Shiro基本用法一

ゞ浴缸里的玫瑰 2023-09-29 19:23 24阅读 0赞

## 1.什么是Shiro? ##

Shiro是一个Java的安全（权限）框架。  
Shiro可以完成，认证，授权，加密，会话管理，Web集成，缓存等。  
•官网: http://shiro.apache.org/

### 1.2有哪些功能 ###

![在这里插入图片描述][445e37c0b6c64210819b930c4de30701.jpeg_pic_center]

![在这里插入图片描述][37fff610351244f299af5fd37bf72c9c.jpeg_pic_center]

![在这里插入图片描述][6d717f43929246cc9e3951b61c5c9f2f.jpeg_pic_center]

## 2.Shiro架构(外部) ##

从外部来看Shiro，即从应用程序角度来观察如何使用shiro完成工作:  
![在这里插入图片描述][6cbcad1bb5884b43814339fa220a9e65.jpeg_pic_center]  
![在这里插入图片描述][dee00dac9ad946909400288eaeeaca4e.jpeg_pic_center]

主要的核心是subject\\shiro\\realm  
Subject:代表的是当前用户，到时候可以通过我们的对象获取subject  
shiroSecurityManager:安全管理器，是安全核心，他管理所有的subject.所以我们会从它里面来获取我们的subject对象  
realm:是用来保证我们的数据访问控制，跟我们的数据打交道，是数据层

## 2、HelloWorld ##

### 2.1、快速实践 ###

查看官网文档: http://shiro.apache.org/tutorial.html  
官方的quickstart: https://github.com/apache/shiro/tree/master/samples/quickstart/  
1.创建一个maven父工程，用于学习Shiro，删掉不必要的东西  
2.创建一个普通的Maven子工程: shiro-01-helloworld  
3.根据官方文档，我们来导入Shiro的依赖

<?xml version="1.0" encoding="UTF-8"?>
    <project xmlns="http://maven.apache.org/POM/4.0.0"
             xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
             xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
        <parent>
            <artifactId>springboot-shiro</artifactId>
            <groupId>com.xyh</groupId>
            <version>1.0-SNAPSHOT</version>
        </parent>
        <modelVersion>4.0.0</modelVersion>
    
        <artifactId>hello-shiro</artifactId>
        <dependencies>
            <dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-core</artifactId>
                <version>1.4.1</version>
            </dependency>
            
            
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>jcl-over-slf4j</artifactId>
                <version>1.7.21</version>
            </dependency>
    
            <dependency>
                <groupId>org.slf4j</groupId>
                <artifactId>slf4j-log4j12</artifactId>
                <version>1.7.21</version>
            </dependency>
    
            <dependency>
                <groupId>log4j</groupId>
                <artifactId>log4j</artifactId>
                <version>1.2.17</version>
            </dependency>
        </dependencies>
    </project>

4.导入log4j.properties配置文件

log4j.rootLogger=DEBUG, Console
    #Console
    log4j.appender.Console=org.apache.log4j.ConsoleAppender
    log4j.appender.Console.layout=org.apache.log4j.PatternLayout
    log4j.appender.Console.layout.ConversionPattern=%d [%t] %-5p [%c] - %m%n
    log4j.logger.java.sql.ResultSet=INFO
    log4j.logger.org.apache=INFO
    log4j.logger.java.sql.Connection=DEBUG
    log4j.logger.java.sql.Statement=DEBUG
    log4j.logger.java.sql.PreparedStatement=DEBUG

导入shiro.ini配置文件

[users]
    # user 'root' with password 'secret' and the 'admin' role
    root = secret, admin
    # user 'guest' with the password 'guest' and the 'guest' role
    guest = guest, guest
    # user 'presidentskroob' with password '12345' ("That's the same combination on
    # my luggage!!!" ;)), and role 'president'
    presidentskroob = 12345, president
    # user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz'
    darkhelmet = ludicrousspeed, darklord, schwartz
    # user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz'
    lonestarr = vespa, goodguy, schwartz
    
