Shiro最實用的操作

java揭開Shiro神祕面紗

1. Shiro是什麼？能幹嘛

Shiro是一個安全框架，主要做認證和授權，權限管理框架，一般我們都會在SpringSecurity和Shiro中選一個，攔截器思想Aop

它能在我們登錄的時候驗證身份，在登錄完後對身份權限做出對應的面板功能顯示等，在安全管理方面比較強

工欲善其事必先利其器，

      //和thymeleaf整合的shiro
      <dependency>
            <groupId>com.github.theborakompanioni</groupId>
            <artifactId>thymeleaf-extras-shiro</artifactId>
            <version>2.0.0</version>
        </dependency>

        //Shiro起步依賴
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.0</version>
        </dependency>
        <dependency>
             <groupId>org.apache.shiro</groupId>
             <artifactId>shiro-core</artifactId>
             <version>1.4.0</version>
        </dependency>
        <dependency>
            <groupId>log4j</groupId>
            <artifactId>log4j</artifactId>
            <version>1.2.17</version>
        </dependency>

1.1 Shiro.ini

Shiro的使用，必須要有一個ini文件配置信息還有個可選的log4j日誌文件

log4j.rootLogger=INFO, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n
# General Apache libraries
log4j.logger.org.apache=WARN
# Spring
log4j.logger.org.springframework=WARN
# Default Shiro logging
log4j.logger.org.apache.shiro=INFO
# Disable verbose logging
log4j.logger.org.apache.shiro.util.ThreadContext=WARN
log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

Shiro.ini

[users]   #角色
# user 'root' with password 'secret' and the 'admin' role
root = secret, admin
# user 'guest' with the password 'guest' and the 'guest' role
guest = guest, guest
# user 'presidentskroob' with password '12345' ("That's the same combination on
# my luggage!!!" ;)), and role 'president'
presidentskroob = 12345, president
# user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz'
darkhelmet = ludicrousspeed, darklord, schwartz
# user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz'
lonestarr = vespa, goodguy, schwartz
# -----------------------------------------------------------------------------
# Roles with assigned permissions
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
# -----------------------------------------------------------------------------
[roles]    #權限
# 'admin' role has all permissions, indicated by the wildcard '*'
admin = *
# The 'schwartz' role can do anything (*) with any lightsaber:
schwartz = lightsaber:*
# The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with
# license plate 'eagle5' (instance specific id)
goodguy = winnebago:drive:eagle5

上面是固定的模板套路，按照官網的QuickStart來的

QuickStart.class

public class Quickstart {
    //日誌打印
    private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);

    public static void main(String[] args) {
        // 創建配置了Shiro SecurityManager的最簡單方法
        // 領域、用戶、角色和權限使用簡單的INI配置。
        // 我們將使用一個可以攝取.ini文件的工廠來實現這一點
        // 返回一個SecurityManager實例:
        // 在類路徑的根目錄下使用shiro.ini文件
        // (file:和url:前綴分別從文件和url加載):

        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        SecurityManager securityManager = factory.getInstance();
        SecurityUtils.setSecurityManager(securityManager);


        //簡單的Shiro環境已經設置好了，讓我們看看你能做些什麼:
        // 獲取當前執行的用戶:
        Subject currentUser = SecurityUtils.getSubject();

        // 使用會話做一些事情(不需要web或EJB容器!!
        Session session = currentUser.getSession();
        session.setAttribute("someKey", "aValue");
        String value = (String) session.getAttribute("someKey");
        if (value.equals("aValue")) {
            log.info("Retrieved the correct value! [" + value + "]");
        }

        // 讓我們登錄當前用戶，這樣我們可以檢查角色和權限:
        if (!currentUser.isAuthenticated()) {
            //Token: 令牌
            UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
            token.setRememberMe(true);
            try {
                currentUser.login(token);
            } catch (UnknownAccountException uae) {
                log.info("There is no user with username of " + token.getPrincipal());
            } catch (IncorrectCredentialsException ice) {
                log.info("Password for account " + token.getPrincipal() + " was incorrect!");
            } catch (LockedAccountException lae) {
                log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                        "Please contact your administrator to unlock it.");
            }
            // 在這裏捕獲更多的異常
            catch (AuthenticationException ae) {
                //unexpected condition?  error?
            }
        }
        //打印它們的標識主體(在本例中爲用戶名):
        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
        //test a role:
        if (currentUser.hasRole("schwartz")) {
            log.info("May the Schwartz be with you!");
        } else {
            log.info("Hello, mere mortal.");
        }
        //test a typed permission (not instance-level)
        if (currentUser.isPermitted("lightsaber:wield")) {
            log.info("You may use a lightsaber ring.  Use it wisely.");
        } else {
            log.info("Sorry, lightsaber rings are for schwartz masters only.");
        }
        //a (very powerful) Instance Level permission:
        if (currentUser.isPermitted("winnebago:drive:eagle5")) {
            log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
                   "Here are the keys - have fun!");
        } else {
            log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
        }
        //註銷
        currentUser.logout();
        System.exit(0);
    }
}

