shiro学习笔记（四） ini配置以及加解密

INI配置

从之前的Shiro架构图可以看出，Shiro是从根对象SecurityManager进行身份验证和授权的；也就是所有操作都是自它开始的，这个对象是线程安全且真个应用只需要一个即可，因此Shiro提供了SecurityUtils让我们绑定它为全局的，方便后续操作。因为Shiro的类都是POJO的，因此都很容易放到任何IoC容器管理。但是和一般的IoC容器的区别在于，Shiro从根对象securityManager开始导航；Shiro支持的依赖注入：public空参构造器对象的创建、setter依赖注入。

DefaultSecurityManager securityManager = new DefaultSecurityManager();

//设置authenticator

ModularRealmAuthenticator authenticator = new ModularRealmAuthenticator();

authenticator.setAuthenticationStrategy(new AtLeastOneSuccessfulStrategy());

securityManager.setAuthenticator(authenticator);  

//设置authorizer

ModularRealmAuthorizer authorizer = new ModularRealmAuthorizer();

authorizer.setPermissionResolver(new WildcardPermissionResolver());

securityManager.setAuthorizer(authorizer);  

//设置Realm

DruidDataSource ds = new DruidDataSource();

ds.setDriverClassName("com.mysql.jdbc.Driver");

ds.setUrl("jdbc:mysql://localhost:3306/shiro");

ds.setUsername("root");

ds.setPassword("");  

JdbcRealm jdbcRealm = new JdbcRealm();

jdbcRealm.setDataSource(ds);

jdbcRealm.setPermissionsLookupEnabled(true);

securityManager.setRealms(Arrays.asList((Realm) jdbcRealm));  

//将SecurityManager设置到SecurityUtils 方便全局使用

SecurityUtils.setSecurityManager(securityManager);  

Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken("zhang", "123");

subject.login(token);

Assert.assertTrue(subject.isAuthenticated());

对应的配置文件

[main]

#authenticator

authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator

authenticationStrategy=org.apache.shiro.authc.pam.AtLeastOneSuccessfulStrategy

authenticator.authenticationStrategy=$authenticationStrategy

securityManager.authenticator=$authenticator  

#authorizer

authorizer=org.apache.shiro.authz.ModularRealmAuthorizer

permissionResolver=org.apache.shiro.authz.permission.WildcardPermissionResolver

authorizer.permissionResolver=$permissionResolver

securityManager.authorizer=$authorizer  

#realm

dataSource=com.alibaba.druid.pool.DruidDataSource

dataSource.driverClassName=com.mysql.jdbc.Driver

dataSource.url=jdbc:mysql://localhost:3306/shiro

dataSource.username=root

#dataSource.password=

jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm

jdbcRealm.dataSource=$dataSource

jdbcRealm.permissionsLookupEnabled=true

securityManager.realms=$jdbcRealm

MD5加密，shiro不止这一个加密方式，还有很多方式，如果需要可以自行查阅

@Test//测试加密解密

    public void testCode(){

        String str = "hello";

        String base64Encoded = Base64.encodeToString(str.getBytes());

        String str2 = Base64.decodeToString(base64Encoded);

        Assert.assertEquals(str, str2); //编码code

        String str3 = "hello";

        String salt = "123";

        String salt2 = "234";

        String md5 = new Md5Hash(new Md5Hash(str3,salt), salt2).toString();//简单二次加密，不可逆，用于密码验证，还可以转换为 toBase64()/toHex()

        System.out.println(new Md5Hash(str3));

        System.out.println(md5);

    }

连接数据库，使用数据库进行加密登录验证，包括提供缓存，限制失败次数

ini配置

#shiro-password.ini
dataSource=com.alibaba.druid.pool.DruidDataSource

dataSource.driverClassName=oracle.jdbc.OracleDriver

dataSource.url=jdbc:oracle:thin:@127.0.0.1:1521:ORCL

dataSource.username=userstudy

dataSource.password=s836659812S

#credentialsMatcher=org.apache.shiro.authc.credential.HashedCredentialsMatcher

credentialsMatcher=code.RetryLimitHashedCredentialsMatcher

credentialsMatcher.hashAlgorithmName=md5

credentialsMatcher.hashIterations=1

credentialsMatcher.storedCredentialsHexEncoded=true


#jdbcRealm=code.MyRealm 这种是使用自定义realm来进行验证的方式

jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm

jdbcRealm.dataSource=$dataSource

jdbcRealm.permissionsLookupEnabled=true

jdbcRealm.saltStyle=COLUMN#这个直接用会错误，需要bean注册转型

jdbcRealm.authenticationQuery=select password,salt from shiro where users = ?

jdbcRealm.credentialsMatcher=$credentialsMatcher

securityManager.realms=$jdbcRealm

public class RetryLimitHashedCredentialsMatcher extends HashedCredentialsMatcher {

    private Ehcache passwordRetryCache;

    public RetryLimitHashedCredentialsMatcher() {

        CacheManager cacheManager = CacheManager.newInstance(CacheManager.class.getClassLoader().getResource("ehcache.xml"));

        passwordRetryCache = cacheManager.getCache("passwordRetryCache");

    }

    @Override

    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {

        String username = (String)token.getPrincipal();

