1、Durid

1.1 简介

Java程序很大一部分要操作数据库，为了提高性能操作数据库的时候，又不得不使用数据库连接池。

Druid 是阿里巴巴开源平台上一个数据库连接池实现，结合了 C3P0、DBCP 等 DB 池的优点，同时加入了日志监控。

Druid 可以很好的监控 DB 池连接和 SQL 的执行情况，天生就是针对监控而生的 DB 连接池。

Druid已经在阿里巴巴部署了超过600个应用，经过一年多生产环境大规模部署的严苛考验。

Spring Boot 2.0 以上默认使用 Hikari 数据源，可以说 Hikari 与 Driud 都是当前 Java Web 上最优秀的数据源，我们来重点介绍 Spring Boot 如何集成 Druid 数据源，如何实现数据库监控。

Github地址：https://github.com/alibaba/druid/

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

1.2 依赖

<!-- druid begin -->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>druid</artifactId>
    <version>1.2.8</version>
</dependency>
<!-- druid end -->
<!-- log4j begin -->
<dependency>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.17</version>
</dependency>
<!-- log4j begin -->

1.3 配置

1.3.1 application.yml

# 端口
server:
  port: 9603
# 服务名
spring:
  application:
    name: kgcmall96-user
  # 数据源配置
  datasource:
    driver-class-name: com.mysql.cj.jdbc.Driver
    url: jdbc:mysql://localhost:3306/kh96_alibaba_kgcmalldb?useUnicode=true&characterEncoding=utf-8&useSSL=false&serverTimezone=GMT
    username: root
    password: root
    #2、切换数据源；之前已经说过 Spring Boot 2.0 以上默认使用 com.zaxxer.hikari.HikariDataSource 数据源，但可以 通过 spring.datasource.type 指定数据源。
    # 指定数据源类型
    type: com.alibaba.druid.pool.DruidDataSource
    # 数据源其他配置
    # 初始化时建立物理连接的个数。初始化发生在显示调用init方法，或者第一次getConnection时
    initialSize: 5
    # 最小连接池数量
    minIdle: 5
    # 最大连接池数量
    maxActive: 20
    # 获取连接时最大等待时间，单位毫秒。
    maxWait: 60000
    # 配置间隔多久才进行一次检测，检测需要关闭的空闲连接，单位是毫秒
    timeBetweenEvictionRunsMillis: 60000
    # 配置一个连接在池中最小生存的时间，单位是毫秒
    minEvictableIdleTimeMillis: 300000
    # 用来检测连接是否有效的sql，要求是一个查询语句。如果validationQuery为null，testOnBorrow、testOnReturn、testWhileIdle都不会其作用。
    validationQuery: SELECT 1 FROM DUAL
    # 建议配置为true，不影响性能，并且保证安全性。申请连接的时候检测，如果空闲时间大于timeBetweenEvictionRunsMillis，执行validationQuery检测连接是否有效
    testWhileIdle: true
    # 申请连接时执行validationQuery检测连接是否有效，做了这个配置会降低性能。
    testOnBorrow: false
    # 归还连接时执行validationQuery检测连接是否有效，做了这个配置会降低性能
    testOnReturn: false
    # 是否缓存preparedStatement，也就是PSCache。PSCache对支持游标的数据库性能提升巨大，比如说oracle。在mysql下建议关闭
    poolPreparedStatements: false
    maxPoolPreparedStatementPerConnectionSize: 20
    # 合并多个DruidDataSource的监控数据
    useGlobalDataSourceStat: true
    # 配置监控统计拦截的filters，去掉后监控界面sql无法统计
    # 属性性类型是字符串，通过别名的方式配置扩展插件，常用的插件有：监控统计用的filter:stat日志用的filter:log4j防御sql注入的filter:wall
    filters: stat,wall,log4j
    # 通过connectProperties属性来打开mergeSql功能；慢SQL记录
    connectionProperties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=500
  # jpa配置
  jpa:
    hibernate:
      ddl-auto: update
    show-sql: true

1.3.2 log4j.properties

在网上随便搜的一个；

log4j.rootLogger=DEBUG, stdout
# Console output...
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%5p [%t] - %m%n

