采用shiro实现登录认证与权限授权管理

曾经终败给现在 2022-09-22 00:32 325阅读 0赞

Shiro 是Shiro 是一个 Apache 下的一开源项目项目，旨在简化身份验证和授权。

本文中记录的是一次使用shiro实现登录认证与权限授权的过程。

本文中主要用的技术有：

spring,springMVC,maven,shiro

## 1 shiro的配置，通过maven加入shiro相关jar包 ##

<dependency>
 			<groupId>org.apache.shiro</groupId>
 			<artifactId>shiro-core</artifactId>
 			<version>1.2.1</version>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.shiro</groupId>
 			<artifactId>shiro-web</artifactId>
 			<version>1.2.1</version>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.shiro</groupId>
 			<artifactId>shiro-ehcache</artifactId>
 			<version>1.2.1</version>
 		</dependency>
 		<dependency>
 			<groupId>org.apache.shiro</groupId>
 			<artifactId>shiro-spring</artifactId>
 			<version>1.2.1</version>
 		</dependency>

## 2 在web.xml中添加shiro过滤器 ##

<?xml version="1.0" encoding="UTF-8"?>
 <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 	xmlns="http://java.sun.com/xml/ns/j2ee" xmlns:javaee="http://java.sun.com/xml/ns/javaee"
 	xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
 	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd"
 	id="WebApp_ID" version="2.4">
 
 	
 	<context-param>
 		<param-name>contextConfigLocation</param-name>
 		<param-value>classpath:application-context-*.xml</param-value>
 	</context-param>
 	<listener>
 		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 	</listener>
 	
 	<filter>
 		<filter-name>CharacterEncodingFilter</filter-name>
 		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
 		<init-param>
 			<param-name>encoding</param-name>
 			<param-value>utf-8</param-value>
 		</init-param>
 	</filter>
 	<filter-mapping>
 		<filter-name>CharacterEncodingFilter</filter-name>
 		<url-pattern>/*</url-pattern>
 	</filter-mapping>
 	
 	<filter>
 		<filter-name>shiroFilter</filter-name>
 		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 	</filter>
 	<filter-mapping>
 		<filter-name>shiroFilter</filter-name>
 		<url-pattern>/admin/*</url-pattern>
 	</filter-mapping>
 	
 	<servlet>
 		<servlet-name>back</servlet-name>
 		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
 		<init-param>
 			<param-name>contextConfigLocation</param-name>
 			<param-value>classpath:springmvc.xml</param-value>
 		</init-param>
 	</servlet>
 	<servlet-mapping>
 		<servlet-name>back</servlet-name>
 		<url-pattern>*.do</url-pattern>
 	</servlet-mapping>
 	<display-name>Archetype Created Web Application</display-name>
 </web-app>

## 3 spring中对shiro配置 ##

<beans xmlns="http://www.springframework.org/schema/beans"
 	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc"
 	xmlns:context="http://www.springframework.org/schema/context"
 	xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"
 	xsi:schemaLocation="http://www.springframework.org/schema/beans 
 		http://www.springframework.org/schema/beans/spring-beans-3.2.xsd 
 		http://www.springframework.org/schema/mvc 
 		http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd 
 		http://www.springframework.org/schema/context 
 		http://www.springframework.org/schema/context/spring-context-3.2.xsd 
 		http://www.springframework.org/schema/aop 
 		http://www.springframework.org/schema/aop/spring-aop-3.2.xsd 
 		http://www.springframework.org/schema/tx 
 		http://www.springframework.org/schema/tx/spring-tx-3.2.xsd ">
 
 	
 	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
 		
 		<property name="securityManager" ref="securityManager" />
 		
 		<property name="loginUrl" value="/admin/login.do" />
 		
 		<property name="successUrl" value="/admin/index.do" />
 		
 		<property name="unauthorizedUrl" value="/refuse.jsp" />
 		
 		<property name="filters">
 			<map>
 				
 				<entry key="authc" value-ref="formAuthenticationFilter" />
 			</map>
 		</property>
 		<property name="filterChainDefinitions">
 			<value>
 				
