springboot redis shiro 实现 单点登录

大家好，我是烤鸭：

    今天给大家分享简单的单点登录的实现方式。

    环境及jar包:

    springboot     1.5.10   

    redis    2.9.0    （可以用tomcat的session，但是无法解决多个tomcat共享session的问题）

    shiro    1.4.0    

    lombok    1.16.10    （可选,编译的时候自动生成get,set,toString()方法）

登录方法：

    主要是用户完成登录，登录信息写在cookie，

    服务器端存缓存(redis)中。

LoginService:

package xxx.xxx.system.service.impl;

import java.io.Serializable;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import com.alibaba.fastjson.JSONObject;
import xxx.xxx.common.constant.IMsgEnum;
import xxx.xxx.common.resp.BaseMsgResp;
import xxx.xxx.common.utils.MD5Utils;
import xxx.xxx.entity.sys.UserDO;
import xxx.xxx.redis.cache.RedisManager;
import xxx.xxx.system.service.LoginService;
import xxx.xxx.system.service.UserService;

@Service
public class LoginServiceImpl implements LoginService {
    @Autowired
    private UserService userService;

    @Override
    public BaseMsgResp login(String username, String password) throws AuthenticationException{
        BaseMsgResp resp = new BaseMsgResp();
        password = MD5Utils.encrypt(username, password);
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        Subject subject = SecurityUtils.getSubject();
        subject.login(token);
        //获取用户
        Map params = new HashMap<>();
        params.put("username", username);
        List list = userService.list(params);
        if(list.size() > 1) {
            resp = new BaseMsgResp(IMsgEnum.SYSTEM_ANOMALY.getMsgCode()+"",IMsgEnum.SYSTEM_ANOMALY.getMsgText());
            return resp;
        }
        //token
        Serializable id = subject.getSession().getId();
        //将token放入redis
        RedisManager manager = RedisManager.getRedisSingleton();
        manager.set("sys:login:user_token_"+id.toString(),list.get(0).getUserId()+"",60*30);
        //防止同一个账号同时登录
        manager.set("sys:user:id_"+list.get(0).getUserId(), id.toString(),60*30);
        //用户信息
        manager.set("sys:login:user_info_"+list.get(0).getUserId(), JSONObject.toJSONString(list.get(0)),60*30);
        return resp;
    }
}

RedisManager.java

    用于redis初始化，和一些基本方法：

packagexxx.xxx.redis.cache;


import java.util.ArrayList;
import java.util.Iterator;
import java.util.List;


/**
 * @author
 * @version V1.0
 */


import java.util.Set;
import java.util.concurrent.TimeUnit;


import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Configuration;


import com.alibaba.fastjson.JSONObject;
import xxx.xxx.redis.config.RedisConstant;


import lombok.Data;
import redis.clients.jedis.Jedis;
import redis.clients.jedis.JedisPool;
import redis.clients.jedis.JedisPoolConfig;


/**
 *
 */
@Configuration
@ConfigurationProperties(value="jedis.pool")
@Data
public class RedisManager {
    private final Logger logger = LoggerFactory.getLogger(this.getClass());

    volatile static RedisManager redisSingleton;

    private String host;
    private int port;
    private int expire;
    private int timeout;
    private String password = "";
    private static JedisPool jedisPool = null;
    //第几个仓库
    private String database;

    public String getDatabase() {
        if(null == database || "".equals(database)) return "0";
        return database;
    }


    public void setDatabase(String database) {
        this.database = database;
    }

    public RedisManager() {


    }



    public static RedisManager getRedisSingleton() {
        if(redisSingleton == null) {
            synchronized (RedisManager.class) {
                if(redisSingleton == null) return new RedisManager();
            }
        }
        return redisSingleton;
    }


    /**
     * 初始化方法
     */
    public void init() {
        if (jedisPool == null) {
            if (password != null && !"".equals(password)) {
                jedisPool = new JedisPool(new JedisPoolConfig(), host, port, timeout, password);
            } else if (timeout != 0) {
                jedisPool = new JedisPool(new JedisPoolConfig(), host, port, timeout);
            } else {
                jedisPool = new JedisPool(new JedisPoolConfig(), host, port);
            }