1.4 Druid数据源配置类

/**
 * @author : huayu
 * @date   : 29/11/2022
 * @param  : 
 * @return : 
 * @description :  Druid数据源配置类
 */
@Configuration
public class DruidConfig {
    @Bean
    @ConfigurationProperties(prefix = "spring.datasource")
    public DataSource dataSource() {
        return new DruidDataSource();
    }
    /**
     * 配置后台管理
     */
    @Bean
    public ServletRegistrationBean statViewServlet() {
        ServletRegistrationBean bean = new ServletRegistrationBean(new StatViewServlet(), "/druid/*");
        // 初始化参数
        Map<String, String> initParams = new HashMap<>();
        initParams.put("loginUsername", "admin");
        initParams.put("loginPassword", "123456");
        // 是否允许访问
        initParams.put("allow", "");
        bean.setInitParameters(initParams);
        return bean;
    }
    /**
     * 配置web监控的过滤器
     */
    @Bean
    public FilterRegistrationBean webStatFilter() {
        FilterRegistrationBean bean = new FilterRegistrationBean();
        bean.setFilter(new WebStatFilter());
        // 初始化参数
        Map<String, String> initParams = new HashMap<>();
        // 排除过滤，静态文件等
        initParams.put("exclusions", "*.css,*.js,/druid/*");
        bean.setInitParameters(initParams);
        bean.setUrlPatterns(Arrays.asList("/*"));
        return bean;
    }
}

1.5 测试

测试代码不在赘述，就简单写一个测试请求就好；

1.5.1 登录

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

1.5.2 测试请求

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2、SpringSecurity

2.0 认识SpringSecurity

Spring Security 是针对Spring项目的安全框架，也是Spring Boot底层安全模块默认的技术选型，他可以实现强大的Web安全控制，对于安全控制，我们仅需要引入 spring-boot-starter-security 模块，进行少量的配置，即可实现强大的安全管理！

记住几个类：

  • WebSecurityConfigurerAdapter：自定义Security策略
  • AuthenticationManagerBuilder：自定义认证策略
  • @EnableWebSecurity：开启WebSecurity模式

Spring Security的两个主要目标是 “认证” 和 “授权”（访问控制）。

“认证”（Authentication）

身份验证是关于验证您的凭据，如用户名/用户ID和密码，以验证您的身份。

身份验证通常通过用户名和密码完成，有时与身份验证因素结合使用。

“授权” （Authorization）

授权发生在系统成功验证您的身份后，最终会授予您访问资源（如信息，文件，数据库，资金，位置，几乎任何内容）的完全权限。

这个概念是通用的，而不是只在Spring Security 中存在。

2.1 项目介绍

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.1 依赖

<!--  thymeleaf  -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-thymeleaf</artifactId>
</dependency>
<!--  security -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<!--   security-thymeleaf整合包  -->
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-springsecurity5</artifactId>
    <version>3.0.4.RELEASE</version>
</dependency>

2.2 application.yml

# 关闭模板缓存
spring:
  thymeleaf:
    cache: false

2.3 html

2.3.1 1.html

创建这几个文件；

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

1.html（这几个html的代码都是一样的）

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <title>首页</title>
    <!--semantic-ui-->
    <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
    <link th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
</head>
<body>
<!--主容器-->
<div class="ui container">
    <div th:replace="~{index::nav-menu}"></div>
    <div class="ui segment">
        <h3>Level-1-1</h3>
    </div>
</div>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/semantic.min.js}"></script>
</body>
</html>

2.3.2 login.html

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <title>登录</title>
    <!--semantic-ui-->
    <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
</head>
<body>
<!--主容器-->
<div class="ui container">
    <div class="ui segment">
        <div>
            <h1 class="header">登录</h1>
        </div>
        <div class="ui placeholder segment">
            <div class="ui column very relaxed stackable grid">
                <div class="column">
                    <div class="ui form">
                        <form th:action="@{/login}" method="post">
                            <div class="field">
                                <label>Username</label>
                                <div class="ui left icon input">
                                    <input type="text" placeholder="Username" name="username">
                                    <i class="user icon"></i>
                                </div>
                            </div>
                            <div class="field">
                                <label>Password</label>
                                <div class="ui left icon input">
                                    <input type="password" name="password">
                                    <i class="lock icon"></i>
                                </div>
                            </div>
                            <div class="field">
                                <input type="checkbox" name="remember"> 记住我
                            </div>
                            <input type="submit" class="ui blue submit button"/>
                        </form>
                    </div>
                </div>
            </div>
        </div>
        <div>
            <div class="ui label">
                </i>注册
            </div>
            <br><br>
            <small>blog.kuangstudy.com</small>
        </div>
        <div class="ui segment">
            <h3>Spring Security Study by 秦疆</h3>
        </div>
    </div>
</div>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/semantic.min.js}"></script>
</body>
</html>