 				/images/** = anon
 				/js/** = anon
 				/styles/** = anon
 				
 				/validatecode.jsp = anon
 				
 				/admin/logout.do = logout
 				
 				
 				
 				/welcome.jsp = user
 				/admin/index.do = user
 				
 				/** = authc
 			</value>
 		</property>
 	</bean>
 
 	
 	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
 		<property name="realm" ref="customRealm" />
 		
 		<property name="cacheManager" ref="cacheManager" />
 		
 		
 		
 		<property name="rememberMeManager" ref="rememberMeManager" />
 	</bean>
 
 	
 	<bean id="customRealm" class="com.zhijianj.stucheck.shiro.CustomRealm">
 		
 		
 	</bean>
 
 	
 	<bean id="credentialsMatcher"
 		class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
 		
 		<property name="hashAlgorithmName" value="md5" />
 		
 		<property name="hashIterations" value="1" />
 	</bean>
 
 	
 	
 	
 	<bean id="formAuthenticationFilter"
 		class="com.zhijianj.stucheck.shiro.CustomFormAuthenticationFilter ">
 		
 		<property name="usernameParam" value="username" />
 		
 		<property name="passwordParam" value="password" />
 		
 		<property name="rememberMeParam" value="rememberMe" />
 	</bean>
 	
 	<bean id="sessionManager"
 		class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
 		
 		<property name="globalSessionTimeout" value="600000" />
 		
 		<property name="deleteInvalidSessions" value="true" />
 	</bean>
 	
 	<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
 		<property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml" />
 	</bean>
 	
 	<bean id="rememberMeManager" class="org.apache.shiro.web.mgt.CookieRememberMeManager">
 		<property name="cookie" ref="rememberMeCookie" />
 	</bean>
 	
 	<bean id="rememberMeCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
 		
 		<constructor-arg value="rememberMe" />
 		
 		<property name="maxAge" value="2592000" />
 	</bean>
 </beans>

在上面的配置中每次开启了sessionManager都会出问题在这里将它注释掉了。

其次，上面中的配置也是将credentialsMatcher没有加入了，这种方式适用于没有对密码进行处理的情况。

其中CustomRealm的配置是重点。

## 4 自定义Realm编码 ##

CustomRealm如下：

public class CustomRealm extends AuthorizingRealm {
 	// 设置realm的名称
 	@Override
 	public void setName(String name) {
 		super.setName("customRealm");
 	}
 
 	@Autowired
 	private AdminUserService adminUserService;
 
 	/**
 	 * 认证
 	 */
 	@Override
 	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
 
 		// token中包含用户输入的用户名和密码
 		// 第一步从token中取出用户名
 		String userName = (String) token.getPrincipal();
 		// 第二步：根据用户输入的userCode从数据库查询
 		TAdminUser adminUser = adminUserService.getAdminUserByUserName(userName);
 		// 如果查询不到返回null
 		if (adminUser == null) {//
 			return null;
 		}
 		// 获取数据库中的密码
 		String password = adminUser.getPassword();
 		/**
 		 * 认证的用户,正确的密码
 		 */
 		AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(adminUser, password, this.getName());
 //MD5 加密+加盐+多次加密
 //SimpleAuthenticationInfo authcInfo = new SimpleAuthenticationInfo(adminUser, password,ByteSource.Util.bytes(salt), this.getName());
 		return authcInfo;
 	}
 
 	/**
 	 * 授权,只有成功通过doGetAuthenticationInfo方法的认证后才会执行。
 	 */
 	@Override
 	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
 		// 从 principals获取主身份信息
 		// 将getPrimaryPrincipal方法返回值转为真实身份类型（在上边的doGetAuthenticationInfo认证通过填充到SimpleAuthenticationInfo中身份类型），
 		TAdminUser activeUser = (TAdminUser) principals.getPrimaryPrincipal();
 		// 根据身份信息获取权限信息
 		// 从数据库获取到权限数据
 		TAdminRole adminRoles = adminUserService.getAdminRoles(activeUser);
 		// 单独定一个集合对象
 		List<String> permissions = new ArrayList<String>();
 		if (adminRoles != null) {
 			permissions.add(adminRoles.getRoleKey());
 		}
 		// 查到权限数据，返回授权信息(要包括 上边的permissions)
 		SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
 		// 将上边查询到授权信息填充到simpleAuthorizationInfo对象中
 		simpleAuthorizationInfo.addStringPermissions(permissions);
 		return simpleAuthorizationInfo;
 	}
 
