SpringBoot学习－（二十五）SpringBoot整合Shiro（详细版本）

其他 2018-06-05 12:12:30 阅读次数: 1

整合内容包括

  • 自定义realm，实现认证和授权
  • 自定义加密，实现密码加密验证
  • 自定义Cachemanager、Cache，实现Shiro的cache管理，存储在redis中
  • 自定义SessionManager、SessionDao、SessionIdCookie，实现Shiro的session管理，存储在redsi中
  • 自定义RememberMeManager、RemeberMeCookie，实现Shiro记住我的功能

添加maven依赖

<!-- spring整合shiro -->
<!-- maven会自动添加shiro-core,shiro-web依赖 -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.3.2</version>
</dependency>

<!-- redis相关 -->
<dependency>
    <groupId>redis.clients</groupId>
    <artifactId>jedis</artifactId>
</dependency>

<!-- 使用@Slf4j注解 -->
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
</dependency>

Shiro配置

package com.ahut.config;

import com.ahut.shiro.MyRealm;
import com.ahut.shiro.RedisShiroCacheManager;
import com.ahut.shiro.RedisShiroSessionDao;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;
import java.util.Map;

/**
 * @author cheng
 * @className: ShiroConfig
 * @description: shiro配置
 * @dateTime 2018/4/18 15:38
 */
@Configuration
@Slf4j
public class ShiroConfig {

}

Shiro工具类

package com.ahut.utils;

import com.ahut.entity.User;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * @author cheng
 * @className: ShiroUtil
 * @description: 管理shiro session的工具类
 * @dateTime 2018/4/19 10:15
 */
public class ShiroUtil {

    /**
     * 日志管理
     */
    private static Logger log = LoggerFactory.getLogger(ShiroUtil.class);
    /**
     * 当前用户
     */
    private static final String CURRENT_USER = "CURRENT_USER";
    /**
     * shiro加密算法
     */
    public static final String HASH_ALGORITHM_NAME = "md5";
    /**
     * 散列次数
     */
    public static final int HASH_ITERATIONS = 2;
    /**
     * 全局session过期时间
     */
    public static final int GLOBAL_SESSION_TIMEOUT = 60000;
    /**
     * 自定义shiro session的cookie名称
     */
    public static final String SESSIONID_COOKIE_NAME = "SHIRO_SESSION_ID";
    /**
     * 自定义remeber me的cookie名称
     */
    public static final String REMEBER_ME_COOKIE_NAME = "REMEBER_ME";
    /**
     * shiro session前缀
     */
    public static final String SHIRO_SESSION_PREFIX = "shiro_session:";
    /**
     * shiro cache前缀
     */
    public static final String SHIRO_CACHE_PREFIX = "shiro_cache:";
    /**
     * shiro session过期时间-秒
     */
    public static final int EXPIRE_SECONDS = 60;

    /**
     * @description: 私有化构造函数
     * @author cheng
     * @dateTime 2018/4/19 10:15
     */
    private ShiroUtil() {
    }

    /**
     * @description: 获取session
     * @author cheng
     * @dateTime 2018/4/19 10:38
     */
    public static Session getSession() {
        Session session = null;
        try {
            Subject currentUser = SecurityUtils.getSubject();
            session = currentUser.getSession();
        } catch (Exception e) {
            log.warn("获取shiro当前用户的session时发生了异常", e);
            throw e;
        }
        return session;
    }

    /**
     * @description: 将数据放到shiro session中
     * @author cheng
     * @dateTime 2018/4/19 10:45
     */
    public static void setAttribute(Object key, Object value) {
        try {
            Session session = getSession();
            session.setAttribute(key, value);
        } catch (Exception e) {
            log.warn("将一些数据放到Shiro Session中时发生了异常", e);
            throw e;
        }
    }

    /**
     * @description: 获取shiro session中的数据
     * @author cheng
     * @dateTime 2018/4/19 10:48
     */
    public static Object getAttribute(Object key) {
        Object value = null;
        try {
            Session session = getSession();
            value = session.getAttribute(key);
        } catch (Exception e) {
            log.warn("获取shiro session中的数据时发生了异常", e);
            throw e;
        }
        return value;
    }

    /**
     * @description: 删除shiro session中的数据
     * @author cheng
     * @dateTime 2018/4/19 10:51
     */
    public static void removeAttribute(Object key) {
        try {
            Session session = getSession();
            session.removeAttribute(key);
        } catch (Exception e) {
            log.warn("删除shiro session中的数据时发生了异常", e);
            throw e;
        }
    }

