Shiro入门

最新推荐文章于 2024-07-21 20:27:07 发布

原创最新推荐文章于 2024-07-21 20:27:07 发布 · 249 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#springboot #shiro

Spring 专栏收录该内容

8 篇文章

订阅专栏

基本介绍：

Apache的强大灵活的开源安全框架

认证、授权、企业会话管理、安全加密

整体架构：

Shiro认证步骤：

创建Security Manager

主体提交认证

SecurityManager认证（Authenticator认证+Realm验证）

Shiro认证代码：

package shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.SimpleAccountRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Before;
import org.junit.Test;


public class Authenticator {

    SimpleAccountRealm simpleAccountRealm = new SimpleAccountRealm();

    @Before
    public void addUser()
    {
        simpleAccountRealm.addAccount("zh","12345");
    }

    @Test
    public void testAuthenticator()
    {
        //构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(simpleAccountRealm);
        //主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        //编辑认证变量
        UsernamePasswordToken token = new UsernamePasswordToken("zh","12345");
        subject.login(token);
        System.out.println("是否认证成功："+subject.isAuthenticated());
        //退出
        subject.logout();
        System.out.println("是否认证成功："+subject.isAuthenticated());
    }
}

Shiro授权步骤：

创建SecutiryMnager

主体授权

SecurityManager授权（Authorizer授权+Realm获取角色权限数据）

Shiro授权代码：

package shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.SimpleAccountRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Before;
import org.junit.Test;


public class Authenticator {

    //SimpleAccountRealm不支持添加权限
    SimpleAccountRealm simpleAccountRealm = new SimpleAccountRealm();

    @Before
    public void addUser()
    {
        simpleAccountRealm.addAccount("zh","12345", "admin", "user");
    }

    @Test
    public void testAuthenticator()
    {
        //构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(simpleAccountRealm);
        //主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        //编辑认证变量
        UsernamePasswordToken token = new UsernamePasswordToken("zh","12345");
        subject.login(token);
        System.out.println("是否认证成功："+subject.isAuthenticated());

        //检查当前主体是否具备参数的角色
        subject.checkRole("admin");
        subject.checkRoles("admin", "user");
    }
}

IniRealm的使用：

package shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class IniRealmTest {
    @Test
    public void testIniRealm()
    {
        IniRealm iniRealm = new IniRealm("classpath:user.ini");
        //构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(iniRealm);
        //主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        //编辑认证变量
        UsernamePasswordToken token = new UsernamePasswordToken("zh","12345");
        subject.login(token);
        System.out.println("是否认证成功："+subject.isAuthenticated());

        subject.checkRole("admin");
        subject.checkPermission("user:delete");
        subject.checkPermission("user:update");
    }
}

[users]
zh=12345,admin
[roles]
admin=user:delete,user:update

JdbcRealm的使用：

package shiro;

import com.alibaba.druid.pool.DruidDataSource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class JdbcRealmTest {
    DruidDataSource dataSource = new DruidDataSource();

    {
        dataSource.setUrl("jdbc:mysql://localhost:3306/test");
        dataSource.setUsername("root");
        dataSource.setPassword("root");
    }

    @Test
    public void testJdbcRealm()
    {
        JdbcRealm jdbcRealm = new JdbcRealm();
        jdbcRealm.setDataSource(dataSource);
        jdbcRealm.setPermissionsLookupEnabled(true);

        String sql = "select password from test_user where user_name=?";
        jdbcRealm.setAuthenticationQuery(sql);

        String roleSql = "select role_name from test_user_role where user_name=?";
        jdbcRealm.setUserRolesQuery(roleSql);

        //构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(jdbcRealm);
        //主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        //编辑认证变量
        UsernamePasswordToken token = new UsernamePasswordToken("zh","12345");
        subject.login(token);
        System.out.println("是否认证成功："+subject.isAuthenticated());

        subject.checkRole("admin");
        subject.checkPermission("user:delete");
        subject.checkPermission("user:update");
    }
}

自定义Realm(加密加盐)的使用：

package shiro;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

public class MyRealm extends AuthorizingRealm {

    Map<String, String> userMap = new HashMap<String, String>();

    {
        userMap.put("zh", "533acafff35d56aa156ec9ba9b500b40");
    }

    //授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String userName = (String) principalCollection.getPrimaryPrincipal();
        //从数据库获取角色数据
        Set<String> roles = getRolesByUserName(userName);
        //从数据库获取权限数据
        Set<String> permissions = getPermissionsByUserName(userName);
        //包装返回数据
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    private Set<String> getPermissionsByUserName(String userName) {
        Set<String> sets = new HashSet<String>();
        sets.add("user:delete");
        sets.add("user:add");
        return sets;
    }

    private Set<String> getRolesByUserName(String userName) {
        Set<String> sets = new HashSet<String>();
        sets.add("admin");
        sets.add("user");
        return sets;
    }

    //认证
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //从主体传过来的认证信息中，获取用户名
        String userName = (String) authenticationToken.getPrincipal();
        //通过用户名到数据库中获取凭证
        String passWord = getPasswordByUserName(userName);
        if(passWord==null)
            return null;
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo("zh",passWord, "realm");
        //加盐
        authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes("salt"));
        return authenticationInfo;
    }

    private String getPasswordByUserName(String userName) {
        return userMap.get(userName);
    }

    public static void main(String[] args)
    {
        Md5Hash md5Hash = new Md5Hash("12345", "salt");
        System.out.println(md5Hash.toHex());
    }
}

测试类：

package shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;

public class Test {

    @org.junit.Test
    public void test()
    {
        MyRealm myRealm = new MyRealm();
        //构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(myRealm);

        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        //设置加密算法的名称
        matcher.setHashAlgorithmName("md5");
        //设置加密次数
        matcher.setHashIterations(1);
        myRealm.setCredentialsMatcher(matcher);
        //主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();
        //编辑认证变量
        UsernamePasswordToken token = new UsernamePasswordToken("zh","12345");
        subject.login(token);
        System.out.println("是否认证成功："+subject.isAuthenticated());
    }
}