springboot shiro 基本整合
springboot shiro 基本整合
https://www.w3cschool.cn/shiro/c52r1iff.html
http://shiro.apache.org/configuration.html#Configuration-ProgrammaticConfiguration
步骤
依赖和配置
定义 org.apache.shiro.realm.Realm 使用 IniRealm
定义 org.apache.shiro.mgt.SecurityManager
定义 org.apache.shiro.spring.web.ShiroFilterFactoryBean
指定登录页面 shiroFilterFactoryBean.setLoginUrl("/login.html")
放行登录相关接口和静态资源
定义登录Controller
Map<String, String> map = new HashMap<>();
map.put("/login/pc", "anon");
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
依赖
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
配置
server:
servlet:
context-path: /mozq
# user.ini
[users]
liubei=123
添加Bean
package com.mozq.sb.shiro03.config;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.realm.text.IniRealm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.apache.shiro.mgt.SecurityManager;
import java.util.HashMap;
import java.util.Map;
@Configuration
public class ShiroConfig {
//自定义 org.apache.shiro.realm.Realm
@Bean
public IniRealm iniRealm(){
IniRealm iniRealm = new IniRealm("classpath:user.ini");
return iniRealm;
}
//定义 org.apache.shiro.mgt.SecurityManager
@Bean
public SecurityManager securityManager(Realm realm){
DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
securityManager.setRealm(realm);
return securityManager;
}
//定义 org.apache.shiro.spring.web.ShiroFilterFactoryBean
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager){
ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
//过滤的路径
Map<String, String> map = new HashMap<>();
map.put("/**", "authc");
map.put("/login/pc", "anon");//放行登录相关接口
map.put("/js/jquery-3.4.1.js", "anon");//放行登录页面静态资源，不然登录页报错。
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
shiroFilterFactoryBean.setLoginUrl("/login.html");//登录页面
return shiroFilterFactoryBean;
}
}
登录页面
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Title</title>
<script src="js/jquery-3.4.1.js"></script>
</head>
<body>
<form action="/login/pc" method="post">
<input id="username" name="username">
<input id="password" name="password">
<!-- <input type="button" value="登录"> -->
<input type="button" value="登录" onclick="login()">
</form>
<script>
var serverPath = "/mozq";
function login() {
var username = $("#username").val();
var password = $("#password").val();
console.log(username);
console.log(password);
$.ajax({//Content-Type: application/x-www-form-urlencoded; charset=UTF-8
url: serverPath + "/login/pc",
type: "post",
data: {"username": username, "password": password},
success: function (res) {
if(res === "success"){
window.location.href = "http://www.baidu.com";
}else{
alert(res);
}
}
});
}
</script>
</body>
</html>
登录Controller
package com.mozq.sb.shiro03.controller;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
@RestController
@RequestMapping("/login")
public class LoginController {
@RequestMapping("/pc")
public String login(@RequestParam String username, @RequestParam String password){
Subject subject = SecurityUtils.getSubject();
UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);
try {
subject.login(usernamePasswordToken);
} catch (AuthenticationException e) {
e.printStackTrace();
return "身份验证错误";
}
return "success";
}
}
bugs
1.
Caused by: org.apache.shiro.config.ConfigurationException: java.io.IOException: Resource [classpath: user.ini] could not be found.
原因：[classpath: user.ini] 路径中加了空格
2.
不配置登录跳转页面，则默认跳转到 http://localhost:8080/login.jsp
配置登录接口：shiroFilterFactoryBean.setLoginUrl("/login.html");//则这个接口成为放行的，即anon
如果项目路径为： localhost/mozq
则此时登录跳转到：localhost/mozq/login.html
3.
如果登录相关的其他接口不放行，则重定向到登录页面。
放行登录相关的接口：map.put("/login/pc", "anon");
如果项目路径为： localhost/mozq
则此时放行路径：localhost/mozq/login/pc
4.
org.apache.shiro.authc.UnknownAccountException: Realm [org.apache.shiro.realm.text.IniRealm@4c9f4ee9] was unable to find account data for the submitted AuthenticationToken [org.apache.shiro.authc.UsernamePasswordToken - 1, rememberMe=false].
原因：user.ini中什么都没有写。则登录验证失败。
方案：添加用户信息
[users]
liubei=123
5.
Uncaught SyntaxError: Unexpected token <
原因：shiro 将login.html的资源 jquery-3.4.1.js 拦截了，无法访问，所以报了这个错误。
方案：
放行静态资源
map.put("/js/jquery-3.4.1.js", "anon")
