shiro加密认证-多realm下

喜欢ヅ旅行 2024-04-17 20:10 89阅读 0赞

前面有说到一个realm下，如果有多realm下呢？

比如有两个数据库，一个MySQL使用MD5加密，而另一个oracle使用SHA1加密，那么该如何写呢？

这里先介绍一下认证策略。

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70][]

我们在realms文件夹下新建立一个SecondRealm.java:

package com.atguigu.shiro.realms;
    
    import org.apache.shiro.authc.*;
    import org.apache.shiro.crypto.hash.SimpleHash;
    import org.apache.shiro.realm.AuthenticatingRealm;
    import org.apache.shiro.util.ByteSource;
    
    public class SecondRealm extends AuthenticatingRealm {
        @Override
        protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
            System.out.println("[SecondRealm]+doGetAuthenticationInfo");
            //1.把AuthenticationToken对象装换为UsernamePasswordToken
            UsernamePasswordToken upToken= (UsernamePasswordToken) token;
            //2.从UsernamePasswordToken中来获取username
            String username = upToken.getUsername();
            //3.调用数据库的方法，从数据库中查询username对应的记录
            System.out.println("从数据库中获取username："+username+"所对应的信息");
            //4.若用户不存在，则可以抛出UnKnownAccountException异常
            if("unknown".equals(username))
            {
                throw new UnknownAccountException("用户不存在！");
            }
            //5.根据用户信息的情况，决定是否需要抛出其他的AuthenticationException异常
            if("monster".equals(username))
            {
                throw new LockedAccountException("用户被锁定！");
            }
            //6.根据用户的情况，来构建AuthenticationInfo对象并且返回
            //通常使用的实现类是SimpleAuthenticationInfo
            //以下信息从数据库中获取
            //<1.principal:认证的实体信息，可以是username也可以是数据表对应的实体类对象
            Object principal=username;
            //<2.credentials:密码
            Object credentials=null;
            if("admin".equals(username))
            {
                credentials="ce2f6417c7e1d32c1d81a797ee0b499f87c5de06";
            }else if("user".equals(username))
            {
                credentials="073d4c3ae812935f23cb3f2a71943f49e082a718";
            }
            //<3.realName：当前realm对象的name，调用父类对象的getName（）方法即可
            String realmName=getName();
            //<4 盐值 这个盐值要唯一，我们假设这里用户名是唯一的，我们使用用户名作为盐值
            //盐值的作用：如果两个人的密码一样的话，就要盐值，就像西红柿，家不同的盐味道不一样！
            ByteSource credentialsSalt=ByteSource.Util.bytes(username);
            SimpleAuthenticationInfo info=null;
            info=new SimpleAuthenticationInfo(principal,credentials,credentialsSalt,realmName);
            return info;
        }
    
        public static void main(String[] args) {
            String algorithmName="SHA1";
            Object credentials="123456";
            Object salt=ByteSource.Util.bytes("admin");
            int hashIterations=1024;
            Object result = new SimpleHash(algorithmName, credentials, salt, hashIterations);
            System.out.println(result);
        }
    }

而后需要修改applicationContext.xml:

修改后如图：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
           xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    
        
        
        
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
            <property name="cacheManager" ref="cacheManager"/>
            
            
            
            <property name="authenticator" ref="authenticator"></property>
              <property name="realms">
                <list>
                    <ref bean="jdbcRealm"></ref>
                    <ref bean="secondRealm"></ref>
                </list>
            </property>
        </bean>
    
        
        
        <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
            
            
            <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
        </bean>
    
    
        
        <bean id="authenticator" class="org.apache.shiro.authc.pam.ModularRealmAuthenticator">
          
            
            <property name="authenticationStrategy">
                <bean class="org.apache.shiro.authc.pam.AllSuccessfulStrategy"></bean>
            </property>
        </bean>
        
        
        <bean id="jdbcRealm" class="com.atguigu.shiro.realms.ShiroRealm">
            <property name="credentialsMatcher">
                <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                    <property name="hashAlgorithmName" value="MD5"></property>
                    <property name="hashIterations" value="1024"></property>
                </bean>
            </property>
        </bean>
        <bean id="secondRealm" class="com.atguigu.shiro.realms.SecondRealm">
            <property name="credentialsMatcher">
                <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                    <property name="hashAlgorithmName" value="SHA1"></property>
                    <property name="hashIterations" value="1024"></property>
                </bean>
            </property>
        </bean>
        
        
        
        <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
        
        
        <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
              depends-on="lifecycleBeanPostProcessor"/>
        <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
            <property name="securityManager" ref="securityManager"/>
        </bean>
    
        
        
        <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
            <property name="securityManager" ref="securityManager"/>
            <property name="loginUrl" value="/login.jsp"/>
            <property name="successUrl" value="/list.jsp"/>
            <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
            
    
            <property name="filterChainDefinitions">
                <value>
                    /login.jsp = anon
                    /shiro/login = anon
                    /shiro/logout = logout
                    # everything else requires authentication:
                    /** = authc
                </value>
            </property>
        </bean>
    
    
    </beans>

这样就ok了。

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MTA2MDkwNQ_size_16_color_FFFFFF_t_70]: https://image.dandelioncloud.cn/pgy_files/images/2024/04/17/bdc0d231942746f4b5d7c4cc0d7e21d9.png