SpringBoot-Shiro入门案例

shiro是Apache下的一个强大且易用的Java安全框架,负责执行身份认证、授权、密码和会话管理。

三个核心组件：Subject、SecurityManager 、Realms
 1.Subject是什么?
   Subject就是"当前操作的用户",但是在Shiro中,并不指定Subject就是指的是人,也指的的操作的资源。
 2.SecurityManager是什么?
   大家可以把SecurityManager理解为是一个管理Subject的一个容器.负责对Subject进行认证,授权,密码加密···总结就是提供安全管理的各种服务
 3.Realms是什么?
   Realms就是负责对用户进行认证,和授权检查后交由SecurityManager,可以把他理解为是一个中间件,负责shiro和应用安全数据之间的桥梁,或连接器,也就是说,当对用户执行认证,和授权时,shiro会从Realm中查找用户和权限信息。

<dependency>
  <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.4.1</version>
</dependency>

//继承了AuthorizingRealm 后会重写两个方法,一个是授权一个是认证,这方法返回的接口的名字非常的像,这里给大家说一个区分的技巧:AuthoriXationInfo，这里X如果是z那么就是授权,如果是c就是认证
public class UserRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;


    // 授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了=>授权[doGetAuthorizationInfo]");
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
        //拿到当前用户
        Subject currentSubject = SecurityUtils.getSubject();
        System.out.println("urrentSubject.getPrincipal()=>"+currentSubject.getPrincipal());
        User currentUser= (User) SecurityUtils.getSubject().getPrincipal();
        //授予权限
        info.addStringPermission(currentUser.getPerms());
        return info;
    }


    // 认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("执行了=>认证[doGetAuthenticationInfo]");
        //用户名,密码~ 数据库中取
        UsernamePasswordToken userToken= (UsernamePasswordToken) token;
        String name=token.getPrincipal().toString();
        System.out.println("用户名=>["+name+"]");
        QueryWrapper<User> queryWrapper=new QueryWrapper<>();
        if (!StringUtils.isEmpty(name)) {
            queryWrapper.eq("name",name);
        }
        User user = userService.getOne(queryWrapper);
        if (null==user){
            return null;//用户不存在
        }
        System.out.println("密码=>["+user.getPassword()+"]");
        System.out.println("getName=>["+getName()+"]");
        //将user放入session
        Subject subject = SecurityUtils.getSubject();
        Session session = subject.getSession();
        session.setAttribute("loginUser",user);
        //密码认证,shiro来做
        return new SimpleAuthenticationInfo(user,user.getPassword(),this.getName());
    }
}

@Configuration
public class ShiroConfig {


    //ShiroFliterFactoryBean:第三步
    @Bean
    public ShiroFilterFactoryBean shiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager) {
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(defaultWebSecurityManager);
        //添加shiro的内置过滤器
        /*
            anon: 无需认证就可以访问
            authc: 必须认证了才能访问
            user: 必须拥有 记住我 功能才能用
            perms: 拥有对某个资源的权限才能访问
            role: 拥有某个角色权限才能访问
         */
        //配置拦截
        Map<String, String> filterMap = new HashMap<>();
        //访问首页以及登录不进行拦截
        filterMap.put("/", "anon");
        filterMap.put("/index", "anon");
        filterMap.put("/login", "anon");
        //进行对用户的操作进行拦截,并要求有权限
        filterMap.put("/user/add", "perms[user:add]");
        filterMap.put("/user/update", "perms[user:update]");
        bean.setFilterChainDefinitionMap(filterMap);
        //设置登录的请求
        bean.setLoginUrl("/toLogin");
        //登录成功后发送的请求
        bean.setSuccessUrl("/index");
        //未授权
        bean.setUnauthorizedUrl("/noAuthorization");
        return bean;
    }


    //DefaultWebSecurityManager:第二步
    @Bean(name = "securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联UserRealm
        securityManager.setRealm(userRealm);
        return securityManager;
    }


    //创建 Realm 对象 , 需要自定义类:第一步
    @Bean(name = "userRealm")
    public UserRealm userRealm() {
        return new UserRealm();
    }
}

@Data
@AllArgsConstructor
@NoArgsConstructor
@TableName(value = "user")
public class User {
    @TableId(value = "id",type = IdType.AUTO)
    private Integer id;
    @TableField(value = "name")
    private String name;
    @TableField(value = "password")
    private String password;
    @TableField(value = "perms")
    private String perms;
}

@Repository
@Mapper
public interface UserMapper extends BaseMapper<User> {}

public interface UserService extends IService<User> {}

@Service
public class UserServiceImpl extends ServiceImpl<UserMapper, User> implements UserService {
    @Autowired
    private UserMapper userMapper;
}

@Controller
public class MyController {
    @RequestMapping({"/","/index"})
    public String toIndex(Model model){
        return "index";
    }
    @RequestMapping("/toLogin")
    public String toLogin(){
        return "login";
    }
    @RequestMapping("/login")
    public String login(String name, String password, Model model, HttpServletRequest request){
        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();
        //封装用户的登录数据
        UsernamePasswordToken token=new UsernamePasswordToken(name,password);
        try {
            subject.login(token);//执行登录方法,如果没有异常就说明成功
            return "redirect:/index";
        } catch (UnknownAccountException e) {//用户名不存在
            model.addAttribute("msg","用户名不存在");
        }catch (IncorrectCredentialsException e) {//密码错误
            model.addAttribute("msg","密码错误");
        }
        return "login";
    }
    @RequestMapping("/noAuthorization")
    @ResponseBody
    public String noAuthorization(){
        return "未经授权,不能访问!";
    }
}

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<h1>登录</h1>
<p th:text="${msg}" style="color: red"></p>
<form th:action="@{/login}">
    <p>用户名:<input type="text" th:name="name"></p>
    <p>密码:<input type="text" th:name="password"></p>
    <p><input type="submit" value="登录"></p>
</form>
</body>
</html>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Title</title>
</head>
<body>
<h1>登录成功!</h1>
</body>
</html>