shiro + mybatis+ spring (只用shiro的密碼校驗和併發剔除)——不用許可權之類

阿新 • • 發佈：2019-02-13

</pre>          shiro很強大，但往往專案不可能大改造，往往只需要部分功能，比如用到驗證碼，加密，還有就是同一個賬戶在兩個地方登入，剔除第一個登入者，本文只提供思路和部分程式碼，<p></p><p></p><p>自定義實現ream,</p><p></p><pre name="code" class="java">package com.shiro.shiro.realm;

import java.util.HashSet;
import java.util.Set;

import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import com.shiro.model.User;
import com.shiro.service.UserService;


public class UserRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;
    //獲取授權資訊
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
     <span style="font-size:18px;">   <span style="color:#ff0000;"><strong>Set<String>  set =new HashSet<String>();
        set.add("*:*:*");</strong></span>
        <span style="color:#ff0000;"><strong>authorizationInfo.setRoles(set);
        authorizationInfo.setStringPermissions(set);
        return authorizationInfo;</strong></span></span>
    }
   //獲取身份驗證資訊
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        String username = (String)token.getPrincipal();

        User user = userService.findByUsername(username);

        if(user == null) {
            throw new UnknownAccountException();//沒找到帳號
        }

        if(Boolean.TRUE.equals(user.getLocked())) {
            throw new LockedAccountException(); //帳號鎖定
        }

        //交給AuthenticatingRealm使用CredentialsMatcher進行密碼匹配，如果覺得人家的不好可以自定義實現
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                user.getUsername(), //使用者名稱
                user.getPassword(), //密碼
                ByteSource.Util.bytes(user.getCredentialsSalt()),//salt=username+salt
                getName()  //realm name
        );
        return authenticationInfo;
    }

    @Override
    public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
        super.clearCachedAuthorizationInfo(principals);
    }

    @Override
    public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
        super.clearCachedAuthenticationInfo(principals);
    }

    @Override
    public void clearCache(PrincipalCollection principals) {
        super.clearCache(principals);
    }

    public void clearAllCachedAuthorizationInfo() {
        getAuthorizationCache().clear();
    }

    public void clearAllCachedAuthenticationInfo() {
        getAuthenticationCache().clear();
    }

    public void clearAllCache() {
        clearAllCachedAuthenticationInfo();
        clearAllCachedAuthorizationInfo();
    }

}

只要在<pre name="code" class="java">doGetAuthorizationInfo方法體裡授權所有資源所有角色就好了

</pre><pre name="code" class="java">

剔除功能

</pre><pre name="code" class="java"><pre name="code" class="java">package com.shiro.shiro.filter;

import org.apache.shiro.cache.Cache;
import org.apache.shiro.cache.CacheManager;
import org.apache.shiro.session.Session;
import org.apache.shiro.session.mgt.DefaultSessionKey;
import org.apache.shiro.session.mgt.SessionManager;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.AccessControlFilter;
import org.apache.shiro.web.util.WebUtils;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import java.io.Serializable;
import java.util.Deque;
import java.util.LinkedList;

/**
 * 併發剔除
 */
public class KickoutSessionControlFilter extends AccessControlFilter {

    private String kickoutUrl; //踢出後到的地址
    private boolean kickoutAfter = false; //踢出之前登入的/之後登入的使用者 預設踢出之前登入的使用者
    private int maxSession = 1; //同一個帳號最大會話數 預設1

    private SessionManager sessionManager;
    private Cache<String, Deque<Serializable>> cache;

    public void setKickoutUrl(String kickoutUrl) {
        this.kickoutUrl = kickoutUrl;
    }

    public void setKickoutAfter(boolean kickoutAfter) {
        this.kickoutAfter = kickoutAfter;
    }

    public void setMaxSession(int maxSession) {
        this.maxSession = maxSession;
    }

    public void setSessionManager(SessionManager sessionManager) {
        this.sessionManager = sessionManager;
    }

    public void setCacheManager(CacheManager cacheManager) {
        this.cache = cacheManager.getCache("shiro-kickout-session");
    }

