SpringBoot中Shiro使用身份认证配置

1. 配置pom.xml

   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>com.xayuli</groupId>
       <artifactId>nettels</artifactId>
       <version>0.0.1-SNAPSHOT</version>
       <packaging>war</packaging>
   
       <name>nettels</name>
       <description>Demo project for Spring Boot</description>
   
       <parent>
           <groupId>org.springframework.boot</groupId>
           <artifactId>spring-boot-starter-parent</artifactId>
           <version>2.0.4.RELEASE</version>
           <relativePath/> <!-- lookup parent from repository -->
       </parent>
   
       <properties>
           <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
           <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
           <java.version>1.8</java.version>
       </properties>
   
       <dependencies>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-data-jpa</artifactId>
           </dependency>
           <!--<dependency>-->
               <!--<groupId>mysql</groupId>-->
               <!--<artifactId>mysql-connector-java</artifactId>-->
           <!--</dependency>-->
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-web</artifactId>
               <!--<exclusions>-->
                   <!--<exclusion>-->
                       <!--<groupId>org.springframework.boot</groupId>-->
                       <!--<artifactId>spring-boot-starter-tomcat</artifactId>-->
                   <!--</exclusion>-->
               <!--</exclusions>-->
           </dependency>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-test</artifactId>
               <scope>test</scope>
           </dependency>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-devtools</artifactId>
               <optional>true</optional> <!-- 这个需要为 true 热部署才有效 -->
           </dependency>
           <dependency>
               <groupId>org.apache.shiro</groupId>
               <artifactId>shiro-spring</artifactId>
               <version>1.4.0</version>
           </dependency>
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-thymeleaf</artifactId>
           </dependency>
           <dependency>
               <groupId>com.microsoft.sqlserver</groupId>
               <artifactId>sqljdbc4</artifactId>
               <version>4.0</version>
               <!--<scope>test</scope>-->
           </dependency>
           <!--声明spring boot内嵌tomcat的作用范围  在运行时不起作用-->
           <dependency>
               <groupId>org.springframework.boot</groupId>
               <artifactId>spring-boot-starter-tomcat</artifactId>
               <scope>provided</scope>
           </dependency>
           <dependency>
               <groupId>javax.servlet</groupId>
               <artifactId>javax.servlet-api</artifactId>
               <version>3.1.0</version>
               <scope>provided</scope>
           </dependency>
       </dependencies>
   
       <build>
           <plugins>
               <plugin>
                   <groupId>org.springframework.boot</groupId>
                   <artifactId>spring-boot-maven-plugin</artifactId>
               </plugin>
           </plugins>
           <finalName>nettels</finalName>
       </build>
   
   
   
       <repositories>
           <repository>
               <id>spring-snapshots</id>
               <name>Spring Snapshots</name>
               <url>https://repo.spring.io/snapshot</url>
               <snapshots>
                   <enabled>true</enabled>
               </snapshots>
           </repository>
           <repository>
               <id>spring-milestones</id>
               <name>Spring Milestones</name>
               <url>https://repo.spring.io/milestone</url>
               <snapshots>
                   <enabled>false</enabled>
               </snapshots>
           </repository>
       </repositories>
   
       <pluginRepositories>
           <pluginRepository>
               <id>spring-snapshots</id>
               <name>Spring Snapshots</name>
               <url>https://repo.spring.io/snapshot</url>
               <snapshots>
                   <enabled>true</enabled>
               </snapshots>
           </pluginRepository>
           <pluginRepository>
               <id>spring-milestones</id>
               <name>Spring Milestones</name>
               <url>https://repo.spring.io/milestone</url>
               <snapshots>
                   <enabled>false</enabled>
               </snapshots>
           </pluginRepository>
       </pluginRepositories>
   
   
   </project>
   

2. ShiroConfig

   package com.xayuli.nettels.controller;
   
   import java.util.LinkedHashMap;
   import java.util.Map;
   
   import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
   import org.apache.shiro.mgt.SecurityManager;
   import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
   import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
   import org.springframework.context.annotation.Bean;
   import org.springframework.context.annotation.Configuration;
   
   @Configuration
   public class ShiroConfig {
       @Bean
       public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager){
           System.out.println("ShiroConfiguration.shirFilter()");
           ShiroFilterFactoryBean shiroFilterFactoryBean  = new ShiroFilterFactoryBean();
           System.out.println("设置拦截器--->");
           // 必须设置 SecurityManager
           shiroFilterFactoryBean.setSecurityManager(securityManager);
   
