shiro快速入门案例

Apache Shiro是什么？

Apache Shiro是一个强大且易用的Java安全框架，可执行身份验证（登录）、授权、密码学和会话管理

架构图

组件基本说明：

subject（主体）：接收客户端账号密码，有一系列的认证授权方法
security manager（安全管理器）：管理所有的subject，并使用底层组件完成操作
authenticator（认证/登录校验）：对subject的身份进行认证，最简单可以理解为对用户的账号密码进行校验
authorize（授权）：subject认证通过后，在访问功能时需要通过授权器判断用户是否有此功能的操作权限
realm（域）：对当前subject的权限管理数据进行封装（从数据库中获取），分别有认证和授权两个
session manager（会话管理器）：类似于web session域的session管理域
sessionDAO（会话DAO）：shiro session的Dao类
cache manager（缓存管理器）：用于缓存权限信息，提高系统性能
crypography（密码学）：一套加密api

快速入门案例

数据库表：
user

user_role

role_permission

maven依赖：

<!-- shiro-core -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.3.2</version>
</dependency>


<!-- 数据库驱动：mysql -->
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>5.1.38</version>
</dependency>


<!-- 连接池：druid -->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>druid</artifactId>
    <version>1.1.6</version>
</dependency>

** 数据库工具类：**

public class DBUtil {

    private DBUtil() {}
    
    private static DruidDataSource druidDataSource = null;
    
    static {
        druidDataSource = new DruidDataSource();
        druidDataSource.setDriverClassName("com.mysql.jdbc.Driver");
        druidDataSource.setUrl("jdbc:mysql://127.0.0.1:3306/test");
        druidDataSource.setUsername("root");
        druidDataSource.setPassword("root");
    }
    
    public static DruidPooledConnection getConnection() throws SQLException {
        return druidDataSource.getConnection();
    }
    
    public static DataSource getDataSource() {
        return druidDataSource;
    }
    
}

** 需要认证授权的用户信息（模拟表填提交的数据）：**

public enum Users {
    ADMIN("admin", "123456"), TEST("test", "123456");
    
    private String username;
    private String password;
    Users(String username, String password) {
        this.username = username;
        this.password = password;
    }
    
    public String getUsername() {
        return username;
    }
    public void setUsername(String username) {
        this.username = username;
    }
    public String getPassword() {
        return password;
    }
    public void setPassword(String password) {
        this.password = password;
    }
    
}

** 入门案例： **

/**
 * 使用shiro提供的SimpleAccountRealm进行认证(不支持自定义授权)
 */
public class SimpleAccountRealmTest {
    
    //备用。用于存放查询出来的角色名称
    private static String[] userRoles = new String[5]; 
    
    //创建一个shiro提供的简单Realm,不支持自定义授权
    private static SimpleAccountRealm realm = new SimpleAccountRealm();
    
    //初始化realm信息
    static {
        
        try {
            
            DruidPooledConnection connection = DBUtil.getConnection();
            
            //获取需要认证用户的user信息
            PreparedStatement userPrepareStatement = connection.prepareStatement("select * from user where username=?"); 
            userPrepareStatement.setString(1, Users.ADMIN.getUsername());
            ResultSet userRs = userPrepareStatement.executeQuery();
            userRs.next(); //username唯一所以只有一个rs
            
            //根据用户信息（username）查找出对应的role
            PreparedStatement rolePrepareStatement = connection.prepareStatement("select * from user_role where username=?");
            rolePrepareStatement.setString(1, Users.ADMIN.getUsername());
            ResultSet roleRs = rolePrepareStatement.executeQuery();
            
            int i = 0;
            while(roleRs.next()) { //可能有多个角色
                userRoles[i++] = roleRs.getString("role_name");
            }
            
            
            /**
             * 注意：这里的account信息应该是数据库中的信息
             */
            realm.addAccount(userRs.getString("username"), userRs.getString("password"), userRoles); //将该账号信息设置到realm中
            
        } catch (Exception e) {
            e.printStackTrace();
        }
        
    }
    
    public static void main(String[] args) {
    
        // 1. 获取默认的SecurityManager
        DefaultSecurityManager sm = new DefaultSecurityManager();
        sm.setRealm(realm);
        
        // 2. 设置到工具中
        SecurityUtils.setSecurityManager(sm);
        
        // 3. 获取主体
        Subject subject = SecurityUtils.getSubject();
        
