Shiro中Realm的初步学习---IniRealm，JdbcRealm，自定义Realm

全部测试代码整体结构：

在此项目基础上继续编辑

https://blog.csdn.net/qq_43560721/article/details/105194364

首先是内置Realm

我们来看一下IniRealm和JdbcRealm

IniRealm：

测试代码：

1.配置user.ini，主要配置用户，角色和权限

[users]
xxs=123,admin
[roles]
admin=user:delete,user:update

2.写测试类：

package cn.xxs.test;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * @Author xxs
 * @Date 2020/3/30 12:16
 */
public class IniRealmTest {

    @Test
    public void  testAuthentication(){
        IniRealm iniRealm = new IniRealm("classpath:user.ini");

        //1.构建SecurityManager环境,SecurityManager提供安全服务
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(iniRealm);
        //2.主题提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);//设置SecurityManager环境
        Subject subject = SecurityUtils.getSubject();//获得主体

        UsernamePasswordToken token = new UsernamePasswordToken("xxs","123");//认证数据
        subject.login(token);//提交认证
        System.out.println("isAuthenticated:"+subject.isAuthenticated());//看是否认证 true/false
        subject.checkRole("admin");//检查角色
        subject.checkPermission("user:update");//检查权限
    }
}

测试过程：

1.正确的用户信息，角色，权限进行检查

2.错误用户名

3.错误的密码

4.错误角色

5.错误权限

JdbcRealm:

测试代码：

1.添加依赖

<!--        引入mysql数据库驱动包-->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>5.1.45</version>
        </dependency>
<!--        引入数据源-->
        <dependency>
            <groupId>com.alibaba</groupId>
            <artifactId>druid</artifactId>
            <version>1.1.6</version>
        </dependency>

2.新建数据库

自带sql例子表：

自定义sql例子表：

3.写测试类

package cn.xxs.test;

import com.alibaba.druid.pool.DruidDataSource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * @Author xxs
 * @Date 2020/3/30 14:02
 */
public class JdbcRealmTest {

    //设置jdbc访问url，用户及密码
    DruidDataSource dataSource = new DruidDataSource();
    {
        dataSource.setUrl("jdbc:mysql://localhost:3306/test?useSSL=false");
        dataSource.setUsername("root");
        dataSource.setPassword("root");
    }
    @Test
    public void  testAuthentication(){
        //创建JdbcRealm对象
        JdbcRealm jdbcRealm = new JdbcRealm();
        //引入jdbc数据源
        jdbcRealm.setDataSource(dataSource);
        jdbcRealm.setPermissionsLookupEnabled(true);//打开查询数据库权限的开关，默认为false
        //自定义sql
        String sql = "select password from test_user where user_name = ?";
        jdbcRealm.setAuthenticationQuery(sql);
        String roleSql =  "select role_name from test_user_role where user_name = ?";
        jdbcRealm.setUserRolesQuery(roleSql);
        //1.构建SecurityManager环境,SecurityManager提供安全服务
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(jdbcRealm);
        //2.主题提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);//设置SecurityManager环境
        Subject subject = SecurityUtils.getSubject();//获得主体
        UsernamePasswordToken token = new UsernamePasswordToken("ss","321");//认证数据
        subject.login(token);//提交认证
        System.out.println("isAuthenticated:"+subject.isAuthenticated());//看是否认证 true/false
//        subject.checkRole("admin");
//        subject.checkRoles("admin","user");
//        subject.checkPermission("user:select");
        subject.checkRole("user");
    }
}

测试过程：

1.自带sql测试

数据对照这3个表

注意点：

jdbcRealm.setPermissionsLookupEnabled(true);//打开查询数据库权限的开关，默认为false

以下面这两张图做对比。必须加上边一行代码，不然默认不查询

JdbcRealm自带的sql是在JdbcRealm类里边，进入会看到如下图所示：

但是有弊端：只能按照自带sql字段来建数据库表。

那么我们可以自定义sql

2.自定义sql测试：

数据对照这2个表

其次是自定义Realm

1.新建一个CustomRealm

package cn.imooc.shiro.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

/**
 * @Author xxs
 * @Date 2020/4/8 10:33
 */
public class CustomRealm  extends AuthorizingRealm {

    Map<String,String> userMap = new HashMap<String, String>(16);
    {
        userMap.put("xxs","123");
        super.setName("customRealm");
    }
    //做授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        // 1.从主体传过来的认证信息中，获得用户名
        String userName = (String) principalCollection.getPrimaryPrincipal();
        //2.通过用户名到数据库或者缓存中获取角色数据
        Set<String> roles = getRolesByUserName(userName);
        //3.通过用户名到数据库或者缓存中获取权限数据
        Set<String> permissions = getPermissionsByUserName(userName);
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    /**
     *模拟数据库或缓存中查询角色的权限
     * @param userName
     * @return
     */
    private Set<String> getPermissionsByUserName(String userName) {
        Set<String> sets = new HashSet<String>();
        sets.add("user:delete");
        sets.add("user:add");
        return sets;
    }

    /**
     *模拟数据库或缓存中查询角色
     * @param userName
     * @return
     */
    private Set<String> getRolesByUserName(String userName) {
        Set<String> sets = new HashSet<String>();
        sets.add("admin");
        sets.add("user");
        return sets;
    }

    //做认证
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {
        // 1.从主体传过来的认证信息中，获得用户名
        String userName = (String) authenticationToken.getPrincipal();
        //2.通过用户名到数据库中获取凭证
        String password = getPasswordByUserName(userName);
        if(password==null){
            return null;
        }
        //创建返回对象
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo
                ("xxs", password, "customRealm");//用户名，密码，realm名称
        return authenticationInfo;
    }

    /**
     * 模拟数据库或缓存中查询凭证
     * @param userName
     * @return
     */
    private String getPasswordByUserName(String userName) {
        return userMap.get(userName);
    }
}

2.新建测试类

package cn.xxs.test;

import cn.imooc.shiro.realm.CustomRealm;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * @Author xxs
 * @Date 2020/4/8 10:49
 */
public class CustomRealmTest {
    @Test
    public void  testAuthentication(){
        CustomRealm customRealm = new CustomRealm();
        //1.构建SecurityManager环境,SecurityManager提供安全服务
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(customRealm);
        //2.主题提交认证请求
        SecurityUtils.setSecurityManager(defaultSecurityManager);//设置SecurityManager环境
        Subject subject = SecurityUtils.getSubject();//获得主体
        UsernamePasswordToken token = new UsernamePasswordToken("xxs","123");//认证数据
        subject.login(token);//提交认证
        System.out.println("isAuthenticated:"+subject.isAuthenticated());//看是否认证 true/false
        subject.checkRole("admin");//检查角色
        subject.checkPermission("user:add");//检查权限

    }
}

测试过程：

1.验证用户信息