 	// 清除缓存
 	public void clearCached() {
 		PrincipalCollection principals = SecurityUtils.getSubject().getPrincipals();
 		super.clearCache(principals);
 	}
 }

## 5 缓存配置 ##

ehcache.xml代码如下：

通过使用ehache中就避免第次都向服务器发送权限授权( doGetAuthorizationInfo)的请求。

## 6.自定义表单编码过滤器 ##

CustomFormAuthenticationFilter代码，认证之前调用，可用于验证码校验

public class CustomFormAuthenticationFilter extends FormAuthenticationFilter {
    	// 原FormAuthenticationFilter的认证方法
    	@Override
    	protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
    		// 在这里进行验证码的校验
    
    		// 从session获取正确验证码
    		HttpServletRequest httpServletRequest = (HttpServletRequest) request;
    		HttpSession session = httpServletRequest.getSession();
    		// 取出session的验证码（正确的验证码）
    		String validateCode = (String) session.getAttribute("validateCode");
    
    		// 取出页面的验证码
    		// 输入的验证和session中的验证进行对比
    		String randomcode = httpServletRequest.getParameter("randomcode");
    		if (randomcode != null && validateCode != null && !randomcode.equals(validateCode)) {
    			// 如果校验失败，将验证码错误失败信息，通过shiroLoginFailure设置到request中
    			httpServletRequest.setAttribute("shiroLoginFailure", "randomCodeError");
    			// 拒绝访问，不再校验账号和密码
    			return true;
    		}
    		return super.onAccessDenied(request, response);
    	}
    }

在此符上验证码jsp界面的代码

validatecode.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
 pageEncoding="UTF-8"%>
 <%@ page import="java.util.Random"%>
 <%@ page import="java.io.OutputStream"%>
 <%@ page import="java.awt.Color"%>
 <%@ page import="java.awt.Font"%>
 <%@ page import="java.awt.Graphics"%>
 <%@ page import="java.awt.image.BufferedImage"%>
 <%@ page import="javax.imageio.ImageIO"%>
 <%
 	int width = 60;
 	int height = 32;
 	//create the image
 	BufferedImage image = new BufferedImage(width, height, BufferedImage.TYPE_INT_RGB);
 	Graphics g = image.getGraphics();
 	// set the background color
 	g.setColor(new Color(0xDCDCDC));
 	g.fillRect(0, 0, width, height);
 	// draw the border
 	g.setColor(Color.black);
 	g.drawRect(0, 0, width - 1, height - 1);
 	// create a random instance to generate the codes
 	Random rdm = new Random();
 	String hash1 = Integer.toHexString(rdm.nextInt());
 	// make some confusion
 	for (int i = 0; i < 50; i++) {
 		int x = rdm.nextInt(width);
 		int y = rdm.nextInt(height);
 		g.drawOval(x, y, 0, 0);
 	}
 	// generate a random code
 	String capstr = hash1.substring(0, 4);
 	//将生成的验证码存入session
 	session.setAttribute("validateCode", capstr);
 	g.setColor(new Color(0, 100, 0));
 	g.setFont(new Font("Candara", Font.BOLD, 24));
 	g.drawString(capstr, 8, 24);
 	g.dispose();
 	//输出图片
 	response.setContentType("image/jpeg");
 	out.clear();
 	out = pageContext.pushBody();
 	OutputStream strm = response.getOutputStream();
 	ImageIO.write(image, "jpeg", strm);
 	strm.close();
 %>