    /**
     * @description: 设置当前用户
     * @author cheng
     * @dateTime 2018/4/19 10:59
     */
    public static void setCurrentUser(Object user) {
        setAttribute(CURRENT_USER, user);
    }

    /**
     * @description: 获取当前用户
     * @author cheng
     * @dateTime 2018/4/19 10:59
     */
    public static User getCurrentUser() {
        User user = (User) getAttribute(CURRENT_USER);
        return user;
    }

    /**
     * @description:删除当前用户
     * @author cheng
     * @dateTime 2018/4/19 10:59
     */
    public static void removeCurrentUser() {
        removeAttribute(CURRENT_USER);
    }

    /**
     * @description: 加密密码
     * @author cheng
     * @dateTime 2018/4/23 15:01
     */
    public static String encrypt(String password, String salt) {
        Md5Hash md5Hash = new Md5Hash(password, salt, HASH_ITERATIONS);
        return md5Hash.toString();
    }

}

配置redis，请看我的这篇博客：springboot整合redis
redis工具类

package com.ahut.utils;

import org.apache.commons.lang3.ArrayUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.util.CollectionUtils;
import redis.clients.jedis.Jedis;
import redis.clients.jedis.JedisPool;

import java.util.Set;

/**
 * @author cheng
 * @className: RedisUtil
 * @description: redis操作工具类
 * @dateTime 2018/4/23 16:12
 */
 // 因为工具类中的JedisPool 使用了spring注入，所以该工具类也要加入IOC容器
@Component
public class RedisUtil {

    /**
     * jedisPool
     */
    private static JedisPool jedisPool;

    /**
     * @description: 静态字段, 通过set注入jedispool
     * @author cheng
     * @dateTime 2018/4/24 9:45
     */
    @Autowired
    public void setJedisPool(JedisPool jedisPool) {
        RedisUtil.jedisPool = jedisPool;
    }

    /**
     * @description: 私有化构造函数
     * @author cheng
     * @dateTime 2018/4/23 16:12
     */
    private RedisUtil() {
    }

    /**
     * @description: 获取jedis
     * @author cheng
     * @dateTime 2018/4/24 9:47
     */
    public static Jedis getJedis() {
        return jedisPool.getResource();
    }

    /**
     * @description: 保存到redis
     * @author cheng
     * @dateTime 2018/4/24 10:04
     */
    public static void set(byte[] key, byte[] value) {
        Jedis jedis = getJedis();
        try {
            jedis.set(key, value);
        } finally {
            jedis.close();
        }
    }

    /**
     * @description: 从redis中获取
     * @author cheng
     * @dateTime 2018/4/24 10:11
     */
    public static byte[] get(byte[] key) {
        Jedis jedis = getJedis();
        try {
            return jedis.get(key);
        } finally {
            jedis.close();
        }
    }

    /**
     * @description: 从redis中删除
     * @author cheng
     * @dateTime 2018/4/24 10:17
     */
    public static void del(byte[] key) {
        Jedis jedis = getJedis();
        try {
            jedis.del(key);
        } finally {
            jedis.close();
        }
    }

    /**
     * @description: 依据前缀删除key
     * @author cheng
     * @dateTime 2018/4/24 16:48
     */
    public static void delByPrefix(String keyPrefix) {
        keyPrefix = keyPrefix + "*";
        Jedis jedis = getJedis();
        try {
            Set<byte[]> keyByteArraySet = jedis.keys(keyPrefix.getBytes());
            for (byte[] keyByteArray : keyByteArraySet) {
                jedis.del(keyByteArray);
            }
        } finally {
            jedis.close();
        }
    }

    /**
     * @description: 设置redis过期时间
     * @author cheng
     * @dateTime 2018/4/24 10:21
     */
    public static void expire(byte[] key, int seconds) {
        Jedis jedis = getJedis();
        try {
            jedis.expire(key, seconds);
        } finally {
            jedis.close();
        }
    }

    /**
     * @description: 从redis中获取指定前缀的key
     * @author cheng
     * @dateTime 2018/4/24 10:25
     */
    public static Set<byte[]> keys(String shiroSessionPrefix) {
        shiroSessionPrefix = shiroSessionPrefix + "*";
        Jedis jedis = getJedis();
        try {
            return jedis.keys(shiroSessionPrefix.getBytes());
        } finally {
            jedis.close();
        }
    }
}