           //拦截器.
           Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
   
           //配置退出过滤器,其中的具体的退出代码Shiro已经替我们实现了
           filterChainDefinitionMap.put("/logout", "logout");
           filterChainDefinitionMap.put("/userLogin", "anon");//开放login方法
           filterChainDefinitionMap.put("/templates/css/**", "anon");//设置不拦截
           filterChainDefinitionMap.put("/templates/js/**", "anon");//设置不拦截
           filterChainDefinitionMap.put("/templates/images/**", "anon");//设置不拦截
           //<!-- 过滤链定义，从上向下顺序执行，一般将 /**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
           //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
           filterChainDefinitionMap.put("/**", "authc");
   
           // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
           shiroFilterFactoryBean.setLoginUrl("/index");
           // 登录成功后要跳转的链接
           shiroFilterFactoryBean.setSuccessUrl("/success");
           //未授权界面;
           shiroFilterFactoryBean.setUnauthorizedUrl("/403");
   
           shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
           return shiroFilterFactoryBean;
       }
   
       /**
        * 自己写的
        * @return
        */
       @Bean
       public MyShiroRealm myShiroRealm(){
           MyShiroRealm myShiroRealm = new MyShiroRealm();
           myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
           return myShiroRealm;
       }
   
       /**
        * 注入
        * @return
        */
       @Bean
       public SecurityManager securityManager(){
           DefaultWebSecurityManager securityManager =  new DefaultWebSecurityManager();
           securityManager.setRealm(myShiroRealm());
           System.out.println("注入我的shiro");
           return securityManager;
       }
   
       /**
        * 凭证匹配器
        * （由于我们的密码校验交给Shiro的SimpleAuthenticationInfo进行处理了
        *  所以我们需要修改下doGetAuthenticationInfo中的代码;
        * ）
        * @return
        */
       @Bean
       public HashedCredentialsMatcher hashedCredentialsMatcher(){
           HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
           System.out.println("(⊙_⊙)设置MD5加密");
           hashedCredentialsMatcher.setHashAlgorithmName("md5");//散列算法:这里使用MD5算法;
           hashedCredentialsMatcher.setHashIterations(1);//散列的次数，比如散列两次，相当于 md5(md5(""));
   
           return hashedCredentialsMatcher;
       }
   
   
   }
   

    

3. MyShiroRealm

   package com.xayuli.nettels.controller;
   
   import com.xayuli.nettels.pojo.TSUser;
   import com.xayuli.nettels.service.UserService;
   import org.apache.shiro.authc.AuthenticationException;
   import org.apache.shiro.authc.AuthenticationInfo;
   import org.apache.shiro.authc.AuthenticationToken;
   import org.apache.shiro.authc.SimpleAuthenticationInfo;
   import org.apache.shiro.authz.AuthorizationInfo;
   import org.apache.shiro.realm.AuthorizingRealm;
   import org.apache.shiro.subject.PrincipalCollection;
   
   import javax.annotation.Resource;
   
   public class MyShiroRealm extends AuthorizingRealm {
   
       @Resource
       private UserService userService;
   
       @Override
       protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
           System.out.println("进行了权限认证!!!");
           return null;
       }
   
   
       /**
        * 身份验证
        * @param authenticationToken
        * @return
        * @throws AuthenticationException
        */
       @Override
       protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
           //获取用户的输入的账号.
           String username = (String)token.getPrincipal();
           //通过username从数据库中查找 User对象，如果找到，没找到.
           //实际项目中，这里可以根据实际情况做缓存，如果不做，Shiro自己也是有时间间隔机制，2分钟内不会重复执行该方法
           TSUser userInfo = userService.findByUsername(username);
           if(userInfo == null){
               return null;
           }
           //账号判断;
           //加密方式;
           //交给AuthenticatingRealm使用CredentialsMatcher进行密码匹配，如果觉得人家的不好可以自定义实现
           String Md5pass = userInfo.getPassword();//"25d55ad283aa400af464c76d713c07ad";
           SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userInfo,Md5pass,getName());//此处传的是用户对象，实体中密码，和getName
           //明文: 若存在，将此用户存放到登录认证info中，无需自己做密码对比，Shiro会为我们进行密码对比校验
           return authenticationInfo;
       }
   }
   

    

4. application.pproperties

   spring.thymeleaf.prefix=classpath:/templates/page/
   spring.thymeleaf.suffix: .html
   spring.mvc.static-path-pattern=/templates/**
   spring.resources.static-locations=classpath:/templates