    # -----------------------------------------------------------------------------
    # Roles with assigned permissions
    # 
    # Each line conforms to the format defined in the
    # org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
    # -----------------------------------------------------------------------------
    [roles]
    # 'admin' role has all permissions, indicated by the wildcard '*'
    admin = *
    # The 'schwartz' role can do anything (*) with any lightsaber:
    schwartz = lightsaber:*
    # The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with
    # license plate 'eagle5' (instance specific id)
    goodguy = winnebago:drive:eagle5

导入quickstart

package com.example.hello_shiro;/*
     * Licensed to the Apache Software Foundation (ASF) under one
     * or more contributor license agreements.  See the NOTICE file
     * distributed with this work for additional information
     * regarding copyright ownership.  The ASF licenses this file
     * to you under the Apache License, Version 2.0 (the
     * "License"); you may not use this file except in compliance
     * with the License.  You may obtain a copy of the License at
     *
     *     http://www.apache.org/licenses/LICENSE-2.0
     *
     * Unless required by applicable law or agreed to in writing,
     * software distributed under the License is distributed on an
     * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
     * KIND, either express or implied.  See the License for the
     * specific language governing permissions and limitations
     * under the License.
     */
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.*;
    import org.apache.shiro.config.IniSecurityManagerFactory;
    import org.apache.shiro.mgt.SecurityManager;
    import org.apache.shiro.session.Session;
    import org.apache.shiro.subject.Subject;
    import org.apache.shiro.util.Factory;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    
    /**
     * Simple Quickstart application showing how to use Shiro's API.
     *
     * @since 0.9 RC2
     */
    public class Quickstart {
        
    
        private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);
    
    
        public static void main(String[] args) {
        
    
            // The easiest way to create a Shiro SecurityManager with configured
            // realms, users, roles and permissions is to use the simple INI config.
            // We'll do that by using a factory that can ingest a .ini file and
            // return a SecurityManager instance:
    
            // Use the shiro.ini file at the root of the classpath
            // (file: and url: prefixes load from files and urls respectively):
            Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
            SecurityManager securityManager = factory.getInstance();
    
            // for this simple example quickstart, make the SecurityManager
            // accessible as a JVM singleton.  Most applications wouldn't do this
            // and instead rely on their container configuration or web.xml for
            // webapps.  That is outside the scope of this simple quickstart, so
            // we'll just do the bare minimum so you can continue to get a feel
            // for things.
            SecurityUtils.setSecurityManager(securityManager);
    
            // Now that a simple Shiro environment is set up, let's see what you can do:
    
            // get the currently executing user:
            Subject currentUser = SecurityUtils.getSubject();
    
            // Do some stuff with a Session (no need for a web or EJB container!!!)
            Session session = currentUser.getSession();
            session.setAttribute("someKey", "aValue");
            String value = (String) session.getAttribute("someKey");
            if (value.equals("aValue")) {
        
                log.info("Retrieved the correct value! [" + value + "]");
            }
    
            // let's login the current user so we can check against roles and permissions:
            if (!currentUser.isAuthenticated()) {
        
                UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
                token.setRememberMe(true);
                try {
        
                    currentUser.login(token);
                } catch (UnknownAccountException uae) {
        
                    log.info("There is no user with username of " + token.getPrincipal());
                } catch (IncorrectCredentialsException ice) {
        
                    log.info("Password for account " + token.getPrincipal() + " was incorrect!");
                } catch (LockedAccountException lae) {
        
                    log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                            "Please contact your administrator to unlock it.");
                }
                // ... catch more exceptions here (maybe custom ones specific to your application?
                catch (AuthenticationException ae) {
        
                    //unexpected condition?  error?
                }
            }
    
            //say who they are:
            //print their identifying principal (in this case, a username):
            log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
    
