SpringBoot整合Shiro的方法詳解

第SpringBoot整合Shiro的方法詳解//新方法shiro更新問題解決正常運(yùn)行

DefaultSecurityManagersecurityManager=newDefaultSecurityManager();

IniRealminiRealm=newIniRealm("classpath:shiro.ini");

securityManager.setRealm(iniRealm);

SecurityUtils.setSecurityManager(securityManager);

//NowthatasimpleShiroenvironmentissetup,let'sseewhatyoucando:

//獲取當(dāng)前用戶對象

SubjectcurrentUser=SecurityUtils.getSubject();

//通過當(dāng)前用戶拿到session

Sessionsession=currentUser.getSession();

session.setAttribute("someKey","aValue");

Stringvalue=(String)session.getAttribute("someKey");

if(value.equals("aValue")){

("subject=!["+value+"]");

//判斷當(dāng)前用戶是否被認(rèn)證

if(!currentUser.isAuthenticated()){

UsernamePasswordTokentoken=newUsernamePasswordToken("lonestarr","vespa");

token.setRememberMe(true);//設(shè)置記住我

try{

currentUser.login(token);

}catch(UnknownAccountExceptionuae){

("Thereisnouserwithusernameof"+token.getPrincipal());

}catch(IncorrectCredentialsExceptionice){

("Passwordforaccount"+token.getPrincipal()+"wasincorrect!");

}catch(LockedAccountExceptionlae){

("Theaccountforusername"+token.getPrincipal()+"islocked."+

"Pleasecontactyouradministratortounlockit.");

//最重要的一個異常，認(rèn)證異常

catch(AuthenticationExceptionae){

//unexpectedconditionerror

//saywhotheyare:

//printtheiridentifyingprincipal(inthiscase,ausername):

("User["+currentUser.getPrincipal()+"]loggedinsuccessfully.");

//testarole:

if(currentUser.hasRole("schwartz")){

("MaytheSchwartzbewithyou!");

}else{

("Hello,meremortal.");

//測試一個簡單的權(quán)限

//粗粒度的一個權(quán)限限制

if(currentUser.isPermitted("lightsaber:wield")){

("Youmayusealightsaberring.Useitwisely.");

}else{

("Sorry,lightsaberringsareforschwartzmastersonly.");

//a(verypowerful)InstanceLevelpermission:

if(currentUser.isPermitted("winnebago:drive:eagle5")){

("Youarepermittedto'drive'thewinnebagowithlicenseplate(id)'eagle5'."+

"Herearethekeys-havefun!");

}else{

("Sorry,youaren'tallowedtodrivethe'eagle5'winnebago!");

//注銷功能

currentUser.logout();

System.exit(0);

以上主要的幾個關(guān)鍵部分代碼：

對象初始化部分

//新方法shiro更新問題解決正常運(yùn)行

DefaultSecurityManagersecurityManager=newDefaultSecurityManager();

IniRealminiRealm=newIniRealm("classpath:shiro.ini");

securityManager.setRealm(iniRealm);

SecurityUtils.setSecurityManager(securityManager);

獲取當(dāng)前用戶

SubjectcurrentUser=SecurityUtils.getSubject();

判斷用戶是否被認(rèn)證

!currentUser.isAuthenticated()

判斷用戶是否具有什么角色

currentUser.hasRole("schwartz")

判斷用戶是否擁有權(quán)限

currentUser.isPermitted("lightsaber:wield")

注銷

currentUser.logout();

此時我們運(yùn)行啟動，項(xiàng)目如下，那么一個簡單的shiroquickStart就已經(jīng)啟動好了。

注意

shir最重要的三個部分：

subject用戶SecurityManager管理所有的用戶Realm連接數(shù)據(jù)

3.SpringBoot中集成

1.導(dǎo)入shiro相關(guān)依賴

!--

subject用戶

SecurityManager管理所有用戶

Realm連接數(shù)據(jù)

!--shiro與springboot--

dependency

groupIdorg.apache.shiro/groupId

artifactIdshiro-spring/artifactId

version1.6.0/version

/dependency

2.自定義UserRealm

packagecom.nuist.shirospringboot.config;

importorg.apache.shiro.authc.AuthenticationException;

importorg.apache.shiro.authc.AuthenticationInfo;

importorg.apache.shiro.authc.AuthenticationToken;

importorg.apache.shiro.authz.AuthorizationInfo;

importorg.apache.shiro.realm.AuthorizingRealm;

importorg.apache.shiro.subject.PrincipalCollection;

*@authorliuhuanhuan

*@version1.0

*@date2025/5/817:59

*@Description

publicclassUserRealmextendsAuthorizingRealm{

@Override

protectedAuthorizationInfodoGetAuthorizationInfo(PrincipalCollectionprincipalCollection){

System.out.println("執(zhí)行了=》授權(quán)doGetAuthorizationInfo方法");

returnnull;

@Override

protectedAuthenticationInfodoGetAuthenticationInfo(AuthenticationTokenauthenticationToken)throwsAuthenticationException{

System.out.println("執(zhí)行了-》認(rèn)證doGetAuthenticationInfo");

returnnull;

3.定義shiroConfig

packagecom.nuist.shirospringboot.config;

importorg.apache.shiro.spring.web.ShiroFilterFactoryBean;

importorg.apache.shiro.web.mgt.DefaultWebSecurityManager;

importorg.apache.shiro.web.session.mgt.DefaultWebSessionManager;

importorg.springframework.beans.factory.annotation.Qualifier;

importorg.springframework.context.annotation.Bean;

importorg.springframework.context.annotation.Configuration;

*@authorliuhuanhuan

*@version1.0

*@date2025/5/817:58

*@Description

@Configuration

publicclassShiroConfig{

//shiroFilterConfiguere

@Bean

publicShiroFilterFactoryBeangetShiroFilterFactoryBean(@Qualifier("getDefaultWebSecurityManager")DefaultWebSecurityManagersecurityManager){

ShiroFilterFactoryBeanshiroFilterFactoryBean=newShiroFilterFactoryBean();

//設(shè)置用戶管理器

shiroFilterFactoryBean.setSecurityManager(securityManager);

returnshiroFilterFactoryBean;

//defaultWebSecurity

//通過@Qualifier是USerRealm進(jìn)行綁定

@Bean

pu