项目背景

在最近重构后的项目中使用了springboot+shiro的技术栈,shiro是一个强大且易用的Java安全框架,执行身份验证、授权、密码学和会话管理.shiro包含三个核心组件subject,securityManager和realm.subject即当前操作用户,代表了当前用户的安全操作,shiro底层使用了threadlocal来存取当前用户的subject.
securityManager则是管理所有用户的安全操作,属于框架的核心组件,shiro通过它来管理内部组件与提供各种服务。
realm充当了shiro与数据之间的桥梁,实质上就是封装好的一个安全相关的DAO。
本系统使用了shiro来处理用户的身份认证与权限校验。

具体实现

首先在项目的pom文件中引入shiro的核心包.

        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-aspectj</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-quartz</artifactId>
            <version>${org.apache.shiro-version}</version>
        </dependency>

然后创建一个shiro的配置类ShiroConfiguration,shiro使用了过滤器shiroFilter来作为入口点,用于拦截需要安全控制的请求.

    /**
     * ShiroFilterFactoryBean 处理拦截资源文件问题。
     * Filter Chain定义说明 1、一个URL可以配置多个Filter，使用逗号分隔 
       2、当设置多个过滤器时，全部验证通过，才视为通过
     * 3、部分过滤器可指定参数，如perms，roles
     */
    @Bean
    public ShiroFilterFactoryBean shirFilter() {
        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        // 必须设置 SecurityManager
        shiroFilterFactoryBean.setSecurityManager(getDefaultWebSecurityManager());
        // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
        shiroFilterFactoryBean.setLoginUrl("/login.html");
        // 登录成功后要跳转的链接
        shiroFilterFactoryBean.setSuccessUrl("/admin/index.html");
        // 未授权界面;
        shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
        //Shiro自定义认证过滤器
        Map<String, Filter> filters = shiroFilterFactoryBean.getFilters();//获取filters
        filters.put("authc", new CustomerFormAuthenticationFilter());
        shiroFilterFactoryBean.setFilters(filters);
        // 拦截器.
        Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
        //拦截的,从上向下顺序执行,匹配成功就不再继续往下走
        filterChainDefinitionMap.put("/static/**", "anon");
        filterChainDefinitionMap.put("/img/favicon.ico", "anon,noSessionCreation");
        filterChainDefinitionMap.put("/templates/system/public/**", "anon");
        filterChainDefinitionMap.put("/vertifyCode/**", "anon");
        filterChainDefinitionMap.put("/login", "anon");
        filterChainDefinitionMap.put("/toLogin", "anon");
        // <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
        filterChainDefinitionMap.put("/**", "authc");
        shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
        return shiroFilterFactoryBean;
    }

设置系统的sessionid,框架默认为: JSESSIONID,可改成其他的如token.

    @Bean
    public SimpleCookie wapsession() {
        SimpleCookie simpleCookie = new SimpleCookie("token");
        simpleCookie.setMaxAge(2592000);
        return simpleCookie;
    }

接下来配置cookie管理器.

    @Bean
    public SimpleCookie rememberMeCookie() {
        SimpleCookie simpleCookie = new SimpleCookie("rememberMe");
        simpleCookie.setMaxAge(2592000);
        simpleCookie.setHttpOnly(true);
        return simpleCookie;
    }

提供了记住我（RememberMe）的功能.

    @Bean
    public CookieRememberMeManager rememberMeManager() {
        CookieRememberMeManager cookieRememberMeManager = new CookieRememberMeManager();
        byte[] cipherKey = Base64.decode("4AvVhmFLUs0KTA3Kprsdag==");
        cookieRememberMeManager.setCookie(rememberMeCookie());
        cookieRememberMeManager.setCipherKey(cipherKey);
        return cookieRememberMeManager;
    }

配置securityManager安全管理器.

    @Bean(name = "securityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager() {
        logger.info("注入Shiro的Web过滤器-->securityManager", ShiroFilterFactoryBean.class);
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        securityManager.setAuthenticator(authenticator());
        //设置多Realm，用于获取认证凭证
        Collection<Realm> realms = new ArrayList<>();
        realms.add(appShiroRealm());
        realms.add(pcShiroRealm());
        realms.add(thirdPathShiroRealm());
        securityManager.setRealms(realms);
        //注入缓存管理器
        //securityManager.setCacheManager(ehCacheManager());
        //注入会话管理器
        securityManager.setSessionManager(sessionManager());
        //注入Cookie(记住我)管理器(remenberMeManager)
        securityManager.setRememberMeManager(rememberMeManager());
        return securityManager;
    }

定义数据源Realm.

    /*
     * @describe 自定义AppRealm
     * @param []
     * @return com.hongsui.win.home.controller.admin.web.realm.AppShiroRealm
    */
    @Bean
    public AppShiroRealm appShiroRealm() {
        AppShiroRealm appShiroRealm = new AppShiroRealm();
        appShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return appShiroRealm;
    }

    /*
     * @describe 自定义AppRealm
     * @param []
     * @return com.hongsui.win.home.controller.admin.web.realm.PcShiroRealm
    */
    @Bean
    public PcShiroRealm pcShiroRealm() {
        PcShiroRealm pcShiroRealm = new PcShiroRealm();
        pcShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return pcShiroRealm;
    }

    /*
     * @describe 自定义ThirdRealm
     * @param []
     * @return com.hongsui.win.home.controller.admin.web.realm.ThirdPathShiroRealm
    */
    @Bean
    public ThirdPathShiroRealm thirdPathShiroRealm() {
        ThirdPathShiroRealm thirdPathShiroRealm = new ThirdPathShiroRealm();
        thirdPathShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher());
        return thirdPathShiroRealm;
    }

配置会话管理器.

    @Bean
    public CustomerWebSessionManager sessionManager() {
        CustomerWebSessionManager sessionManager = new CustomerWebSessionManager();
        //会话验证器调度时间
        sessionManager.setSessionValidationInterval(1800000);
        //定时检查失效的session
        sessionManager.setSessionValidationSchedulerEnabled(true);
        //是否在会话过期后会调用SessionDAO的delete方法删除会话 默认true
        sessionManager.setDeleteInvalidSessions(true);
        sessionManager.setSessionDAO(redisSessionDAO());
        sessionManager.setSessionIdUrlRewritingEnabled(false);
        sessionManager.setSessionIdCookie(wapsession());
        sessionManager.setSessionIdCookieEnabled(true);
        return sessionManager;
    }

保证实现了Shiro内部lifecycle函数的bean执行.

    @Bean(name = "lifecycleBeanPostProcessor")
    public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

开启Shiro的注解(如@RequiresRoles,@RequiresPermissions等等),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证,配置以下两个bean(DefaultAdvisorAutoProxyCreatorAuthorizationAttributeSourceAdvisor)即可实现此功能.

    @Bean
    @DependsOn({"lifecycleBeanPostProcessor"})
    public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
        DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();
        advisorAutoProxyCreator.setProxyTargetClass(true);
        return advisorAutoProxyCreator;
    }

    @Bean
    public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor() {
        AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor =
                new AuthorizationAttributeSourceAdvisor();
        authorizationAttributeSourceAdvisor.setSecurityManager(getDefaultWebSecurityManager());
        return authorizationAttributeSourceAdvisor;
    }

到此shiro框架已经与springboot集成到项目中了,之后就可以编写相应的realm代码以及在controller层实现登录认证了.