Shiro

 Realm相当于数据源，SecurityManager从Reaml获取相应的用户进行比较

Shiro的架构

• Subject：任何可以与用户交互的用户
• SecurityManager：所有具体的交互都由SecurityManager控制，它管理所有的Subject，切负责进行认证，授权，会话即缓存管理
• Authenticator：认证器，负责Subject的认证，可以自定义实现。可以使用认证策略来定义什么情况下算用户认证通过
• Authorizer： 授权器，即访问控制器，确定主体是否有权限进行相应的操作。
• Realm：用于获取安全实体，可以有一个或多个。一般在用于中都需要自己实现Realm
• SessionManager：管理Session生命周期的组件。
• SessionDao：代表SessionManager执行Session持久化操作
• CacheManager：缓存控制器，用来管理用户，角色，权限等缓存
• Cryptography：密码模块，加密解密。

初步使用

导入依赖

<dependencies>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.4.1</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-simple</artifactId>
            <version>1.7.21</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
            <version>1.7.21</version>
        </dependency>
        <dependency>
            <groupId>commons-logging</groupId>
            <artifactId>commons-logging</artifactId>
            <version>1.2</version>
        </dependency>
</dependencies>

编写Shiro配置

shiro.ini

[users]
root = secret, admin
guest = guest, guest
presidentskroob = 12345, president
darkhelmet = ludicrousspeed, darklord, schwartz
lonestarr = vespa, goodguy, schwartz
[roles]
admin = *
schwartz = lightsaber:*
goodguy = winnebago:drive:eagle5

log4j.properties

log4j.rootLogger=INFO, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n
# General Apache libraries
log4j.logger.org.apache=WARN
# Spring
log4j.logger.org.springframework=WARN
# Default Shiro logging
log4j.logger.org.apache.shiro=INFO
# Disable verbose logging
log4j.logger.org.apache.shiro.util.ThreadContext=WARN
log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

使用shiro API

package com.deng;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class Quickstart {
    private static final transient Logger log =
            LoggerFactory.getLogger(Quickstart.class);

    public static void main(String[] args) {
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        SecurityManager securityManager = factory.getInstance();
        SecurityUtils.setSecurityManager(securityManager);
        Subject currentUser = SecurityUtils.getSubject();
        Session session = currentUser.getSession();
        session.setAttribute("someKey", "aValue");
        String value = (String) session.getAttribute("someKey");
        if (value.equals("aValue")) {
            log.info("Retrieved the correct value! [" + value + "]");
        }
        if (!currentUser.isAuthenticated()) {
            UsernamePasswordToken token = new
                    UsernamePasswordToken("lonestarr", "vespa");
            token.setRememberMe(true);
            try {
                currentUser.login(token);
            } catch (UnknownAccountException uae) {
                log.info("There is no user with username of " +
                        token.getPrincipal());
            } catch (IncorrectCredentialsException ice) {
                log.info("Password for account " +
                        token.getPrincipal() + " was incorrect!");
            } catch (LockedAccountException lae) {
                log.info("The account for username " +
                        token.getPrincipal() + " is locked. " +
                        "Please contact your administrator to unlock it.");
            } catch (AuthenticationException ae) {
            }
        }
        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
        if (currentUser.hasRole("schwartz")) {
            log.info("May the Schwartz be with you!");
        } else {
            log.info("Hello, mere mortal.");
        }
        if (currentUser.isPermitted("lightsaber:wield")) {
            log.info("You may use a lightsaber ring. Use it wisely.");
        } else {
            log.info("Sorry, lightsaber rings are for schwartz masters only.");
        }
        if (currentUser.isPermitted("winnebago:drive:eagle5")) {
            log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'. " +
                    "Here are the keys - have fun!");
        } else {
            log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
        }
        currentUser.logout();
        System.exit(0);
    }
}

解析上面的代码：

1.通过工厂模式创建SecurityManager实例对象

Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
SecurityManager securityManager = factory.getInstance();
SecurityUtils.setSecurityManager(securityManager);

2.获取当前的subject

Subject currentUser = SecurityUtils.getSubject();

3.session操作

Session session = currentUser.getSession();//获取session
session.setAttribute("someKey", "aValue");//设置session的值
String value = (String) session.getAttribute("someKey");//从session中获取值
if (value.equals("aValue")) {//判断session中是否存在值
       log.info("Retrieved the correct value! [" + value + "]");
}

4.用户认证功能

 if (!currentUser.isAuthenticated()) {//当前用户是否已经认证
            //将用户名和密码封装为UsernamePasswordToken
            UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
            //开启记住我功能
            token.setRememberMe(true);
            try {
                currentUser.login(token);//执行登录
            } catch (UnknownAccountException uae) {//如果没有指定用户，抛出该异常
                log.info("There is no user with username of " +
                        token.getPrincipal());
            } catch (IncorrectCredentialsException ice) {//如果密码不对，抛出该异常
                log.info("Password for account " +
                        token.getPrincipal() + " was incorrect!");
            } catch (LockedAccountException lae) {//如果用户被锁定抛出该异常
                log.info("The account for username " +
                        token.getPrincipal() + " is locked. " +
                        "Please contact your administrator to unlock it.");
            } catch (AuthenticationException ae) {//认证异常，上面的异常都是其子类