        // 4. 创建token
        UsernamePasswordToken token = new UsernamePasswordToken(Users.ADMIN.getUsername(), Users.ADMIN.getPassword());
        
        // 5. 认证
        subject.login(token);
        
        System.out.println( "是否认证成功: " + subject.isAuthenticated() );
        System.out.println( "是否有super这个角色: " +  subject.hasRole("super"));
        System.out.println( "是否有default这个角色: " +  subject.hasRole("default"));
//      boolean[] hasRoles = subject.hasRoles(Arrays.asList(userRoles)); //是否同时有super和default这个角色
        
        
    }

}

shiro提供的realm基本使用

** IniRealm: **
auth.ini:

[users]
admin=123456,super,default
test=123456,default

[roles]
super=user:delete,user:select,user:update,user:insert
default=user:select

code:

/**
 * 使用shiro提供的IniRealm进行认证(使用配置文件保存认证授权信息)
 */
public class IniRealmTest {
    
    private static IniRealm iniRealm;
    
    static {
        iniRealm = new IniRealm("classpath:auth.ini");
    }

    public static void main(String[] args) {

        

        // 1. 获取默认的SecurityManager
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(iniRealm);

        // 2. 设置到工具中
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        
        // 3. 获取主体
        Subject subject = SecurityUtils.getSubject();

        // 4. 创建token
        UsernamePasswordToken token = new UsernamePasswordToken(Users.ADMIN.getUsername(), Users.ADMIN.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), Users.TEST.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken("AAAA", "XXX"); //UnknownAccountException 没有该账号
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), "XXX"); //IncorrectCredentialsException 凭证错误（密码错误）
        
        // 5. 认证
        subject.login(token);

        System.out.println( "是否认证成功: " + subject.isAuthenticated() );
        System.out.println( "是否有super这个角色: " +  subject.hasRole("super") );
        System.out.println( "是否有default这个角色: " +  subject.hasRole("default") );
        
        // 6. 授权
        System.out.println( "是否有user:select权限 " + subject.isPermitted("user:select"));
        System.out.println( "是否有user:delete权限 " + subject.isPermitted("user:delete"));
        System.out.println( "是否有user:update权限 " + subject.isPermitted("user:update"));
        System.out.println( "是否有user:insert权限 " + subject.isPermitted("user:insert"));

        
    }

}

** JdbcRealm: **

/**
 * 使用shiro提供的JdbcRealm进行认证(使用数据库数据)
 */
public class JdbcRealmTest {

    private static JdbcRealm jdbcRealm;
    
    static {
        jdbcRealm = new JdbcRealm();
        jdbcRealm.setDataSource(DBUtil.getDataSource());
        jdbcRealm.setPermissionsLookupEnabled(true);    // 使用JdbcRealm时要设置权限开关，默认为false
        
        // 自定义SQL语句（如果不设置自定义的SQL语句则按照JdbcRealm内置的模板SQL语句进行数据库操作，可以进入JdbcRealm查看）
        String sql = "select password from user where username = ?";
        jdbcRealm.setAuthenticationQuery(sql);

        String roleSql = "select role_name from user_role where username = ?";
        jdbcRealm.setUserRolesQuery(roleSql);
        
        String permissionSql = "select permission from role_permission where role_name = ?";
        jdbcRealm.setPermissionsQuery(permissionSql);
    }
    
    public static void main(String[] args) {

        // 1. 获取默认的SecurityManager
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(jdbcRealm);

        // 2. 设置到工具中
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        
        // 3. 获取主体
        Subject subject = SecurityUtils.getSubject();

        // 4. 创建token
        UsernamePasswordToken token = new UsernamePasswordToken(Users.ADMIN.getUsername(), Users.ADMIN.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), Users.TEST.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken("AAAA", "XXX"); //UnknownAccountException 没有改账号
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), "XXX"); //IncorrectCredentialsException 凭证错误（密码错误）
        
        // 5. 认证
        subject.login(token);

        System.out.println( "是否认证成功: " + subject.isAuthenticated() );
        System.out.println( "是否有super这个角色: " +  subject.hasRole("super") );
        System.out.println( "是否有default这个角色: " +  subject.hasRole("default") );
        
        // 6. 授权
        System.out.println( "是否有user:select权限 " + subject.isPermitted("user:select"));
        System.out.println( "是否有user:delete权限 " + subject.isPermitted("user:delete"));
        System.out.println( "是否有user:update权限 " + subject.isPermitted("user:update"));
        System.out.println( "是否有user:insert权限 " + subject.isPermitted("user:insert"));
        
