文章目錄

• token類
• 自定義realm
• 自定義的jwtFilter用于訪問攔截：
• shiroconfig
• controller
• vo對象
• 測試

jwt和shiro框架就不多介紹了，直接上實例代碼吧。目前測試可正常登錄、獲得用戶角色、訪問接口時根據@requireRoles進行攔截。

token類

import org.apache.shiro.authc.AuthenticationToken; //一般的登陸只需要校驗賬號和密碼兩個要素,默認的UsernamePasswordToken就能滿足需求 //這個就類似UsernamePasswordToken //在JwtRealm中的授權部分，可以使用JwtUtil.decode(jwt).get("username")獲取到username，使用username去數據庫中查找到對應的權限，然后將權限賦值給這個用戶就可以實現權限的認證了public class JWTToken implements AuthenticationToken {private String token;public JWTToken(String token){this.token = token;}@Overridepublic Object getPrincipal() {return token;}@Overridepublic Object getCredentials() {return token;} }

自定義realm

@Slf4j public class JwtRealm extends AuthorizingRealm {/** 多重寫一個support* 標識這個Realm是專門用來驗證JwtToken* 不負責驗證其他的token（UsernamePasswordToken）* */@Overridepublic boolean supports(AuthenticationToken token) {//這個token就是從過濾器中傳入的jwtTokenreturn token instanceof JWTToken;}@Autowiredprivate IInowRoleUserService roleUserService;@Autowiredprivate IInowRoleService roleService;@Autowiredprivate IInowUserService userService;//授權@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {log.info("=========執行了授權===========================");InowUser userName = (InowUser) principalCollection.getPrimaryPrincipal();InowUser inowUser = userService.selectOneByName(userName.getUserName());SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();final InowRoleUser roleuser = roleUserService.getOne(new LambdaQueryWrapper<InowRoleUser>().eq(InowRoleUser::getUserId, inowUser.getUserId()));List<String> inowRoleList = new ArrayList<>();inowRoleList.add(roleService.getOne(new LambdaQueryWrapper<InowRole>().eq(InowRole::getId,roleuser.getRoleId())).getRoleName());simpleAuthorizationInfo.addRoles(inowRoleList);//添加用戶角色，用于@requireroles注解return simpleAuthorizationInfo;}//認證// 這里的 token是從 JWTFilter 的 executeLogin 方法傳遞過來的（請求頭的token)// 只要調用了subject.login(token)方法，就會進入到realm的doGetAuthenticationInfo內。@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken auth) throws AuthenticationException {String token = (String)auth.getCredentials();log.info("從auth獲得的Token"+token);String userName = JWTUtil.getUsername(token);//用戶不存在（這個在登錄時不會進入，只有在token校驗時才有可能進入）if(userName == null){throw new UnknownAccountException();}InowUser user = userService.selectOneByName(userName);if(Objects.isNull(user)){throw new UnknownAccountException();}String salt = "666666"; //自己隨便寫的一個加密鹽Md5Hash md5Hash = new Md5Hash(user.getUserId(), salt, 1024); if(!JWTUtil.verify(token,userName, md5Hash.toHex()))//學號當做用戶密碼{throw new IncorrectCredentialsException();}//toke過期if(JWTUtil.isExpire(token)){throw new ExpiredCredentialsException();}return new SimpleAuthenticationInfo(user, token, getName());}}

