首先导包
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.4.0</version>
</dependency>
一个简单的认证的测试
public class test {
public static void main(String[] args) {
//1.构建securityManager
DefaultSecurityManager securityManager = new DefaultSecurityManager();
//2.创建一个realm认证.(注：这个认证方式有很多种，比如网上最多的，iniRealm,就是配置一个.ini文件。还有就是jdbcRealm，通过查询数据库进行认证)
SimpleAccountRealm realm = new SimpleAccountRealm();
//3.给realm认证添加一个用户
realm.addAccount("123", "123");//用户名和密码
//4.给securityManager配置realm认证
securityManager.setRealm(realm);
//5将securityManager设置为主题认证
SecurityUtils.setSecurityManager(securityManager);
//6.创建主体subject
Subject subject = SecurityUtils.getSubject();
//这里模拟当前用户的用户名和密码
String user = "123";
String pwd = "123";
//6.将用户名和密码放入token中等待认证
UsernamePasswordToken token = new UsernamePasswordToken(user, pwd);
try {
//7.进行登录认证，如果认证不成功会抛出下面相应的异常
subject.login(token);
} catch (UnknownAccountException uae) {
System.out.println("用户名不存在:" + token.getPrincipal());
} catch (IncorrectCredentialsException ice) {
System.out.println("账户密码 " + token.getPrincipal() + " 不正确!");
} catch (LockedAccountException lae) {
System.out.println("用户名 " + token.getPrincipal() + " 被锁定 !");
}
// 判断是否认证成功
if (subject.isAuthenticated()) {
//得到当前用户名
System.out.println("用户 " + subject.getPrincipal() + " 认证成功！");
//退出，注销当前用户
subject.logout();
}
}
}
运行结果
在ssm中使用shiro，就是将1-6放在spring.xml进行，一般realm认证为自定，
一、web.xml中添加
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
二、创建一个自定义的realm认证，（创建一个类，继承AuthorizingRealm，重写它的两个方法，一个是认证一个是授权），代码如下
import java.util.ArrayList;
import java.util.List;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
public class CustomRealm extends AuthorizingRealm {
/**
* 认证
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
// 从 token 中获取用户身份信息
String username = (String) token.getPrincipal();
//模拟数据库查询
//查询不到用户名为123的返回null
if(!username.equals("123")){
return null;
}
//模拟数据库查询出的密码为123
String dbPassword = "123";
//返回认证信息由父类 AuthenticatingRealm 进行认证，将数据库中查询到的额用户名和密码放入Realm
SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(username, dbPassword,getName());
return simpleAuthenticationInfo;
}
/**
* 授权
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
// 获取身份信息
String username = (String) principals.getPrimaryPrincipal();
// 根据身份信息从数据库中查询权限数据
// 这里使用静态数据模拟,list 为数据库中查到的权限
List<String> permissions = new ArrayList<String>();
permissions.add("user:*");
permissions.add("department:*");
// 将权限信息封闭为AuthorizationInfo
SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
// 模拟数据，添加 给用户添加manager 角色
simpleAuthorizationInfo.addRole("manager");
//给用户天剑权限
for(String permission:permissions){
simpleAuthorizationInfo.addStringPermission(permission);
}
return simpleAuthorizationInfo;
}
}
三、spring.xml中添加
<!-- 创建securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!--配置realm认证 -->
<property name="realm" ref="customRealm" />
</bean>
<!-- 创建自定义的 realm认证 ，com.hp.core.CustomRealm这个为自定义realm的路径，-->
<bean id="customRealm" class="com.hp.core.CustomRealm"></bean>
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<!--配置securityManager -->
<property name="securityManager" ref="securityManager"/>
<!-- 登录页 -->
<property name="loginUrl" value="/loginView"/>
<!-- 未认证的跳转页面 -->
<property name="unauthorizedUrl" value="/loginView"/>
<!-- 认证链 -->
<property name="filterChainDefinitions">
<value>
<!-- anon不是不需要认证 ，authc需要认证-->
/resources/** = anon
/loginView = anon
/login.do = anon
/** = authc
</value>
</property>
</bean>
四、Controller中获取表单传来的用户名和密码，进行认证授权，
@RequestMapping("/login.do")
public String login(@RequestParam Map map) {
//创建subject主体
Subject subject = SecurityUtils.getSubject();
//token放入从表单中获取的用户名和密码
UsernamePasswordToken token = new UsernamePasswordToken((String)map.get("name"), (String)map.get("pwd"));
try {
//登录认证
subject.login(token);
return "index";
} catch (UnknownAccountException uae) {
System.out.println("用户名不存在:" + token.getPrincipal());
return "WEB-INF/jsp/login";
} catch (IncorrectCredentialsException ice) {
System.out.println("账户密码 " + token.getPrincipal() + " 不正确!");
return "WEB-INF/jsp/login";
} catch (LockedAccountException lae) {
System.out.println("用户名 " + token.getPrincipal() + " 被锁定 !");
return "WEB-INF/jsp/login";
}
}
我得login.jsp
<form action="login.do">
用户名：<input type="text" name="name"/><br>
密码：<input type="text" name="pwd"/>
<input name="submit" type="submit" value="submit" />
</form>
这里认证成功或回跳转index页面，不成功还会返回到login页面