shiro实现jwt

这里只实现jwt，shiro实现前面文章有，先实现shiro在实现jwt。

jwt

JSON Web Token（JWT）是目前最流行的跨域身份验证解决方案。通过session管理用户登录状态成本越来越高，因此慢慢发展成为token的方式做登录身份校验，然后通过token去取redis中的缓存的用户信息，随着之后jwt的出现，校验方式更加简单便捷化，无需通过redis缓存，而是直接根据token取出保存的用户信息，以及对token可用性校验，单点登录更为简单。
概念来自：https://www.jianshu.com/p/fe67b4bb6f2c

依赖

	
		com.auth0
		java-jwt
		3.4.1
	

相关类

JwtFilter

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter;
import org.springframework.http.HttpStatus;
import org.springframework.web.bind.annotation.RequestMethod;
public class JwtFilter extends BasicHttpAuthenticationFilter {
	 
	 
    /**
     * 执行登录认证
     *
     * @param request
     * @param response
     * @param mappedValue
     * @return
     */
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        try {
            executeLogin(request, response);
            return true;
        } catch (Exception e) {
            return false;
        }
    }
 
    /**
     *
     */
    @Override
    protected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        String token = httpServletRequest.getHeader("Authorization");
 
        JwtToken jwtToken = new JwtToken(token);
        // 提交给realm进行登入，如果错误他会抛出异常并被捕获
        getSubject(request, response).login(jwtToken);
        // 如果没有抛出异常则代表登入成功，返回true
        return true;
    }
 
 
 
    /**
     * 对跨域提供支持
     */
    @Override
    protected boolean preHandle(ServletRequest request, ServletResponse response) throws Exception {
        HttpServletRequest httpServletRequest = (HttpServletRequest) request;
        HttpServletResponse httpServletResponse = (HttpServletResponse) response;
        httpServletResponse.setHeader("Access-control-Allow-Origin", httpServletRequest.getHeader("Origin"));
        httpServletResponse.setHeader("Access-Control-Allow-Methods", "GET,POST,OPTIONS,PUT,DELETE");
        httpServletResponse.setHeader("Access-Control-Allow-Headers", httpServletRequest.getHeader("Access-Control-Request-Headers"));
        // 跨域时会首先发送一个option请求，这里我们给option请求直接返回正常状态
        if (httpServletRequest.getMethod().equals(RequestMethod.OPTIONS.name())) {
            httpServletResponse.setStatus(HttpStatus.OK.value());
            return false;
        }
        return super.preHandle(request, response);
    }
}

JwtToken

import org.apache.shiro.authc.AuthenticationToken;

/**
 * 收集用户提交的身份（如用户名）及凭据（如密码）进行认证
 * @author zyp
 *
 */
public class JwtToken implements AuthenticationToken {
	private static final long serialVersionUID = 1L;
	private String token;
 
    public JwtToken(String token) {
        this.token = token;
    }
 
    @Override
    public Object getPrincipal() {
        return token;
    }
 
    @Override
    public Object getCredentials() {
        return token;
    }
}

JwtUtil

import java.util.Date;

import com.auth0.jwt.JWT;
import com.auth0.jwt.JWTVerifier;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.JWTDecodeException;
import com.auth0.jwt.interfaces.DecodedJWT;

public class JwtUtil {
	private static final long EXPIRE_TIME = 5 * 60 * 1000;
	 
    /**
     * 校验token是否正确
     *
     * @param token  密钥
     * @param secret 用户的密码
     * @return 是否正确
     */
	@SuppressWarnings("unused")
    public static boolean verify(String token, String username, String secret) {
        try {
            //根据密码生成JWT效验器
            Algorithm algorithm = Algorithm.HMAC256(secret);
            JWTVerifier verifier = JWT.require(algorithm)
                    .withClaim("username", username)
                    .build();
            //效验TOKEN
			DecodedJWT jwt = verifier.verify(token);
            return true;
        } catch (Exception exception) {
            return false;
        }
    }
 
    /**
     * 获得token中的信息无需secret解密也能获得
     *
     * @return token中包含的用户名
     */
    public static String getUsername(String token) {
    	if(token==null){
    		return null;
    	}
        try {
            DecodedJWT jwt = JWT.decode(token);
            return jwt.getClaim("username").asString();
        } catch (JWTDecodeException e) {
            return null;
        }
    }
 