        }
    }




    /**
     * 给Redis中Set集合中某个key值设值
     *
     * @param key
     * @param value
     */
    public void set(String key, String value) {
        Jedis jedis = null;
        try {
            jedis = jedisPool.getResource();
            jedis.select(Integer.parseInt(getDatabase()));
            jedis.set(key, value);
        } catch (Exception e) {
            logger.error("Jedis set 异常" + e.getMessage());
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }
    }


    /**
     * 从Redis中Set集合中获取key对应value值
     *
     * @param key
     */
    public String get(String key) {
        Jedis jedis = null;
        try {
            jedis = jedisPool.getResource();
            jedis.select(Integer.parseInt(getDatabase()));
            return jedis.get(key);
        } catch (Exception e) {
            logger.error("Jedis get 异常" + e.getMessage());
            return null;
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }
    }






    /**
     * 给Redis中Set集合中某个key值设值
     *
     * @param key
     * @param value
     */
    public void set(String key, String value, long time) {
        Jedis jedis = null;
        try {
            jedis = jedisPool.getResource();
            jedis.select(Integer.parseInt(getDatabase()));
            jedis.set(key, value);
            jedis.set(key, value, "XX", "EX", time);
        } catch (Exception e) {
            logger.error("Jedis set 异常" + e.getMessage());
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }
    }



    /**
     *
    * @Title: expire
    * @Description: 设置指定key的生存时间
    * @return Long    成功 返回 1
    * @throws
     */
    public Long expire(String key,int seconds) {
        Jedis jedis = null;
        try {
            jedis = jedisPool.getResource();
            jedis.select(Integer.parseInt(getDatabase()));
            return jedis.expire(key, seconds);
        } catch (Exception e) {
            logger.error("Jedis expire 异常" + e.getMessage());
            return null;
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }


    }
    /**
     *
    * @Title: exist
    * @Description: 判断key是否存在
    * @return Boolean    返回类型
    * @throws
     */
    public Boolean exist(String key) {
        Jedis jedis = null;
        try {
            jedis = jedisPool.getResource();
            jedis.select(Integer.parseInt(getDatabase()));
            return jedis.exists(key);
        } catch (Exception e) {
            logger.error("Jedis exist 异常" + e.getMessage());
            return null;
        } finally {
            if (jedis != null) {
                jedis.close();
            }
        }


    }

}

LoginInterceptor:

    每次请求都会经过拦截器，校验用户是否登录或者多个浏览器（客户端）登录。

    如果用户已登录，用这次请求cookie中的token和缓存中的比较，如果不一致，就把之前缓存中的用户信息清空。

    这样之前的用户如果再次操作，就会跳转到登陆页面。

package xxx.xxx.system.interceptor;

import java.io.IOException;
import java.io.Serializable;
import java.lang.ProcessBuilder.Redirect;
import java.util.HashMap;
import java.util.Map;

import javax.servlet.ServletOutputStream;
import javax.servlet.http.Cookie;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.commons.lang3.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.autoconfigure.web.ErrorMvcAutoConfiguration;
import org.springframework.stereotype.Component;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.method.HandlerMethod;
import org.springframework.web.servlet.HandlerInterceptor;
import org.springframework.web.servlet.ModelAndView;

import com.alibaba.fastjson.JSONObject;
import xxx.xxx.common.utils.LogUtils;
import xxx.xxx.redis.cache.RedisManager;
import xxx.xxx.system.utils.ShiroUtils;

/**
 * ClassName: PlatformInterceptor date: 2015年12月30日 下午2:13:24 Description: 拦截器
 *
 * @author
 * @version
 * @since JDK 1.8
 */
@Component
@EnableAutoConfiguration(exclude = ErrorMvcAutoConfiguration.class)
public class LoginInterceptor implements HandlerInterceptor {

    private static final Log logger = LogFactory.getLog(LoginInterceptor.class);