接下來就可以啓動主啓動類看看日誌有無報錯，沒有就成功了

2. Shiro配置類

首先我們需要一個Relam對象繼承AuthorizingRealm，裏面有兩個方法，認證和授權，

下面這個例子是連接數據庫獲取的對象信息

public class UserRealm extends AuthorizingRealm {
    @Autowired
    EmployeeService employeeService;
    //授權
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("執行了授權doGetAuthorizationInfo");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        info.addStringPermission("user:add");   //登錄的用戶都給一個可以去add的權限
        //拿到當前用戶對象
        Subject subject = SecurityUtils.getSubject();
        Employee CurrentEmployee = (Employee)subject.getPrincipal();//拿到employee
        info.addStringPermission(CurrentEmployee.getName());  //本來應該單獨設置權限字段，這裏用名字代替權限
        return info;
    }
    //認證
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("認證doGetAuthenticationInfo");
//        //用戶名,密碼,數據中取
//        String name="root";
//        String password="123456";


        UsernamePasswordToken userToken= (UsernamePasswordToken) token;
//       if(!userToken.getUsername().equals((name))){
//           return null;  //拋出異常
//       }
        //連接真實數據庫
        Employee employee = employeeService.queryByName(userToken.getUsername());
        if(employee==null){
            return null;  //UnknowAccountExpection
        }
        Subject CurrentSubject=SecurityUtils.getSubject();
        Session session=CurrentSubject.getSession();
        session.setAttribute("loginUser","employee");
        //密碼認證，shiro做  可以加密MD5 子類繼承了，有加密類
        return new SimpleAuthenticationInfo(employee,employee.getPassword(),"");
    }
}

2.1 Shiro之Subject 用戶

Subject currentUser=SecurityUtils.getSubject();  //獲得當前用戶
Session session=currentUser.getSession();   //開啓Session
currentUser.isAuthenticated();   //是否認證
currentUser.getPrincipal()        //獲取權限
currentUser.hasRole("schwartz");    //是否擁有schwartz權限
currentUser.isPermitted("lightsaber:wield");   //允許lightsaber:wield訪問
currentUser.logout();   //登出註銷

2.1.1 ShiroCofig

UserRealm->DefaultWebSecurityManager->ShiroFilterFactoryBean

三大步驟

1. 創建realm對象 需要自定義 第一步
2. DefaultWebSecurityManager 安全對象 第二步
3. ShiroFilterFactoryBean Shiro過濾對象工廠 第三步 這個裏面可以寫權限

@Configuration
public class ShiroCofig {


    //ShiroFilterFactoryBean   Shiro過濾對象工廠 第三步
    @Bean
    public ShiroFilterFactoryBean  getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //設置安全管理器
        bean.setSecurityManager(defaultWebSecurityManager);
        //添加Shiro的內置過濾器
        /*
        * anon 無需認證就可以訪問
        * authc 必須認證了才能訪問
        * user   必須有 記住我功能才能用
        * perms  擁有堆某個資源的權限才能訪問
        * role 擁有某個角色
        * */
        //設置一個過濾器的鏈 Map
        //攔截
        Map<String, String> filterMap=new LinkedHashMap<>();
//        filterMap.put("/user/add","authc");
//        filterMap.put("/user/update","authc");
        //授權 正常情況下未授權會401
        filterMap.put("/user/add","perms[2]");       //名字爲2的才能訪問add頁面
        filterMap.put("/user/update","perms[root]");   //名字爲root的才能訪問update頁面
        filterMap.put("/user/*","authc");
        bean.setFilterChainDefinitionMap(filterMap);
        //設置登錄的請求
        bean.setLoginUrl("/toLogin");
        //設置未授權的請求 頁面
        bean.setUnauthorizedUrl("/noauth");
        return bean;
    }
    
    
    
    //DefaultWebSecurityManager  安全對象 第二步
    //Qualifier 綁定到一個方法上
    @Bean(name="securityManager")
    public DefaultWebSecurityManager getdefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //關聯UserRelam
        securityManager.setRealm(userRealm);
        return securityManager;
    }


    //創建realm對象 需要自定義 第一步
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }

    //整合ShiroDialect: 用來整合 shiro thymeleaf
    @Bean
    public ShiroDialect getShiroDialect(){
        return  new ShiroDialect();
    }
}

登錄認證攔截

filterMap.put("/user/add",“authc”);
filterMap.put("/user/update",“authc”);

bean.setFilterChainDefinitionMap(filterMap); map參數生效

代表了這個兩個路勁要認證了才能訪問，也就是登錄

2.2 Shiro之SecurityMannager 用戶管理類

//主要是做一個呈上啓下的作用給過濾工作返回一個管理類，

對下就是封裝來自userRelam的用戶數據信息

        DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();
        //關聯UserRelamjava
        securityManager.setRealm(userRealm);
        return securityManager;

