springboot整合shiro

shiro是什么

Apache Shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码学和会话管理。使用Shiro的易于理解的API,您可以快速、轻松地获得任何应用程序,从最小的移动应用程序到最大的网络和企业应用程序。（百度百科）

主要功能

三个核心组件：Subject, SecurityManager 和 Realms.

Subject：即“当前操作用户”。但是，在Shiro中，Subject这一概念并不仅仅指人，也可以是第三方进程、后台帐户（Daemon Account）或其他类似事物。它仅仅意味着“当前跟软件交互的东西”。但考虑到大多数目的和用途，你可以把它认为是Shiro的“用户”概念。 　　Subject代表了当前用户的安全操作，SecurityManager则管理所有用户的安全操作。 　　 SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro通过SecurityManager来管理内部组件实例，并通过它来提供安全管理的各种服务。 　　 Realm： Realm充当了Shiro与应用安全数据间的“桥梁”或者“连接器”。也就是说，当对用户执行认证（登录）和授权（访问控制）验证时，Shiro会从应用配置的Realm中查找用户及其权限信息。 　　从这个意义上讲，Realm实质上是一个安全相关的DAO：它封装了数据源的连接细节，并在需要时将相关数据提供给Shiro。当配置Shiro时，你必须至少指定一个Realm，用于认证和（或）授权。配置多个Realm是可以的，但是至少需要一个。 　　Shiro内置了可以连接大量安全数据源（又名目录）的Realm，如LDAP、关系数据库（JDBC）、类似INI的文本配置资源以及属性文件等。如果缺省的Realm不能满足需求，你还可以插入代表自定义数据源的自己的Realm实现。

springboot+shiro的dome

maven依赖

<!-- Apache Shiro版本号 --> <properties> <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding> <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding> <java.version>1.8</java.version> <shiro.version>1.4.0</shiro.version> <shiro-redis.version>3.1.0</shiro-redis.version> </properties> <!-- Apache Shiro依赖 --> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.4.0</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>${shiro.version}</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-ehcache</artifactId> <version>${shiro.version}</version> </dependency> <dependency> <groupId>org.crazycake</groupId> <artifactId>shiro-redis</artifactId> <version>${shiro-redis.version}</version> </dependency>

