springboot+mybatis整合shiro

1.什么是shiro?
Apache Shiro™ is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.

Apache Shiro™是一个功能强大且易于使用的Java安全框架，它执行身份验证，授权，加密和会话管理。使用Shiro易于理解的API，您可以快速轻松地保护任何应用程序-从最小的移动应用程序到最大的Web和企业应用程序。
Shiro提供了用于执行以下方面的应用程序安全性API（我将其称为应用程序安全性的4个基石）：

身份验证-证明用户身份，通常称为用户“登录”。
授权-访问控制
密码术-保护或隐藏数据以防窥视
会话管理-每个用户的时间敏感状态

2.使用shiro的三个核心组件是什么？
三个核心组件：Subject, SecurityManager 和 Realms.
Subject：即“当前操作用户”。但是，在Shiro中，Subject这一概念并不仅仅指人，也可以是第三方进程、后台帐户（Daemon Account）或其他类似事物。它仅仅意味着“当前跟软件交互的东西”。
Subject代表了当前用户的安全操作，SecurityManager则管理所有用户的安全操作。
SecurityManager：它是Shiro框架的核心，典型的Facade模式，Shiro通过SecurityManager来管理内部组件实例，并通过它来提供安全管理的各种服务。
Realm： Realm充当了Shiro与应用安全数据间的“桥梁”或者“连接器”。也就是说，当对用户执行认证（登录）和授权（访问控制）验证时，Shiro会从应用配置的Realm中查找用户及其权限信息。
从这个意义上讲，Realm实质上是一个安全相关的DAO：它封装了数据源的连接细节，并在需要时将相关数据提供给Shiro。当配置Shiro时，你必须至少指定一个Realm，用于认证和（或）授权。配置多个Realm是可以的，但是至少需要一个。
Shiro内置了可以连接大量安全数据源（又名目录）的Realm，如LDAP、关系数据库（JDBC）、类似INI的文本配置资源以及属性文件等。如果缺省的Realm不能满足需求，你还可以插入代表自定义数据源的自己的Realm实现。

3.ShiroConfiguration类

package com.apache.shiroview.util;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import java.util.LinkedHashMap;
import java.util.Map;@Configuration
public class ShiroConfiguration {@Beanpublic ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();shiroFilterFactoryBean.setSecurityManager(securityManager);Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();shiroFilterFactoryBean.setLoginUrl("/showLogin");shiroFilterFactoryBean.setSuccessUrl("/index");shiroFilterFactoryBean.setUnauthorizedUrl("/403");filterChainDefinitionMap.put("/login", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/userInfo/register", "anon"); // 注册表示可以匿名访问filterChainDefinitionMap.put("/userInfo/doLogin", "anon"); // 注册表示可以匿名访问filterChainDefinitionMap.put("/logout", "logout");filterChainDefinitionMap.put("/static/**", "anon");filterChainDefinitionMap.put("/resources/static/css/**", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/fonts/**", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/css/**", "anon");//不需要验证filterChainDefinitionMap.put("/images/**", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/js/**", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/plugins/**", "anon"); // 表示可以匿名访问filterChainDefinitionMap.put("/*", "authc");// 表示需要认证才可以访问filterChainDefinitionMap.put("/**", "authc");// 表示需要认证才可以访问filterChainDefinitionMap.put("/*.*", "authc");shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);return shiroFilterFactoryBean;}@Beanpublic MyShiroRealm myShiroRealm() {MyShiroRealm myShiroRealm = new MyShiroRealm();myShiroRealm.setCredentialsMatcher(hashedCredentialsMatcher()); // 原来在这里return myShiroRealm;}@Beanpublic AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager) {AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);return authorizationAttributeSourceAdvisor;}@Beanpublic SecurityManager securityManager() {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();securityManager.setRealm(myShiroRealm());return securityManager;}//散列算法@Beanpublic HashedCredentialsMatcher hashedCredentialsMatcher() {HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();hashedCredentialsMatcher.setHashAlgorithmName(PasswordHelper.ALGORITHM_NAME); // 散列算法hashedCredentialsMatcher.setHashIterations(PasswordHelper.HASH_ITERATIONS); // 散列次数return hashedCredentialsMatcher;}@Beanpublic PasswordHelper passwordHelper() {return new PasswordHelper();}
}