    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        return false;
    }

    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        Subject subject = getSubject(request, response);
        if(!subject.isAuthenticated() && !subject.isRemembered()) {//未授權且非remember 
            //如果沒有登入，直接進行之後的流程
            return true;
        }

        Session session = subject.getSession();
        String username = (String) subject.getPrincipal();
        Serializable sessionId = session.getId();

        //TODO 同步控制
        Deque<Serializable> deque = cache.get(username);
        if(deque == null) {
            deque = new LinkedList<Serializable>();
            cache.put(username, deque);
        }

        //如果佇列裡沒有此sessionId，且使用者沒有被踢出；放入佇列
        if(!deque.contains(sessionId) && session.getAttribute("kickout") == null) {
            deque.push(sessionId);
        }

        //如果佇列裡的sessionId數超出最大會話數，開始踢人
        while(deque.size() > maxSession) {
            Serializable kickoutSessionId = null;
            if(kickoutAfter) { //如果踢出後者
                kickoutSessionId = deque.removeFirst();
            } else { //否則踢出前者
                kickoutSessionId = deque.removeLast();
            }
            try {
                Session kickoutSession = sessionManager.getSession(new DefaultSessionKey(kickoutSessionId));
                if(kickoutSession != null) {
                    //設定會話的kickout屬性表示踢出了
                    kickoutSession.setAttribute("kickout", true);
                }
            } catch (Exception e) {//ignore exception
            }
        }

        //如果被踢出了，直接退出，重定向到踢出後的地址
        if (session.getAttribute("kickout") != null) {
            //會話被踢出了
            try {
                subject.logout();//這裡走的shiro的退出
            } catch (Exception e) { //ignore
            }
            saveRequest(request);
            WebUtils.issueRedirect(request, response, kickoutUrl);
            return false;
        }

        return true;
    }
}

此處用到了快取，當然可以自己實現，把session存到資料庫中然後判斷操作

</pre><pre name="code" class="java">再看下部分配置檔案

</pre><pre name="code" class="java">

<pre name="code" class="html"><?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd
       http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">
    <!-- 快取管理器 -->
    <bean id="cacheManager" class="com.shiro.spring.cache.SpringCacheManagerWrapper">
        <property name="cacheManager" ref="springCacheManager"/>
    </bean>
    <!-- 憑證匹配器 -->
    <bean id="credentialsMatcher" class="com.shiro.shiro.credentials.CredentialsMatcher">
        <property name="hashAlgorithmName" value="md5"/>
        <property name="hashIterations" value="2"/>
        <property name="storedCredentialsHexEncoded" value="true"/>
    </bean>
    <!-- Realm實現 -->
    <bean id="userRealm" class="com.shiro.shiro.realm.UserRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher"/>
        <property name="cachingEnabled" value="false"/>
    </bean>
    <!-- 會話ID生成器 -->
    <bean id="sessionIdGenerator" class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator"/>
    <!-- 會話Cookie模板 maxAge=-1表示瀏覽器關閉時失效此Cookie-->
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="sid"/>
        <property name="httpOnly" value="true"/>
        <property name="maxAge" value="-1"/>
    </bean>
    <!-- 會話DAO -->
    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
        <property name="activeSessionsCacheName" value="shiro-activeSessionCache"/>
        <property name="sessionIdGenerator" ref="sessionIdGenerator"/>
    </bean>
    <!-- 會話驗證排程器 -->
    <bean id="sessionValidationScheduler" class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler">
        <property name="sessionValidationInterval" value="1800000"/>
        <property name="sessionManager" ref="sessionManager"/>
    </bean>
    <!-- 會話管理器 -->
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="globalSessionTimeout" value="1800000"/>
        <property name="deleteInvalidSessions" value="true"/>
        <property name="sessionValidationSchedulerEnabled" value="true"/>
        <property name="sessionValidationScheduler" ref="sessionValidationScheduler"/>
        <property name="sessionDAO" ref="sessionDAO"/>
        <property name="sessionIdCookieEnabled" value="true"/>
        <property name="sessionIdCookie" ref="sessionIdCookie"/>
    </bean>
    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="userRealm"/>
        <property name="sessionManager" ref="sessionManager"/>
        <property name="cacheManager" ref="cacheManager"/>
    </bean>
	
