springboot整合shiro

pom文件配置

		<dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring</artifactId><version>1.4.0</version></dependency>

config类的配置

定义一个ShiroConfig类的，来配置shiro的相关配置

@Configuration
public class ShiroConfig {@Beanpublic ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();shiroFilterFactoryBean.setSecurityManager(securityManager);shiroFilterFactoryBean.setLoginUrl("/login");shiroFilterFactoryBean.setSuccessUrl("/index");shiroFilterFactoryBean.setUnauthorizedUrl("/403");LinkedHashMap<String, String> filterChainDefinitionMap = new LinkedHashMap<>();filterChainDefinitionMap.put("/css/**", "anon");filterChainDefinitionMap.put("/js/**", "anon");filterChainDefinitionMap.put("/fonts/**", "anon");filterChainDefinitionMap.put("/img/**", "anon");filterChainDefinitionMap.put("/druid/**", "anon");filterChainDefinitionMap.put("/logout", "logout");filterChainDefinitionMap.put("/", "anon");filterChainDefinitionMap.put("/**", "authc");shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);return shiroFilterFactoryBean;}@Bean  public SecurityManager securityManager(){  DefaultWebSecurityManager securityManager =  new DefaultWebSecurityManager();securityManager.setRealm(shiroRealm());return securityManager;  }  @Bean  public ShiroRealm shiroRealm(){  ShiroRealm shiroRealm = new ShiroRealm();  return shiroRealm;  }  }

注意这里的ShiroRealm是我们自己定义的一个realm，我们的认证逻辑都是写在这里的，我们可以把这个realm理解成一个过滤器，来过滤非法请求。

过滤器的配置（ShiroRealm）

public class ShiroRealm extends AuthorizingRealm {@Autowiredprivate UserMapper userMapper;/*** 获取用户角色和权限*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal) {return null;}/*** 登录认证*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {String userName = (String) token.getPrincipal();String password = new String((char[]) token.getCredentials());System.out.println("用户" + userName + "认证-----ShiroRealm.doGetAuthenticationInfo");User user = userMapper.findByUserName(userName);if (user == null) {throw new UnknownAccountException("用户名或密码错误！");}if (!password.equals(user.getPassword())) {throw new IncorrectCredentialsException("用户名或密码错误！");}if (user.getStatus().equals("0")) {throw new LockedAccountException("账号已被锁定,请联系管理员！");}SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, password, getName());return info;}}

Realm实现只需继承AuthorizingRealm类，然后实现doGetAuthorizationInfo()和doGetAuthenticationInfo()方法即可。这两个方法名乍看有点像，authorization为授权，批准的意思，即获取用户的角色和权限等信息；authentication为认证，身份验证的意思，即登录时验证用户的合法性，比如验证用户名和密码。这里我们就先只验证用户名和密码。

controller层

@Controller
public class LoginController {@GetMapping("/login")public String login() {return "login";}@PostMapping("/login")@ResponseBodypublic ResponseBo login(String username, String password) {password = MD5Utils.encrypt(username, password);UsernamePasswordToken token = new UsernamePasswordToken(username, password);Subject subject = SecurityUtils.getSubject();try {subject.login(token);return ResponseBo.ok();} catch (UnknownAccountException e) {return ResponseBo.error(e.getMessage());} catch (IncorrectCredentialsException e) {return ResponseBo.error(e.getMessage());} catch (LockedAccountException e) {return ResponseBo.error(e.getMessage());} catch (AuthenticationException e) {return ResponseBo.error("认证失败！");}}@RequestMapping("/")public String redirectIndex() {return "redirect:/index";}@RequestMapping("/index")public String index(Model model) {// 拿到用户对象User user = (User) SecurityUtils.getSubject().getPrincipal();model.addAttribute("user", user);return "index";}
}

这里前端调用login接口后，会根据之前在ShiroConfig中的配置shiroFilterFactoryBean.setSuccessUrl("/index")，页面会自动访问/index路径

测试

项目启动后，可以访问地址测试一下

http://localhost:8080/

http://localhost:8080/index

http://localhost:8080/qwer

项目源码