本文共 5818 字，大约阅读时间需要 19 分钟。

Shiro ????

??

• ????SpringBoot????
  • 6.1 ????
  • 6.2 ????
    • 1. ????
    • 2. ????
      • JSP ????
      • Shiro ?? SpringBoot ??
    • 3. ????
      • application.properties ????
    • 4. ????
  • 6.3 ????
    • 1. ?????
    • [2. ??? realm](#2-??? realm)
    • 3. JSP ??
    • 4. ????
  • 6.4 ?????
    • anon ???
    • authc ???
    • Logout ???
    • ?????
  • 6.5 ???????
    • ????
    • ????
  • [6.7 MD5?Salt ?????](#67-MD5?Salt ?????)
    • ??????????
    • ?????
    • Shiro ?????
    • ?????
  • 6.8 ????
    • ?????
    • ???????
    • ??????????
    • ????
  • [6.9 ?? CacheManager](#69-?? CacheManager)
    • Cache ??
    • [Shiro ??? EhCache ??](#Shiro-??? EhCache ??)
    • Redis ????
    • ??? Redis ????
  • 6.10 ?????
    • ????????
    • ???????
    • ?????
    • Shiro ???????

???? SpringBoot ????

6.1 ????

?? Shiro ??? SpringBoot ?????????????????????????????? ShiroFilterFactoryBean ? DefaultWebSecurityManager?????? realm ?????????????????????

6.2 ????

1. ????

?? SpringBoot ???????????? Web ?????? Shiro ??????

2. ????

• JSP ?????

           
        
         org.apache.tomcat.embed
            
        
         tomcat-embed-jasper
        
       
           
        
         jstl
            
        
         jstl
            
        
         1.2
        
       

• Shiro ?? SpringBoot ???

           
        
         org.apache.shiro
            
        
         shiro-spring-boot-starter
            
        
         1.5.3
        
       

3. ????

• ? application.properties ????

  server.port=8080server.servlet.context-path=/shirospringapplication.name=shirospring

mvc.view.prefix=/springmvc.view.suffix=.jsp

#### 4. ????JSP ? SpringBoot ??????????? IDE ?????---### 6.3 ????#### 1. ?????```javapackage com.lut.config;import com.lut.shiro.realms.CustomerRealm;import org.apache.shiro.authc.credential.HashedCredentialsMatcher;import org.apache.shiro.realm.Realm;import org.apache.shiro.spring.web.ShiroFilterFactoryBean;import org.apache.shiro.web.mgt.DefaultWebSecurityManager;import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.Configuration;@Configurationpublic class ShiroConfig {  @Bean  public ShiroFilterFactoryBean getShiroFilterFactoryBean(DefaultWebSecurityManager defaultWebSecurityManager) {      ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();      shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);      Map
   
     map = new HashMap<>();      map.put("/index.jsp", "authc");      shiroFilterFactoryBean.setFilterChainDefinitionMap(map);      shiroFilterFactoryBean.setLoginUrl("/login.jsp");      return shiroFilterFactoryBean;  }  @Bean  public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm) {      DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();      defaultWebSecurityManager.setRealm(realm);      return defaultWebSecurityManager;  }  @Bean  public Realm getRealm() {      CustomerRealm customerRealm = new CustomerRealm();      HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();      matcher.setHashAlgorithmName("md5");      matcher.setHashIterations(1024);      customerRealm.setCredentialsMatcher(matcher);      return customerRealm;  }}
   

2. ??? realm

package com.lut.shiro.realms;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.AuthenticationInfo;import org.apache.shiro.authc.AuthenticationToken;import org.apache.shiro.authc.SimpleAuthenticationInfo;import org.apache.shiro.authz.AuthorizationInfo;import org.apache.shiro.authz.SimpleAuthorizationInfo;import org.apache.shiro.realm.AuthorizingRealm;import org.apache.shiro.subject.PrincipalCollection;import org.springframework.util.CollectionUtils;import org.springframework.util.ObjectUtils;public class CustomerRealm extends AuthorizingRealm {    @Override    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {        return null;    }    @Override    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {        String principal = (String) token.getPrincipal();        UserService userService = (UserService) ApplicationContextUtils.getBean("userService");        User user = userService.findByUserName(principal);        if (!ObjectUtils.isEmpty(user)) {            return new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), new MyByteSource(user.getSalt()), this.getName());        }        return null;    }}

3. JSP ??

    <%@ page contentType="text/html;utf-8" isELIgnored="false" %> 
    
    
     
????
 
   
     
    
????
     
    
????
     
    
????
     
    
????
 
   

4. ????

?? http://localhost:8080/shiro/index.jsp?????????????

6.4 ?????

anon ???

???????? URL?

authc ???

???????????????????

Logout ???

?????????

?????

?? perms?roles?ssl?user ??

6.5 ???????

????

@RequestMapping("login")public String login(String username, String password) {    try {        Subject subject = SecurityUtils.getSubject();        subject.login(new UsernamePasswordToken(username, password));        return "redirect:/index.jsp";    } catch (UnknownAccountException e) {        e.printStackTrace();        System.out.println("?????!");    } catch (IncorrectCredentialsException e) {        e.printStackTrace();        System.out.println("????!");    } catch (Exception e) {        e.printStackTrace();        System.out.println(e.getMessage());    }    return "redirect:/login.jsp";}

????

@RequestMapping("logout")public String logout() {    Subject subject = SecurityUtils.getSubject();    subject.logout();    return "redirect:/login.jsp";}

6.7 MD5?Salt ?????

??????????

• ???? salt
• MD5 ????
• ?? salt ???????

?????

• ??????
• ????

Shiro ??

• ???????
• ????

6.8 ????

?????

• ???????????????????????
• ?????????

???????

• <shiro:hasanyroles name="admin, user">

??????????

• <shiro:haspermission name="user:create:01">

6.9 ?? CacheManager

Cache ??

• ?????????

Shiro ??? EhCache ??

• ?? EhCacheManager

Redis ????

• ?? RedisTemplate
• ????

6.10 ?????

??????

• ?????
• ???????

???????

• ????
• ??????

Shiro ??

• ???????
• ????

??????? B?????????????????