    <!-- 相當於呼叫SecurityUtils.setSecurityManager(securityManager) -->
    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager"/>
        <property name="arguments" ref="securityManager"/>
    </bean>

    <!-- 基於Form表單的身份驗證過濾器 -->
<strong>    <bean id="authcFilter" class="com.shiro.shiro.filter.MyFormAuthenticationFilter">
        <property name="usernameParam" value="username"/>
        <property name="passwordParam" value="password"/>
        <property name="failureKeyAttribute" value="shiroLoginFailure"/>
    </bean>
    
     <bean id="validateFilter" class="com.shiro.shiro.filter.ValidateFilter">
        <property name="verificationAbled" value="true"/>
        <property name="verificationParam" value="verificationParam"/>
        <property name="failureKeyAttribute" value="shiroLoginFailure"/>
    </bean></strong>
       <!-- Shiro的Web過濾器 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/login"/>
        <property name="filters">
            <util:map>
                <entry key="authc" value-ref="<strong>authcFilter</strong>"/>
                <entry key="sysUser" value-ref="sysUserFilter"/>
                <entry key="validateFilter" value-ref="<strong>validateFilter</strong>"/>
                <entry key="kickout" value-ref="<strong>kickoutSessionControlFilter</strong>"/>
            </util:map>
        </property>
        <property name="filterChainDefinitions">
            <value>
                 /login = <strong>validateFilter</strong>,authc
                 /logout = logout
                /authenticated = authc
                /** = <strong>kickout</strong>,user,sysUser
            </value>
        </property>
    </bean>
    
    <!-- currenuser  -->
    <bean id="sysUserFilter" class="com.shiro.shiro.filter.SysUserFilter"/>
    <!-- 併發踢出 
            kickoutAfter：是否踢出後來登入的，預設是false 
            kickoutUrl：被踢出後重定向到的地址
            maxSession：同一個使用者最大的會話數，預設1
     -->
    <bean id="kickoutSessionControlFilter" class="com.shiro.shiro.filter.KickoutSessionControlFilter">
        <property name="cacheManager" ref="cacheManager"/>
        <property name="sessionManager" ref="sessionManager"/>
        <property name="kickoutAfter" value="false"/>
        <property name="maxSession" value="2"/>
        <property name="kickoutUrl" value="/login?kickout=1"/>
    </bean>
    <!-- Shiro生命週期處理器-->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
    
</beans>

</pre><pre name="code" class="java">自定義的

</pre><pre name="code" class="java"><pre name="code" class="java">package com.shiro.shiro.filter;

import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * 自定義shiro FormAuthenticationFilter 表單過濾器
 * @author changliang
 *
 */
public class MyFormAuthenticationFilter extends FormAuthenticationFilter {
    /**
     * 授權是否失敗
     */
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        if(request.getAttribute(getFailureKeyAttribute()) != null) {
            return true;
        }
        return super.onAccessDenied(request, response, mappedValue);
    }
}

</pre>密碼校驗<pre>

<pre name="code" class="java">package com.shiro.shiro.filter;

import org.apache.shiro.web.filter.AccessControlFilter;
import org.apache.shiro.web.util.WebUtils;
import org.springframework.beans.factory.annotation.Autowired;

import com.shiro.service.UserService;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

