首先導包
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.0</version>
</dependency>
一個簡單的認證的測試
public class test {
public static void main(String[] args) {
//1.構建securityManager
DefaultSecurityManager securityManager = new DefaultSecurityManager();
//2.創建一個realm認證.(注：這個認證方式有很多種，比如網上最多的，iniRealm,就是配置一個.ini文件。還有就是jdbcRealm，通過查詢數據庫進行認證)
SimpleAccountRealm realm = new SimpleAccountRealm();
//3.給realm認證添加一個用戶
realm.addAccount("123", "123");//用戶名和密碼
//4.給securityManager配置realm認證
securityManager.setRealm(realm);
//5將securityManager設置爲主題認證
SecurityUtils.setSecurityManager(securityManager);
//6.創建主體subject
Subject subject = SecurityUtils.getSubject();
//這裏模擬當前用戶的用戶名和密碼
String user = "123";
String pwd = "123";
//6.將用戶名和密碼放入token中等待認證
UsernamePasswordToken token = new UsernamePasswordToken(user, pwd);
try {
//7.進行登錄認證，如果認證不成功會拋出下面相應的異常
subject.login(token);
} catch (UnknownAccountException uae) {
System.out.println("用戶名不存在:" + token.getPrincipal());
} catch (IncorrectCredentialsException ice) {
System.out.println("賬戶密碼 " + token.getPrincipal() + " 不正確!");
} catch (LockedAccountException lae) {
System.out.println("用戶名 " + token.getPrincipal() + " 被鎖定 !");
}
// 判斷是否認證成功
if (subject.isAuthenticated()) {
//得到當前用戶名
System.out.println("用戶 " + subject.getPrincipal() + " 認證成功！");
//退出，註銷當前用戶
subject.logout();
}
}
}
運行結果
在ssm中使用shiro，就是將1-6放在spring.xml進行，一般realm認證爲自定，
一、web.xml中添加
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
二、創建一個自定義的realm認證，（創建一個類，繼承AuthorizingRealm，重寫它的兩個方法，一個是認證一個是授權），代碼如下
import java.util.ArrayList;
import java.util.List;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
public class CustomRealm extends AuthorizingRealm {
/**
* 認證
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
// 從 token 中獲取用戶身份信息
String username = (String) token.getPrincipal();
//模擬數據庫查詢
//查詢不到用戶名爲123的返回null
if(!username.equals("123")){
return null;
}
//模擬數據庫查詢出的密碼爲123
String dbPassword = "123";
//返回認證信息由父類 AuthenticatingRealm 進行認證，將數據庫中查詢到的額用戶名和密碼放入Realm
SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(username, dbPassword,getName());
return simpleAuthenticationInfo;
}
/**
* 授權
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
// 獲取身份信息
String username = (String) principals.getPrimaryPrincipal();
// 根據身份信息從數據庫中查詢權限數據
// 這裏使用靜態數據模擬,list 爲數據庫中查到的權限
List<String> permissions = new ArrayList<String>();
permissions.add("user:*");
permissions.add("department:*");
// 將權限信息封閉爲AuthorizationInfo
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
// 模擬數據，添加 給用戶添加manager 角色
simpleAuthorizationInfo.addRole("manager");
//給用戶天劍權限
for(String permission:permissions){
simpleAuthorizationInfo.addStringPermission(permission);
}
return simpleAuthorizationInfo;
}
}
三、spring.xml中添加
<!-- 創建securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--配置realm認證 -->
<property name="realm" ref="customRealm" />
</bean>
<!-- 創建自定義的 realm認證 ，com.hp.core.CustomRealm這個爲自定義realm的路徑，-->
<bean id="customRealm" class="com.hp.core.CustomRealm"></bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<!--配置securityManager -->
<property name="securityManager" ref="securityManager"/>
<!-- 登錄頁 -->
<property name="loginUrl" value="/loginView"/>
<!-- 未認證的跳轉頁面 -->
<property name="unauthorizedUrl" value="/loginView"/>
<!-- 認證鏈 -->
<property name="filterChainDefinitions">
<value>
<!-- anon不是不需要認證 ，authc需要認證-->
/resources/** = anon
/loginView = anon
/login.do = anon
/** = authc
</value>
</property>
</bean>
四、Controller中獲取表單傳來的用戶名和密碼，進行認證授權，
@RequestMapping("/login.do")
public String login(@RequestParam Map map) {
//創建subject主體
Subject subject = SecurityUtils.getSubject();
//token放入從表單中獲取的用戶名和密碼
UsernamePasswordToken token = new UsernamePasswordToken((String)map.get("name"), (String)map.get("pwd"));
try {
//登錄認證
subject.login(token);
return "index";
} catch (UnknownAccountException uae) {
System.out.println("用戶名不存在:" + token.getPrincipal());
return "WEB-INF/jsp/login";
} catch (IncorrectCredentialsException ice) {
System.out.println("賬戶密碼 " + token.getPrincipal() + " 不正確!");
return "WEB-INF/jsp/login";
} catch (LockedAccountException lae) {
System.out.println("用戶名 " + token.getPrincipal() + " 被鎖定 !");
return "WEB-INF/jsp/login";
}
}
我得login.jsp
<form action="login.do">
用戶名：<input type="text" name="name"/><br>
密碼：<input type="text" name="pwd"/>
<input name="submit" type="submit" value="submit" />
</form>
這裏認證成功或回跳轉index頁面，不成功還會返回到login頁面