Foreword

This chapter learning Custom Realm of License

method

1. Concept

1) regarding the authorization process of source code analysis, I hope the reader to carry out inspection under the login authentication mode

2) About License JdbcRealm hope readers to write their own

Because JdbcRealm the License is limited to table, in general, we use a custom realm to authorization.

2. Coding

1) preparation of the following documents shiro.ini

[main]
myJdbcRealm = cn.edu.ccut.test.MyJdbcRealm
securityManager.realms = $myJdbcRealm

2) write MyJdbcRealm.java

Before landing verification explain the custom realm, we have used this class, where we continue to use.

We need to rewrite their doGetAuthorizationInfo approach to authorization.

package cn.edu.ccut.test;

import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

import java.util.HashSet;
import java.util.Set;

/**
 * @Auther:jwang
 * @Date:2019/5/11
 * @Description:cn.edu.ccut.test
 * @Version 1.0
 **/
public class MyJdbcRealm extends AuthorizingRealm {

    @Override
    public String getName() {
        return "MyJdbcRealm";
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = (String) getAvailablePrincipal(principals);
        //假设通过username取出角色为role1，jdbc代码略
        Set<String> roleNames = new HashSet<>();
        roleNames.add("role1");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roleNames);
        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        String username = upToken.getUsername();
        //假设通过username取出密码为1234，jdbc代码略
        String password = "1234";
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(username, password.toCharArray(), getName());
        return info;
    }
}

3) writing test code

package cn.edu.ccut.test;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.apache.shiro.mgt.SecurityManager;

/**
 * @Auther:jwang
 * @Date:2019/5/8
 * @Description:cn.edu.ccut.test
 * @Version 1.0
 **/
public class Authentication {

    public static void main(String [] args){
        //创建SecurityManager工厂
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        //通过SecurityManager工厂获取SecurityManager实例
        SecurityManager securityManager = factory.getInstance();
        //将SecurityManager对象设置到运行环境中
        SecurityUtils.setSecurityManager(securityManager);
        //通过SecurityUtils获取主体Subject
        Subject currentUser = SecurityUtils.getSubject();
        //设置用户名和密码
        String username = "zhangsan";
        String password = "1234";
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        //进行用户身份验证
        try {
            currentUser.login(token);
            //如果用户认证成功
            if (currentUser.isAuthenticated()) {
                System.out.println("用户["+username+","+password+"]登录成功！");
                //判断用户是否拥有角色role1
                System.out.println(currentUser.hasRole("role1"));
            }
        }catch (AuthenticationException e){
            e.printStackTrace();
            System.out.println("用户["+username+","+password+"]登录失败！");
        }

    }
}

Program results are as follows:

Visible, zhangsan the user has the role role1

Shiro entry (seven) Custom Realm of authorization

Foreword

method

Guess you like