spring boot + shiro实现登录功能

朱雀 2020-10-02 02:18 960阅读 0赞

一、用maven导入相关依赖

<parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>1.4.3.RELEASE</version>
      </parent>
      <dependencies>
        <dependency>
          <groupId>org.springframework.boot</groupId>
          <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
          <groupId>org.apache.tomcat.embed</groupId>
          <artifactId>tomcat-embed-jasper</artifactId>
          <scope>provided</scope>
        </dependency>
        <dependency>
          <groupId>javax.servlet</groupId>
          <artifactId>jstl</artifactId>
        </dependency>
        <dependency>
          <groupId>org.apache.shiro</groupId>
          <artifactId>shiro-spring</artifactId>
          <version>1.2.2</version>
        </dependency>
      </dependencies>

二、先创建一个验证的MyShiroRealm类，继承AuthorizingRealm类，重写doGetAuthorizationInfo方法和doGetAuthenticationInfo方法

package springboot.shiro;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.*;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    
    import java.util.HashSet;
    import java.util.Set;
    
    public class MyShiroRealm extends AuthorizingRealm {
    	@Override
    		protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    		//获取用户
    		User user = (User)SecurityUtils.getSubject().getPrincipal();
    		SimpleAuthorizationInfo info =  new SimpleAuthorizationInfo();
    		//获取用户角色
    		Set<String> roleSet = new HashSet<String>();
    		roleSet.add("100002");
    		info.setRoles(roleSet);
    		//获取用户权限
    		Set<String> permissionSet = new HashSet<String>();
    		permissionSet.add("sys:acc:aaaa");
    		permissionSet.add("权限删除");
    		info.setStringPermissions(permissionSet);
    		return info;
    	}
    
    	/**
    	 * 验证用户身份,如果验证失败，返回null或者异常（带返回message），跳转到login的post链接
    	 */
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
    		UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
    		String username = token.getUsername();
    		if(!"aaa".equals(username)){
    			throw new AuthenticationException("用户不存在");
    		}
    		//没连接数据库，写死账号密码
    		User user = new User("aaa","123");
    		//进行认证，将正确数据给shiro处理
    		//密码不用自己比对，AuthenticationInfo认证信息对象，一个接口，new他的实现类对象SimpleAuthenticationInfo
    		AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user, user.getPassword(), this.getName());
    		//清之前的授权信息
    		super.clearCachedAuthorizationInfo(authcInfo.getPrincipals());
    		SecurityUtils.getSubject().getSession().setAttribute("login", user);
    		return authcInfo;//返回给安全管理器，securityManager，由securityManager比对数据库查询出的密码和页面提交的密码
    	}
    }

注：doGetAuthorizationInfo方法只有在以下三种情况才会被调用，正常登录成功不进doGetAuthorizationInfo方法

（1）subject.hasRole(“admin”) 或 subject.isPermitted(“admin”)：自己调用这个是否有什么角色或者是否有什么权限的时候；

（2）@RequiresRoles("admin") ：在方法上加注解的时候；

（3）\[@shiro.hasPermission name = "admin"\]\[/@shiro.hasPermission\]：在页面上加shiro标签的时候，即进这个页面的时候扫描到有这个标签的时候。

三、创建ShiroConfiguration类配置shiro

package springboot.shiro;
    
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
    import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    import java.util.LinkedHashMap;
    import java.util.Map;
    
    /**
     * Shiro 配置
     *
     * Apache Shiro 核心通过 Filter 来实现，就像SpringMvc 通过DispachServlet 来控制一样。
     * Filter 是通过URL规则来进行过滤和权限校验，所以需要定义一系列关于URL的规则和访问权限。
     *
     */
    @Configuration
    public class ShiroConfiguration {
    	/**
    	 * ShiroFilterFactoryBean 处理拦截资源文件问题。
    	 * 注：单独一个ShiroFilterFactoryBean配置是或报错的，因为在
    	 * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
    	 *
    	 Filter Chain定义说明
    	 1、一个URL可以配置多个Filter，使用逗号分隔
    	 2、当设置多个过滤器时，全部验证通过，才视为通过
    	 3、部分过滤器可指定参数，如perms，roles
    	 *
    	 */
    	@Bean
    	public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    		ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    
    		// 必须设置 SecurityManager
    		shiroFilterFactoryBean.setSecurityManager(securityManager);
    
    		// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    		shiroFilterFactoryBean.setLoginUrl("/login");
    		// 登录成功后要跳转的链接
    		shiroFilterFactoryBean.setSuccessUrl("/index");
    		// 未授权界面;
    		shiroFilterFactoryBean.setUnauthorizedUrl("/403");
    