/**
 * 驗證碼過濾器
 */
public class ValidateFilter extends AccessControlFilter {
	
	@SuppressWarnings("unused")
	@Autowired
	private UserService userService;

    private boolean verificationAbled = true;                //是否開啟驗證碼支援

    @SuppressWarnings("unused")
	private String verificationParam = "verificationParam";  //前臺提交的驗證碼引數名

    private String failureKeyAttribute = "shiroLoginFailure"; //驗證碼驗證失敗後儲存到的屬性名
    
   
    public void setVerificationAbled(boolean verificationAbled) {
		this.verificationAbled = verificationAbled;
	}

	public void setVerificationParam(String verificationParam) {
		this.verificationParam = verificationParam;
	}

	public void setFailureKeyAttribute(String failureKeyAttribute) {
        this.failureKeyAttribute = failureKeyAttribute;
    }

    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
        //1、設定驗證碼是否開啟屬性，頁面可以根據該屬性來決定是否顯示驗證碼
        request.setAttribute("verificationAbled", verificationAbled);

        HttpServletRequest httpServletRequest = WebUtils.toHttp(request);
        //2、判斷驗證碼是否禁用 或不是表單提交（允許訪問）
        if (verificationAbled == false || !"post".equalsIgnoreCase(httpServletRequest.getMethod())) {
            return true;
        }
       <span style="color:#ff0000;"><strong> //3、此時是表單提交，驗證驗證碼是否正確
        //TODO 增加自己的驗證碼校驗
        //return  userService.verification(verificationParam);
        return true;</strong></span>
    }
    @Override
    protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {
        //如果驗證碼失敗了，儲存失敗key屬性
    	//在LoginController裡過濾用到
        request.setAttribute(failureKeyAttribute, "<span style="color:#ff0000;">verification.error</span>");
        return true;
    }
}

處理器

</pre><pre name="code" class="java"><pre name="code" class="java">package com.shiro.controller;

import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;

import javax.servlet.http.HttpServletRequest;
/**
 * 常見錯誤：
 *  subject.login()
	 * DisabledAccountException（禁用的帳號）、
	 * LockedAccountException（鎖定的帳號）、
	 * UnknownAccountException（錯誤的帳號）、
	 * ExcessiveAttemptsException（登入失敗次數過多）、
	 * IncorrectCredentialsException （錯誤的憑證）、
	 * ExpiredCredentialsException（過期的憑證）
 * @author changliang
 *
 */
@Controller
public class LoginController {

    @RequestMapping(value = "/login"    )
    public String showLoginForm(HttpServletRequest req, Model model) {
        String exceptionClassName = (String)req.getAttribute("shiroLoginFailure");
        String error = null;
        if(UnknownAccountException.class.getName().equals(exceptionClassName)) {
            error = "使用者名稱/密碼錯誤";
        } else if(IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {
            error = "使用者名稱/密碼錯誤";//錯誤的憑證
        }else if("<span style="color:#ff0000;">verification.error</span>".equals(exceptionClassName)) {
            error = "驗證碼錯誤";
        } else if(exceptionClassName != null) {
            error = "其他錯誤：" + exceptionClassName;
        }
        model.addAttribute("error", error);
        return "login";
    }


}

參考：http://jinnianshilongnian.iteye.com/blog/2049092

</pre><pre name="code" class="java">

</pre><pre name="code" class="java">

</pre><pre name="code" class="java">

</pre><pre name="code" class="java">

</pre>

shiro + mybatis+ spring (只用shiro的密碼校驗和併發剔除)——不用許可權之類

</pre> shiro很強大，但往往專案不可能大改造，往往只需要部分功能，比如用到驗證碼，加密，還有就是同一個賬戶在兩個地方登入，剔除第一個登入者，本文只提供思路和部分程式碼，<p></p><p><

用戶名和密碼校驗程序

提示用戶名 pass true () brush inpu highlight print name = input(‘請輸入用戶名:‘) password = input(‘請輸入密碼:‘) if 6 <= len(name) <= 20: pri

Spring基礎系列-引數校驗

原創作品，可以轉載，但是請標註出處地址：https://www.cnblogs.com/V1haoge/p/9953744.html Spring中使用引數校驗概述 JSR 303中提出了Bean Validation，表示JavaBean的校驗，Hibernate Validation是其具體實

spring mvc 參數校驗

efault ror span font exc exce default 地方 doc 　　　　　　　　　　　　　　　　　　spring mvc中的參數校驗 spring mvc 支持jsr-303 Bean驗證框架，默認實現是使用的Hibernate validator