            }
        }
        //getPrincipal()获取标识主体
        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");

5.角色检查

       //检测用户是否拥有某一角色
        if (currentUser.hasRole("schwartz")) {
            log.info("May the Schwartz be with you!");
        } else {
            log.info("Hello, mere mortal.");
        }

6.权限检查

       //测试用户是否具有某一权限，行为
        if (currentUser.isPermitted("lightsaber:wield")) {
            log.info("You may use a lightsaber ring. Use it wisely.");
        } else {
            log.info("Sorry, lightsaber rings are for schwartz masters only.");
        }
        //测试用户是否具有某一权限，行为，比上面更加具体
        if (currentUser.isPermitted("winnebago:drive:eagle5")) {
            log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'. " +
                    "Here are the keys - have fun!");
        } else {
            log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
        }

7.注销

currentUser.logout();

SpringBoot集成

导入Shiro和Spring整合的依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.0</version>
</dependency>

Realm是Shiro的连接数据，创建Realm类继承AuthorizingRealm类，重写认证和授权逻辑

public class UserRealm extends AuthorizingRealm {
    //执行授权逻辑
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了授权逻辑");
        return null;
    }
    //执行认证逻辑
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了认证逻辑");
        return null;
    }
}

编写ShiroConfig配置类，对请求进行过滤

@Configuration
public class ShiroConfig {
    //创建ShiroFilterFactoryBean
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager")DefaultWebSecurityManager securityManager){
        ShiroFilterFactoryBean shiroFilterFactoryBean=new ShiroFilterFactoryBean();
        //设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        /*添加内置过滤器，常用过滤器如下：
           anon:无需认证就可以访问
           authc：必须认证才可以访问
           user:如果使用了记住我功能就可以直接访问
           perms:拥有某个资源权限才可以访问
           role：拥有某个角色才可以访问
        */
        Map<String,String> filterMap=new LinkedHashMap<>();
        filterMap.put("/user/add","authc");
        filterMap.put("/user/update","authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
        //配置跳转页面
        shiroFilterFactoryBean.setLoginUrl("/toLogin");
        return shiroFilterFactoryBean;
    }
    //创建DefaultWebSecurityManager
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm")UserRealm userRealm){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //关联Realm
        securityManager.setRealm(userRealm);
        return securityManager;
    }
    //创建realm
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }

}

登录认证操作

Controller

@Controller
public class LoginController {
    //登录认证
    @RequestMapping("/login")
    public String login(String username, String password, Model model){
        //获取Subject
        Subject subject=SecurityUtils.getSubject();
        //封装用户数据
        UsernamePasswordToken token=new UsernamePasswordToken(username,password);
        //执行登录操作
        try{
            subject.login(token);//登录成功就返回首页
            return "index";
        }catch (UnknownAccountException e){
            model.addAttribute("msg","用户名不存在");
            return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密码错误");
            return "login";
        }
    }
}

在登录认证是会执行Realm里面的认证逻辑

编写Realm的认证逻辑

 //执行认证逻辑
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了认证逻辑");
        String name="root";
        String password="123456";
        //将token强转为UsernamePasswordToken
        UsernamePasswordToken token=(UsernamePasswordToken)authenticationToken;
        //判断用户名,不存在直接返回
        if(!token.getUsername().equals(name)){
            return  null;
        }
        //验证密码，使用AuthenticationInfo实现类SimpleAuthenticationInfo,shiro会自动验证密码
        return new SimpleAuthenticationInfo("",password,"");
    }

 整合数据库

配置好mybatis查询逻辑

改造Realm

 //执行认证逻辑
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("执行了认证逻辑");
        //将token强转为UsernamePasswordToken
        UsernamePasswordToken token=(UsernamePasswordToken)authenticationToken;
        User user=userService.queryUserByName(token.getUsername());
        //判断用户名,不存在直接返回
        if(user==null){
            return  null;
        }
        //验证密码，使用AuthenticationInfo实现类SimpleAuthenticationInfo,shiro会自动验证密码
        return new SimpleAuthenticationInfo("",user.getPwd(),"");
    }

修改当前Realm的CredentialsMatcher属性可以设置加密算法

用户授权操作

在配置类中给资源设置权限

filterMap.put("/user/add","perms[user:add]");

设置没有权限时执行逻辑

//配置未授权页面
 shiroFilterFactoryBean.setUnauthorizedUrl("/noauth");

此时用户登录后没有访问/user/add的权限

给用户授权，编写Realm

 //执行授权逻辑
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了授权逻辑");
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        //添加资源的授权字符串
        info.addStringPermission("user:add");
        return info;
    }

实际开发中可以在数据库增加一个字段，来获取不同用户的权限

@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
           System.out.println("执行了=>授权逻辑PrincipalCollection");
           //给资源进行授权
           SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
           //添加资源的授权字符串
           //info.addStringPermission("user:add");
           Subject subject = SecurityUtils.getSubject(); //获得当前对象
           User currentUser = (User) subject.getPrincipal(); //拿到User对象
           info.addStringPermission(currentUser.getPerms()); //设置权限
           return info;
}