SpringBoot整合shiro框架

最新推荐文章于 2025-09-28 07:00:00 发布

原创最新推荐文章于 2025-09-28 07:00:00 发布 · 1.7k 阅读

1 ·

CC 4.0 BY-SA版权

本文详细介绍如何在Spring Boot项目中集成Apache Shiro框架，包括配置Maven依赖、编写Shiro配置类、实现自定义Realm类及配置web.xml等关键步骤。

1.导入pom依赖


		<!-- shiro -->
		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-core</artifactId>
			<version>1.4.0</version>
		</dependency>

		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-spring</artifactId>
			<version>1.4.0</version>
		</dependency>

		<dependency>
			<groupId>org.apache.shiro</groupId>
			<artifactId>shiro-ehcache</artifactId>
			<version>1.4.0</version>
		</dependency>

2.编写shiro配置类：

package com.springboot.shiro;

import java.util.LinkedHashMap;  
import java.util.Map;  
  
import org.apache.shiro.cache.ehcache.EhCacheManager;  
import org.apache.shiro.spring.LifecycleBeanPostProcessor;  
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;  
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;  
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;  
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;  
import org.springframework.context.annotation.Bean;  
import org.springframework.context.annotation.Configuration;  
  
  
@Configuration  
public class ShiroConfiguration {  
  
    private static Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();  
  
    @Bean(name = "AuthRealm")  
    public AuthRealm getShiroRealm() {  
        return new AuthRealm();  
    }  
  
    @Bean(name = "shiroEhcacheManager")  
    public EhCacheManager getEhCacheManager() {  
        EhCacheManager em = new EhCacheManager();  
        em.setCacheManagerConfigFile("classpath:ehcache-shiro.xml");  
        return em;  
    }  
  
    @Bean(name = "lifecycleBeanPostProcessor")  
    public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {  
        return new LifecycleBeanPostProcessor();  
    }  
  
    @Bean  
    public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {  
        DefaultAdvisorAutoProxyCreator daap = new DefaultAdvisorAutoProxyCreator();  
        daap.setProxyTargetClass(true);  
        return daap;  
    }  
  
    @Bean(name = "securityManager")  
    public DefaultWebSecurityManager getDefaultWebSecurityManager() {  
        DefaultWebSecurityManager dwsm = new DefaultWebSecurityManager();  
        dwsm.setRealm(getShiroRealm());
        dwsm.setCacheManager(getEhCacheManager());  
        return dwsm;  
    }  
  
    @Bean  
    public AuthorizationAttributeSourceAdvisor getAuthorizationAttributeSourceAdvisor() {  
        AuthorizationAttributeSourceAdvisor aasa = new AuthorizationAttributeSourceAdvisor();  
        aasa.setSecurityManager(getDefaultWebSecurityManager());  
        return new AuthorizationAttributeSourceAdvisor();  
    }  
  
    @Bean(name = "shiroFilter")  
    public ShiroFilterFactoryBean getShiroFilterFactoryBean() {  
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();  
        shiroFilterFactoryBean  
                .setSecurityManager(getDefaultWebSecurityManager());  
        shiroFilterFactoryBean.setLoginUrl("/tologin");  
        filterChainDefinitionMap.put("/staticfile/**", "anon");  
        filterChainDefinitionMap.put("/tologin", "anon");  
        filterChainDefinitionMap.put("/login", "anon");  
        filterChainDefinitionMap.put("/**", "authc");  
        shiroFilterFactoryBean  
                .setFilterChainDefinitionMap(filterChainDefinitionMap);  
        return shiroFilterFactoryBean;  
    }  
  
}

3.编写重写的CredentialsMatcher类（如果数据库密码没有加密可以选择不重写，使用默认的CredentialsMatcher）

package com.springboot.shiro;

import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.SimpleCredentialsMatcher;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.springframework.stereotype.Component;
@Component
public class AuthCredential extends  SimpleCredentialsMatcher{
	@Override
	public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
		//需要将token密码进行个加密处理
		UsernamePasswordToken loginToken = (UsernamePasswordToken)token;
		String password = String.valueOf(loginToken.getPassword());
		String hashPassword = password.hashCode()+"";
		//将密码存入令牌中
		loginToken.setPassword(hashPassword.toCharArray());
		//将用户输入的内容和真实数据做匹配
		return super.doCredentialsMatch(loginToken, info);
	}
}

4.编写realm类

package com.springboot.shiro;
import java.util.List;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.CredentialsMatcher;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import com.springboot.chen.service.UserpService;
import com.springboot.people.pojo.Userp;

public class AuthRealm extends AuthorizingRealm{
	@Autowired
	private CredentialsMatcher cm;
	@Autowired
	private UserpService UserpService;
	//注入自己重写的CredentialsMatcher
	public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
		super.setCredentialsMatcher(cm);
	}	
	//权限管理
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
		//获取用户真实对象
		Userp user = (Userp)SecurityUtils.getSubject().getPrincipal();
		List<String> list = UserpService.findPrivilegeList(user.getUserId());
		System.err.println("用户权限："+list);
		//为权限控制提供真实数据
		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		info.addStringPermissions(list);
		return info;
	}
	//登录认证
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		
		//需要为shiro安全中提供真实的用户数据，需要根据用户名擦和讯user对象
		UsernamePasswordToken upToken = (UsernamePasswordToken)token;
		String username = upToken.getUsername();
		//用户名必须唯一
		Userp userp = UserpService.findUserByUserName(username); 
		/*
		 * 1.principal		表示用户真实的对象
		 * 2.credentials	真实的密码
		 * 3.realmName		realm的名称
		 */
		AuthenticationInfo info = new SimpleAuthenticationInfo(userp, userp.getPassword(),this.getName());
		return info;
	}

}

5.配置web.xm

<filter-mapping>
		<filter-name>encodingFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>
  
  	<filter>
		<filter-name>shiroFilter</filter-name>
		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
		<init-param>
			<!-- spring将过滤器的声明周期交给web容器管理 -->
			<param-name>targetFilterLifecycle</param-name>
			<param-value>true</param-value>
		</init-param>
	</filter>

	<filter-mapping>
		<filter-name>shiroFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>