    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
        try {
            logger.info(LogUtils.getRequestLog(request));
            //校验用户是否已经登录,如果登录过,将之前用户踢掉,同时更新缓存中用户信息
            Subject subject = SecurityUtils.getSubject();
            Serializable token = subject.getSession().getId();
            RedisManager redisManager = RedisManager.getRedisSingleton();
            //获取用户id
            String userId = redisManager.get("sys:login:user_token_"+token.toString());
            if(StringUtils.isNotBlank(userId)) {
                String tokenPre = redisManager.get("sys:user:id_"+userId);
                if(!token.equals(tokenPre)) {
                     //重定向到login.html
                    redirect(request, response);
                    return false;
                }else {
                    Long expire = redisManager.ttl("sys:login:user_token_"+token.toString());
                    //过期时间小于1分钟的,更新token
                    if(expire < 1 * 60 * 1000) {
                        redisManager.expire("sys:login:user_token_"+token.toString(), 60*30);
                    }
                }
            }else {
                redirect(request, response);
                return false;
            }
        } catch (Exception e) {
            logger.info("preHandle="+e.getMessage());
        }
        return true;
    }

    @Override
    public void postHandle(HttpServletRequest request, HttpServletResponse response, Object handler,
            ModelAndView modelAndView) throws Exception {

    }

    @Override
    public void afterCompletion(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex)
            throws Exception {
    }
      //对于请求是ajax请求重定向问题的处理方法
    public void redirect(HttpServletRequest request, HttpServletResponse response) throws IOException{
        //获取当前请求的路径
        String basePath = request.getScheme() + "://" + request.getServerName() + ":"  + request.getServerPort()+request.getContextPath();
//        response.getOutputStream().write("账号在别处登录。".getBytes("UTF-8"));
        //如果request.getHeader("X-Requested-With") 返回的是"XMLHttpRequest"说明就是ajax请求，需要特殊处理 否则直接重定向就可以了
        if("XMLHttpRequest".equals(request.getHeader("X-Requested-With"))){
            //告诉ajax我是重定向
            response.setHeader("REDIRECT", "REDIRECT");
            //告诉ajax我重定向的路径
            response.setHeader("CONTENTPATH", basePath+"/login");
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
        }else{
            response.sendRedirect(basePath + "/login");
        }
    }
}

ShiroUtils.java

    shiro 工具类，获取subject对象。

package xxx.xxx.system.utils;


import java.security.Principal;
import java.util.Collection;
import java.util.List;


import org.apache.shiro.SecurityUtils;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.eis.SessionDAO;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;


import xxx.xxx.entity.sys.UserDO;


public class ShiroUtils {
    @Autowired
    private static SessionDAO sessionDAO;


    public static Subject getSubjct() {
        return SecurityUtils.getSubject();
    }
    public static UserDO getUser() {
        Object object = getSubjct().getPrincipal();
        return (UserDO)object;
    }
    public static Integer getUserId() {
        return getUser().getUserId();
    }
    public static void logout() {
        getSubjct().logout();
    }


    public static List getPrinciples() {
        List principals = null;
        Collection sessions = sessionDAO.getActiveSessions();
        return principals;
    }
}

UserDO.java

    用户对象。

package xxx.xxx.entity.sys;

import org.springframework.format.annotation.DateTimeFormat;

import java.io.Serializable;
import java.util.Date;
import java.util.List;

public class UserDO implements Serializable {
    private static final long serialVersionUID = 1L;
    //用户id
    private Integer userId;
    // 用户名
    private String username;
    // 用户真实姓名
    private String name;
    // 密码
    private String password;
}

application.yml

jedis :
  pool :
    host : 127.0.0.1
    port : 9001
    password: abcd123
    maxTotal: 100
    maxIdle: 10
    maxWaitMillis : 100000
转载地址：https://blog.csdn.net/Angry_Mills/article/details/80111780