Shiro-认证思路分析及认证流程实现

素颜马尾好姑娘i 2022-04-08 12:26 259阅读 0赞

1、获取当前的Subject。调用SecurityUtils.getSubject()；  
2、测试当前的用户是否已经被认证。即是否已经登录。调用Subject的isAuthenticated()  
3、若没有被认证，则把用户名和密码封装为UsernamePasswordToken对象  
    1）创建一个表单页面  
    2）把请求提交到SpringMVC的Handler  
    3）获取用户名和密码  
4、执行登录：调用Subject的login（AuthenticationToken）方法。  
5、自定义Realm的方法，从数据库中获取对应的记录，返回给Shiro。  
    1）实际上需要继承org.apache.shiro.realm.AuthenticatingRealm类，org.apache.shiro.realm.AuthenticatingRealm间接实现了Realm接口  
    2）实现doGetAuthenticationInfo（AuthenticationToken）方法。  
6、由shiro完成对密码的比对。

项目结构

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2NzIyMDM5_size_16_color_FFFFFF_t_70][]

### 1、整合spirng和shiro ###

web.xml

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	version="2.5">
    
    	
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:applicationContext.xml</param-value>
    	</context-param>
    
    	
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    
    	
    	<filter>
    		<filter-name>shiroFilter</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    		<init-param>
    			<param-name>targetFilterLifecycle</param-name>
    			<param-value>true</param-value>
    		</init-param>
    	</filter>
    
    	<filter-mapping>
    		<filter-name>shiroFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    
    
    	
    	<servlet>
    		<servlet-name>spring</servlet-name>
    		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    		<load-on-startup>1</load-on-startup>
    	</servlet>
    
    	
    	<servlet-mapping>
    		<servlet-name>spring</servlet-name>
    		<url-pattern>/</url-pattern>
    	</servlet-mapping>
    
    </web-app>

spring配置文件

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    
    
    	
    	<bean id="securityManager"
    		class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    		<property name="cacheManager" ref="cacheManager" />
    		
    		<property name="sessionMode" value="native" />
    		<property name="realm" ref="jdbcRealm" />
    	</bean>
    
    	
    	<bean id="cacheManager"	class="org.apache.shiro.cache.ehcache.EhCacheManager">
    		<property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
    	</bean>
    
    	
    	
    	<bean id="jdbcRealm" class="com.atguigu.shiro.realms.ShiroRealm"></bean>
    
    	
    	
    	
    	<bean id="lifecycleBeanPostProcessor"
    		class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
    	
    	<bean
    		class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
    		depends-on="lifecycleBeanPostProcessor" />
    	<bean
    		class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    		<property name="securityManager" ref="securityManager" />
    	</bean>
    
    	
    	<bean id="shiroFilter"
    		class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    		<property name="securityManager" ref="securityManager" />
    		<property name="loginUrl" value="/login.jsp" />
    		<property name="successUrl" value="/list.jsp" />
    		<property name="unauthorizedUrl" value="/unauthorized.jsp" />
    		
    		<property name="filterChainDefinitions">
    			<value>
    				/login.jsp = anon
    				/shiro/login = anon
    				
    				# everything else requires authentication:
    				/** = authc
    				
    				/list.jsp = anon
    			</value>
    		</property>
    	</bean>
    
    
    </beans>

ehcache.xml

### 2、编码实现 ###

<form action="shiro/login" method="post">
    		UserName:<input name="username" type="text"/>
    		
    		<br><br>
    		
    		PassWord:<input name="password" type="password"/>
    		
    		<br><br>
    		
    		<input type="submit" value="Submit"/>
    	</form>

ShiroHandler.java

package com.atguigu.shiro.handlers;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.RequestParam;
    
    /**
     * 实现Shiro认证
     * @author Lee
     *
     */
    @Controller
    @RequestMapping("/shiro")
    public class ShiroHandler {
    
    	@RequestMapping(value="/login",method=RequestMethod.POST)
    	public String login(@RequestParam("username") String username,@RequestParam("password") String password) {
    		System.out.println(username + "" + password);
    		Subject currentUser = SecurityUtils.getSubject();
    		
    		if (!currentUser.isAuthenticated()) {
    			UsernamePasswordToken token = new UsernamePasswordToken(username, password);
    			token.setRememberMe(true);
    			System.out.println(token.hashCode());
    			try {
    				currentUser.login(token);
    			} catch (AuthenticationException e) {
    				System.out.println("登陆失败");
    				e.printStackTrace();
    			}
    		}
    		return "redirect:/list.jsp";
    	}
    	
    }

ShiroRealm.java

package com.atguigu.shiro.realms;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.realm.AuthenticatingRealm;
    
    /**
     * 
     * @author Lee
     *
     */
    public class ShiroRealm extends AuthenticatingRealm{
    
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    		System.out.println("doGetAuthenticationInfo" + token);
    		System.out.println(token.hashCode());
    		return null;
    	}
    
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3FxXzM2NzIyMDM5_size_16_color_FFFFFF_t_70]: /images/20220405/928224f9b9a3416ea31c699986d0f2a7.png