2.3.3 index.html

<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.thymeleaf.org"
      xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
    <title>首页</title>
    <!--semantic-ui-->
    <link href="https://cdn.bootcss.com/semantic-ui/2.4.1/semantic.min.css" rel="stylesheet">
    <link th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/css/qinstyle.css}" rel="stylesheet">
</head>
<body>
<!--主容器-->
<div class="ui container">
    <div class="ui segment" id="index-header-nav" th:fragment="nav-menu">
        <div class="ui secondary menu">
            <a class="item"  th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/index}">首页</a>
            <!--登录注销-->
            <div class="right menu">
                <!--  如果未登录  用户名，注销-->
                <div sec:authorize="!isAuthenticated()">
                    <a class="item" th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/toLogin}">
                        <i class="address card icon"></i> 登录
                    </a>
                </div>
                <!--如果登录了: 用户名 注销-->
                <div sec:authorize="isAuthenticated()">
                    <a class="item">
                        用户名： <span sec:authentication="name"></span>
                        角色： <span sec:authentication="principal.authorities"></span>
                    </a>
                    <a class="item" th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/logout}">
                        <i class="sign-out icon"></i> 注销
                    </a>
                </div>
                <!--已登录
                <a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/usr/toUserCenter}">
                    <i class="address card icon"></i> admin
                </a>
                -->
            </div>
        </div>
    </div>
    <div class="ui segment">
        <h3>Spring Security Study by 秦疆</h3>
    </div>
    <div>
        <br>
        <div class="ui three column stackable grid">
            <div class="column" sec:authorize="hasRole('vip1')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 1</h5>
                            <hr>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level1/1}"><i class="bullhorn icon"></i> Level-1-1</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level1/2}"><i class="bullhorn icon"></i> Level-1-2</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level1/3}"><i class="bullhorn icon"></i> Level-1-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
            <div class="column" sec:authorize="hasRole('vip3')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 2</h5>
                            <hr>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level2/1}"><i class="bullhorn icon"></i> Level-2-1</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level2/2}"><i class="bullhorn icon"></i> Level-2-2</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level2/3}"><i class="bullhorn icon"></i> Level-2-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
            <div class="column" sec:authorize="hasRole('vip3')">
                <div class="ui raised segment">
                    <div class="ui">
                        <div class="content">
                            <h5 class="content">Level 3</h5>
                            <hr>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level3/1}"><i class="bullhorn icon"></i> Level-3-1</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level3/2}"><i class="bullhorn icon"></i> Level-3-2</a></div>
                            <div><a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/level3/3}"><i class="bullhorn icon"></i> Level-3-3</a></div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/jquery-3.1.1.min.js}"></script>
<script th:src="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/qinjiang/js/semantic.min.js}"></script>
</body>
</html>

2.4 RouterController

@Controller
public class RouterController {
    //首页
    @RequestMapping({"/","/index"})
    public String index(){
        return "index";
    }
    //登录
    @RequestMapping("/toLogin")
    public String toLogin(){
        return "views/login";
    }
    //level1 权限才可以访问
    @RequestMapping("/level1/{id}")
    public String leave1(@PathVariable("id") int id){
        return "views/level1/"+id;
    }
    //level2 权限才可以访问
    @RequestMapping("/level2/{id}")
    public String leave2(@PathVariable("id") int id){
        return "views/level2/"+id;
    }
    //level3 权限才可以访问
    @RequestMapping("/level3/{id}")
    public String leave3(@PathVariable("id") int id){
        return "views/level3/"+id;
    }
}