## 7.登录控制器方法 ##

/**
    	 * 到登录界面
    	 * 
    	 * @return
    	 * @throws Exception
    	 */
    	@RequestMapping("login.do")
    	public String adminPage(HttpServletRequest request) throws Exception {
    		// 如果登陆失败从request中获取认证异常信息，shiroLoginFailure就是shiro异常类的全限定名
    		String exceptionClassName = (String) request.getAttribute("shiroLoginFailure");
    		// 根据shiro返回的异常类路径判断，抛出指定异常信息
    		if (exceptionClassName != null) {
    			if (UnknownAccountException.class.getName().equals(exceptionClassName)) {
    				// 最终会抛给异常处理器
    				throw new CustomJsonException("账号不存在");
    			} else if (IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {
    				throw new CustomJsonException("用户名/密码错误");
    			} else if ("randomCodeError".equals(exceptionClassName)) {
    				throw new CustomJsonException("验证码错误 ");
    			} else {
    				throw new Exception();// 最终在异常处理器生成未知错误
    			}
    		}
    		// 此方法不处理登陆成功（认证成功），shiro认证成功会自动跳转到上一个请求路径
    		// 登陆失败还到login页面
    		return "admin/login";
    	}

## 8.用户回显Controller ##

当用户登录认证成功后，CustomRealm在调用完doGetAuthenticationInfo时，通过

AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(adminUser, password, this.getName());
    		return authcInfo;

SimpleAuthenticationInfo构造参数的第一个参数传入一个用户的对象，之后，可通过Subject subject = SecurityUtils.getSubject();中的subject.getPrincipal()获取到此对象。

所以需要回显用户信息时，我这样调用的

@RequestMapping("index.do")
    	public String index(Model model) {
    		//从shiro的session中取activeUser
    		Subject subject = SecurityUtils.getSubject();
    		//取身份信息
    		TAdminUser adminUser = 	(TAdminUser) subject.getPrincipal();
    		//通过model传到页面
    		model.addAttribute("adminUser", adminUser);
    		return "admin/index";
    	}

## 9.在jsp页面中控制权限 ##

先引入shiro的头文件

<%@ taglib uri="http://shiro.apache.org/tags" prefix="shiro"%>

采用shiro标签对权限进行处理

<shiro:hasPermission name="curd">
 					 
 					我拥有超级的增删改查权限额
 				</shiro:hasPermission>

## 10.在Controller控制权限 ##

通过@RequiresPermissions注解，指定执行此controller中某个请求方法需要的权限

@RequestMapping("/queryInfo.do")
    	@RequiresPermissions("q")//执行需要"q"权限
    	public ModelAndView queryItems(HttpServletRequest request) throws Exception {

## 11.MD5加密加盐处理 ##

这里以修改密码为例,通过获取新的密码(明文)后通过MD5加密+加盐+6次加密为例

@RequestMapping("updatePassword.do")
    	@ResponseBody
    	public String updateAdminUserPassword(String newPassword) {
    		// 从shiro的session中取activeUser
    		Subject subject = SecurityUtils.getSubject();
    		// 取身份信息
    		TAdminUser adminUser = (TAdminUser) subject.getPrincipal();
    		// 生成salt,随机生成
    		SecureRandomNumberGenerator secureRandomNumberGenerator = new SecureRandomNumberGenerator();
    		String salt = secureRandomNumberGenerator.nextBytes().toHex();
    		Md5Hash md5 = new Md5Hash(newPassword, salt, 6);
    		String newMd5Password = md5.toHex();
    		// 设置新密码
    		adminUser.setPassword(newMd5Password);
    		// 设置盐
    		adminUser.setSalt(salt);
    		adminUserService.updateAdminUserPassword(adminUser);
    		return newPassword;
    	}

ok!编码完成后对此WEB程序跑一下，截图符几张：

当前用户信息和权限信息表截图如下

系统管理员表：

![Center][]

权限表：

![Center 1][]

管理员权限关系中间表：

![Center 2][]

![Center 3][]

![Center 4][]

[Center]: /images/20220721/d019f15c7520441086256bc94c7332f6.png
[Center 1]: /images/20220721/90e2c6355d104045b61f5b12622e4f93.png
[Center 2]: /images/20220721/e54a663959d64ab0913290d898e320de.png
[Center 3]: /images/20220721/bc867470095946e586e7d7c4f5047b1d.png
[Center 4]: /images/20220721/2f013e1435ec4414b6037a3626b8b19c.png