            //test a role:
            if (currentUser.hasRole("schwartz")) {
        
                log.info("May the Schwartz be with you!");
            } else {
        
                log.info("Hello, mere mortal.");
            }
    
            //test a typed permission (not instance-level)
            if (currentUser.isPermitted("lightsaber:wield")) {
        
                log.info("You may use a lightsaber ring.  Use it wisely.");
            } else {
        
                log.info("Sorry, lightsaber rings are for schwartz masters only.");
            }
    
            //a (very powerful) Instance Level permission:
            if (currentUser.isPermitted("winnebago:drive:eagle5")) {
        
                log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
                        "Here are the keys - have fun!");
            } else {
        
                log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
            }
    
            //all done - log out!
            currentUser.logout();
    
            System.exit(0);
        }
    }

5.然后我们去运行quickstart类，基本入门就完成了

## 3.quickstart类内部代码分析 ##

1.获取Subject对象

Subject currentUser = SecurityUtils.getSubject();

2.获取session对象

Session session = currentUser.getSession();

3.判断当前用户是否被认证

if (!currentUser.isAuthenticated())

4.获取当前用户的一个认证

currentUser.getPrincipal()

5.用户是否拥有对应的角色

currentUser.hasRole("schwartz")

6.获取当前用户的有哪些权限

currentUser.isPermitted("lightsaber:wield")

7.注销

currentUser.logout();

具体的细节在quickstart代码中

## 4.在springBoot中去集成shiro ##

1.创建一个springBoot项目，内部去导入thymeleaf依赖。  
2.在resource的static中创建一个html页面  
3.创建controller层，内部写方法  
4.测试成功后就可以去整合shiro

subject：用户  
securityManager：管理所有用户  
Realm：连接数据库  
5.导入shiro-spring的依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.1</version>
            </dependency>

6.创建shiro的配置文件shiroConfig  
7.自定义realm对象  
8.创建add.html,update.html,搭建好环境

## 5.shiro实现登录拦截 ##

让有的用户能进去，有的用户进不去，去进行实现  
1.在shiroConfig中去配置内置过滤器

@Bean
        public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("scurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        
            ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
    //        设置安全管理器
            bean.setSecurityManager(defaultWebSecurityManager);
    /*       添加shiro的内置过滤器
            anon:无需认证就可以访问
            authc:必须认证了才能让问
            user:必须拥有记住我功能才能用，一般不会去使用
            perms :拥有对某个资源的权限才能访问;比如我们的管理员，就可以去访问我们的所有资源
            role：拥有某个角色权限才能访问
    */
    //        向bean中去设置值
            Map<String,String> filterMap = new LinkedHashMap<>();
    //        设置：这个路径下，需要被认证了才能访问，进行测试
            filterMap.put("/user/add","authc") ;
            filterMap.put("/user/update","authc" );
    
            bean.setFilterChainDefinitionMap(filterMap);
            return bean;
        }

然后启动项目进行测试，发现add和update都不能正常的访问，拦截成功。  
2.去写一个简单的登录页面去测试  
在controller中写一个跳转login界面的接口，然后去配置类中配置一下跳转，启动项目，当我们点add或者update是跳转到登录页面，证明拦截成功。  
3.配置类中的代码

@Bean
        public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("scurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        
            ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
    //        设置安全管理器
            bean.setSecurityManager(defaultWebSecurityManager);
    /*       添加shiro的内置过滤器
            anon:无需认证就可以访问
            authc:必须认证了才能让问
            user:必须拥有记住我功能才能用，一般不会去使用
            perms :拥有对某个资源的权限才能访问;比如我们的管理员，就可以去访问我们的所有资源
            role：拥有某个角色权限才能访问
    */
    //        登录拦截
    //        向bean中去设置值
            Map<String,String> filterMap = new LinkedHashMap<>();
    //        设置：这个路径下，需要被认证了才能访问，进行测试
    //        filterMap.put("/user/add","authc") ;
    //        filterMap.put("/user/update","authc");
            filterMap.put("/user/*","authc");//支持通配符的
            bean.setFilterChainDefinitionMap(filterMap);
    //        设置登录的请求
            bean.setLoginUrl("/toLogin");
            return bean;
        }