2.5 SecurityConfig

//AOP : 拦截器
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    //授权
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        //首页所有人可以访问，功能页只有对应权限的人才能访问
        //请求授权的规则
        http.authorizeRequests()
                .antMatchers("/").permitAll()  //所有的人可以访问
                .antMatchers("/level1/**").hasRole("vip1")   //有相对的权限才可以访问
                .antMatchers("/level2/**").hasRole("vip2")
                .antMatchers("/level3/**").hasRole("vip3");
        //没有权限默认会到登录页面
        //  /login
        http.formLogin()
                .loginPage("/toLogin") //走的登录页面
                .usernameParameter("username").passwordParameter("password") //默认的帮我们写的登录验真参数为username,password,通过这个可以改变参数名字，例如user,pwd
                .loginProcessingUrl("/login");  //真正的登录页面
        //防止网站工具： get post
        http.csrf().disable(); //关闭csrf功能 防止攻击  登录失败可能存在的原因
        //注销，开启了注销功能,跳到首页
        http.logout()
                .deleteCookies("remove")  //移除cookies
                .invalidateHttpSession(true)  //清除session
                .logoutSuccessUrl("/");
        //开启记住我功能
        http.rememberMe()  //默认保存两周  //这些直接开启的都是自动配置里面的那个登录页面，只需要开启就可以；
        .rememberMeParameter("remember"); //自定义接收前端的参数  //这些需要自定义参数的都是我们自己写的登录页面
    }
    //认证 ， springboot 2.1.x可以使用
    //密码编码： PasswowrdEncoder   报错： 密码前面直接加{noop}，就可以了 password("{noop}123456")
    //在Spring Secutiry 5.0+ 新增了很多的加密方法
    //定义认证规则
    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        //这些数据正常应该从数据库中读
        auth
//                .jdbcAuthentication() //从数据库中读数据
                .inMemoryAuthentication().passwordEncoder(new BCryptPasswordEncoder())
                .withUser("kuangshen").password(new BCryptPasswordEncoder().encode("123456")).roles("vip2","vip3")
                .and()
                .withUser("root").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1","vip2","vip3")
                .and()
                .withUser("guest").password(new BCryptPasswordEncoder().encode("123456")).roles("vip1");
    }
}

2.6 测试

2.6.1 不同权限的用户登录

2.6.1.1 只有 vip1 权限

登录：guest 用户

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

登录成功：

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.6.1.2 只有 vip1， vip2 权限

登录：kuangshen 用户

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

登陆成功：

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.6.1.3 只有 vip1， vip2， vip3 权限

登录：root 用户

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

登陆成功

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.6.2 记住我

2.6.2.1 登录

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.6.2.2 登录成功

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

2.6.2.3 关闭浏览器，重新访问 http://localhost:8080/

登录成功

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

检查Cookie

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

参考博客地址：https://mp.weixin.qq.com/s/FLdC-24_pP8l5D-i7kEwcg

视频地址：https://www.bilibili.com/video/BV1PE411i7CV/?p=34

3、Shiro

3.1 helloShiro快速开始

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.1.1 依赖

<!-- shiro-core  -->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.7.1</version>
</dependency>
<!-- configure logging -->
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
    <version>1.7.21</version>
</dependency>
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>slf4j-log4j12</artifactId>
    <version>1.7.21</version>
</dependency>
<dependency>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.17</version>
</dependency>

3.1.2 log4j.properties

log4j.rootLogger=INFO, stdout
log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n
# General Apache libraries
log4j.logger.org.apache=WARN
# Spring
log4j.logger.org.springframework=WARN
# Default Shiro logging
log4j.logger.org.apache.shiro=INFO
# Disable verbose logging
log4j.logger.org.apache.shiro.util.ThreadContext=WARN
log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

3.1.3 shiro.ini

[users]
# user 'root' with password 'secret' and the 'admin' role
root = secret, admin
# user 'guest' with the password 'guest' and the 'guest' role
guest = guest, guest
# user 'presidentskroob' with password '12345' ("That's the same combination on
# my luggage!!!" ;)), and role 'president'
presidentskroob = 12345, president
# user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz'
darkhelmet = ludicrousspeed, darklord, schwartz
# user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz'
lonestarr = vespa, goodguy, schwartz
# -----------------------------------------------------------------------------
# Roles with assigned permissions
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
# -----------------------------------------------------------------------------
[roles]
# 'admin' role has all permissions, indicated by the wildcard '*'
admin = *
# The 'schwartz' role can do anything (*) with any lightsaber:
schwartz = lightsaber:*
# The 'goodguy' role is allowed to 'drive' (action) the winnebago (type) with
# license plate 'eagle5' (instance specific id)
goodguy = winnebago:drive:eagle5