    /**
     * 生成签名,5min后过期
     *
     * @param username 用户名
     * @param secret   用户的密码
     * @return 加密的token
     */
    public static String sign(String username, String secret) {
        Date date = new Date(System.currentTimeMillis() + EXPIRE_TIME);
        Algorithm algorithm = Algorithm.HMAC256(secret);
        // 附带username信息
        return JWT.create()
                .withClaim("username", username)
                .withExpiresAt(date)
                .sign(algorithm);
 
    }
}

shiroFilter中的配置

		 // 添加自己的过滤器并且取名为jwt
	    Map filterMap = new HashMap<>();
	    //设置自定义的JWT过滤器
	    filterMap.put("jwt", new JwtFilter());
	    shiroFilterFactoryBean.setFilters(filterMap);
        // 所有请求通过自己的JWT Filter
	    filterRuleMap.put("/**", "jwt");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterRuleMap);

ShiroRealm中的配置

import java.util.HashSet;
import java.util.Set;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

import com.nk.entity.CoreUser;
import com.nk.service.CoreUserServcie;

public class MyShiroRealm extends AuthorizingRealm{
		@Autowired
		private CoreUserServcie coreUserServcie;

		/**
	     * 必须重写此方法，不然Shiro会报错
	     */
	    @Override
	    public boolean supports(AuthenticationToken token) {
	        return token instanceof JwtToken;
	    }
	 
	    /**
	     * 只有当需要检测用户权限的时候才会调用此方法，例如checkRole,checkPermission之类的
	     */
	    @Override
	    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
	        String username = JwtUtil.getUsername(principals.toString());
			CoreUser selectByPrimaryKey = coreUserServcie.selectByPrimaryKey(username);
	    	//构建权限的类
			SimpleAuthorizationInfo sai=new SimpleAuthorizationInfo();
			Set proleList=new HashSet();
			Set stringPermissions=new HashSet();
			//有问题后续要改（查找权限的）
			/*if(user!=null){
				List lrole = rolemapper.getRoleById(user.getUser_id());
				for (Role role : lrole) {
					proleList.add(role.getName());
					List plist = permissionmapper.getPermissionById(role.getId());
					for (Permission permission : plist) {
						stringPermissions.add(permission.getName());
					}
				}
			}*/
			sai.setRoles(proleList);
			sai.setStringPermissions(stringPermissions);
			return sai;
	    }
	 
	    /**
	     * 默认使用此方法进行用户名正确与否验证，错误抛出异常即可。
	     */
	    @Override
	    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {
	        String token = (String) auth.getCredentials();
	        // 解密获得username，用于和数据库进行对比
	        String username = JwtUtil.getUsername(token);
	        if (username == null) {
	            throw new AuthenticationException("token无效");
	        }
	 
	        CoreUser selectByPrimaryKey = coreUserServcie.selectByPrimaryKey(username);
	        if (selectByPrimaryKey == null) {
	            throw new AuthenticationException("用户不存在!");
	        }
	 
	        if (!JwtUtil.verify(token, username, selectByPrimaryKey.getPassword())) {
	            throw new AuthenticationException("用户名或密码错误");
	        }
	 
	        return new SimpleAuthenticationInfo(token, token, "myRealm");
	    }
}

给swagger（注意shiro拦截器配置swagger的静态资源不拦截）加上Authorization属性

import java.util.ArrayList;
import java.util.List;

import org.springframework.boot.SpringBootConfiguration;
import org.springframework.context.annotation.Bean;

import springfox.documentation.builders.ApiInfoBuilder;
import springfox.documentation.builders.ParameterBuilder;
import springfox.documentation.builders.PathSelectors;
import springfox.documentation.builders.RequestHandlerSelectors;
import springfox.documentation.schema.ModelRef;
import springfox.documentation.service.Parameter;
import springfox.documentation.spi.DocumentationType;
import springfox.documentation.spring.web.plugins.Docket;

@SpringBootConfiguration
public class SwaggerConfig {

	@Bean
	public Docket docket() {
		  ParameterBuilder tokenPar = new ParameterBuilder();  
        List pars = new ArrayList();  
        tokenPar.name("Authorization").description("令牌").modelRef(new ModelRef("string")).parameterType("header").required(false).build();  
        pars.add(tokenPar.build());
		return new Docket(DocumentationType.SWAGGER_2)
				.apiInfo(new ApiInfoBuilder().title("api接口文档")
											.version("1.0")
											.build())
				.select()
				.apis(RequestHandlerSelectors.basePackage("com.nk.controller"))
				.paths(PathSelectors.any())
				.build()
				 .globalOperationParameters(pars);
	}
}

效果

使用swagger测试，首先需要登录系统取到token

swagger测试（通过token成功获取到数据）