自定义Realm

package com.ahut.shiro;

import com.ahut.common.ApiResponse;
import com.ahut.entity.User;
import com.ahut.enums.UserStatusEnum;
import com.ahut.service.UserService;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.ArrayList;
import java.util.Date;
import java.util.List;

/**
 * @author cheng
 * @className: MyRealm
 * @description: 自定义realm
 * @dateTime 2018/4/18 15:40
 */
@Slf4j
public class MyRealm extends AuthorizingRealm {

    /**
     * 用户业务逻辑,因为使用的spring的自动装配，
     * 所以MyRealm 也要添加到IOC容器中，不然会出现userService为null
     */
    @Autowired
    private UserService userService;

    /**
     * @description: 用于认证
     * @author cheng
     * @dateTime 2018/4/18 15:42
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken newToken = (UsernamePasswordToken) token;
        // 获取用户账号
        String userAccount = newToken.getUsername();
        log.info("用户{}请求认证", userAccount);
        // 依据用户账号查找用户
        ApiResponse apiResponse = userService.selectByUserAccount(userAccount);
        // 账号不存在
        if (ApiResponse.FAIL_TYPE.equals(apiResponse.getType())) {
            throw new UnknownAccountException();
        }
        List<User> userList = (List<User>) apiResponse.getData();
        User user = userList.get(0);
        // 获取用户状态
        int userStatus = user.getUserStatus();
        // 获取用户密码
        String userPassword = user.getUserPassword();
        // 账号锁定
        if (userStatus == UserStatusEnum.LOCKED_ACCOUNT.getCode()) {
            throw new LockedAccountException();
        }
        // 账号禁用
        if (userStatus == UserStatusEnum.DISABLED_ACCOUNT.getCode()) {
            throw new DisabledAccountException();
        }
        // 盐
        String salt = user.getId();
        // 保存当前用户信息到shiro session中
        ShiroUtil.setCurrentUser(user);
        // 与UsernamePasswordToken(userAccount, userPassword)进行比较
        // 如果没有配置Shiro加密，会直接进行比较
        // 如果配置了Shiro的加密,会先对UsernamePasswordToken(userAccount, userPassword)中的密码进行加密，
        // 再和SimpleAuthenticationInfo(userAccount, userPassword, ByteSource.Util.bytes(salt), this.getName())中的密码进行比较
        return new SimpleAuthenticationInfo(userAccount, userPassword, ByteSource.Util.bytes(salt), this.getName());
    }

    /**
     * @description: 用于授权
     * @author cheng
     * @dateTime 2018/4/18 15:42
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 获取用户账号
        // String userAccount = (String) principals.getPrimaryPrincipal();
        // 依据用户账号在数据库中查找权限信息

        log.info("用户请求授权");

        // 角色
        List<String> roles = new ArrayList<>();
        roles.add("admin");
        roles.add("user");
        // 权限
        List<String> permissions = new ArrayList<>();
        permissions.add("admin:select");
        permissions.add("admin:delete");

        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.addStringPermissions(permissions);
        simpleAuthorizationInfo.addRoles(roles);
        return simpleAuthorizationInfo;
    }

}

在ShiroConfig 中添加配置

    /**
     * @description:自定义realm
     * @author cheng
     * @dateTime 2018/4/18 15:44
     */
    @Bean
    public MyRealm createMyRealm() {
        MyRealm myRealm = new MyRealm();
        log.info("自定义realm");
        return myRealm;
    }

自定义加密

保存用户时
用户密码 -> 加密 -> 保存到数据库
加密方法

    /**
     * 散列次数
     */
    public static final int HASH_ITERATIONS = 2;

    /**
     * @description: 加密密码
     * @author cheng
     * @dateTime 2018/4/23 15:01
     */
    public static String encrypt(String password, String salt) {
        Md5Hash md5Hash = new Md5Hash(password, salt, HASH_ITERATIONS);
        return md5Hash.toString();
    }

用户认证时
用户密码 -> 加密 -> 认证
修改ShiroConfig中自定义Realm配置

    /**
     * @description:自定义realm
     * @author cheng
     * @dateTime 2018/4/18 15:44
     */
    @Bean
    public MyRealm createMyRealm() {
        // 加密相关
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        // 散列算法
        hashedCredentialsMatcher.setHashAlgorithmName(ShiroUtil.HASH_ALGORITHM_NAME);
        // 散列次数
        hashedCredentialsMatcher.setHashIterations(ShiroUtil.HASH_ITERATIONS);
        MyRealm myRealm = new MyRealm();
        myRealm.setCredentialsMatcher(hashedCredentialsMatcher);
        log.info("自定义realm");
        return myRealm;
    }