3.1.4 Quickstart

/**
 * Simple Quickstart application showing how to use Shiro's API.
 *
 * @since 0.9 RC2
 */
public class Quickstart {
    private static final transient Logger log = LoggerFactory.getLogger(Quickstart.class);
    public static void main(String[] args) {
        Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
        SecurityManager securityManager = factory.getInstance();
        SecurityUtils.setSecurityManager(securityManager);
        // Now that a simple Shiro environment is set up, let's see what you can do:
        // get the currently executing user:
        //获取当前的用户对象 Subject
        Subject currentUser = SecurityUtils.getSubject();
        // Do some stuff with a Session (no need for a web or EJB container!!!)
        //通过当前用户拿到session
        Session session = currentUser.getSession();
        session.setAttribute("someKey", "aValue");
        String value = (String) session.getAttribute("someKey");
        if (value.equals("aValue")) {
            log.info("Retrieved the correct value! [" + value + "]");
        }
        //判断当前用户是否被认证
        //Token:没有获取,直接设置令牌
        if (!currentUser.isAuthenticated()) {
            UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
            token.setRememberMe(true);//设置记住我
            try {
                currentUser.login(token);//执行登录操作
            } catch (UnknownAccountException uae) {
                log.info("There is no user with username of " + token.getPrincipal());
            } catch (IncorrectCredentialsException ice) {
                log.info("Password for account " + token.getPrincipal() + " was incorrect!");
            } catch (LockedAccountException lae) {
                log.info("The account for username " + token.getPrincipal() + " is locked.  " +
                        "Please contact your administrator to unlock it.");
            }
            // ... catch more exceptions here (maybe custom ones specific to your application?
            catch (AuthenticationException ae) {
                //unexpected condition?  error?
            }
        }
        //say who they are:
        //print their identifying principal (in this case, a username):
        log.info("User [" + currentUser.getPrincipal() + "] logged in successfully.");
        //test a role:
        if (currentUser.hasRole("schwartz")) {
            log.info("May the Schwartz be with you!");
        } else {
            log.info("Hello, mere mortal.");
        }
        //粗粒度
        //test a typed permission (not instance-level)
        if (currentUser.isPermitted("lightsaber:wield")) {
            log.info("You may use a lightsaber ring.  Use it wisely.");
        } else {
            log.info("Sorry, lightsaber rings are for schwartz masters only.");
        }
        //细粒度
        //a (very powerful) Instance Level permission:
        if (currentUser.isPermitted("winnebago:drive:eagle5")) {
            log.info("You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  " +
                    "Here are the keys - have fun!");
        } else {
            log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");
        }
        //注销
        //all done - log out!
        currentUser.logout();
        //结束
        System.exit(0);
    }
}

3.1.5 测试

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2 整合SpringBoot,MyBatis,Thymeleaf

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2.1 依赖

<!--
    Subject 用户
    SecurityManger 管理所有用户和
    Realm 连接数据库
 -->
<!--shiro整合包-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.1</version>
</dependency>
<!--        thymeleaf模板  -->
<dependency>
    <groupId>org.thymeleaf</groupId>
    <artifactId>thymeleaf-spring5</artifactId>
</dependency>
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-java8time</artifactId>
</dependency>
<!--    log4j     -->
<dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>slf4j-log4j12</artifactId>
    <version>1.7.21</version>
</dependency>
<dependency>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.17</version>
</dependency>
<!-- druid -->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>druid</artifactId>
    <version>1.1.21</version>
</dependency>
<!-- mysql-connector-java -->
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <scope>runtime</scope>
</dependency>
<!-- spring-boot-starter-jdbc -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-jdbc</artifactId>
</dependency>
<!-- mybatis-spring-boot-starter -->
<dependency>
    <groupId>org.mybatis.spring.boot</groupId>
    <artifactId>mybatis-spring-boot-starter</artifactId>
    <version>2.1.4</version>
</dependency>
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <version>1.18.22</version>
</dependency>
<!--  shiro-thymeleaf 整合-->
<!--导入thymeleaf依赖-->
<dependency>
    <groupId>org.thymeleaf</groupId>
    <artifactId>thymeleaf-spring5</artifactId>
    <version>3.0.11.RELEASE</version>
</dependency>
<dependency>
    <groupId>org.thymeleaf.extras</groupId>
    <artifactId>thymeleaf-extras-java8time</artifactId>
    <version>3.0.4.RELEASE</version>
</dependency>
<!--shiro-thymeleaf整合-->
<dependency>
    <groupId>com.github.theborakompanioni</groupId>
    <artifactId>thymeleaf-extras-shiro</artifactId>
    <version>2.0.0</version>
</dependency>

