今日要闻!【千锋南京JAVA】jwt结合shiro和idea版

用BCrypt加密的shiro配置多个realm配置Shiro的多Realm验证的实现–shiro实现不同身份使用不同Realm进行验证 springboot整合shiro和idea版最新Apache Shiro快速入门Security安全框架【千锋南京JAVA】 jwt结合shiro使用

@Bean    public ShiroRealm getRealm() {ShiroRealm shiroRealm1 = new ShiroRealm();        shiroRealm1.setCredentialsMatcher(new CredentialsMatcher() {@Override            public boolean doCredentialsMatch(AuthenticationToken authenticationToken, AuthenticationInfo authenticationInfo) {UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;                String plaimtext = new String(token.getPassword());                String hashed = authenticationInfo.getCredentials().toString();                System.out.println("明文密码"+plaimtext+hashed);                return BCrypt.checkpw(plaimtext,hashed);            }        });        return shiroRealm1;    }

(资料图片)

package com.sbibits.config;import org.apache.shiro.SecurityUtils;import org.apache.shiro.spring.web.ShiroFilterFactoryBean;import org.apache.shiro.subject.Subject;import org.apache.shiro.web.mgt.DefaultWebSecurityManager;import org.springframework.beans.factory.annotation.Qualifier;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;import java.util.LinkedHashMap;import java.util.Map;/** * @author admin * @version 1.0.0 * @ClassName ShiroConfig.java * @Description TODO * @createTime 2019年12月12日 16:10:00 */@Configurationpublic class ShiroConfig {//创建ShiroFilterFactoryBean    @Bean    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();        //设置安全管理器        shiroFilterFactoryBean.setSecurityManager(securityManager);        /**         * 添加shiro内置过滤器         *      常用的过滤器：         *         anon:无需认证可以访问         *         authc:必须认证         *         user：若使用remeberme的功能可以访问         *         perms:须得到授权         *         role： 需得到角色可访问         * */        MapfilterMap = new LinkedHashMap<>();        filterMap.put("/user/*", "authc");        filterMap.put("/*", "anon");        //修改调整的页面//        shiroFilterFactoryBean.setLoginUrl("/");        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);        return shiroFilterFactoryBean;    }    //创建DefaultWebSecurityManager    @Bean(name = "securityManager")    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();        //关联realm        securityManager.setRealm(userRealm);        return securityManager;    }    //创建realm    @Bean(name = "userRealm")    public UserRealm getRealm() {return new UserRealm();    }}

package com.sbibits.config;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.AuthenticationInfo;import org.apache.shiro.authc.AuthenticationToken;import org.apache.shiro.authz.AuthorizationInfo;import org.apache.shiro.realm.AuthorizingRealm;import org.apache.shiro.subject.PrincipalCollection;/** * @author admin * @version 1.0.0 * @ClassName UserRealm.java * @Description TODO * @createTime 2019年12月12日 16:12:00 */public class UserRealm extends AuthorizingRealm {//执行授权逻辑    @Override    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {System.out.println("执行授权逻辑");        return null;    }    //执行认证逻辑    @Override    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {return null;    }}

用户注册时，先用bcrypt加密存入数据库 执行认证逻辑时，用 BCrypt.checkpw判断密码是否相同，返回boolean值 获取盐 登出操作

shiro

导入依赖

org.apache.shiroshiro-spring1.4.0

编写shiro两个核心配置shiroconfig和userrealm

public class UserRealm extends AuthorizingRealm {//授权逻辑    @Override    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {System.out.println("执行授权逻辑");        SimpleAuthorizationInfo sa = new SimpleAuthorizationInfo();        sa.addStringPermission("user:add");        return sa;    }    //认证逻辑    @Override    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {System.out.println("执行认证逻辑");        UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken;        return new SimpleAuthenticationInfo("","1234","");    }

@Bean    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();        //设置安全管理器        shiroFilterFactoryBean.setSecurityManager(securityManager);        return shiroFilterFactoryBean;    }    //创建DefaultWebSecurityManager    @Bean(name = "securityManager")    public DefaultWebSecurityManager getDefaultWebSecurityManager() {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();        //关联realm        securityManager.setRealm(getRealm());        return securityManager;    }    //创建realm，需要自定义realm    @Bean    public UserRealm getRealm() {return new UserRealm();    }

编写controller

@PostMapping("register")    public String shiro(User user, Model model) {//获取subject        Subject subject = SecurityUtils.getSubject();        System.out.println("判断是否已经登录" + subject.isAuthenticated());        //若没有登录，把用户名密码封装为UsernamePasswordToken对象        UsernamePasswordToken token = new UsernamePasswordToken(user.getName(), user.getPassword());        try {//执行登录            subject.login(token);            System.out.println("再判断是否已经登录" + subject.isAuthenticated());            return "success";        } catch (IncorrectCredentialsException e) {model.addAttribute("msg", "密码不存在");            return "login";        } catch (UnknownAccountException e) {model.addAttribute("msg", "用户名不存在");            return "login";        }

Shiro的三种授权(十二)

多个权限标识 hasAnyPermissions hasPermission

// 拥有 admin 角色可以访问 @RequiresRoles(“admin”) // 拥有 user 或 admin 角色可以访问 @RequiresRoles(logical = Logical.OR, value = {“user”, “admin”}) // 拥有 user 或 admin 角色，且拥有 vip 权限可以访问 @GetMapping("/getVipMessage") @RequiresRoles(logical = Logical.OR, value = {“user”, “admin”}) @RequiresPermissions(“vip”) public ResultMap getVipMessage() {return resultMap.success().code(200).message(“成功获得 vip 信息！”); }