    		// 拦截器.
    		Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    		// 配置不会被拦截的链接 顺序判断
    		filterChainDefinitionMap.put("/static/**", "anon");
    		filterChainDefinitionMap.put("/verify", "anon");
    
    		// 配置退出过滤器,其中的具体的退出代码Shiro已经替我们实现了
    		filterChainDefinitionMap.put("/logout", "logout");
    
    		filterChainDefinitionMap.put("/add", "perms[权限添加]");
    
    		// :这是一个坑呢，一不小心代码就不好使了;
    		// 
    		filterChainDefinitionMap.put("/**", "authc");
    
    		shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    		System.out.println("Shiro拦截器工厂类注入成功");
    		return shiroFilterFactoryBean;
    	}
    
    	@Bean
    	public SecurityManager securityManager() {
    		DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
    		// 设置realm.
    		securityManager.setRealm(myShiroRealm());
    		return securityManager;
    	}
    
    	/**
    	 * 身份认证realm; (这个需要自己写，账号密码校验；权限等)
    	 *
    	 */
    	@Bean
    	public MyShiroRealm myShiroRealm() {
    		return new MyShiroRealm();
    	}
    }

注：这里我登录页面访问的是login，form表单提交的是verify，所以需要打开verify的访问权限

@RequestMapping("/login")
    public String login() {
        return "login";
    }

filterChainDefinitionMap.put("/verify", "anon");

四、controller代码

package springboot.controller;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.IncorrectCredentialsException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.context.annotation.Bean;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.servlet.mvc.support.RedirectAttributes;
    import org.springframework.web.servlet.view.InternalResourceViewResolver;
    import springboot.shiro.User;
    
    import javax.servlet.http.HttpServletRequest;
    
    @Controller
    public class JspController {
        @RequestMapping("/verify")
        public String userlogin(User user, RedirectAttributes attr, Model model) {
            if(user.isEmpty()){return "login";}
            String username=user.getUsername();
            String password=user.getPassword();
            UsernamePasswordToken token = new UsernamePasswordToken(username,password,false);
            Subject currentUser = SecurityUtils.getSubject();
            try {
                //调用realm的认证方法
                currentUser.login(token);
            } catch(IncorrectCredentialsException e){
                model.addAttribute("message", "密码错误");
                return "login";
            } catch (AuthenticationException e) {
                attr.addFlashAttribute("test", "登录失败");
                return"redirect:/login?message='登录失败'";
            }
            return "redirect:/index";
        }
    
        @RequestMapping(value="logout",method =RequestMethod.GET)
        public String logout(HttpServletRequest request){
    
            //subject的实现类DelegatingSubject的logout方法，将本subject对象的session清空了
            //即使session托管给了redis ，redis有很多个浏览器的session
            //只要调用退出方法，此subject的、此浏览器的session就没了
            try {
                //退出
                SecurityUtils.getSubject().logout();
    
            } catch (Exception e) {
                System.err.println(e.getMessage());
            }
            return "login";
    
        }
    
        @RequestMapping(value="403")
        public String unAuth(){
    
            return "403";
        }
        
        @RequestMapping("/login")
        public String login() {
            return "login";
        }
    
        @Bean
        public InternalResourceViewResolver viewResolver() {
            InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
            viewResolver.setPrefix("/WEB-INF/");
            viewResolver.setSuffix(".jsp");
            return viewResolver;
        }
    
    }

注：

（1）登录调用了logout方法，清空了subject对象的session

SecurityUtils.getSubject().logout();

（2）如果使用重定向的话，可以使用RedirectAttributes对象传参数，Jsp页面接收值比较特殊

attr.addFlashAttribute("test", "登录失败");
    return"redirect:/login?message='登录失败'";

${sessionScope['org.springframework.web.servlet.support.SessionFlashMapManager.FLASH_MAPS'][0]['test']

（3）转发使用Model传参

model.addAttribute("message", "密码错误");
    return "login";

${message}

五、JSP页面代码

<%@ page language="java" contentType="text/html; charset=utf-8" pageEncoding="utf-8"%>
    <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
        <script type="text/javascript" src="js/jquery.min.js"></script>
        <script type="text/javascript" src="js/layer/layer.js"></script>
    </head>
    <body style="text-align: center">
        <form action="verify" method="post">
            <p>账号：<input type="text" name="username" value="admin"/></p>
            <p>密码：<input type="text" name="password" value="123456"/></p>
            <P><input type="checkbox" name="rememberMe" />记住我</P>
            <p><input type="submit" value="登录"/></p>
            <br/>
            <div>${sessionScope['org.springframework.web.servlet.support.SessionFlashMapManager.FLASH_MAPS'][0]['test']}${message}</div>
        </form>
    </body>
    <script type="text/javascript">
    
    </script>
    </html>