自定义缓存管理

自定义Cache

package com.ahut.shiro;

import com.ahut.utils.RedisUtil;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.springframework.util.SerializationUtils;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Set;

/**
 * @author cheng
 * @className: RedisShiroCache
 * @description: redis管理shiro缓存
 * @dateTime 2018/4/24 16:04
 */
@Slf4j
public class RedisShiroCache<K, V> implements Cache<K, V> {

    /**
     * @description: 获取加工后的key的字节数组
     * @author cheng
     * @dateTime 2018/4/24 9:57
     */
    private byte[] getKey(Object key) {
        return (ShiroUtil.SHIRO_CACHE_PREFIX + key).getBytes();
    }

    /**
     * @description: 从缓存中获取数据
     * @author cheng
     * @dateTime 2018/4/24 16:09
     */
    @Override
    public Object get(Object key) throws CacheException {
        if (key == null) {
            return null;
        }
        // 序列化键
        byte[] keyByteArray = getKey(key);
        // 从redis中获取数据
        byte[] valueByteArray = RedisUtil.get(keyByteArray);
        log.info("从缓存中获取数据");
        // 返回对应的数据
        return valueByteArray == null ? null : SerializationUtils.deserialize(valueByteArray);
    }

    /**
     * @description: 保存shiro缓存到redis
     * @author cheng
     * @dateTime 2018/4/24 16:13
     */
    @Override
    public Object put(Object key, Object value) throws CacheException {
        if (key == null || value == null) {
            return null;
        }
        // 序列化
        byte[] keyByteArray = getKey(key);
        byte[] valueByteArray = SerializationUtils.serialize((Serializable) value);
        RedisUtil.set(keyByteArray, valueByteArray);
        log.info("保存shiro缓存到redis");
        // 返回保存的值
        return SerializationUtils.deserialize(valueByteArray);
    }

    /**
     * @description: 从redis中删除
     * @author cheng
     * @dateTime 2018/4/24 16:19
     */
    @Override
    public Object remove(Object key) throws CacheException {
        if (key == null) {
            return null;
        }
        // 序列化
        byte[] keyByteArray = getKey(key);
        byte[] valueByteArray = RedisUtil.get(keyByteArray);
        // 删除
        RedisUtil.del(keyByteArray);
        log.info("从redis中删除");
        // 返回删除的数据
        return SerializationUtils.deserialize(valueByteArray);
    }

    /**
     * @description: 清空所有的缓存
     * @author cheng
     * @dateTime 2018/4/24 16:25
     */
    @Override
    public void clear() throws CacheException {
        log.info("清空所有的缓存");
        RedisUtil.delByPrefix(ShiroUtil.SHIRO_CACHE_PREFIX);
    }

    /**
     * @description: 缓存个数
     * @author cheng
     * @dateTime 2018/4/24 16:56
     */
    @Override
    public int size() {
        Set<byte[]> keyByteArraySet = RedisUtil.keys(ShiroUtil.SHIRO_CACHE_PREFIX);
        log.info("获取缓存个数");
        return keyByteArraySet.size();
    }

    /**
     * @description: 获取所有的key
     * @author cheng
     * @dateTime 2018/4/24 16:59
     */
    @Override
    public Set keys() {
        Set<byte[]> keyByteArraySet = RedisUtil.keys(ShiroUtil.SHIRO_CACHE_PREFIX);
        log.info("获取缓存所有的key");
        return keyByteArraySet;
    }

    /**
     * @description: 获取所有的value
     * @author cheng
     * @dateTime 2018/4/24 16:59
     */
    @Override
    public Collection values() {
        Set keySet = this.keys();
        List<Object> valueList = new ArrayList<>(16);
        for (Object key : keySet) {
            byte[] keyByteArray = SerializationUtils.serialize(key);
            byte[] valueByteArray = RedisUtil.get(keyByteArray);
            valueList.add(SerializationUtils.deserialize(valueByteArray));
        }
        log.info("获取缓存所有的value");
        return valueList;
    }

}

自定义CacheManager

package com.ahut.shiro;

import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheException;
import org.apache.shiro.cache.CacheManager;

/**
 * @author cheng
 * @className: RedisShiroCacheManager
 * @description: redis shiro 缓存管理器
 * @dateTime 2018/4/24 15:58
 */
public class RedisShiroCacheManager implements CacheManager {

