Shiro之加密加盐及凭证验证

我就是我 2022-05-21 09:57 240阅读 0赞

MD5加密在Shiro中使用极其简单:

shiro中工具类:**`SimpleHash`**

//SimpleHash构造器
    SimpleHash(String algorithmName, Object source, Object salt, int hashIterations)

参数解释:

<table> 
 <thead> 
  <tr> 
   <th>参数名</th> 
   <th>参数解释</th> 
   <th>参数数据类型</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>algorithmName</td> 
   <td>加密类型[MD5、Md2、Sha1、Sha256等]</td> 
   <td>String</td> 
  </tr> 
  <tr> 
   <td>source</td> 
   <td>要加密的对象</td> 
   <td>Object</td> 
  </tr> 
  <tr> 
   <td>salt</td> 
   <td>加盐对象，如果不打算加密时进行加盐则传null</td> 
   <td>Object</td> 
  </tr> 
  <tr> 
   <td>hashIterations</td> 
   <td>对目标对象加密次数,次数越多可靠性越高。同时越复杂</td> 
   <td>int</td> 
  </tr> 
 </tbody> 
</table>

使用示例:

//SimpleHash加密
    SimpleHash simpleHash2 = new SimpleHash("MD5", "123456", salt, 0);
    //输出加密后结果[直接输出对象，或调用toString方法后就是加密结果]
    System.out.println(simpleHash2);

Shrio中可以通过修改实现了`Realm`接口的自定义`Realm`中的`credentialsMatcher`属性所对应的证书匹配器来使用加密设置。常用的是其实现类`HashedCredentialsMatcher`对象,在整合了Spring之后Spring的配置中如下:

<bean id="jdbcRealm" class="com.heiketu.shiro.realm.ShiroRealm">
        
        <property name="credentialsMatcher">
            
            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                
                <property name="hashAlgorithmName" value="MD5"></property>
            </bean>
        </property>
    </bean>
    
    
    
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="cacheManager" ref="cacheManager" />
        
        <property name="realm" ref="jdbcRealm" />
    </bean>
    
    
    
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor" />
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager" />
    </bean>
    
    <bean id="secureRemoteInvocationExecutor" class="org.apache.shiro.spring.remoting.SecureRemoteInvocationExecutor">
        <property name="securityManager" ref="securityManager" />
    </bean>
    
    
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        
        <property name="loginUrl" value="/login.jsp" />
        
        <property name="successUrl" value="/success.jsp" />
        
        <property name="unauthorizedUrl" value="/unauthorized.jsp" />
        
        <property name="filterChainDefinitions">
            <value>
                
                /login.jsp = anon
                /shiroRequest/login = anon
                /shiro/logout = logout
                
                /** = authc
            </value>
        </property>
    </bean>

注:如果自定义`Realm`是继承自`AuthenticatingRealm`实现类，则需要实现:`AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0)`抽象方法。

`Shiro中doGetAuthenticationInfo方法的示例代码如下:`

@Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0) throws AuthenticationException {
        //强转UsernamePasswordToken
        UsernamePasswordToken upToken = (UsernamePasswordToken)arg0;
    
        //用户名
        String username = upToken.getUsername();
        if("unkown".equals(username)) {
            throw new UnknownAccountException("未知用户");
        }
    
        //principal
        Object principal = username;
        //密码:加盐
        ByteSource bytes = ByteSource.Util.bytes("admin");
        String pass = new SimpleHash("MD5", "123456", bytes, 0).toString();
        String name2 = getName();
        //不加盐的设置
        //AuthenticationInfo info = new SimpleAuthenticationInfo(principal, pass, name2);
        AuthenticationInfo info = new SimpleAuthenticationInfo(username, pass, bytes, getName());
        return info;
    }