加我微信索要我正在使用的《 Apacher Shiro参考手册中文版学习.pdf》 我们一起学习吧~
Apache Shiro 中文文档 - Apache Shiro 教程 | Docs4devApache Shiro 是一个功能强大且易于使用的 Java 安全框架,它用于处理身份验证,授权,加密和会话管理。https://www.docs4dev.com/docs/zh/apache-shiro/1.5.3/reference/tutorial.html
目录
1 Configuration 编写一个配置文件
/resources/shiro.ini
精简的shiro.ini
2 Ref Config 引用配置文件
[1] 建造工厂
[2]获取实例
[3] 实例注入运行环境
3 使用 shiro
3.1 subject
3.2 session
3.3 Authentication 用户验证
3.4Authentication验证异常
3.5 其他
4 完整代码:
5 pom
6 shiro.ini
1 Configuration 编写一个配置文件 Shiro 通过基于文本的 INI 配置文件进行配置。其他配置格式也可以。 /resources/shiro.ini
# Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information # regarding copyright ownership. The ASF licenses this file # to you under the Apache License, Version 2.0 (the # "License"); you may not use this file except in compliance # with the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, # software distributed under the License is distributed on an # "AS IS" BASIS, WITHOUT WARRANTIES OR ConDITIONS OF ANY # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. # # ============================================================================= # Quickstart INI Realm configuration # # For those that might not understand the references in this file, the # definitions are all based on the classic Mel Brooks' film "Spaceballs". ;) # ============================================================================= # ----------------------------------------------------------------------------- # Users and their assigned roles # # Each line conforms to the format defined in the # org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc # ----------------------------------------------------------------------------- [users] # user 'root' with password 'secret' and the 'admin' role root = secret, admin # user 'guest' with the password 'guest' and the 'guest' role guest = guest, guest # user 'presidentskroob' with password '12345' ("That's the same combination on # my luggage!!!" ;)), and role 'president' presidentskroob = 12345, president # user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz' darkhelmet = ludicrousspeed, darklord, schwartz # user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz' lonestarr = vespa, goodguy, schwartz # ----------------------------------------------------------------------------- # Roles with assigned permissions # # Each line conforms to the format defined in the # org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc # ----------------------------------------------------------------------------- [roles] # 'admin' role has all permissions, indicated by the wildcard '*' admin = * # The 'schwartz' role can do anything (*) with any lightsaber: schwartz = lightsaber:* # The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with # license plate 'eagle5' (instance specific id) goodguy = winnebago:drive:eagle5精简的shiro.ini
井号是注释,精简版本如下
[users] root = secret, admin guest = guest, guest presidentskroob = 12345, president darkhelmet = ludicrousspeed, darklord, schwartz lonestarr = vespa, goodguy, schwartz [roles] admin = * schwartz = lightsaber:* goodguy = winnebago:drive:eagle5
idea中可以在插件中心下载ini 让ini配置文件有高亮,更好看
2 Ref Config 引用配置文件 使用 3 行代码开启Shiro。public static void main(String[] args) { //[1]解析 shiro.ini 文件 Factory[1] 建造工厂factory = new IniSecurityManagerFactory("classpath:shiro.ini"); //[2]通过 SecurityManager 工厂获得 SecurityManager 实例 SecurityManager securityManager = factory.getInstance(); //[3]把 SecurityManager 对象设置到运行环境中 SecurityUtils.setSecurityManager(securityManager); }
new IniSecurityManagerFactory("classpath:shiro.ini");使用 Shiro 的 IniSecurityManager 实现来提取我们的 shiro.ini 文件,作为实例工厂的建造材料。文件位于 classpath 的根目录。 classpath是这个: [2]获取实例
factory.getInstance()factory.getInstance() 方法被调用,它来解析 INI 文件并返回反映该配置的 SecurityManager 实例。 [3] 实例注入运行环境
org.apache.shiro.SecurityUtils.setSecurityManager(securityManager);将securityManager通过工具类放到运行环境中,至此,一个具有shiro功能的的运行环境已经构建完成。(虽然肉眼什么也看不到) 3 使用 shiro 3.1 subject shiro是一个安全框架,当考虑到一个程序的安全性时候,我们把我们的安全需求抽象成为以下两点: 1“当前用户是谁” Authentication——身份验证 2“当前用户是否被允许做XXX ” Authorization ——权限审查 因此,对于我们考虑应用程序安全的最自然的方式是基于当前用户。 Shiro 的 API 使用它的 Subject 概念从根本上代表了“当前用户”的概念。