    /**
     * @description:
     * @author cheng
     * @dateTime 2018/4/24 16:05
     */
    @Override
    public <K, V> Cache<K, V> getCache(String name) throws CacheException {
        return new RedisShiroCache<K, V>();
    }
}

在ShiroConfig中添加配置

    /**
     * @description: 自定义缓存管理器
     * @author cheng
     * @dateTime 2018/4/24 15:59
     */
    public RedisShiroCacheManager createCacheManager() {
        RedisShiroCacheManager redisShiroCacheManager = new RedisShiroCacheManager();
        log.info("自定义CacheManager");
        return redisShiroCacheManager;
    }

自定义会话管理

自定义sessionDao

扫描二维码关注公众号，回复： 1469879 查看本文章 
package com.ahut.shiro;

import com.ahut.utils.RedisUtil;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO;
import org.springframework.util.SerializationUtils;

import java.io.Serializable;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Set;

/**
 * @author cheng
 * @className: RedisShiroSessionDao
 * @description: 使用redis管理shiro session
 * @dateTime 2018/4/24 9:26
 */
@Slf4j
public class RedisShiroSessionDao extends EnterpriseCacheSessionDAO {

    /**
     * @description: 获取加工后的key的字节数组
     * @author cheng
     * @dateTime 2018/4/24 9:57
     */
    private byte[] getKey(String key) {
        return (ShiroUtil.SHIRO_SESSION_PREFIX + key).getBytes();
    }

    /**
     * @description: 更新会话；如更新会话最后访问时间/停止会话/设置超时时间/设置移除属性等会调用
     * @author cheng
     * @dateTime 2018/4/24 9:32
     */
    @Override
    public void doUpdate(Session session) {
        // 判断session
        if (session != null && session.getId() != null) {
            byte[] key = getKey(session.getId().toString());
            // 序列化session
            byte[] value = SerializationUtils.serialize(session);
            // 把session信息存储到redis中
            RedisUtil.set(key, value);
            log.info("更新session:{}", session);
        }
    }

    /**
     * @description: 删除会话；当会话过期/会话停止（如用户退出时）会调用
     * @author cheng
     * @dateTime 2018/4/24 9:31
     */
    @Override
    protected void doDelete(Session session) {
        // 判断session
        if (session != null && session.getId() != null) {
            byte[] key = getKey(session.getId().toString());
            // 从redis中删除session
            RedisUtil.del(key);
            log.info("删除session:{}", session);
        }
    }

    /**
     * @description: 如DefaultSessionManager在创建完session后会调用该方法；
     * 如保存到关系数据库/文件系统/NoSQL数据库；即可以实现会话的持久化；
     * 返回会话ID；主要此处返回的ID.equals(session.getId())；
     * @author cheng
     * @dateTime 2018/4/24 9:32
     */
    @Override
    public Serializable doCreate(Session session) {
        // 判断session
        if (session != null) {
            // 获取sessionId
            Serializable sessionId = super.doCreate(session);
            byte[] key = getKey(sessionId.toString());
            // 序列化session
            byte[] value = SerializationUtils.serialize(session);
            // 把session信息存储到redis中
            RedisUtil.set(key, value);
            // 设置过期时间
            RedisUtil.expire(key, ShiroUtil.EXPIRE_SECONDS);
            log.info("创建session:{}", session);
            return sessionId;
        }
        return null;
    }

    /**
     * @description: 根据会话ID获取会话
     * @author cheng
     * @dateTime 2018/4/24 9:32
     */
    @Override
    public Session doReadSession(Serializable sessionId) {
        if (sessionId != null) {
            byte[] key = getKey(sessionId.toString());
            byte[] value = RedisUtil.get(key);
            // 反序列化session
            Session session = (Session) SerializationUtils.deserialize(value);
            log.info("获取session:{}", session);
            return session;
        }
        return null;
    }

    /**
     * @description: 获取当前所有活跃用户，如果用户量多此方法影响性能
     * @author cheng
     * @dateTime 2018/4/24 9:32
     */
    @Override
    public Collection<Session> getActiveSessions() {
        List<Session> sessionList = new ArrayList<>(16);
        // 从redis从查询
        Set<byte[]> keyByteArraySet = RedisUtil.keys(ShiroUtil.SHIRO_SESSION_PREFIX);
        for (byte[] keyByteArray : keyByteArraySet) {
            // 反序列化
            Session session = (Session) SerializationUtils.deserialize(keyByteArray);
            sessionList.add(session);
        }
        return sessionList;
    }