2.3 Shiro之Realm 真實對象數據

2.3.1 認證

Controller層提交登錄用戶

    @RequestMapping({"/login"})
    public String login(String username,String password,Model model){
        //獲取當前的用戶
        Subject subject = SecurityUtils.getSubject();
        //封裝用戶的登陸數據
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        try {
            subject.login(token);   //登錄的方法，沒有異常就ok
            return  "index";
        }catch (UnknownAccountException e){
            model.addAttribute("msg","用戶名錯誤");
            return "login";
        }catch (IncorrectCredentialsException e){
            model.addAttribute("msg","密碼錯誤");
            return "login";
        }
    }

只要進了登錄Controller就會去subject.login(token)，走UserRealm認證方法

在自己寫的UserRealm類裏面有個認證AuthenticationInfo方法裏面

它可以直接這樣拿到提交的token用戶信息然後判斷是否數據庫對等

 UsernamePasswordToken userToken= (UsernamePasswordToken) token;
        //連接真實數據庫
        Employee employee = employeeService.queryByName(userToken.getUsername());
        if(employee==null){
            return null;  //UnknowAccountExpection
        }

密碼認證就交給Shiro做

return new SimpleAuthenticationInfo(employee,employee.getPassword(),"");

2.3.2 授權

認證返回了employee的用戶對象信息，裏面有權限字段

return new SimpleAuthenticationInfo(employee,employee.getPassword(),"");

這個方法主要是從認證的時候封裝的Subject拿到的用戶權限字段，然後給用戶賦予這個權限

    //授權
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("執行了授權doGetAuthorizationInfo");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
//        info.addStringPermission("user:add");   //登錄的用戶都給一個可以去add的權限
        //拿到當前用戶對象
        Subject subject = SecurityUtils.getSubject();
        Employee CurrentEmployee = (Employee)subject.getPrincipal();//拿到employee
        info.addStringPermission(CurrentEmployee.getName());  //本來應該單獨設置權限字段，這裏用名字代替權限
        return info;
    }

3. 前端小細節

如果開啓這個

        //設置未授權的請求 頁面
        bean.setUnauthorizedUrl("/noauth");

@RequestMapping({"/noauth"})
@ResponseBody
public String unauthorized(){
    return "未經授權無法訪問此頁面";
}

那麼如果是訪問到沒有授權的就會顯示這些字，因爲會走/noauth路勁

---

  //整合ShiroDialect: 用來整合 shiro thymeleaf
    @Bean
    public ShiroDialect getShiroDialect(){
        return  new ShiroDialect();
    }

上面的寫在ShiroConfig裏面可以讓thymeleaf實現權限展示，有權限的纔看的到

<html lang="en" xmlns:th="http://www.thymeleaf.org" xmlns:shiro="http://www.thymeleaf-extras-shiro">
//頭部聲明使用shiro和thymeleaf

  <div shiro:hasPermission="2">
       <a th:href="@{/user/add}">add</a>
  </div>
  <div shiro:hasPermission="root">
       <a th:href="@{/user/update}">update</a>
  </div>

有對應權限的纔會顯示

前後端分離 同源策略如何破

重寫一個過濾器，重寫請求,通過請求頭允許跨域

@Order(-100)
@Component
@ServletComponentScan
@WebFilter(urlPatterns = "/*",filterName = "shiroLoginFilter")
public class ShiroLoginFilter implements Filter {
 
    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
    }
 
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
        HttpServletResponse response = (HttpServletResponse) servletResponse;
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        // 允許哪些Origin發起跨域請求
        String orgin = request.getHeader("Origin");
        // response.setHeader( "Access-Control-Allow-Origin", config.getInitParameter( "AccessControlAllowOrigin" ) );
        response.setHeader( "Access-Control-Allow-Origin", orgin );
        // 允許請求的方法
        response.setHeader( "Access-Control-Allow-Methods", "POST,GET,OPTIONS,DELETE,PUT" );
        //多少秒內,不需要再發送預檢驗請求，可以緩存該結果
        response.setHeader( "Access-Control-Max-Age", "3600" );
        // 表明它允許跨域請求包含xxx頭
        response.setHeader( "Access-Control-Allow-Headers", "x-auth-token,Origin,Access-Token,X-Requested-With,Content-Type, Accept" );
        //是否允許瀏覽器攜帶用戶身份信息（cookie）
        response.setHeader( "Access-Control-Allow-Credentials", "true" );
        //prefight請求
        if (request.getMethod().equals( "OPTIONS" )) {
            response.setStatus( 200 );
            return;
        }
        chain.doFilter( servletRequest, response );
    }
 
    @Override
    public void destroy() {
 
    }
}