自定義的jwtFilter用于訪問攔截：

@Slf4j //@Component("jwtFilter") //去掉@Component注解，讓filter不交給springbean管理，因為這會導致shiro內置的anon過濾器失效，具體原因還未找出 public class JwtFilter extends BasicHttpAuthenticationFilter {/*** 進行token的驗證*/@Overrideprotected boolean executeLogin(ServletRequest request, ServletResponse response) throws Exception {//在請求頭中獲取tokenHttpServletRequest httpServletRequest = (HttpServletRequest) request;String token = httpServletRequest.getHeader("Authorization"); //前端命名Authorization//token不存在if(token == null || "".equals(token)){ Result result = new Result();result.setCode(400);result.setMsg("token為空，無法訪問");out(response,result);return false;}//token存在，進行驗證JWTToken jwtToken = new JWTToken(token);try {SecurityUtils.getSubject().login(jwtToken); //通過subject，提交給myRealm進行登錄驗證return true;} catch (ExpiredCredentialsException e){Result result = new Result();result.setCode(400);result.setMsg("登錄已經過期"); out(response,result);e.printStackTrace();return false;} catch (ShiroException e){// 其他情況拋出的異常統一處理，由于先前是登錄進去的了，所以都可以看成是token被偽造造成的Result res = new Result();res.setMsg("無效token");out(response,res);e.printStackTrace();return false;}}/*** json形式返回結果token驗證失敗信息，無需轉發*/private void out(ServletResponse response, Result res) throws IOException {HttpServletResponse httpServletResponse = WebUtils.toHttp(response);ObjectMapper mapper = new ObjectMapper();String jsonRes = mapper.writeValueAsString(res);httpServletResponse.setCharacterEncoding("UTF-8");httpServletResponse.setContentType("application/json; charset=utf-8");httpServletResponse.getOutputStream().write(jsonRes.getBytes());}/*** 過濾器攔截請求的入口方法*/@Overrideprotected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {try {return executeLogin(request, response); //token驗證} catch (Exception e) {e.printStackTrace();return false;}}/*** isAccessAllowed()方法返回false，即認證不通過時進入onAccessDenied方法*/ // @Override // protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception { // return super.onAccessDenied(request, response); // }/*** token認證executeLogin成功后，進入此方法，可以進行token更新過期時間*/ // @Override // protected boolean onLoginSuccess(AuthenticationToken token, Subject subject, ServletRequest request, ServletResponse response) throws Exception {// } }

shiroconfig

@Configuration public class ShiroConfig {public logOutFilter mylogoutFilter(){logOutFilter MylogoutFilter = new logOutFilter();MylogoutFilter.setLoginUrl("login");//設置退出后重定向的跳轉地址return MylogoutFilter;}/*** 注入Shiro過濾器鏈配置* 注入安全服務配置* 注入自定義jwt過濾器**/@Beanpublic ShiroFilterFactoryBean shiroFilterFactoryBean(@Autowired @Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager,@Autowired ShiroFilterChainDefinition definition){JwtFilter jwtFilter = new JwtFilter();ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();bean.setSecurityManager(defaultWebSecurityManager);//設置安全管理器//可以添加shiro的內置過濾器//anon:無需認證就可以訪問 authc:必須認證了才能用 oerms:擁有對某個資源的權限才能訪問bean.setLoginUrl("/login");//設置登錄路徑//bean.setUnauthorizedUrl("/unlogin");Map<String, Filter> filterMap = new HashMap<>();// 注銷成功，則跳轉到指定頁面filterMap.put("logout", mylogoutFilter());filterMap.put("anon", new AnonymousFilter());filterMap.put("jwt",jwtFilter); bean.setFilters(filterMap);bean.setFilterChainDefinitionMap(definition.getFilterChainMap());return bean;}/*** 自定義jwt過濾器** @return*///@Beanpublic JwtFilter jwtFilter(){return new JwtFilter();}/*** 定義攔截器鏈，所有請求都經過自定義的jwt過濾器** @return*/@Beanpublic ShiroFilterChainDefinition shiroFilterChainDefinition(){DefaultShiroFilterChainDefinition definition = new DefaultShiroFilterChainDefinition();Map<String,String> map = new LinkedHashMap<>();map.put("/login","anon");map.put("/swagger-ui.html","anon");map.put("/doc.html","anon");map.put("/**","jwt");definition.addPathDefinitions(map);return definition;}/*** 自定義Realm** @return*/@Beanpublic JwtRealm myUserRealm(){JwtRealm userRealm = new JwtRealm();return userRealm;}/*** 開啟認證授權注解** @param securityManager* @return*/@Beanpublic AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(@Autowired DefaultWebSecurityManager securityManager){AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);return authorizationAttributeSourceAdvisor;}@Beanpublic LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {return new LifecycleBeanPostProcessor();}@Bean@DependsOn("lifecycleBeanPostProcessor")//DefaultAdvisorAutoProxyCreator://BeanPostProcessor實現，它根據當前BeanFactory中的所有候選Advisor創建 AOP 代理。public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();// 強制指定注解的底層實現使用 cglib 方案，防止重復代理和可能引起代理出錯的問題defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);return defaultAdvisorAutoProxyCreator;}/*** 配置安全服務機制，注入自定義Realm，關閉了shiro的默認session機制** @param* @return*//** 關閉shiro自帶的session，詳情見文檔* http://shiro.apache.org/session-management.html#SessionManagement-StatelessApplications%28Sessionless%29*//** a. 告訴shiro不要使用默認的DefaultSubject創建對象，因為不能創建Session* */@Beanpublic SubjectFactory subjectFactory() {return new JwtDefaultSubjectFactory();}@Bean("securityManager")public DefaultWebSecurityManager securityManager(@Autowired JwtRealm myRealm) {DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();securityManager.setRealm(myRealm);// 關閉 ShiroDAO 功能DefaultSubjectDAO subjectDAO = new DefaultSubjectDAO();DefaultSessionStorageEvaluator defaultSessionStorageEvaluator = new DefaultSessionStorageEvaluator();// 不需要將 Shiro Session 中的東西存到任何地方（包括 Http Session 中）defaultSessionStorageEvaluator.setSessionStorageEnabled(false);subjectDAO.setSessionStorageEvaluator(defaultSessionStorageEvaluator);securityManager.setSubjectDAO(subjectDAO);//禁止Subject的getSession方法securityManager.setSubjectFactory(subjectFactory());return securityManager;}}

