1.shiro整体架构

image.png

1.Authenticator=>认证器:负责用户登录登出
2.Authoorizer=>授权器:shiro给用户授权
3.Session Manager=>Session管理机制
4.SessionDao=>负责增删改查
5.Pluggable Realms=>与数据库交互,获取权限信息
6.Cryptography=>加密

2.Shiro认证

image.png

1.创建模版:

image.png

1.pom.xml添加依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.4.0</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>RELEASE</version>
        </dependency>

2.创建测试类

image.png

package com.imooc.test;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.SimpleAccountRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Before;
import org.junit.Test;

/**
 * Created by fly on 2018/4/18.
 */
public class AuthenticationTest {

    //暂时使用SimpleAccountRealm
    SimpleAccountRealm simpleAccountRealm=new SimpleAccountRealm();

    //创建一个用户
    @Before
    public void addUser(){
        simpleAccountRealm.addAccount("Mark","123456");
    }

    @Test
    public void testAuthentication(){

        //1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();
        defaultSecurityManager.setRealm(simpleAccountRealm);

        //2.主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject=SecurityUtils.getSubject();//注意使用shiro下的Subject

        UsernamePasswordToken token=new UsernamePasswordToken("Mark","123456");
        subject.login(token);

        System.out.println("isAuthenticated:"+subject.isAuthenticated());

        subject.logout();

        System.out.println("isAuthenticated:"+subject.isAuthenticated());
    }

}

认证结果:

image.png

2.Shiro授权

image.png

1.给用户赋予一个角色

image.png

2.验证是否拥有该角色

image.png
结果:
image.png

若主体角色错误(异常)

image.png
扩展
可同时添加多个角色,check多个角色
image.png

Shiro自定义Realm

内置Realm:
1.IniRealm
2.JdbcRealm

1.IniRealm测试类

目录结构

image.png

创建IniRealmTest

package com.imooc.test;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * Created by fly on 2018/4/18.
 */
public class IniRealTest {

    //创建IniRealm
    IniRealm iniRealm=new IniRealm("classpath:user.ini");

    @Test
    public void testAuthentication(){

        //1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();
        defaultSecurityManager.setRealm(iniRealm);

        //2.主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject=SecurityUtils.getSubject();//注意使用shiro下的Subject

        UsernamePasswordToken token=new UsernamePasswordToken("Mark","123456");
        subject.login(token);

        System.out.println("isAuthenticated:"+subject.isAuthenticated());
        //权限验证
        subject.checkRole("admin");
        //是否具备某权限
        subject.checkPermission("user:delete");
    }
}

创建user.ini

[users]
Mark=123456,admin
[roles]
admin=user:delete

运行结果

image.png

2.JdbcRealm

在pom.xml中导入mysql支持和datasource数据源

 <!--mysql驱动包-->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.36</version>
        </dependency>
        <!--数据源-->
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.6</version>
        </dependency>
    </dependencies>

JdbcRealmTest类

package com.imooc.test;

import com.alibaba.druid.pool.DruidDataSource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * Created by fly on 2018/4/19.
 */
public class JdbcRealmTest {


    //创建jdbc数据源
    DruidDataSource dataSource=new DruidDataSource();

    //设置jdbc入口
    {
        dataSource.setUrl("jdbc:mysql://localhost:3306/shiro_test");
        dataSource.setUsername("root");
        dataSource.setPassword("123456");
    }

    @Test
    public void testAuthentication(){

        //创建JdbcRealm
        JdbcRealm jdbcRealm=new JdbcRealm();
        //设置JdbcRealm数据源
        jdbcRealm.setDataSource(dataSource);
        //设置权限开关(默认为false)
        jdbcRealm.setPermissionsLookupEnabled(true);

        //1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();
        defaultSecurityManager.setRealm(jdbcRealm);

        //2.主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject=SecurityUtils.getSubject();//注意使用shiro下的Subject

        UsernamePasswordToken token=new UsernamePasswordToken("zhangsan","123456");
        subject.login(token);

        System.out.println("isAuthenticated:"+subject.isAuthenticated());

        //验证角色
        subject.checkRole("admin");
        //验证权限
        subject.checkPermission("user:delete");

    }
}

如果使用shiro默认的查询语句,就根据shiro查询语句创建表

image.png
image.png

注意:如果不设置开关 subject.checkPermission("user:delete");将报错

image.png
image.png

自定义sql语句查询

image.png

3.自定义Realm

创建自定义CustomRealm和测试类CustomRealmTest

image.png

没有从数据库查询,使用Map和Set进行模拟查询

CustomRealm

package com.imooc.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

/**
 * Created by fly on 2018/4/19.
 */
public class CustomRealm extends AuthorizingRealm {

    Map<String,String> userMap=new HashMap<String, String>(16);
    {
        userMap.put("Mark","123456");
        super.setName("customRealm");
    }

    //授权方法
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        String userName=(String) principalCollection.getPrimaryPrincipal();
        //从数据库或者缓存中获取角色数据
        Set<String> roles=getRolesByUserName(userName);
        //从数据库或者缓存中获取权限数据
        Set<String> permissions=getPermissionsByUserName(userName);

        SimpleAuthorizationInfo simpleAuthorizationInfo=new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);

        return simpleAuthorizationInfo;
    }

    //模拟数据库获取角色数据
    private Set<String> getPermissionsByUserName(String userName) {
        Set<String> sets=new HashSet<String>();
        sets.add("user:delete");
        sets.add("user:select");
        return sets;
    }

    //模拟数据库获取角色数据
    private Set<String> getRolesByUserName(String userName) {
        Set<String> sets=new HashSet<String>();
        sets.add("admin");
        sets.add("user");
        return sets;
    }

    //认证方法
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //1.从主体穿过来的认证信息中,获得用户名
        String userName=(String) authenticationToken.getPrincipal();

        //2.通过用户名到数据库中获取凭证
        String password=getPasswordByUserName(userName);
        if(password==null){
            return null;
        }
        SimpleAuthenticationInfo authenticationInfo=new SimpleAuthenticationInfo("Mark",password,"customRealm");

        return authenticationInfo;
    }

    //模拟数据库查询
    private String getPasswordByUserName(String userName) {

        return userMap.get(userName);
    }
}

CustomRealmTest

package com.imooc.test;

import com.imooc.realm.CustomRealm;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * Created by fly on 2018/4/19.
 */
public class CustomReamlTest {

    @Test
    public void testAuthentication(){

        //创建CustomRealm
        CustomRealm customRealm=new CustomRealm();

        //1.构建SecurityManager环境
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();
        defaultSecurityManager.setRealm(customRealm);

        //2.主体提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject=SecurityUtils.getSubject();//注意使用shiro下的Subject

        UsernamePasswordToken token=new UsernamePasswordToken("Mark","123456");
        subject.login(token);

        System.out.println("isAuthenticated:"+subject.isAuthenticated());

        subject.checkRole("admin");
        subject.checkPermissions("user:delete","user:select");
    }
}

Shiro加密

1.Shiro散列配置

HashedCredentialsMatcher

自定义Realm中使用散列

盐的使用

在验证方法中设置加密类型,加密次数

HashedCredentialsMatcher matcher=new HashedCredentialsMatcher();
        matcher.setHashAlgorithmName("md5");//设置加密方法
        matcher.setHashIterations(1);//设置加密次数
        customRealm.setCredentialsMatcher(matcher);

在Realm中设置盐等参数

 //设置盐
        authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes("Mark"));

============未完待续=================