4.PasswordHelper

package com.apache.shiroview.util;import com.apache.shiroview.domain.UserInfoModel;
import org.apache.shiro.crypto.RandomNumberGenerator;
import org.apache.shiro.crypto.SecureRandomNumberGenerator;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.util.ByteSource;public class PasswordHelper {private RandomNumberGenerator randomNumberGenerator = new SecureRandomNumberGenerator();public static final String ALGORITHM_NAME = "md5"; // 基础散列算法public static final int HASH_ITERATIONS = 2; // 自定义散列次数public void encryptPassword(UserInfoModel user){// 随机字符串作为salt因子，实际参与运算的salt我们还引入其它干扰因子user.setSalt(randomNumberGenerator.nextBytes().toHex());String newPassword = new SimpleHash(ALGORITHM_NAME, user.getPassword(),ByteSource.Util.bytes(user.getCredentialsSalt()), HASH_ITERATIONS).toHex();user.setPassword(newPassword);}}

5.MyShiroRealm

/*** Copyright 2018 Goldwind Science & Technology.* All rights reserved. GOLDWIND PROPRIETARY/CONFIDENTIAL.* Use is subject to license terms.*/
package com.apache.shiroview.util;import com.apache.shiroview.domain.PermissionModel;
import com.apache.shiroview.domain.RoleModel;
import com.apache.shiroview.domain.UserInfoModel;
import com.apache.shiroview.domain.UserModel;
import com.apache.shiroview.service.UserInfoService;
import com.apache.shiroview.service.UserService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;import java.util.Collection;/*** 身份校验核心类* * @author Administrator**/public class MyShiroRealm extends AuthorizingRealm {@Autowiredprivate UserInfoService infoService ;/*** 认证信息(身份验证) Authentication 是用来验证用户身份* * 输入 认证信息* * 返回*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {System.out.println("身份认证-------------》doGetAuthenticationInfo");String username = (String) token.getPrincipal();UserInfoModel user = infoService.findUserByName(username);if (user == null) {return null;}// 获取用户的输入帐号SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user.getUserName(), // 用户名user.getPassword(), ByteSource.Util.bytes(user.getCredentialsSalt()), getName());return authenticationInfo;}@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {// TODO Auto-generated method stubSystem.out.println("权限配置-->MyShiroRealm.doGetAuthorizationInfo()");// 获取当前用户SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();String username = (String) principals.getPrimaryPrincipal();UserInfoModel user = infoService.findUserByName(username);for (RoleModel role : user.getRoles()) {authorizationInfo.addRole(role.getRoleName());for (PermissionModel permission : role.getPermissList()) {authorizationInfo.addStringPermission(permission.getAuthName());}}return authorizationInfo;}@Overridepublic boolean hasAllRoles(PrincipalCollection principal, Collection<String> roleIdentifiers) {AuthorizationInfo info = getAuthorizationInfo(principal);return info != null && hasAnyRoles(roleIdentifiers, info);}private boolean hasAnyRoles(Collection<String> roleIdentifiers, AuthorizationInfo info) {if (roleIdentifiers != null && !roleIdentifiers.isEmpty()) {for (String roleName : roleIdentifiers) {if (hasRole(roleName, info)) {return true;}}return false;}return true;}}

6.UserInfoController

package com.apache.shiroview.controller;import com.apache.shiroview.domain.UserInfoModel;
import com.apache.shiroview.service.UserInfoService;
import com.apache.shiroview.util.PasswordHelper;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.*;
import org.springframework.web.servlet.ModelAndView;import java.util.*;@Controller
@RequestMapping("/userInfo")
public class UserInfoController {@Autowiredprivate PasswordHelper passwordHelper;@Autowiredprivate UserInfoService userInfoService ;@RequestMapping("showLogin")public ModelAndView showLogin(){ModelAndView modelAndView = new ModelAndView("login");return modelAndView;}@GetMapping("doLogin")@ResponseBodypublic ModelAndView  doLogin(@RequestParam String username, @RequestParam String password) {ModelAndView modelAndView = new ModelAndView();UsernamePasswordToken token = new UsernamePasswordToken(username, password);//实现记住我token.setRememberMe(true);Subject subject = SecurityUtils.getSubject();try {subject.login(token);} catch (IncorrectCredentialsException ice) {modelAndView.addObject("result", "密码错误");modelAndView.setViewName("login");return modelAndView;} catch (UnknownAccountException uae) {modelAndView.addObject("result", "用户不存在");modelAndView.setViewName("login");return modelAndView;}UserInfoModel user = userInfoService.findUserByName(username);subject.getSession().setAttribute("user", user);modelAndView.setViewName("index"); ;return modelAndView;}@GetMapping("register")@ResponseBodypublic Integer register(@RequestParam String username, @RequestParam String password) {UserInfoModel user = new UserInfoModel();user.setId(UUID.randomUUID().toString().replaceAll("-",""));user.setUserName(username);user.setPassword(password);int index = 0 ;passwordHelper.encryptPassword(user);try {userInfoService.saveUser(user);index = 1 ;} catch (Exception e) {e.printStackTrace();index = -1 ;}return index;}}