shiro配置类

package com.fc.test.system.config; import java.util.Collection; import java.util.LinkedHashMap; import java.util.Map; import javax.servlet.Filter; import com.fc.test.common.constant.ConstantConfig; import com.fc.test.system.shiro.StatelessDefaultSubjectFactory; import com.fc.test.system.shiro.auth.AuthRealm; import com.fc.test.system.shiro.filter.AuthenticationFilter; import com.fc.test.system.shiro.filter.JcaptchaValidateFilter; import com.fc.test.system.shiro.session.ShiroSessionManager; import org.apache.shiro.SecurityUtils; import org.apache.shiro.mgt.DefaultSecurityManager; import org.apache.shiro.session.mgt.SessionManager; import org.apache.shiro.spring.LifecycleBeanPostProcessor; import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.web.mgt.DefaultWebSecurityManager; import org.apache.shiro.web.mgt.DefaultWebSubjectFactory; import org.apache.shiro.web.servlet.SimpleCookie; import org.crazycake.shiro.RedisCacheManager; import org.crazycake.shiro.RedisManager; import org.crazycake.shiro.RedisSessionDAO; import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator; import org.springframework.boot.web.servlet.FilterRegistrationBean; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.DependsOn; import org.springframework.web.filter.DelegatingFilterProxy; /** * [简要描述]: shiro配置<br/> [详细描述]: * * @author zzc * @time 2019/10/31 * @since V0.1 */ @Configuration public class ShiroConfig { //将自己的验证方式加入容器 @Bean public AuthRealm myShiroRealm() { AuthRealm authRealm = new AuthRealm(); return authRealm; } @Bean public FilterRegistrationBean<DelegatingFilterProxy> delegatingFilterProxy() { FilterRegistrationBean<DelegatingFilterProxy> filterRegistrationBean = new FilterRegistrationBean<>(); DelegatingFilterProxy proxy = new DelegatingFilterProxy(); proxy.setTargetFilterLifecycle(true); proxy.setTargetBeanName("shiroFilter"); filterRegistrationBean.setFilter(proxy); filterRegistrationBean.setOrder(2); return filterRegistrationBean; } /* * shiro放行url */ @Bean("shiroFilter") @DependsOn("securityManager") public ShiroFilterFactoryBean shiroFilter(DefaultSecurityManager securityManager) { ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean(); shiroFilter.setSecurityManager(securityManager); // 拦截器 Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>(); // 允许用户匿名访问/login(登录接口) filterChainDefinitionMap.put("/api/v1/login", "anon"); // 允许注册接口匿名 filterChainDefinitionMap.put("/api/v1/reg", "anon"); filterChainDefinitionMap.put("/druid/**", "anon"); filterChainDefinitionMap.put("/api-docs", "anon"); filterChainDefinitionMap.put("/v2/api-docs", "anon"); filterChainDefinitionMap.put("/favicon.ico", "anon"); filterChainDefinitionMap.put("/swagger-ui.html", "anon"); filterChainDefinitionMap.put("/webjars/**", "anon"); filterChainDefinitionMap.put("/swagger-resources/**", "anon"); filterChainDefinitionMap.put("/static/**", "anon"); shiroFilter.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilter; } /** * Subject工厂管理器 */ @Bean public DefaultWebSubjectFactory subjectFactory() { return new StatelessDefaultSubjectFactory(); } /* * 开启shiro aop注解支持 使用代理方式;所以需要开启代码支持; */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() { AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor(); authorizationAttributeSourceAdvisor.setSecurityManager(securityManager()); return authorizationAttributeSourceAdvisor; } /** * 安全管理器 */ @Bean("securityManager") public DefaultWebSecurityManager securityManager() { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); securityManager.setRealm(myShiroRealm()); SecurityUtils.setSecurityManager(securityManager); return securityManager; } /** * Session Manager 使用的是shiro-redis开源插件 */ @Bean public SessionManager sessionManager() { SimpleCookie simpleCookie = new SimpleCookie("Token"); simpleCookie.setPath("/"); simpleCookie.setHttpOnly(false); ShiroSessionManager sessionManager = new ShiroSessionManager(); sessionManager.setSessionDAO(redisSessionDAO()); sessionManager.setSessionIdCookieEnabled(false); sessionManager.setSessionIdUrlRewritingEnabled(false); sessionManager.setDeleteInvalidSessions(true); sessionManager.setSessionIdCookie(simpleCookie); return sessionManager; } /** * RedisSessionDAO shiro sessionDao层的实现 通过redis 使用的是shiro-redis开源插件 */ @Bean public RedisSessionDAO redisSessionDAO() { RedisSessionDAO redisSessionDAO = new RedisSessionDAO(); redisSessionDAO.setRedisManager(redisManager()); return redisSessionDAO; } /** * Shiro生命周期处理器 此方法需要用static作为修饰词，否则无法通过@Value()注解的方式获取配置文件的值 */ @Bean(name = "lifecycleBeanPostProcessor") public static LifecycleBeanPostProcessor lifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } /** * 开启Shiro注解(如@RequiresRoles,@RequiresPermissions) */ @Bean @DependsOn("lifecycleBeanPostProcessor") public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() { DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator(); advisorAutoProxyCreator.setProxyTargetClass(true); return advisorAutoProxyCreator; } /** * 配置shiro redisManager 使用的是shiro-redis开源插件 */ @Bean public RedisCacheManager cacheManager() { RedisCacheManager redisCacheManager = new RedisCacheManager(); redisCacheManager.setRedisManager(redisManager()); //设置前缀 return redisCacheManager; } /** * 配置shiro redisManager 使用的是shiro-redis开源插件 */ public RedisManager redisManager() { RedisManager redisManager = new RedisManager(); //redis地址 redisManager.setHost(ConstantConfig.springRedisHost); //redis端口 redisManager.setPort(ConstantConfig.springRedisPort); //设置过期时间 redisManager.setTimeout(1800); redisManager.setPassword(ConstantConfig.springRedisPassword); return redisManager; } }