controller

@ApiOperation("登錄接口")@GetMappingpublic Result userLogin(@ApiParam(name="userId",value="用戶學號",required=true)@RequestParam(value = "userId",required = true)String userId,@ApiParam(name="userName",value="用戶姓名",required=true)@RequestParam(value = "userName",required = true)String userName) {// 1、獲取Subject實例對象//根據用戶名獲取正確用戶信息InowUser user = userService.selectOneByName(userName);if(user == null){return Result.fail("無效用戶，請檢查您的姓名");}//鹽 + 輸入的密碼(注意不是用戶的正確密碼) + 1024次散列，作為token生成的密鑰String salt = "666666";Md5Hash md5Hash = new Md5Hash(userId, salt, 1024);//生成token字符串String token = JWTUtil.getJwtToken(userName, md5Hash.toHex()); //toHex轉換成16進制，32為字符log.info("從controller生成的Token"+token);JWTToken jwtToken = new JWTToken(token);Subject currentUser = SecurityUtils.getSubject();// 4、認證try {currentUser.login(jwtToken);// 傳到Realm類中的方法進行認證 進入 AuthenticationInfo方法//session.setAttribute("username", userName);InowUser nowUser = (InowUser) currentUser.getPrincipal();InowUserVo userVo = new InowUserVo();BeanUtils.copyProperties(nowUser,userVo);userVo.setToken(token);return Result.success(userVo);}catch (AuthenticationException e) {String msg = null;if (StringUtils.isNotEmpty(e.getMessage())) {msg = e.getMessage();}return Result.fail("用戶名與學號不匹配！");}// }}

vo對象

在vo中放了token屬性的成員屬性

@Data @JsonInclude(JsonInclude.Include.NON_EMPTY) public class InowUserVo implements Serializable {private static final long serialVersionUID = 1L;/** 學號或者教師id */@NotBlank(message = "id不能為空！")@ApiModelProperty(value="用戶id，學號或教師號",name="id",example="2020214283")private String userId;private Integer id;/** 姓名 */@NotBlank(message = "姓名不能為空！")@ApiModelProperty(value="用戶姓名",name="userName",example="張三")private String userName;/** 學院 */@ApiModelProperty(value="用戶學院",name="userAcademy",example="計算機與信息學院")private String userAcademy;/** 微信id */@ApiModelProperty(value="微信id",name="wechatId",example="微信id")private Long wechatId;@ApiModelProperty(value="性別",name="userSex",example="1男，2女")private byte userSex;@ApiModelProperty(value="最后登陸時間",name="loginDate")private Date loginDate;@ApiModelProperty(value="用戶角色",name="roleName")private String roleName; private String token; }

測試

登錄接口：

訪問一個標有注解@RequireRoles（“admin”）的方法：
在不加token時返回結果：

加一個沒有Admin角色的Token訪問結果：

用有admin角色的用戶token訪問結果：

總結

以上是生活随笔為你收集整理的shiro+jwt进行认证和授权的解决方案代码实例的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。