本文主要是介绍进阶SpringBoot之 Shiro（3）实现登录拦截和用户认证，希望对大家解决编程问题提供一定的参考价值，需要的开发者们随着小编来一起学习吧！
Config 配置类添加 Shiro 的内置过滤器
anon：无需认证就能访问
authc：认证才能访问
user：拥有“记住我”功能才能使用
perms：拥有对某个资源的权限才能访问
role：拥有某个角色权限才能访问
package com.demo.shirospringboot.config;import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Controller;import java.util.LinkedHashMap;
import java.util.Map;@Controller
public class ShiroConfig {//第三步：ShiroFilterFactoryBean@Beanpublic ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager) {ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();//设置安全管理器bean.setSecurityManager(defaultWebSecurityManager);/*添加Shiro的内置过滤器anon：无需认证就能访问authc：认证才能访问user：拥有“记住我”功能才能使用perms：拥有对某个资源的权限才能访问role：拥有某个角色权限才能访问*/Map<String,String> filterMap = new LinkedHashMap<>();filterMap.put("/user/*","authc");bean.setFilterChainDefinitionMap(filterMap);//设置登录的请求bean.setLoginUrl("/toLogin");return bean;}//第二步：DefaultWebSecurityManager@Bean(name="securityManager")public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();//关联UserRealmsecurityManager.setRealm(userRealm);return securityManager;}//第一步：创建realm对象，需自定义类@Beanpublic UserRealm userRealm(){return new UserRealm();}
}设置了 authc 未认证无法访问（拦截），需跳转到登录页
login.html：
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head><meta charset="UTF-8"><title>Title</title>
</head>
<body><div align="center"><h1>登录</h1><hr><p th:text="${msg}"></p><form th:action="@{/login}"><p>用户名：<input type="text" name="username"></p><p>密码：<input type="text" name="password"></p><p><input type="submit"></p></form>
</div></body>
</html>Controller 类实现用户认证
SecurityUtils.getSubject() 获取当前用户
new 一个 UsernamePasswordToken，封装登录数据
捕获异常，判断用户名和密码是否存在，成功则进入首页，错误则返回登录页
package com.demo.shirospringboot.controller;import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;@Controller
public class MyController {@RequestMapping("/index")public String toIndex(Model model){model.addAttribute("msg","Hello,Shiro!");return "index";}@RequestMapping("/user/add")public String add(){return "user/add";}@RequestMapping("/user/update")public String update(){return "user/update";}@RequestMapping("/toLogin")public String toLogin(){return "login";}@RequestMapping("/login")public String login(String username,String password,Model model){//获取当前用户Subject subject = SecurityUtils.getSubject();//封装用户的登录数据UsernamePasswordToken token = new UsernamePasswordToken(username, password);try{subject.login(token); //执行登录方法return "index";}catch (UnknownAccountException e){ //用户名不存在model.addAttribute("msg","用户名错误");return "login";}catch (IncorrectCredentialsException e){ //密码不存在model.addAttribute("msg","密码错误");return "login";}}}Realm 类继承 AuthorizingRealm，重写认证方法
设置用户数据，完善 Controller 类
package com.demo.shirospringboot.config;import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;//自定义UserRealm
public class UserRealm extends AuthorizingRealm {//授权@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {System.out.println("授权");return null;}//认证@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {System.out.println("认证");String name = "admin";String password = "123456";UsernamePasswordToken userToken = (UsernamePasswordToken) authenticationToken;if(!userToken.getUsername().equals(name)){return null; //抛出异常 UnknownAccountException}//密码认证return new SimpleAuthenticationInfo("",password,"");}
}这篇关于进阶SpringBoot之 Shiro（3）实现登录拦截和用户认证的文章就介绍到这儿，希望我们推荐的文章对编程师们有所帮助！