Spring Boot MVC 引數校驗

文章目錄 Spring Boot Validate 常用註解使用說明基本使用實現分組校驗處理校驗結果自定義校驗註解配置校驗提示資訊手動進行校驗

密碼校驗正則 -- 數字、字符、特殊符號

div reg mage bubuko info clas ima 數字匹配密碼要求輸入：必須包含數字、字符和特殊符號 var reg = /(?=.*[a-z_])(?=.*\d)(?=.*[^a-z0-9_])[\S]/i; 語法： 1、斷言： (?=.*[

vue + elementUi 實現密碼校驗

<el-form-item v-else label="密碼" label-width='150px' prop="password"> <el-input :placeholder="info.password" v-model="info.pas

spring註解式引數校驗

一般入參我們都會轉為vo物件。那麼直接在物件的屬性上註解即可。其實spring用的是hibernate的validator. 步驟 1.配置spring.xml <mvc:annotation-driven /> 2.配置

redis開啟和禁用登陸密碼校驗

1. 開啟登陸密碼校驗在redis-cli命令列工具中執行如下命令: config set requirepass yourpassword 2. 禁用登陸密碼校驗同上，需要在redis

Android 密碼校驗，字串中必須包含字母或者數字

下面是Util類的內容提供了三種密碼規則的校驗和一個判斷輸入型別的方法 /** * Created by zhangshun on 2016/8/18. */ public class PwdCheckUtil { /** * 規則1：至少包含大小寫

springBoot整合CXF並實現使用者名稱密碼校驗

話不多說直接上程式碼:準備工作:建立springBoot專案webservice_server建立springBoot專案webservice_client分別新增CXF的依賴: <dependency>

spring 自定義引數校驗

Spring bean校驗 public abstract class GenericValidator { public abstract void validate(ProceedingJoinPoint pjp); protected

使用spring jdbcTemplate 批量查詢校驗【支援50萬資料】使用JDBC不會造成記憶體溢位

1.使用spring jdbcTemplate做批量校驗（支援50萬資料） public void mxCheck(String tableName,Map<String,String> checkMap) {

Spring Boot的引數校驗

閱讀本文需要Spring Boot、Java註解等背景知識背景我們通常需要驗證引數是否非法, 比如長度、非空、列舉範圍等. 二逼青年的做法是寫一堆if進行校驗 if (id == null || id <= 0) {

spring boot 自定義校驗註解

建立註解 import cn.wyj.validation.SpecificIntegerConstraintValidator; import javax.validation.Constrai

賬戶密碼加密及密碼校驗

package com.framework.core.lang; import java.security.MessageDigest; import org.apache.commons.codec.binary.Base64; /** * 加密、密碼判斷 *

用servlet進行用戶名和密碼校驗

encoding 修改修改編碼 generated ack std 前臺如果 utf-8 目錄結構：一、在Email_Login.jsp中，創建表單當輸入賬號和密碼，提交到${pageContext.request.contextPath

用servlet行用戶名和密碼校驗

normal hold ioe alt ansi not con response private 登錄界面驗證 <!DOCTYPE html> <html> <head>

Spring方法級別資料校驗：@Validated + MethodValidationPostProcessor

每篇一句在《深度工作》中作者提出這麼一個公式：高質量產出=時間*專注度。所以高質量的產出不是靠時間熬出來的，而是效率為王相關閱讀【小家Java】深入瞭解資料校驗：Java Bean Validation 2.0（JSR303、JSR349、JSR380）Hibernate-Validation 6.

使用者註冊及密碼校驗 BCrypt

使用者註冊的加密方式除了MD5 還有更安全的方式用 BCrypt 前提： <dependency>

shiro + mybatis+ spring (只用shiro的密碼校驗和併發剔除)——不用許可權之類

相關推薦