        //retry count + 1

        Element element = passwordRetryCache.get(username);

        if(element == null) {

            element = new Element(username , new AtomicInteger(0));

            passwordRetryCache.put(element);

        }

        AtomicInteger retryCount = (AtomicInteger)element.getObjectValue();

        if(retryCount.incrementAndGet() > 5) {

            //if retry count > 5 throw

            throw new ExcessiveAttemptsException();

        }

        boolean matches = super.doCredentialsMatch(token, info);

        if(matches) {

            //clear retry count

            passwordRetryCache.remove(username);

        }

        return matches;

    }

}

public class MyRealm extends AuthorizingRealm {

    private PasswordService passwordService;

    public void setPasswordService(PasswordService passwordService) {

        this.passwordService = passwordService;

    }

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(

            PrincipalCollection principals) {

        return null;

    }

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(

            AuthenticationToken token) throws AuthenticationException {

        // TODO Auto-generated method stub

        return new SimpleAuthenticationInfo("sheng",passwordService.encryptPassword("zhi"),getName());

    }

}

<?xml version="1.0" encoding="UTF-8"?>

<ehcache name="es">

    <diskStore path="java.io.tmpdir"/>

    <!-- 登录记录缓存 锁定10分钟 -->

    <cache name="passwordRetryCache"

           maxEntriesLocalHeap="2000"

           eternal="false"

           timeToIdleSeconds="3600"

           timeToLiveSeconds="0"

           overflowToDisk="false"

           statistics="true">

    </cache>

</ehcache>

缓存机制现在还不懂，先跳过

package code;

import org.apache.commons.beanutils.BeanUtilsBean;

import org.apache.commons.beanutils.converters.AbstractConverter;

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.UsernamePasswordToken;

import org.apache.shiro.config.IniSecurityManagerFactory;

import org.apache.shiro.crypto.hash.Md5Hash;

import org.apache.shiro.realm.jdbc.JdbcRealm;

import org.apache.shiro.subject.Subject;

import org.apache.shiro.util.Factory;

import org.junit.Test;

public class TestCode {

    /*

    @Test//测试加密解密

    public void testCode(){

        String str = "hello";

        String base64Encoded = Base64.encodeToString(str.getBytes());

        String str2 = Base64.decodeToString(base64Encoded);

        Assert.assertEquals(str, str2); //编码code

        String str3 = "hello";

        String salt = "123";

        String salt2 = "234";

        String md5 = new Md5Hash(new Md5Hash(str3,salt), salt2).toString();//简单二次加密，不可逆，用于密码验证，还可以转换为 toBase64()/toHex()

        System.out.println(new Md5Hash(str3));

        System.out.println(md5);

    }

    */

    /*

    @Test

    public void testCode(){

        login("classpath:shiro-password.ini","sheng","z1hi");

    }

    */

    @Test

    public void jdbcPassTest(){//此处还要注意Shiro默认使用了apache commons BeanUtils，默认是不进行Enum类型转型的，此时需要自己注册一个Enum转换器

        BeanUtilsBean.getInstance().getConvertUtils().register(new EnumConverter(), JdbcRealm.SaltStyle.class);

        String str3 = "567";

        String salt = "123";

        String salt2 = "123";

        String md5 = new Md5Hash(str3,salt).toString();//一次md5+盐，用于验证密码多少

        System.out.println(md5);

        for(int i = 1; i <= 5; i++) {

            try {

                login("classpath:shiro-jdbc-pass.ini","zhizhi","566");

            } catch (Exception e) {/*ignore*/}

        }

        login("classpath:shiro-jdbc-pass.ini","zhizhi","566");//经过五次失败后没有错误提示，被锁了起来。

    }

    private void login(String path, String name, String password) {

        // 1、获取SecurityManager工厂，此处使用Ini配置文件初始化SecurityManager

        Factory<org.apache.shiro.mgt.SecurityManager> factory = new IniSecurityManagerFactory(

                path);

        // Factory<org.apache.shiro.mgt.SecurityManager> factory = new

        // IniSecurityManagerFactory("classpath:shiro.ini");

        // 2、得到SecurityManager实例 并绑定给SecurityUtils

        org.apache.shiro.mgt.SecurityManager securityManager = factory

                .getInstance();

        SecurityUtils.setSecurityManager(securityManager);

        // 3、得到Subject及创建用户名/密码身份验证Token（即用户身份/凭证）

        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken token = new UsernamePasswordToken(name, password);

        try {

            // 4、登录，即身份验证

            subject.login(token);

            System.out.println("login success");

        } catch (AuthenticationException e) {

            // 5、身份验证失败

            System.out.println("login file."+e.getMessage());

        }

        //Assert.assertEquals(true, subject.isAuthenticated()); // 断言用户已经登录

        // 6、退出

        // subject.logout();

    }

    private class EnumConverter extends AbstractConverter {

        @Override

        protected String convertToString(final Object value) throws Throwable {

            return ((Enum) value).name();

        }

        @Override

        protected Object convertToType(final Class type, final Object value) throws Throwable {

            return Enum.valueOf(type, value.toString());

        }

        @Override

        protected Class getDefaultType() {

            return null;

        }

    }

}

巴特西

shiro学习笔记（四） ini配置以及加解密

最新文章

热门文章