讲一讲SpringBoot整合shiro框架实现登录认证的流程及原理

SpringBoot整合shiro框架实现登录认证的流程及原理可以分为以下步骤：

引入shiro和web依赖

在pom.xml中引入shiro和web依赖，如下所示：
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.7.1</version>
</dependency>

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
登录后复制

配置shiro

在application.properties文件中配置shiro相关属性，如下所示：
# shiro配置
# 加密算法
shiro.hashAlgorithmName=md5
# 加密次数
shiro.hashIterations=2
# shiro缓存
shiro.cacheManager=org.apache.shiro.cache.MemoryConstrainedCacheManager
登录后复制

自定义Realm

实现自定义Realm，继承org.apache.shiro.realm.AuthorizingRealm类，重写doGetAuthorizationInfo和doGetAuthenticationInfo方法，分别用于授权和认证。
public class CustomRealm extends AuthorizingRealm {

@Autowired
private UserService userService;

/**
* 授权
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
return null;
}

/**
* 认证
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
String username = usernamePasswordToken.getUsername();
User user = userService.findByUsername(username);
if (user == null) {
throw new UnknownAccountException("用户名不存在");
}
String password = new String(usernamePasswordToken.getPassword());
String salt = user.getSalt();
String hashedPassword = new SimpleHash("md5", password, salt, 2).toString();
if (!user.getPassword().equals(hashedPassword)) {
throw new IncorrectCredentialsException("密码错误");
}
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user, user.getPassword(), getName());
return authenticationInfo;
}
}
登录后复制

配置shiroFilterFactoryBean

在配置类中配置shiroFilterFactoryBean，用于拦截请求，并进行认证和授权。
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(DefaultWebSecurityManager securityManager) {
ShiroFilterFactoryBean filterFactoryBean = new ShiroFilterFactoryBean();
filterFactoryBean.setSecurityManager(securityManager);
filterFactoryBean.setLoginUrl("/login");
filterFactoryBean.setUnauthorizedUrl("/unauthorized");
Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
filterChainDefinitionMap.put("/login", "anon");
filterChainDefinitionMap.put("/logout", "logout");
filterChainDefinitionMap.put("/**", "authc");
filterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
return filterFactoryBean;
}
登录后复制

配置securityManager

在配置类中配置securityManager，将自定义Realm添加到securityManager中。
@Bean
public DefaultWebSecurityManager securityManager() {
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(customRealm());
return securityManager;
}
登录后复制

配置shiro的注解支持

在配置类中配置shiro的注解支持，用于在Controller中使用@RequiresRoles和@RequiresPermissions注解。
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(DefaultWebSecurityManager securityManager) {
AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
advisor.setSecurityManager(securityManager);
return advisor;
}
登录后复制

编写Controller

编写Controller，用于处理登录请求。
@Controller
public class LoginController {

@GetMapping("/login")
public String login() {
return "login";
}

@PostMapping("/login")
public String doLogin(String username, String password) {
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
try {
subject.login(token);
return "redirect:/index";
} catch (UnknownAccountException e) {
return "login";
} catch (IncorrectCredentialsException e) {
return "login";
}
}

@GetMapping("/logout")
public String logout() {
Subject subject = SecurityUtils.getSubject();
subject.logout();
return "redirect:/login";
}

@GetMapping("/unauthorized")
public String unauthorized() {
return "unauthorized";
}
}
登录后复制
以上就是SpringBoot整合shiro框架实现登录认证的流程及原理。