}

在ShiroConfig中配置SessionDao

    /**
     * @description: 自定义sessionDao
     * @author cheng
     * @dateTime 2018/4/24 10:47
     */
    public RedisShiroSessionDao createRedisShiroSessionDao() {
        RedisShiroSessionDao sessionDao = new RedisShiroSessionDao();
        // 设置缓存管理器
        sessionDao.setCacheManager(createCacheManager());
        log.info("自定义sessionDao");
        return sessionDao;
    }

在ShiroConfig中自定义Shiro session cookie信息

    /**
     * @description: 自定义shiro session cookie
     * @author cheng
     * @dateTime 2018/4/24 11:09
     */
    public SimpleCookie createSessionIdCookie() {
        SimpleCookie simpleCookie = new SimpleCookie(ShiroUtil.SESSIONID_COOKIE_NAME);
        // 保证该系统不会受到跨域的脚本操作攻击
        simpleCookie.setHttpOnly(true);
        // 定义Cookie的过期时间，单位为秒，如果设置为-1表示浏览器关闭，则Cookie消失
        simpleCookie.setMaxAge(-1);
        log.info("自定义SessionIdCookie");
        return simpleCookie;
    }

在ShiroConfig中配置SessionManager

    /**
     * @description: 自定义sessionManager
     * @author cheng
     * @dateTime 2018/4/24 10:37
     */
    public SessionManager createMySessionManager() {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        // 自定义sessionDao
        sessionManager.setSessionDAO(createRedisShiroSessionDao());
        // session的失效时长,单位是毫秒
        sessionManager.setGlobalSessionTimeout(ShiroUtil.GLOBAL_SESSION_TIMEOUT);
        // 删除失效的session
        sessionManager.setDeleteInvalidSessions(true);
        // 所有的session一定要将id设置到Cookie之中，需要提供有Cookie的操作模版
        sessionManager.setSessionIdCookie(createSessionIdCookie());
        // 定义sessionIdCookie模版可以进行操作的启用
        sessionManager.setSessionIdCookieEnabled(true);
        log.info("配置sessionManager");
        return sessionManager;
    }

自定义记住我

在ShiroConfig中自定义记住我cookie

    /**
     * @description: 记住我cookie
     * @author cheng
     * @dateTime 2018/4/24 15:39
     */
    public SimpleCookie createRemeberMeCookie() {
        SimpleCookie simpleCookie = new SimpleCookie(ShiroUtil.REMEBER_ME_COOKIE_NAME);
        // 保证该系统不会受到跨域的脚本操作攻击
        simpleCookie.setHttpOnly(true);
        // 定义Cookie的过期时间，单位为秒，如果设置为-1表示浏览器关闭，则Cookie消失
        simpleCookie.setMaxAge(2592000);
        log.info("自定义RemeberMeCookie");
        return simpleCookie;
    }

在ShiroConfig中配置RememberMeManager

    /**
     * @description: 自定义记住我
     * @author cheng
     * @dateTime 2018/4/24 15:35
     */
    public CookieRememberMeManager createRememberMeManager() {
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        // 设置记住我的cookie
        cookieRememberMeManager.setCookie(createRemeberMeCookie());
        log.info("配置RemeberMeManager");
        return cookieRememberMeManager;
    }

登录时，使用记住我

package com.ahut.serviceImpl;

import com.ahut.common.ApiResponse;
import com.ahut.entity.User;
import com.ahut.service.LoginService;
import com.ahut.service.UserService;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.*;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
import org.springframework.transaction.annotation.Transactional;

import java.util.Date;

/**
 * @author cheng
 * @className: LoginServiceImpl
 * @description:
 * @dateTime 2018/4/19 9:21
 */
@Service
@Transactional
@Slf4j
public class LoginServiceImpl implements LoginService {

    /**
     * 用户业务逻辑
     */
    @Autowired
    private UserService userService;

