Springboot整合Shiro实现登录验证

痛定思痛。 2023-01-19 14:55 52阅读 0赞

# Springboot整合Shiro实现登录验证 #

**1** **关于Shiro**

Apache Shiro 是一个Java的安全框架，主要有三个核心的组件：

1.  Subject：指当前的操作用户。
2.  SecurityManager：安全管理器，Shiro通过它来管理内部组件。
3.  Realm：用于权限的验证，需要自己实现。

**2** **步骤**

首先引入Shiro的maven：

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:414.8pt;"> &lt;!--整合shiro--&gt; &lt;dependency&gt; &nbsp;&nbsp;&nbsp; &lt;groupId&gt;org.apache.shiro&lt;/groupId&gt; &nbsp;&nbsp;&nbsp; &lt;artifactId&gt;shiro-spring-boot-web-starter&lt;/artifactId&gt; &nbsp;&nbsp;&nbsp; &lt;version&gt;1.4.0&lt;/version&gt; &lt;/dependency&gt; </td> 
 </tr> 
 </tbody> 
</table>

在application.properties里添加Shrio的配置信息：

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:414.8pt;"> <pre style="margin-left:0cm;">#1.第一行表示是否允许将sessionld 放到cookie 中 shiro.sessionManager.sessionIdCookieEnabled=true #2第二行表示是否允许将sessionld 放到Url地址拦中 shiro.sessionManager.sessionIdUrlRewritingEnabled=true #3.第三行表示访问未获授权的页面时，默认的跳转路径 shiro.unauthorizedUrl=/login #4.第四行表示开启shiro shiro.web.enabled=true #5.第五行表示登录成功的跳转页面 shiro.successUrl=/index #6.第六行表示登录页面 shiro.loginUrl=/doLogin</pre> </td> 
 </tr> 
 </tbody> 
</table>

需要实现一个Realme类，继承AuthorizingRealm，并实现它的方法，其中一个是AuthorizationInfo，需要自己写对于权限的管理，另一个是AuthenticationInfo，这里是写登录验证。具体代码如下：

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:414.8pt;"> <pre style="margin-left:0cm;">public class UserRealm extends AuthorizingRealm {

&nbsp;&nbsp;&nbsp; @Autowired

&nbsp;&nbsp;&nbsp; private StudentServiceImpl studentService;</pre> <pre style="margin-left:0cm;">
&nbsp;&nbsp;&nbsp; @Override

&nbsp;&nbsp;&nbsp; protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return null;

&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp; @Override

&nbsp;&nbsp;&nbsp; protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; String username = authenticationToken.getPrincipal().toString();

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Optional&lt;Student&gt; studentOptional = studentService.findStudentBySno(username);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; if (studentOptional.isPresent()) {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Student student = studentOptional.get();

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return new SimpleAuthenticationInfo(username, student.getPassword(), ByteSource.Util.bytes(username), getName());

}

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; throw new UnknownAccountException("不存在");

&nbsp;&nbsp;&nbsp; }

}</pre> </td> 
 </tr> 
 </tbody> 
</table>

登录验证是先获取到username，然后查到该用户的相关信息，如果不存在则返回一个UnknownAccountException异常。存在则返回一个SimpleAuthenticationInfo，参数是username、数据库查到的密码、还有盐值和用户名。接着需要配置Shiro：

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:414.8pt;"> <pre style="margin-left:0cm;">@Configuration

public class ShiroConfig {

&nbsp;&nbsp;&nbsp; @Bean

&nbsp;&nbsp;&nbsp; UserRealm userRealm() {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return new UserRealm();

&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp; @Bean

&nbsp;&nbsp;&nbsp; DefaultWebSecurityManager securityManager() {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; defaultWebSecurityManager.setRealm(userRealm());

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return defaultWebSecurityManager;

&nbsp;&nbsp;&nbsp; }

&nbsp;&nbsp;&nbsp; @Bean

&nbsp;&nbsp;&nbsp; ShiroFilterChainDefinition shiroFilterChainDefinition() {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; DefaultShiroFilterChainDefinition defaultShiroFilterChainDefinition = new DefaultShiroFilterChainDefinition();

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; defaultShiroFilterChainDefinition.addPathDefinition("/doLogin", "anon");

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; defaultShiroFilterChainDefinition.addPathDefinition("/**", "authc");

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; return defaultShiroFilterChainDefinition;

&nbsp;&nbsp;&nbsp; }

}</pre> &nbsp; </td> 
 </tr> 
 </tbody> 
</table>

将刚刚的UserReaml交给SecurityManager进行管理。并且设置过滤器，比如哪些接口是需要登录后或者某种权限才能访问的。其中 anon 表示匿名即游客就能访问，这里设置了登录接口。authc是需要登录验证后才能访问。除了这两种还有其他：authcBasic、logout、noSessionCreation、perms、port、rest、roles、ssl、user。如果用户开启了RememberMe，则当用户关闭浏览器，下次访问时，不再是authc，而是user。因为authc是需要重新认证的。User就表示该用户曾经被Shiro记住过。

接下来写LoginController：

<table> 
 <tbody> 
 <tr> 
 <td style="vertical-align:top;width:414.8pt;"> <pre style="margin-left:0cm;">@PostMapping("/doLogin")

public Result&lt;Object&gt; doLogin(@RequestBody UserToken userToken) {

&nbsp;&nbsp;&nbsp; Subject subject = SecurityUtils.getSubject();

&nbsp;&nbsp;&nbsp; String pwd = ShiroKit.mds(String.valueOf(userToken.getPassword()), userToken.getUsername());

&nbsp;&nbsp;&nbsp; UsernamePasswordToken token = new UsernamePasswordToken(userToken.getUsername(), pwd);

&nbsp;&nbsp;&nbsp; String sessionId = (String) subject.getSession().getId();

&nbsp;&nbsp;&nbsp; try {

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; subject.login(token);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Map&lt;String, String&gt; map = new HashMap&lt;String, String&gt;();

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; map.put("sessionId", sessionId);

&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; map.put("username", userToken.getUsername());