUsername("admin"); user.setPassword("1ebc4dcaf1e21b814ece65f27531f1a9" ); user.setSalt("weruiothergjkdfnbgjkdfngjkdf"); return user; } return null; } * 重写doGetAuthorizationInfo方法（授权）java // 授权方法，授权是在认证之后的操作 @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { //1. 获取认证用户的信息 User user = (User) principals.getPrimaryPrincipal(); //2. 基于用户信息获取当前用户拥有的角色。 Set<String> roleSet = this.findRolesByUser(); //3. 基于用户拥有的角色查询权限信息 Set<String> permSet = this.findPermsByRoleSet(roleSet); //4. 声明AuthorizationInfo对象作为返回值，传入角色信息和权限信息 SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); info.setRoles(roleSet); info.setStringPermissions(permSet); //5. 返回 return info;

1

private Set findPermsByRoleSet(Set roleSet) { Set set = new HashSet<>(); set.add("user:add"); set.add("user:update"); return set; } private Set findRolesByUser() { Set set = new HashSet<>(); set.add("超级管理员"); set.add("运营"); return set; } ```

1

@Configuration public class ShiroConfig { @Bean public DefaultWebSecurityManager securityManager(ShiroRealm realm){ DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(realm); return securityManager; } @Bean public DefaultShiroFilterChainDefinition shiroFilterChainDefinition(){ DefaultShiroFilterChainDefinition shiroFilterChainDefinition = new DefaultShiroFilterChainDefinition(); Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); filterChainDefinitionMap.put("/login.html","anon"); filterChainDefinitionMap.put("/user/**","anon"); filterChainDefinitionMap.put("/**","authc"); shiroFilterChainDefinition.addPathDefinitions(filterChainDefinitionMap); return shiroFilterChainDefinition; } }

1

public enum DefaultFilter { // .... perms(PermissionsAuthorizationFilter.class), roles(RolesAuthorizationFilter.class), // .... } filterChainDefinitionMap.put("/item/select","roles[超级管理员,运营]"); filterChainDefinitionMap.put("/item/delete","perms[item:delete,item:insert]");

1

// 构建管理SessionDAO的SessionManager @Bean public SessionManager sessionManager(SessionDAO sessionDAO) { DefaultWebSessionManager sessionManager = new DefaultWebSessionManager(); sessionManager.setSessionDAO(sessionDAO); return sessionManager; } @Bean public DefaultWebSecurityManager securityManager(ShiroRealm realm,SessionManager sessionManager){ DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(realm); // 将使用MemorySessionDAO的SessionManager注入到SecurityManager securityManager.setSessionManager(sessionManager); return securityManager; }

1

@Override protected Session retrieveSession(SessionKey sessionKey) throws UnknownSessionException { // 通过sessionKey获取sessionId Serializable sessionId = getSessionId(sessionKey); // 将sessionKey转为WebSessionKey if(sessionKey instanceof WebSessionKey){ WebSessionKey webSessionKey = (WebSessionKey) sessionKey; // 获取到request域 ServletRequest request = webSessionKey.getServletRequest(); // 通过request尝试获取session信息 Session session = (Session) request.getAttribute(sessionId + ""); if(session != null){ System.out.println("从request域中获取session信息"); return session; }else{ session = retrieveSessionFromDataSource(sessionId); if (session == null) { //session ID was provided, meaning one is expected to be found, but we couldn't find one: String msg = "Could not find session with ID [" + sessionId + "]"; throw new UnknownSessionException(msg); } System.out.println("Redis---doReadSession"); request.setAttribute(sessionId + "",session); return session; } } return null; }

1

* 配置DefaultRedisWebSessionManager到SecurityManager中 java @Bean public SessionManager sessionManager(RedisSessionDAO sessionDAO) { DefaultRedisWebSessionManager sessionManager = new DefaultRedisWebSessionManager(); sessionManager.setSessionDAO(sessionDAO); return sessionManager; }

1

@Component public class RedisCache<K, V> implements Cache<K, V> { @Autowired private RedisTemplate redisTemplate; private final String CACHE_PREFIX = "cache:"; /** * 获取授权缓存信息 * @param k * @return * @throws CacheException */ @Override public V get(K k) throws CacheException { V v = (V) redisTemplate.opsForValue().get(CACHE_PREFIX + k); if(v != null){ redisTemplate.expire(CACHE_PREFIX + k,15, TimeUnit.MINUTES); } return v; } /** * 存放缓存信息 * @param k * @param v * @return * @throws CacheException */ @Override public V put(K k, V v) throws CacheException { redisTemplate.opsForValue().set(CACHE_PREFIX + k,v,15,TimeUnit.MINUTES); return v; } /** * 清空当前缓存 * @param k * @return * @throws CacheException */ @Override public V remove(K k) throws CacheException { V v = (V) redisTemplate.opsForValue().get(CACHE_PREFIX + k); if(v != null){ redisTemplate.delete(CACHE_PREFIX + k); } return v; } /** * 清空全部的授权缓存 * @throws CacheException */ @Override public void clear() throws CacheException { Set keys = redisTemplate.keys(CACHE_PREFIX + "*"); redisTemplate.delete(keys); } /** * 查看有多个权限缓存信息 * @return */ @Override public int size() { Set keys = redisTemplate.keys(CACHE_PREFIX + "*"); return keys.size(); } /** * 获取全部缓存信息的key * @return */ @Override public Set<K> keys() { Set keys = redisTemplate.keys(CACHE_PREFIX + "*"); return keys; } /** * 获取全部缓存信息的value * @return */ @Override public Collection<V> values() { Set values = new HashSet(); Set keys = redisTemplate.keys(CACHE_PREFIX + "*"); for (Object key : keys) { Object value = redisTemplate.opsForValue().get(key); values.add(value); } return values; } }

