<!-- 配置自定义realm -->
<bean id="shiroAuthRealm" class="com.sykj.realm.ShiroAuthRealm">
<!-- 配置加密 -->
<property name="credentialsMatcher">
<bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
<property name="hashAlgorithmName" value="MD5"></property> <!-- 加密算法的名称 -->
<property name="hashIterations" value="1024"></property> <!-- 配置加密的次数 -->
</bean>
</property>
</bean>
<!-- 配置安全管理器 -->
<!-- shiro的核心组件：securityManager -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- 配置缓存 -->
<property name="cacheManager" ref="cacheManager" />
<!-- 配置域realm，用户名，密码，角色都保存在域里，完成登录校验、权限校验的自定义JAVA类 -->
<property name="realm" ref="shiroAuthRealm" /> <!-- 步骤4中配置的bean id -->
</bean>
<!-- 配置拦截规则 -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<property name="loginUrl" value="/login.html"/>
<property name="successUrl" value="/succes.html"/>
<property name="unauthorizedUrl" value="/unauth.html"/>
<!-- 拦截规则 -->
<property name="filterChainDefinitions">
<value>
/login.html = anon <!-- anon 匿名访问 不登录允许访问-->
/account/login = anon
/** = authc <!-- authc 授权访问(必须登录后才能访问) -->
<!-- roles[角色名] 权限的控制 -->
/account/queryall=roles[admin]
</value>
</property>
</bean>
以下 我自己看得懂的
realm类里面的 任务借鉴时候用
package com.sykj.realm;
import java.util.Collection;
import java.util.HashSet;
import java.util.Set;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;
import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.sykj.bean.Account;
import com.sykj.mapper.AccountMapper;
public class ShiroAuthRealm extends AuthorizingRealm{--使用权限框架一定是要继承这个
@Autowired
private AccountMapper accountMapper;
/**
* 访问权限校验
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
// TODO Auto-generated method stub
Account account=(Account) principals.getPrimaryPrincipal();
//根据账号或者id调用service的方法查找该用户的所有角色
Set<String> roles=new HashSet<>();
roles.add(account.getAccname());--这其实是获取权限的 我只是为了验证才写的名字(简单一点 我看得懂)
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
info.addRoles(roles);
return info;
}
/**
* 登录校验
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0) throws AuthenticationException {
// TODO Auto-generated method stub
UsernamePasswordToken token=(UsernamePasswordToken) arg0;//传过来的token对象
String accname= token.getUsername();//取到账号
QueryWrapper wrapper=new QueryWrapper();
wrapper.eq("accname", accname);
Account account= accountMapper.selectOne(wrapper);
System.out.println(account+"realm里面的account");
if (account ==null) {//数据库里面的数据
throw new UnknownAccountException();//抛出账号不存在的异常
}
if (account.getAcczt().equals("0")) {//如果等于0就是账户被锁定
throw new LockedAccountException();
}
ByteSource bs=ByteSource.Util.bytes("admin");//用传过来的名字当做加盐
//父类 子类
AuthenticationInfo info=new SimpleAuthenticationInfo(account, account.getAccpassword(),bs, getName());
return info;
}
}