    /**
     * @description: 登录
     * @author cheng
     * @dateTime 2018/4/19 9:21
     */
    @Override
    public ApiResponse login(String userAccount, String userPassword) {
        // 获取当前用户
        Subject subject = SecurityUtils.getSubject();
        // 自己创建令牌
        UsernamePasswordToken token = new UsernamePasswordToken(userAccount, userPassword);
        // 当前登录用户信息
        User user = null;
        // 提示信息
        String msg = null;
        try {
            // 记住我
            token.setRememberMe(true);
            subject.login(token);
            // 用户认证成功,获取当前用户
            user = ShiroUtil.getCurrentUser();
            // 完成认证的后续操作
            // 修改用户信息
            user.setLastLoginTime(new Date());
            userService.updateUser(user);
            msg = "用户登录成功";
            return ApiResponse.createSuccessResponse(msg, user);
        } catch (UnknownAccountException e) {
            msg = "用户账号不存在";
            log.warn(msg, e);
        } catch (LockedAccountException e) {
            msg = "用户账号被锁定";
            log.warn(msg, e);
        } catch (DisabledAccountException e) {
            msg = "用户账号被禁用";
            log.warn(msg, e);
        } catch (IncorrectCredentialsException e) {
            msg = "用户密码错误";
            log.warn(msg, e);
        }
        // 用户认证失败,删除当前用户
        ShiroUtil.removeCurrentUser();
        return ApiResponse.createFailResponse(msg);
    }

}

完整的ShiroConfig配置

package com.ahut.config;

import com.ahut.shiro.MyRealm;
import com.ahut.shiro.RedisShiroCacheManager;
import com.ahut.shiro.RedisShiroSessionDao;
import com.ahut.utils.ShiroUtil;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.CookieRememberMeManager;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.apache.shiro.web.servlet.SimpleCookie;
import org.apache.shiro.web.session.mgt.DefaultWebSessionManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;
import java.util.Map;

/**
 * @author cheng
 * @className: ShiroConfig
 * @description: shiro配置
 * @dateTime 2018/4/18 15:38
 */
@Configuration
@Slf4j
public class ShiroConfig {

    /**
     * @description:自定义realm
     * @author cheng
     * @dateTime 2018/4/18 15:44
     */
    @Bean
    public MyRealm createMyRealm() {
        // 加密相关
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        // 散列算法
        hashedCredentialsMatcher.setHashAlgorithmName(ShiroUtil.HASH_ALGORITHM_NAME);
        // 散列次数
        hashedCredentialsMatcher.setHashIterations(ShiroUtil.HASH_ITERATIONS);
        MyRealm myRealm = new MyRealm();
        myRealm.setCredentialsMatcher(hashedCredentialsMatcher);
        log.info("自定义realm");
        return myRealm;
    }

    /**
     * @description: 自定义sessionDao
     * @author cheng
     * @dateTime 2018/4/24 10:47
     */
    public RedisShiroSessionDao createRedisShiroSessionDao() {
        RedisShiroSessionDao sessionDao = new RedisShiroSessionDao();
        // 设置缓存管理器
        sessionDao.setCacheManager(createCacheManager());
        log.info("自定义sessionDao");
        return sessionDao;
    }

    /**
     * @description: 自定义shiro session cookie
     * @author cheng
     * @dateTime 2018/4/24 11:09
     */
    public SimpleCookie createSessionIdCookie() {
        SimpleCookie simpleCookie = new SimpleCookie(ShiroUtil.SESSIONID_COOKIE_NAME);
        // 保证该系统不会受到跨域的脚本操作攻击
        simpleCookie.setHttpOnly(true);
        // 定义Cookie的过期时间，单位为秒，如果设置为-1表示浏览器关闭，则Cookie消失
        simpleCookie.setMaxAge(-1);
        log.info("自定义SessionIdCookie");
        return simpleCookie;
    }


    /**
     * @description: 自定义sessionManager
     * @author cheng
     * @dateTime 2018/4/24 10:37
     */
    public SessionManager createMySessionManager() {
        DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();
        // 自定义sessionDao
        sessionManager.setSessionDAO(createRedisShiroSessionDao());
        // session的失效时长,单位是毫秒
        sessionManager.setGlobalSessionTimeout(ShiroUtil.GLOBAL_SESSION_TIMEOUT);
        // 删除失效的session
        sessionManager.setDeleteInvalidSessions(true);
        // 所有的session一定要将id设置到Cookie之中，需要提供有Cookie的操作模版
        sessionManager.setSessionIdCookie(createSessionIdCookie());
        // 定义sessionIdCookie模版可以进行操作的启用
        sessionManager.setSessionIdCookieEnabled(true);
        log.info("配置sessionManager");
        return sessionManager;
    }

