Shiro 认证Authentication(五)

青旅半醒 2024-02-18 20:46 32阅读 0赞

一.从应用程序的角度观察Shiro是如何完成工作!

![20180602170853107][]

二.认证的步骤:

1.获取当前的Subject .调用SecurityUtils.getSubject();
    2.测试当前的用户是否已经认证,即是否已登录,调用Subject的isAuthenticated()
    3.若没有被认证,则把用户名和密码封装为UsernamePaswordToken对象
     1)创建一个表单页面
     2)把请求提交到SpringMVC 的Handler
     3)获取用户名和密码
    4.执行登录:调用Subject的login(AuthenticationToken)方法.
    5.自定义Realm的方法,从数据库中获取对应的记录,返回给Shiro.
      1)实际上需要继承org.apache.shiro.realm.AuthenticatingRealm抽象类
      2)实现这个类中的doGetAuthenticationInfo(AuthenticationToken token)方法;
    6.由 Shiro完成密码的比对哦!

三.具体如下:

*在[Shiro 集成Spring详细介绍(四)][Shiro _Spring]基础上扩展哦!*

<h1>Login JSP!</h1>
    
    <form action="shiro/login" method="post">
     name:<input type="text" name="uname"/><p/>
     pass:<input type="password" name="upwd"/><p/>
    <input type="submit" value="login" name="sub"/>
    </form>

ShiroHandler类

@Controller
    @RequestMapping("/shiro")
    public class ShiroHandler {
    	@RequestMapping("/login")
    	public String login(@RequestParam("uname") String uname,@RequestParam("upwd") String upwd){
    		
    //		1.获取当前的Subject .调用SecurityUtils.getSubject();
    		Subject currentUser=SecurityUtils.getSubject();
    //		2.测试当前的用户是否已经认证,即是否已登录,调用Subject的isAuthenticated()
    		if(!currentUser.isAuthenticated()){
    			//将用户名和密码封装在UsernamePasswordToken对象中
    			UsernamePasswordToken token=new UsernamePasswordToken(uname, upwd);
    		    //记住哦
    			token.setRememberMe(true);
    			try {
    				//可以执行hashCode
    				System.out.println("token==>"+token.hashCode());
    				
    				//执行登录
    				currentUser.login(token);
    				
    			} catch (AuthenticationException e) {
    				// TODO: handle exception
    				System.out.println("登录失败:"+e.getMessage());
    			}
    		}
    		return "redirect:/list.jsp";
    	}
    
    }

ShiroRealm类

public class ShiroRealm extends AuthenticatingRealm {
    
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    		// TODO Auto-generated method stub
    	System.out.println("doGetAuthenticationInfo==>"+token.hashCode());
    return null
    }

application.xml文件

![20180602171548580][]

启动运行:

![20180602171601160][]

![20180602171609739][]

原因:请求的token与ShiroRealm中的token hashCode是相同;但在ShiroRealm中没有写代码实现哦!

ShiroRealm实现如下:

@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    		// TODO Auto-generated method stub
    		// System.out.println("doGetAuthenticationInfo==>"+token.hashCode());
    
    		// 1.把AuthenticationToken转换成UsernamePasswordToken
    
    		UsernamePasswordToken uToken = (UsernamePasswordToken) token;
    
    		// 2.从UsernamePasswordToken中取出username
    		String username = uToken.getUsername();
    
    		// 3.调用数据库的方法,从数据库中查询username对应的用户记录
    		System.out.println("从数据库中查询username:[" + username + "]对应用户记录");
    
    		// 4.若用户不存在,则可以抛出UnknowAccountException子类异常
    		if ("bear".equals(username)) {
    			throw new UnknownAccountException("用户不存在!");
    		}
    
    		// 5.根据用户信息情况,觉得是否需要抛出其他AuthenticationException异常
    		if ("angel".equals(username)) {
    			throw new LockedAccountException("用户被锁定!");
    		}
    
    		// 6.根据用户情况,来构建AuthenticationInfo对象返回,通常实现类SimpleAuthenticationInfo
    
    		// a)principal:认证实体信息,可以是username,也可以是数据库表对应的用户
    		Object principal = username;
    
    		// b)credentials: 密码
    		Object credentials = "aaa";
    		
    		// c)realmName:当前realm对象的name,调用父类的getName()方法;
    		String realmName = getName();
    
    		// 认证对象
    		SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(principal, credentials, realmName);
    
    		return info;
    	}

运行测试如下:

**(1)angel用户登录!**

![2018060411081192][]

**(2)qq用户登录!就登录成功!**

![20180604111602559][]

**那么其他页面就可以访问了!**

![20180604111909655][]

**(3)bear用户登录!**

**![20180604111817503][]**

(4)如果是退回

![20180604112015793][]

(5)如何解决这个问题了呢? 用登出

![20180604112041860][]

(6)单击就ok了!重新登录哦!

![20180604112114588][]

[20180602170853107]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/da0cabe39ee2401eaf98fcf9eb37ea06.png
[Shiro _Spring]: https://mp.csdn.net/postedit/80547649
[20180602171548580]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/880ad97bd2da44ecbee29f5715da46f2.png
[20180602171601160]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/95af2179a0a34b66a7e103a61611d34a.png
[20180602171609739]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/ebb6d41ec007428f9a988979fe1e9d15.png
[2018060411081192]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/dac974e76d7c408a83e93430425081bf.png
[20180604111602559]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/15dea86263084338819290c81eb3b423.png
[20180604111909655]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/db7ba3e0173f4ab6975b922a1be0dafb.png
[20180604111817503]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/bd2f59d23ef34cd5a9e375337f802402.png
[20180604112015793]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/cde1838496184eefa83e57319b543005.png
[20180604112041860]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/3a4395be1cd74a98b4ce33ee9da3ed11.png
[20180604112114588]: https://image.dandelioncloud.cn/pgy_files/images/2024/01/29/9e697b65460346c0b6b361d8ac444546.png