自定义Realm认证授权

package com.fc.test.system.shiro.auth; import lombok.extern.slf4j.Slf4j; import org.apache.shiro.authc.*; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; /** * 自定义realm * @author zzc */ @Slf4j public class AuthRealm extends AuthorizingRealm { public AuthRealm() {} /** authorization 权限授予 */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { log.info("=============shiro权限授权============="); //获取登录时认证的用户名 String username = String.valueOf(principals); Set<String> roles = new HashSet<>(); Set<String> permissions = new HashSet<>(); //给用户添加user权限 (没有进行判断、对所有的用户给user权限) if("user".equals(username)){ roles.add("user"); permissions.add("user:detail"); } //当用户名为admin时 为用户添加权限admin 两个admin可以理解为连个字段 if ("admin".equals(username)) { roles.add("admin"); permissions.add("admin:add"); permissions.add("admin:detele"); permissions.add("admin:detail"); permissions.add("admin:list"); permissions.add("admin:update"); } SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roles); //添加权限 //permissions里包含@RequiresPermissions("admin:update")传来的值则认证成功 info.setStringPermissions(permissions); info.setRoles(roles); return info; } /** authentication 身份验证 */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { log.info("=============shiro开始认证============="); // 将AuthenticationToken强转为UsernamePasswordToken对象 UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken; // 获得从表单传过来的用户名 String username = upToken.getUsername(); //通用mapper查询 Condition condition = new Condition(TSysUser.class); condition.createCriteria().andEqualTo("username",username); List<TSysUser> tSysUserList = tSysUserMapper.selectByCondition(condition); if(tSysUserList==null || tSysUserList.isEmpty()){ throw new UnknownAccountException(); } TSysUser tSysUser = tSysUserList.get(0); //用户名和密码跟subject.login(usernamePasswordToken);传来的一致则认证成功 return new SimpleAuthenticationInfo(username,tSysUser.getPassword(), getName()); } @Override public void clearCachedAuthorizationInfo(PrincipalCollection principals) { super.clearCachedAuthorizationInfo(principals); } @Override public void clearCachedAuthenticationInfo(PrincipalCollection principals) { super.clearCachedAuthenticationInfo(principals); } @Override public void clearCache(PrincipalCollection principals) { super.clearCache(principals); } private void clearAllCachedAuthorizationInfo() { getAuthorizationCache().clear(); } private void clearAllCachedAuthenticationInfo() { getAuthenticationCache().clear(); } public void clearAllCache() { clearAllCachedAuthenticationInfo(); clearAllCachedAuthorizationInfo(); } }

控制层shiro认证

package com.fc.test.controller.user; import com.fc.test.util.CommonUtil; import io.swagger.annotations.Api; import io.swagger.annotations.ApiOperation; import io.swagger.annotations.ApiResponse; import io.swagger.annotations.ApiResponses; import lombok.extern.slf4j.Slf4j; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.UsernamePasswordToken; import org.apache.shiro.subject.Subject; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; /** * [简要描述]:Restful控制器 <br/> * [详细描述]: * * @author zzc * @time 2019/10/25 * @since V0.1 */ @Slf4j @Api(value = "用户登录", tags = {"用户登录"}) @RestController @RequestMapping("/api/v1") public class LoginControllet { /** * 用户登录 1. userName 登录名(非必须) 2. passWord 密码凭证 */ @ApiOperation(value = "登录", notes = "请注意请求参数!") @ApiResponses({ @ApiResponse(code = 200, message = "成功", response = String.class), @ApiResponse(code = 999, message = "失败"), }) @PostMapping("/login") public String userLogin(String userName,String passWord) { //密码通过md5+用户名加密 String pwd = CommonUtil.encryptMD5(userName+passWord); UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(userName,pwd); String token = CommonUtil.generateToken(); //主体 Subject subject = SecurityUtils.getSubject(); //调用自定义的Realm的doGetAuthenticationInfo认证,传入的账号密码跟doGetAuthenticationInfo返回的账号密码一致则认证成功 subject.login(usernamePasswordToken); //认证成功返回token return token; } }

控制层shiro授权过程

@ApiOperation(value = "获取数据列表") @ApiResponses({ @ApiResponse(code = 200, message = "成功", response = TSysUser.class), @ApiResponse(code = 101, message = "数据校验未通过"), @ApiResponse(code = 999, message = "失败"), @ApiResponse(code = 1501, message = "用户令牌过期"), }) @ApiImplicitParams({ @ApiImplicitParam(name = "page", value = "页数 "), @ApiImplicitParam(name = "size", value = "每页数量 "), }) @GetMapping //该注解调用Realm的doGetAuthorizationInfo进行授权, @RequiresPermissions("admin:list") public RestResponse list(@RequestParam(defaultValue = "1") Integer page, @RequestParam(defaultValue = "10") Integer size) { PageInfo pageInfo = tSysUserService.findTSysUserList(page, size); return RestResponse.builder().respStatus(RespStatus.SUCCESS).respData(pageInfo).build(); }

代码执行

登录 这里正确账号密码是账号：admin 密码：123456 输入正确账号密码返回token shiro进行认证，账号密码跟数据库一致认证成功 输出错误账号或密码，接口返回的自定义异常是根据shiro抛出的异常自己自定义的 shiro进行授权验证 admin账号有查询列表的权限请求成功 user账号进行登录查询用户列表 这就是shiro整个认证授予过程 数据库密码是使用用户名+密码md5加密组成