登录认证完成。

## 6.shiro实现用户的认证 ##

1.我们的用户信息都是放在realm对象中的，在controller写一个方法，用来获取用户信息

@RequestMapping("/login")
        public String login(String username,String password,Model model) {
        
            //获取当前的用户
            Subject subject = SecurityUtils.getSubject();
            //1封装用户的登录数据
            UsernamePasswordToken token = new UsernamePasswordToken(username, password);
            //执行登录的方法，如果没有异常，就登录成功了
    //        在quickstart中看到捕获了很多异常
            try {
        
                subject.login(token);
                ;//执行了登录操作，但是这里是看不到的
                return "index";
    //                如果用户名不存在就会报错
            } catch (UnknownAccountException e) {
        
                model.addAttribute("msg", "用户名错误");//提示给前端信息
                return "login";//跳转到登录页面
    
    //                密码不正确，会打印下面的日志信息
            } catch (IncorrectCredentialsException e) {
        
                model.addAttribute("msg", "密码错误");//提示给前端信息
                return "login";//跳转到登录页面
            }
        }

当我们在登录的时候就会去走认证的代码，这时就就可以在userRealm中做一些操作

//    认证
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        
    //        获取用户名和密码，从数据库中取,先伪造数据
            String name = "root" ;
            String password = "123456";
    //        在登录的时候会进到这个方法里面，token中封装了用户的信息
            UsernamePasswordToken userToken = (UsernamePasswordToken)token;
    //        进行比较
            if (!userToken.getUsername().equals(name)){
        
                return null;//抛出异常UnknownAccountException
            }
            System.out.println("执行了认证");
    
    //        密码认证,shiro做~
            return new SimpleAuthenticationInfo("" ,password, "");
        }

启动整个项目，就可以去测试我们的用户名和密码了，看看用户认证是否生效。

## 7.shiro整合 mybatis ##

1.导入相关的jar包资源  
2.写配置文件，配置数据源，mybatis映射路径等  
3.连接数据库，将UserRealm中原来的假数据换成数据库真是的数据。  
4.测试

## 8.shiro请求授权实现 ##

1.在我们的shiroConfig中在做过滤拦截时进行一些授权操作  
2.在controller中写为授权的跳转方法  
3.可以在我们的userRealm中给用户设置一些权限  
问题：当我们设置授权信息后，每个人进来都会有一样的授权信息，我们要求不一样的登录授权。  
4.在数据库中创建一个权限表  
5.在ShiroConfig配置类中进行授权操作，这样就是实现了不同用户有不同的权限

[445e37c0b6c64210819b930c4de30701.jpeg_pic_center]: https://img-blog.csdnimg.cn/445e37c0b6c64210819b930c4de30701.jpeg#pic_center
[37fff610351244f299af5fd37bf72c9c.jpeg_pic_center]: https://img-blog.csdnimg.cn/37fff610351244f299af5fd37bf72c9c.jpeg#pic_center
[6d717f43929246cc9e3951b61c5c9f2f.jpeg_pic_center]: https://img-blog.csdnimg.cn/6d717f43929246cc9e3951b61c5c9f2f.jpeg#pic_center
[6cbcad1bb5884b43814339fa220a9e65.jpeg_pic_center]: https://img-blog.csdnimg.cn/6cbcad1bb5884b43814339fa220a9e65.jpeg#pic_center
[dee00dac9ad946909400288eaeeaca4e.jpeg_pic_center]: https://img-blog.csdnimg.cn/dee00dac9ad946909400288eaeeaca4e.jpeg#pic_center