1

@Component public class RedisCacheManager implements CacheManager { @Autowired private RedisCache redisCache; @Override public <K, V> Cache<K, V> getCache(String s) throws CacheException { return redisCache; } }

1

@Bean public DefaultWebSecurityManager securityManager(ShiroRealm realm, SessionManager sessionManager, RedisCacheManager redisCacheManager){ DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(realm); securityManager.setSessionManager(sessionManager); // 设置CacheManager，提供与Redis交互的Cache对象 securityManager.setCacheManager(redisCacheManager); return securityManager; }

1

public class MD5HashQueryDatabaseAuthenticationHandler extends AbstractJdbcUsernamePasswordAuthenticationHandler { @NotNull private String sql; @NotNull private String saltSql; private final Integer hashIterations = 1024; /** * {@inheritDoc} */ @Override protected final HandlerResult authenticateUsernamePasswordInternal(final UsernamePasswordCredential credential) throws GeneralSecurityException, PreventedException { // 获取用户输入的用户名 final String username = credential.getUsername(); // 获取用户输入的密码 final String encryptedPassword = this.getPasswordEncoder().encode(credential.getPassword()); try { // 基于用户名查询数据库的密码 final String dbPassword = getJdbcTemplate().queryForObject(this.sql, String.class, username); // 基于用户名查询当前用户的salt final String salt = getJdbcTemplate().queryForObject(this.saltSql, String.class, username); // 将用户输入的密码进行加密和加盐操作~ final String password = new Md5Hash(encryptedPassword, salt, hashIterations).toString(); // 比较密码 if (!dbPassword.equals(password)) { throw new FailedLoginException("Password does not match value on record."); } } catch (final IncorrectResultSizeDataAccessException e) { if (e.getActualSize() == 0) { throw new AccountNotFoundException(username + " not found with SQL query"); } else { throw new FailedLoginException("Multiple records found for " + username); } } catch (final DataAccessException e) { throw new PreventedException("SQL exception while executing query for " + username, e); } return createHandlerResult(credential, this.principalFactory.createPrincipal(username), null); } /** * @param sql The sql to set. */ public void setSql(final String sql) { this.sql = sql; } /** * @param saltSql The sql to set - select salt. */ public void setSaltSql(final String saltSql) { this.saltSql = saltSql; }

1

<!--配置primaryAuthenticationHandler，QueryDatabaseAuthenticationHandler--> <bean id="primaryAuthenticationHandler" class="org.jasig.cas.adaptors.jdbc.MD5HashQueryDatabaseAuthenticationHandler"> <property name="dataSource" ref="dataSource" /> <property name="sql" value="select password from tb_user where username = ?" /> <property name="saltSql" value="select salt from tb_user where username = ?" /> </bean>

1

public class CasClient extends org.pac4j.cas.client.CasClient { public CasClient() { super(); } public CasClient(CasConfiguration configuration) { super(configuration); } @Override public RedirectAction getRedirectAction(final WebContext context) { init(); AjaxRequestResolver ajaxRequestResolver = getAjaxRequestResolver(); RedirectActionBuilder redirectActionBuilder = getRedirectActionBuilder(); // it's an AJAX request -> appropriate action if (ajaxRequestResolver.isAjax(context)) { logger.info("AJAX request detected -> returning the appropriate action"); RedirectAction action = redirectActionBuilder.redirect(context); cleanRequestedUrl(context); return ajaxRequestResolver.buildAjaxResponse(action.getLocation(), context); } // authentication has already been tried -> unauthorized final String attemptedAuth = (String) context.getSessionStore().get(context, getName() + ATTEMPTED_AUTHENTICATION_SUFFIX); if (CommonHelper.isNotBlank(attemptedAuth)) { cleanAttemptedAuthentication(context); cleanRequestedUrl(context); // 跑抛出异常，页面401,只修改这个位置！！ // throw HttpAction.unauthorized(context); return redirectActionBuilder.redirect(context); } return redirectActionBuilder.redirect(context); } private void cleanRequestedUrl(final WebContext context) { SessionStore<WebContext> sessionStore = context.getSessionStore(); if (sessionStore.get(context, Pac4jConstants.REQUESTED_URL) != null) { sessionStore.set(context, Pac4jConstants.REQUESTED_URL, ""); } } private void cleanAttemptedAuthentication(final WebContext context) { SessionStore<WebContext> sessionStore = context.getSessionStore(); if (sessionStore.get(context, getName() + ATTEMPTED_AUTHENTICATION_SUFFIX) != null) { sessionStore.set(context, getName() + ATTEMPTED_AUTHENTICATION_SUFFIX, ""); } } }