什么是shiro

shiro就是一个安全框架，可以对用户进行认证和授权
认证：就是对用户身份的一种确认，只有用户的身份符合标准，那就可以认证成功。
授权：在认证之后，可以对已经获得认证的用户授予权限(就是允许他们做什么事情)

几个重要的概念

1、Subject，可以把它看成浏览器
2、SecurityManager，安全管理器 主要管理的是认证、授权、缓存、会话…
3、 Authenticator，认证器 负责认证
4、Authorizer，授权器 负责授权
5、Realm，就是对用户进行认证和授权的地方
6、CacheManager，将用户权限数据存储在缓存，这样可以提高性能。
7、Cryptography，一套加密/解密的组件 可以对数据加解密

springboot整合shiro

1、maven：

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring-boot-starter</artifactId>
            <version>1.5.3</version>
        </dependency>

2、配置三个Bean

    @Bean("myRealm")
    public Realm getRealm(){
    
    	//自定义Realm
        CustomerRealm customerRealm = new CustomerRealm();
        //对密码的加密方式
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");
        hashedCredentialsMatcher.setHashIterations(1024);
        customerRealm.setCredentialsMatcher(hashedCredentialsMatcher);
        return customerRealm;
    }

    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("myRealm") Realm realm){
    
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
        defaultWebSecurityManager.setRealm(realm);
        return defaultWebSecurityManager;
    }

    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(SecurityManager securityManager){
    
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        shiroFilterFactoryBean.setSecurityManager(securityManager);
        //认证时的登录页面
        shiroFilterFactoryBean.setLoginUrl("/login.html");
        Map<String,String> map = new LinkedHashMap<>();
		//设置权限,/a路径谁都可以访问，/b认证通过的用户才可以访问，/c只有授权过的用户才可以访问
        map.put("/a","anon");
        map.put("/b","authc");
        map.put("/c","roles");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
        return shiroFilterFactoryBean;
    }

自定义的Realm

public class CustomerRealm extends AuthorizingRealm {
    

    @Autowired
    private UserService userService;

    @Autowired
    private VipService vipService;

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    
    	//取得用户的用户名
        String primaryPrincipal = (String) principalCollection.getPrimaryPrincipal();
        try{
    
        	//去数据库查询该用户对应的权限资格
            int vip = vipService.select_vip(primaryPrincipal);
            SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
            //授予权限资格
            simpleAuthorizationInfo.addRole(vip+"");
            return simpleAuthorizationInfo;
        }catch (Exception e){
    
            e.printStackTrace();
            return null;
        }
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    
    	//取得登录时的用户名
        String principal = (String) authenticationToken.getPrincipal();
		//我们可以根据用户名去数据库查找是否有此人，如果就把密码取出来
        String pw = userService.select_user(principal);
   		//现在对用户进行验证,其中this.getName()照写就行；MyByteSource.Util.bytes("")是salt(序列化的salt) 我这里的salt是空的(该salt也可以从数据库中取出)
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal, pw, MyByteSource.Util.bytes(""), this.getName());
        return simpleAuthenticationInfo;

    }
}

什么时候会触发Realm的认证、授权方法呢？

    //登录
    @RequestMapping("toLogin")
    public String toLogin(String username, String password){
    
        try{
    
            Subject subject = SecurityUtils.getSubject();
            
            //这一步将会触发认证方法
            subject.login(new UsernamePasswordToken(username,password,true));
            Map<String,String> map = new HashMap<>();
            map.put("username",username);
            return JWTUtils.getToken(map);
        }catch (UnknownAccountException unknownAccountException){
    
            unknownAccountException.printStackTrace();
            System.out.println("用户名不存在");
        }catch (IncorrectCredentialsException incorrectCredentialsException){
    
            incorrectCredentialsException.printStackTrace();
            System.out.println("密码不正确");
        }
            return "false";
    }

    @GetMapping("c")
    public String APIc(){
    
        Subject subject = SecurityUtils.getSubject();
        
        //这一步触发授权方法
        if (subject.hasRole("1")) {
    
            return "pass";
        }else {
    
            return "fail";
        }

    }

有一个问题，就是每次我们访问需要权限的的路径时，总是要求数据库查询，为了安全和效率我们可以把用户的权限以及用户名密码都暂时放在内存里

    @Bean
    public Realm getRealm(){
    
        CustomerRealm customerRealm = new CustomerRealm();
        //修改凭证校验匹配器
        HashedCredentialsMatcher credentialsMatcher = new HashedCredentialsMatcher();
        //设置加密算法为md5
        credentialsMatcher.setHashAlgorithmName("MD5");
        //设置散列次数
        credentialsMatcher.setHashIterations(1024);
        customerRealm.setCredentialsMatcher(credentialsMatcher);

        //开启缓存管理器
        customerRealm.setCachingEnabled(true);
        customerRealm.setAuthorizationCachingEnabled(true);
        customerRealm.setAuthorizationCachingEnabled(true);
        customerRealm.setCacheManager(new EhCacheManager());
        return customerRealm;
    }

也可以使用redis进行缓存

public class RedisCacheManager implements CacheManager {
    
    @Override
    public <K, V> Cache<K, V> getCache(String cacheName) throws CacheException {
    
        System.out.println("缓存名称: "+cacheName);
        return new RedisCache<K,V>();
    }
}

public class RedisCache <K,V> implements Cache<K,V> {
    

    //用户认证、授权的缓存都在这里查询，如果return null那就说明在缓存找不到 返回给自定义realm处理
    @Override
    public V get(K k) throws CacheException {
    

        RedisTemplate redisTemplate = (RedisTemplate)ApplicationContextUtils.getBean("myredis");

        if (k instanceof PrincipalCollection){
    
            String primaryPrincipal = (String)((PrincipalCollection) k).getPrimaryPrincipal();
            System.out.println(primaryPrincipal);
            String viplevel = (String)redisTemplate.opsForValue().get(primaryPrincipal+"level");
            if (viplevel != null){
    
                SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
                simpleAuthorizationInfo.addRole(viplevel+"");
                return (V) simpleAuthorizationInfo;
            }else {
    
                return null;
            }
        }else {
    
            String pw = (String)redisTemplate.opsForValue().get(k);
            if (pw!=null){
    
                SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(k, pw, MyByteSource.Util.bytes(""),"123");
                return (V) simpleAuthenticationInfo;
            }else {
    
                return null;
            }
        }
    }

    @Bean("myRealm")
    public Realm getRealm(){
    
        CustomerRealm customerRealm = new CustomerRealm();
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        hashedCredentialsMatcher.setHashAlgorithmName("md5");
        hashedCredentialsMatcher.setHashIterations(1024);
        customerRealm.setCredentialsMatcher(hashedCredentialsMatcher);

        //开启缓存管理器
        customerRealm.setCacheManager(new RedisCacheManager());
        customerRealm.setCachingEnabled(true);//开启全局缓存
        customerRealm.setAuthenticationCachingEnabled(true);
        customerRealm.setAuthorizationCachingEnabled(true);
        return customerRealm;
    }