    /**
     * @description: 记住我cookie
     * @author cheng
     * @dateTime 2018/4/24 15:39
     */
    public SimpleCookie createRemeberMeCookie() {
        SimpleCookie simpleCookie = new SimpleCookie(ShiroUtil.REMEBER_ME_COOKIE_NAME);
        // 保证该系统不会受到跨域的脚本操作攻击
        simpleCookie.setHttpOnly(true);
        // 定义Cookie的过期时间，单位为秒，如果设置为-1表示浏览器关闭，则Cookie消失
        simpleCookie.setMaxAge(2592000);
        log.info("自定义RemeberMeCookie");
        return simpleCookie;
    }

    /**
     * @description: 自定义记住我
     * @author cheng
     * @dateTime 2018/4/24 15:35
     */
    public CookieRememberMeManager createRememberMeManager() {
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        // 设置记住我的cookie
        cookieRememberMeManager.setCookie(createRemeberMeCookie());
        log.info("配置RemeberMeManager");
        return cookieRememberMeManager;
    }

    /**
     * @description: 自定义缓存管理器
     * @author cheng
     * @dateTime 2018/4/24 15:59
     */
    public RedisShiroCacheManager createCacheManager() {
        RedisShiroCacheManager redisShiroCacheManager = new RedisShiroCacheManager();
        log.info("自定义CacheManager");
        return redisShiroCacheManager;
    }

    /**
     * @description: 注意方法返回值SecurityManager为org.apache.shiro.mgt.SecurityManager, 不要导错包
     * @author cheng
     * @dateTime 2018/4/18 15:48
     */
    public SecurityManager createSecurityManager() {
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        // 自定义realm
        securityManager.setRealm(createMyRealm());
        // 自定义sessionManager
        securityManager.setSessionManager(createMySessionManager());
        // 自定义rememberMeManager
        securityManager.setRememberMeManager(createRememberMeManager());
        // 自定义cacheManager
        securityManager.setCacheManager(createCacheManager());
        log.info("配置rsecurityManager");
        return securityManager;
    }

    /**
     * @description: shiro web过滤器
     * @author cheng
     * @dateTime 2018/4/18 15:50
     */
    @Bean
    public ShiroFilterFactoryBean createShiroFilter() {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(createSecurityManager());
        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/v1/toLoginPage");

        // 过滤器
        Map<String, String> filterChainDefinitionMap = new HashMap<>();
        // 配置不会被过滤的链接 顺序判断
        // 过虑器链定义，从上向下顺序执行，一般将/**放在最下边
        // 用户注册匿名访问
        filterChainDefinitionMap.put("/v1/users/", "anon");
        // 管理员登录页面
        filterChainDefinitionMap.put("/v1/toLoginPage", "anon");
        // 管理员登录
        filterChainDefinitionMap.put("/v1/login", "anon");
        // 对静态资源设置匿名访问
        // anon:所有url都都可以匿名访问
        filterChainDefinitionMap.put("/static/**", "anon");

        // authc:所有url都必须认证通过才可以访问
        filterChainDefinitionMap.put("/**", "anon");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

}

猜你喜欢

转载自blog.csdn.net/qq_28988969/article/details/80076689
今日推荐
火速冲上 GitHub 热榜 —— 开源编程语言、框架哪有这么可爱？
北京人形机器人创新中心发布全球首个纯电驱拟人奔跑的全尺寸人形机器人“天工”
LFOSSA 源来如此公开课 | 掌握云原生未来：CNCF 认证全面攻略与备考秘籍
国产云输入法——仅华为无云端数据上传安全问题
开源日报 | 工业开源项目OGG 1.0；姐姐，你要和我一起配置火狐吗；苹果AI遥遥落后？Fedora 40
开放签电子签章：停止新增，优化体验，前进更进（五一假期前工作）
开源日报 | 中学生开源前端动画引擎；全球首个Llama3 8B中文版开源模型；联想电脑恐出局；Linus讽刺AI炒作
周排行
浏览器对同一域名进行请求的最大并发连接数
React Hook之自定义Hook
【转】MyBatis缓存机制
-Java-泛型
自动化测试常用脚本-发送邮件
LeetCode#859: Buddy Strings
java、Python处理字符串
第二篇の博客
Hadoop伪分布式环境安装
SQL Server进阶（十一）临时表、表变量
每日归档
更多
2024-04-27(56)
2024-04-26(39)
2024-04-25(22)
2024-04-24(36)
2024-04-23(26)
2024-04-22(39)
2024-04-21(0)
2024-04-20(6)
2024-04-19(5)
2024-04-18(0)

代码天地 © 2018 codetd.com

境外服务器   最新电视剧2022