Shiro入门到精通--实现认证realm及加盐

• ShiroRealm1

package com.spring.shiro.realms;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.realm.AuthenticatingRealm;

public class ShiroRealm1  extends  AuthenticatingRealm{

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("doGetAuthenticationInfo"+token);
        //1.把AuthenticationToken强制转换为 UsernamePasswordToken 
        UsernamePasswordToken   upToken  =  (UsernamePasswordToken) token;
        //2.从UsernamePasswordToken中获取token
        String username =upToken.getUsername();
        //3.从数据库中获取对应的username
        System.out.println("从数据库中获取username" +username +"对应的值");
        //4. 若用户不存在抛出UnknowAccountException
        if ("unknow".equals(username)) {
            throw  new  UnknownAccountException("用户名不存在");
        }
        //5.根据用户信息决定是否要抛出其他的AuthenticationException异常  比如账号锁定
        if ("monster".equals(username)) {
            throw  new LockedAccountException("账号被锁定");
        }
        //6.根据用户的情况，构建AuthenticationInfo并返回  SimpleAuthenticationInfo
        //以下信息从数据库获取到的  principal 认证的实体信息，也可以是username
        Object  principal =username;
        //credentials  密码
        Object credentials = "123456";
        //  realmName 调用父类的getName方法即可
        String  realmName  = getName();
        SimpleAuthenticationInfo info  = new SimpleAuthenticationInfo(principal, credentials, realmName);
        
        return info ;
    }

}

配置这个logout是因为前面的输入任意用户名密码为123456，即可认证成功，认证成功后shiro有缓存机制,之后的测试你即时密码不输入123456也可以登陆成功 配置登出过滤器可解决

• 加盐操作

package com.spring.shiro.realms;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.realm.AuthenticatingRealm;
import org.apache.shiro.util.ByteSource;

/**
 * 这个类主要做盐值加密
 * @author admin
 * 2018年2月5日 上午11:40:32
 */
public class ShiroRealm2   extends  AuthenticatingRealm{

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        
        UsernamePasswordToken   upToken  = (UsernamePasswordToken) token;
        String username = upToken.getUsername();
        Object principal  =username;
        Object hashedCredentials =null;
        ByteSource credentialsSalt  =ByteSource.Util.bytes(username);
        if ("admin".equals(username)) {
            hashedCredentials ="038bdaf98f2037b31f1e75b5b4c9b26e";
        }else if ("user".equals(username)) {
            hashedCredentials ="098d2c478e9c11555ce2823231e02ec1";
        }
        String  realmName = getName();
        SimpleAuthenticationInfo   info  = null;
        info  = new  SimpleAuthenticationInfo(principal, hashedCredentials, credentialsSalt, realmName);
        return info;
    }
        public static void main(String[] args) {
            String algorithmName  ="MD5";
            Object source ="123456";
            ByteSource salt  = ByteSource.Util.bytes("admin");
            int  hashIterations =1024;
              Object result =  new  SimpleHash(algorithmName, source, salt, hashIterations);
            System.out.println(result);  //123456 +加盐 admin之后的密码
            
        }
}

 

• applicationContext.xml 自定义的那个realm 需要做对应的更改

<bean id="jdbcRealm" class="com.spring.shiro.realms.ShiroRealm1">
        <!-- 使用加密 指定加密算法MD5 加密次数 1024次 -->
        <property name="credentialsMatcher">
            <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                <property name="hashAlgorithmName" value="MD5"></property>
                <property name="hashIterations" value="1024"></property>
            </bean>
        </property>
    </bean>

 

密码没有从数据库中做获取，自己随便写的。。。。。