3.2.2 application.yml

spring:
  datasource:
    username: root
    password: 17585273765
    url: jdbc:mysql://localhost:3306/mybatis?serverTimezone=GMT&useUnicode=true&characterEncoding=utf-8
    driver-class-name: com.mysql.cj.jdbc.Driver
    type: com.alibaba.druid.pool.DruidDataSource
    #Spring Boot 默认是不注入这些属性值的，需要自己绑定
    #druid 数据源专有配置
    initialSize: 5
    minIdle: 5
    maxActive: 20
    maxWait: 60000
    timeBetweenEvictionRunsMillis: 60000
    minEvictableIdleTimeMillis: 300000
    validationQuery: SELECT 1 FROM DUAL
    testWhileIdle: true
    testOnBorrow: false
    testOnReturn: false
    poolPreparedStatements: true
    #配置监控统计拦截的filters，stat:监控统计、log4j：日志记录、wall：防御sql注入
    #如果允许时报错  java.lang.ClassNotFoundException: org.apache.log4j.Priority
    #则导入 log4j 依赖即可，Maven 地址：https://mvnrepository.com/artifact/log4j/log4j
    filters: stat,wall,log4j
    maxPoolPreparedStatementPerConnectionSize: 20
    useGlobalDataSourceStat: true
    connectionProperties: druid.stat.mergeSql=true;druid.stat.slowSqlMillis=500
  thymeleaf:
    cache: false

3.2.3 静态资源

3.2.3.1 login.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.themeleaf.org">
<head>
    <meta charset="UTF-8">
    <title>登录页面</title>
</head>
<body>
<h1>登录</h1>
<p th:text="${msg}"></p>
<form th:action="@{/login}">
    <p>用户名： <input type="text" name="username"></p>
    <p>密码： <input type="text" name="password"></p>
    <p><input type="submit"></p>
</form>
</body>
</html>
3.2.3.2 index.html
<!DOCTYPE html>
<html lang="en" xmlns:th="http://www.themeleaf.org"
      xmlns:shiro="http://www.thymeleaf.org/thymeleaf-extras-shiro" >
<head>
    <meta charset="UTF-8">
    <title>首页</title>
</head>
<body>
<h1>首页</h1>
<p th:if="${session.loginUser} == null" >
    <a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/toLogin}">登录</a>
</p>
<p th:text="${msg}"></p>
<hr>
<div shiro:hasPermission="user:add">
    <a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/user/add}">add</a>
</div>
<div shiro:hasPermission="user:update">
    <a th:href="https://www.cnblogs.com/xiaoqigui/archive/2022/12/03/@{/user/update}">update</a>
</div>
</body>
</html>
3.2.3.3 add.html
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>添加页面</title>
</head>
<body>
<h1>add</h1>
</body>
</html>
3.2.3.4 update.html
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>修改页面</title>
</head>
<body>
<h1>update</h1>
</body>
</html>

