shiro学习分享(一)—— 登陆验证和密码加密篇

登陆验证和密码加密篇

---

shiro是一个封装了诸多登陆验证有关功能的轻型框架，可以十分方便地实现密码加密验证，登陆用户管理等功能，通过对里面的部分类进行继承重写实现所需功能

而登陆验证则是通过重写shiro的AuthorizingRealm类来实现，使用eclipse的话可以将光标移到这个类名，使用快捷键Ctrl+T查看该类的具体继承和实现

至于密码加密采用的是shiro自带的MD5算法，这里注意加密和验证的时候使用的函数的第三个参数（即盐值）是不太一样的，博主加密直接采用用户名，加密时第三个参数直接就是用户名，而验证时要用ByteSource.Util.bytes(currentUser.getUsername())
(currentUser为reaml实现类的方法传进来的token)

---

• pom.xml

<properties>
    <shiro.version>1.3.0shiro.version>
properties>
        <dependency>
            <groupId>net.sf.ehcachegroupId>
            <artifactId>ehcache-coreartifactId>
            <version>2.4.8version>
        dependency>
        
        <dependency>
            <groupId>org.apache.shirogroupId>
            <artifactId>shiro-coreartifactId>
            <version>${shiro.version}version>
        dependency>
        <dependency>
            <groupId>org.apache.shirogroupId>
            <artifactId>shiro-ehcacheartifactId>
            <version>${shiro.version}version>
        dependency>
        <dependency>
            <groupId>org.apache.shirogroupId>
            <artifactId>shiro-springartifactId>
            <version>${shiro.version}version>
        dependency>

        <dependency>
            <groupId>org.apache.shirogroupId>
            <artifactId>shiro-webartifactId>
            <version>${shiro.version}version>
        dependency>
        

---

• web.xml

    <context-param>
        <param-name>contextConfigLocationparam-name>
        
        <param-value>classpath:spring/applicationContext.xml,classpath:shiro/spring-shiro-web.xmlparam-value>
    context-param>
    
    <filter>
        <filter-name>shiroFilterfilter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxyfilter-class>
        <init-param>
            <param-name>targetFilterLifecycleparam-name>
            <param-value>trueparam-value>
        init-param>
    filter>
    <filter-mapping>
        <filter-name>shiroFilterfilter-name>
        <url-pattern>/*url-pattern>
    filter-mapping>

---

• shiro-spring.xml（只显示加密所需代码）

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="userRealm" />
        <property name="cacheManager" ref="cacheManager" />
        
    bean>
    
    <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:shiro/ehcache.xml" />
    bean>
    
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="MD5" />
        <property name="hashIterations" value="2" />
    bean>
    
    <bean id="userRealm" class="com.mdy.student.shiro.realm.MyRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher" />
    bean>
    
    

---

• 自己实现的realm类

public class MyRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;

    @Override
    // 身份认证api
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        SimpleAuthenticationInfo info = null;

        // 将传进来的token进行类型转化
        UsernamePasswordToken currentUser = (UsernamePasswordToken) token;
        // 获得数据库里面的账户密码
        String password = userService.getUserPassword(currentUser.getUsername());
        if (password != null) {
            // 比对密码
            info = new SimpleAuthenticationInfo(currentUser.getPrincipal(), password,
                    ByteSource.Util.bytes(currentUser.getCredentials()), this.getName());
        } else {
            throw new UnknownAccountException();
        }
        return info;
    }
    // 授权认证api省略

---