Subject Subject 是一个安全术语,它基本上的意思是“当前正在执行的用户的特定的安全视图”。 它并没有被称为"User"是因为"User"一词通常和人类相关联。 在安全界,术语"Subject"可以表示为人类,而且可是第三方进程,cron job,daemon account,或其他类似的东西。 它仅仅意味着“该事物目前正与软件交互”。对于大多数的意图和目的,你可以把 Subject 看成是 Shiro"User"概念。几乎在所有的环境中,你可以通过下面的调用获取当前正在执行的用户:
Subject subject = SecurityUtils.getSubject(); // 将变量名写成currentUser 会更便于理解 Subject currentUser = SecurityUtils.getSubject();3.2 session
从一个subject中,当然可以获取到一个它所属于的session。
Session session = currentUser.getSession(); session.setAttribute("someKey", "aValue");Session 是一个 Shiro 的特定实例,它提供了大部分你经常与 HttpSessoins 使用所一样的东西,但它却不需要一个 HTTP 环境! ★ 如果在一个 Web 应用程序内部部署,默认的 Session 将会是基于 HttpSession 的。 在一个非 Web 环境中,像这个简单的教程应用程序, Shiro 将会默认自动地使用它的 Enterprise Session Management 。 3.3 Authentication 用户验证 因此,现在你能获取一个 Subject 以及他们的 Session。如果他们被允许做某些事,如对角色和权限的检查,像“检 查”真正有用的地方在哪呢? 嗯,我们只能为一个已知的用户做这些检查。我们上面的 Subject 实例代表了当前用户,但谁又是当前用户?呃, 他们是匿名的——也就是说,直到直到他们至少登录一次。那么,让我像下面这样做:
// 如果没验证 if (!currentUser.isAuthenticated()) { //验证过程 //用一组用户名和对应密码 --》 设置一个令牌 //用户在shiro.ini中配置 //username = password, roleName1, roleName2, …, roleNameN //如:root = secret, admin //表示 用户是root,密码是secret 角色是admin UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa"); //设置记住我选项(没错,就是这么现代的一个功能) token.setRememberMe(true); //用设置好的令牌来进入当前的运行环境 currentUser.login(token); }
登录失败的各种情况,shiro已经通过抛出异常来提示,请为抛出的异常提供不同的解决方案吧。
// let's login the current user so we can check against roles and permissions: if (!currentUser.isAuthenticated()) { UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa"); token.setRememberMe(true); try { currentUser.login(token); } catch (UnknownAccountException uae) { log.info("There is no user with username of " + token.getPrincipal()); } catch (IncorrectCredentialsException ice) { log.info("Password for account " + token.getPrincipal() + " was incorrect!"); } catch (LockedAccountException lae) { log.info("The account for username " + token.getPrincipal() + " is locked. " + "Please contact your administrator to unlock it."); } // ... catch more exceptions here (maybe custom ones specific to your application? catch (AuthenticationException ae) { //unexpected condition? error? } }3.4Authentication验证异常
如下
怎么解决这些异常呢?官方这么说:
3.5 其他 4 完整代码import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.*; import org.apache.shiro.config.IniSecurityManagerFactory; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.session.Session; import org.apache.shiro.subject.Subject; import org.apache.shiro.util.Factory; import org.slf4j.Logger; import org.slf4j.LoggerFactory; public class Quickstart { private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class); public static void main(String[] args) { // The easiest way to create a Shiro SecurityManager with configured // realms, users, roles and permissions is to use the simple INI config. // We'll do that by using a factory that can ingest a .ini file and // return a SecurityManager instance: // Use the shiro.ini file at the root of the classpath // (file: and url: prefixes load from files and urls respectively): Factory5 pomfactory = new IniSecurityManagerFactory("classpath:shiro.ini"); SecurityManager securityManager = factory.getInstance(); // for this simple example quickstart, make the SecurityManager // accessible as a JVM singleton. Most applications wouldn't do this // and instead rely on their container configuration or web.xml for // webapps. That is outside the scope of this simple quickstart, so // we'll just do the bare minimum so you can continue to get a feel // for things. SecurityUtils.setSecurityManager(securityManager); // Now that a simple Shiro environment is set up, let's see what you can do: // get the currently executing user: Subject currentUser = SecurityUtils.getSubject(); // Do some stuff with a Session (no need for a web or EJB container!!!) Session session = currentUser.getSession(); session.setAttribute("someKey", "aValue"); String value = (String) session.getAttribute("someKey"); if (value.equals("aValue")) { log.info("Retrieved the correct value! [" + value + "]"); } // let's login the current user so we can check against roles and permissions: if (!currentUser.isAuthenticated()) { UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa"); token.setRememberMe(true); try { currentUser.login(token); } catch (UnknownAccountException uae) { log.info("There is no user with username of " + token.getPrincipal()); } catch (IncorrectCredentialsException ice) { log.info("Password for account " + token.getPrincipal() + " was incorrect!"); } catch (LockedAccountException lae) { log.info("The account for username " + token.getPrincipal() + " is locked. " + "Please contact your administrator to unlock it."); } // ... catch more exceptions here (maybe custom ones specific to your application? catch (AuthenticationException ae) { //unexpected condition? error? } } //say who they are: //print their identifying principal (in this case, a username): log.info("User [" + currentUser.getPrincipal() + "] logged in successfully."); //test a role: if (currentUser.hasRole("schwartz")) { log.info("May the Schwartz be with you!"); } else { log.info("Hello, mere mortal."); } //test a typed permission (not instance-level) if (currentUser.isPermitted("lightsaber:wield")) { log.info("You may use a lightsaber ring. Use it wisely."); } else { log.info("Sorry, lightsaber rings are for schwartz masters only."); } //a (very powerful) Instance Level permission: if (currentUser.isPermitted("winnebago:drive:eagle5")) { log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'. " + "Here are the keys - have fun!"); } else { log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!"); } //all done - log out! currentUser.logout(); System.exit(0); } }
6 shiro.ini4.0.0 org.apache.shiro.tutorials shiro-tutorial1.0.0-SNAPSHOT First Apache Shiro Application jar 8 8 UTF-8 org.apache.maven.plugins maven-compiler-plugin2.0.2 1.5 ${project.build.sourceEncoding} org.codehaus.mojo exec-maven-plugin1.1 java test Tutorial org.apache.shiro shiro-core1.1.0 org.slf4j slf4j-api1.7.25 org.slf4j slf4j-nop1.7.2
# Licensed to the Apache Software Foundation (ASF) under one # or more contributor license agreements. See the NOTICE file # distributed with this work for additional information # regarding copyright ownership. The ASF licenses this file # to you under the Apache License, Version 2.0 (the # "License"); you may not use this file except in compliance # with the License. You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, # software distributed under the License is distributed on an # "AS IS" BASIS, WITHOUT WARRANTIES OR ConDITIONS OF ANY # KIND, either express or implied. See the License for the # specific language governing permissions and limitations # under the License. # # ============================================================================= # Quickstart INI Realm configuration # # For those that might not understand the references in this file, the # definitions are all based on the classic Mel Brooks' film "Spaceballs". ;) # ============================================================================= # ----------------------------------------------------------------------------- # Users and their assigned roles # # Each line conforms to the format defined in the # org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc # ----------------------------------------------------------------------------- [users] # user 'root' with password 'secret' and the 'admin' role root = secret, admin # user 'guest' with the password 'guest' and the 'guest' role guest = guest, guest # user 'presidentskroob' with password '12345' ("That's the same combination on # my luggage!!!" ;)), and role 'president' presidentskroob = 12345, president # user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz' darkhelmet = ludicrousspeed, darklord, schwartz # user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz' lonestarr = vespa, goodguy, schwartz # ----------------------------------------------------------------------------- # Roles with assigned permissions # # Each line conforms to the format defined in the # org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc # ----------------------------------------------------------------------------- [roles] # 'admin' role has all permissions, indicated by the wildcard '*' admin = * # The 'schwartz' role can do anything (*) with any lightsaber: schwartz = lightsaber:* # The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with # license plate 'eagle5' (instance specific id) goodguy = winnebago:drive:eagle5
欢迎分享,转载请注明来源:内存溢出
评论列表(0条)