springboot整合shiro（一）：登录认证

1、该项目只做了登录认证

2、使用的是IDEA

 

一、导包（添加依赖）

	org.apache.shiro
	shiro-spring
	1.4.0

二、配置shiro

package com.imooc.config;

import com.imooc.Realm.adminRealm;
import org.apache.shiro.spring.LifecycleBeanPostProcessor;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.apache.shiro.mgt.SecurityManager;
import org.springframework.context.annotation.DependsOn;
import java.util.LinkedHashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {

    @Bean(name = "shiroFilter")//附名后正确运行
    public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

        shiroFilterFactoryBean.setSecurityManager(securityManager);

        //设置拦截默认访问，如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/login");
        //设置登录成功后需要跳转的页面
        shiroFilterFactoryBean.setSuccessUrl("/welcome");

        Map filterChainDefinitionMap = new LinkedHashMap();
        //配置匿名可访问页面和静态文件
        filterChainDefinitionMap.put("/css/**","anon");
        filterChainDefinitionMap.put("/js/**","anon");
        filterChainDefinitionMap.put("/img/**","anon");
        filterChainDefinitionMap.put("/images/**","anon");
        filterChainDefinitionMap.put("/pic/**","anon");
        filterChainDefinitionMap.put("/login","anon");
        filterChainDefinitionMap.put("/ajaxLogin","anon");
        filterChainDefinitionMap.put("/logout","logout");
        //过滤器规则，从上而下顺序执行，将/**放在最后
        filterChainDefinitionMap.put("/**","authc");
        //设置规则
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

        return shiroFilterFactoryBean;
    }

    @Bean(name = "securityManager")
    public SecurityManager securityManager(){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();

        securityManager.setRealm(myRealm());
        return securityManager;
    }

    @Bean(name = "myRealm")
    public adminRealm myRealm(){
        adminRealm myRealm =  new adminRealm();
        return myRealm;
    }

    @Bean(name = "lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor(){
        return new LifecycleBeanPostProcessor();
    }

   /* @Bean(name = "advisorAutoProxyCreator")
    @DependsOn("lifecycleBeanPostProcessor")
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator(){
        DefaultAdvisorAutoProxyCreator autoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        autoProxyCreator.setProxyTargetClass(true);
        return autoProxyCreator;
    }*/

    @Bean(name = "sourceAdvisor")
    public AuthorizationAttributeSourceAdvisor sourceAdvisor(){
        AuthorizationAttributeSourceAdvisor advisor = new AuthorizationAttributeSourceAdvisor();
        advisor.setSecurityManager(securityManager());
        return advisor;
    }

}

此处有遇到报错：Consider defining a bean named 'authenticator' in your configuration.

解决方法是给每个注解Bean添加name属性,一般为方法名

三、写登录认证类

package com.imooc.Realm;


import com.imooc.dataobject.SellerInfo;
import com.imooc.service.SellerService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;


public class adminRealm extends AuthorizingRealm {

    @Autowired
    private SellerService sellerService;

    /**
     * 权限认证
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }


    /**
     * 登录认证
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        String username = (String) authenticationToken.getPrincipal();
        SellerInfo sellerInfo = sellerService.findSellerInfoByName(username);
        if (sellerInfo != null){
            AuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(sellerInfo.getUsername(),sellerInfo.getPassword(),getName());
            return authenticationInfo;
        }else {
            return null;
        }
    }
}

四、写controller控制类

package com.imooc.controller;

import com.imooc.enums.ResultEnum;
import lombok.extern.slf4j.Slf4j;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.servlet.ModelAndView;

import javax.servlet.http.HttpServletResponse;
import java.util.Map;

@Slf4j
@Controller
public class AdminController {

    @RequestMapping("/login")
    public String goLogin(){
        return "login";
    }

    @RequestMapping("/welcome")
    public String welcome(){
        return "welcome";
    }

    @RequestMapping(value = "/ajaxLogin",method = RequestMethod.POST)
    public ModelAndView submitLogin(String username,
                                    String password,
                                    Map map){


        UsernamePasswordToken token = new UsernamePasswordToken(username,password,"login");
        Subject subject = SecurityUtils.getSubject();

        log.info(username+"开始验证");
        try {
            subject.login(token);
            if (subject.isAuthenticated()){
                System.out.println(username+"认证成功");
                map.put("msg","登录成功");
                return new ModelAndView("redirect:/seller/welcome");
            }else {
                map.put("msg", ResultEnum.LOGIN_FAIL.getMessage());
                token.clear();
                System.out.println(username+"认证失败");
                return new ModelAndView("redirect:/login");
            }
        }catch (UnknownAccountException e){
            log.info(username+"验证失败，用户名不存在");
        }catch (IncorrectCredentialsException e){
            log.info(username+"验证失败，密码错误");
        }catch (AuthenticationException e){
            log.error(e.getMessage());
        }
        return new ModelAndView("redirect:/login");
    }
}