    }

}

自定义Realm(参考JdbcRealm)

** 辅助类： **

/**
 * MyRealm的辅助类（可以定义成内部类）
 */
public class UserDaoUtil {
    
    private UserDaoUtil(){ }
    
    private static Connection conn;

    static {
        try {
            conn = DBUtil.getConnection();
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
    
    
    /**
     * 根据username获取SimpleAccount
     * @param username
     * @param realmName
     * @return
     */
    public static SimpleAccount getSimpleAccount(String username, String realmName) {
        
        PreparedStatement prepareStatement = null;
        ResultSet rs = null;
        SimpleAccount account = null;
        try {
            
            prepareStatement = conn.prepareStatement("select * from user where username = ?");
            prepareStatement.setString(1, username);
            rs = prepareStatement.executeQuery();
            rs.next();
            
            account = new SimpleAccount(rs.getString("username"), rs.getString("password"), realmName);
            
        } catch (Exception e) {
            e.printStackTrace();
        }
        
        return account;
    }
    
    
    /**
     * 根据username获取role
     * @param username
     * @return
     */
    public static Set<String> getRoleNamesForUser(String username) {

        PreparedStatement prepareStatement = null;
        ResultSet rs = null;
        Set<String> roles = null;
        try {
            roles = new HashSet<>();
            prepareStatement = conn.prepareStatement("select * from user_role where username = ?");
            prepareStatement.setString(1, username);
            rs = prepareStatement.executeQuery();
            
            while(rs.next()) {
                roles.add( rs.getString("role_name") );
            }
            
        } catch (Exception e) {
            e.printStackTrace();
        }
        
        return roles;
    }
    
    /**
     * 获取Permissions
     * @param username
     * @param roleNames
     * @return
     */
    public static Set<String> getPermissions(Set<String> roleNames) {
        
        PreparedStatement prepareStatement = null;
        ResultSet rs = null;
        Set<String> permissions = null;
        try {
            
            permissions = new HashSet<>();
            
            for (String roleName : roleNames) {
                
                prepareStatement = conn.prepareStatement("select * from role_permission where role_name = ?");
                prepareStatement.setString(1, roleName);
                rs = prepareStatement.executeQuery();
                
                while(rs.next()) {
                    permissions.add(rs.getString("permission"));
                }
            }
            
        } catch (Exception e) {
            e.printStackTrace();
        }
        
        return permissions;
    }
    
}

** 自定义Realm: **

public class MyRealmTest {

    private static MyRealm myRealm;
    
    static {
        myRealm = new MyRealm();
    }   
    
    public static void main(String[] args) {
        
        // 1. 获取默认的SecurityManager
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(myRealm);

        // 2. 设置到工具中
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        
        // 3. 获取主体
        Subject subject = SecurityUtils.getSubject();

        // 4. 创建token
        UsernamePasswordToken token = new UsernamePasswordToken(Users.ADMIN.getUsername(), Users.ADMIN.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), Users.TEST.getPassword());
//        UsernamePasswordToken token = new UsernamePasswordToken("AAAA", "XXX"); //UnknownAccountException 没有改账号
//        UsernamePasswordToken token = new UsernamePasswordToken(Users.TEST.getUsername(), "XXX"); //IncorrectCredentialsException 凭证错误（密码错误）
        
        // 5. 认证
        subject.login(token);
        System.out.println( "是否认证成功: " + subject.isAuthenticated() );
        
        System.out.println("----------------------------------------------------------------");
        
        System.out.println( "是否有super这个角色: " +  subject.hasRole("super") );
        System.out.println( "是否有default这个角色: " +  subject.hasRole("default") );
        
        System.out.println("----------------------------------------------------------------");
        
        // 6. 授权
        System.out.println( "是否有user:select权限 " + subject.isPermitted("user:select"));
        System.out.println( "是否有user:delete权限 " + subject.isPermitted("user:delete"));
        System.out.println( "是否有user:update权限 " + subject.isPermitted("user:update"));
        System.out.println( "是否有user:insert权限 " + subject.isPermitted("user:insert"));
    }

}

shiro快速入门案例

Apache Shiro是什么？

架构图

快速入门案例

shiro提供的realm基本使用

自定义Realm(参考JdbcRealm)

猜你喜欢