白话介绍shiro及使用

一、shiro 是一款安全框架
主要功能，如下

二、shiro登录流程步骤

三、所以使用shiro需要配置一些东西
** 1.自定义AuthorizingRealm**
重写doGetAuthenticationInfo方法
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
String username = upToken.getUsername();
String password = "";
if (upToken.getPassword() != null)
{
password = new String(upToken.getPassword());
}

    SysUser user = null;
    try
    {
        user = loginService.login(username, password);
    }
    catch (CaptchaException e)
    {
        throw new AuthenticationException(e.getMessage(), e);
    }
    catch (UserNotExistsException e)
    {
        throw new UnknownAccountException(e.getMessage(), e);
    }
    catch (UserPasswordNotMatchException e)
    {
        throw new IncorrectCredentialsException(e.getMessage(), e);
    }
    catch (UserPasswordRetryLimitExceedException e)
    {
        throw new ExcessiveAttemptsException(e.getMessage(), e);
    }
    catch (UserBlockedException e)
    {
        throw new LockedAccountException(e.getMessage(), e);
    }
    catch (RoleBlockedException e)
    {
        throw new LockedAccountException(e.getMessage(), e);
    }
    catch (Exception e)
    {
        log.info("对用户[" + username + "]进行登录验证..验证未通过{}", e.getMessage());
        throw new AuthenticationException(e.getMessage(), e);
    }
    SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, password, getName());
    return info;
}

2. 创建SecurityMananger并注入到spring容器
   @Bean
   public SecurityManager securityManager(UserRealm userRealm) {
   DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
   // 设置realm.
   securityManager.setRealm(userRealm);
   return securityManager;
   }

3. 通过 Subject.login 登录验证
   UsernamePasswordToken token = new UsernamePasswordToken(username, password, rememberMe);
   Subject subject = SecurityUtils.getSubject();
   try {
   subject.login(token);
   return success();
   } catch (AuthenticationException e) {
   String msg = "用户或密码错误";
   if (StringUtils.isNotEmpty(e.getMessage())) {
   msg = e.getMessage();
   }
   return error(msg);
   }

这样会有一个问题，登录的用户 我们没有做处理，我们可以把登录的用户数据保存起来，以sessionId为key，当然也可以做成jwt + redisCache