3.2.4 根据用户名和密码查询用户信息

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2.5 shiro配置信息

3.2.5.1 UserRealm 认证
//自定义的 UserRealm  extends AuthorizingRealm
public class UserRealm extends AuthorizingRealm {
    @Autowired
    UserService userService;
    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了=>授权doGetAuthorizationInfo");
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //info.addStringPermission("user:add");  //给用户添加add权限
        //拿到当前登录的这个对象
        Subject subject = SecurityUtils.getSubject();
        User currentUser  = (User)subject.getPrincipal();  //Shiro取出当前对象   拿到user对象
        //设置当前用户的权限
        info.addStringPermission(currentUser.getPerms());
        return info;
    }
    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("执行了=>认证doGetAuthenticationInfo");
        //用户名 密码  模拟 数据库中取
//        String name = "root";
//        String password = "123456";
        UsernamePasswordToken userToken = (UsernamePasswordToken)token;
        //连接真实数据库
        User user = userService.queryUserByName(userToken.getUsername());
        //模拟判断
/*       if (!userToken.getUsername().equals(name)){
            return null; //抛出异常 UnknownAccountException
        }
        //密码认证 shiro
        return new SimpleAuthenticationInfo("",user.password,"");
*/
        //数据库判断
        if(user == null){ //没有这个人
            return  null;
        }
        //获取session对象，保存user对象
        Subject currentSubject = SecurityUtils.getSubject();
        Session session = currentSubject.getSession();
        session.setAttribute("loginUser",user);
        //可以加密：md5  md5盐值加密
        //密码认证 shiro
        //第一个参数user是为了传递参数
        return new SimpleAuthenticationInfo(user,user.getPwd(),"");
    }
}
3.2.5.2 ShiroConfig 授权
@Configuration
public class ShiroConfig {
    //ShiroFilterFactoryBean   工厂对象 第三步
    @Bean
    public ShiroFilterFactoryBean  getShiroFilterFactoryBean(@Qualifier("defaultWebSecurityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(defaultWebSecurityManager);
        //添加shiro的内置过滤器
        /*
           anon: 无需认证就可以访问
           authc: 必须认证； 才能访问
           user: 必须拥有某个资源的权限才能访问
           role: 拥有某个角色权限才能访问
         */
        //拦截
        Map<String, String> filterMap = new LinkedHashMap<>();
        //拦截路径
//        filterMap.put("/user/add","authc");
//        filterMap.put("/user/update","authc");
        //授权 ，正常情况下，没有授权会跳到未授权页面
        filterMap.put("/user/add","perms[user:add]"); //有add权限的user才可以访问/user/add
        filterMap.put("/user/update","perms[user:update]");
        bean.setFilterChainDefinitionMap(filterMap);
        bean.setLoginUrl("/toLogin"); //设置登录的请求
        //未授权页面
        bean.setUnauthorizedUrl("/noauth");
        return bean;
    }
    //DefaultWebSecurityManger  安全对象  第二步
    @Bean("defaultWebSecurityManager")
    public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
        //关联 userRealm
        securityManager.setRealm(userRealm);
        return securityManager;
    }
    //创建 realm 对象  ，需要自定义类  第一步
    @Bean(name = "userRealm")
    public UserRealm userRealm(){
        return  new UserRealm();
    }
    //整合ShiroDialect：用来整合 Shiro
    @Bean
    public ShiroDialect getShiroDialect(){
        return new ShiroDialect();
    }
}

3.2.6 控制层

@Controller
public class MyController {
    //index
    @GetMapping({"/","/index"})
    public String toIndex(Model model){
        model.addAttribute("msg","hello,shiro");
        return "index";
    }
    //add
    @RequestMapping("/user/add")
    public String add(){
        return "user/add";
    }
    //update
    @RequestMapping("/user/update")
    public String update(){
        return "user/update";
    }
    //去登录
    @RequestMapping("/toLogin")
    public String toLogin(){
        return "login";
    }
    //登录
    @RequestMapping("/login")
    public String login( String username, String password,Model model){
        //获取当前的用户
        Subject subject = SecurityUtils.getSubject();
        //封装用户的登陆数据
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        try {
            subject.login(token); //执行登陆方法，如果没有异常就说明Ok
            return "index";  //登录成功，返回首页
        }catch (UnknownAccountException e){ //用户名bu存在
            model.addAttribute("msg","用户名错误");
            return "login";
        }catch (IncorrectCredentialsException e){  //密码不存在
            model.addAttribute("msg","密码错误");
            return "login";
        }
    }
    //未授权
    @RequestMapping("/noauth")
    @ResponseBody
    public String unauthorized(){
        return "未经授权无法访问此页面！！！";
    }
}

3.2.7 测试

3.2.7.1 没有权限

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2.7.2 add 权限

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2.7.3 update 权限

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

3.2.7.4 add + update 权限

SpringCloud Alibaba(八) - Durid,SpringSecurity,Shiro

声明：本站所有文章，如无特殊说明或标注，均为本站原创发布。任何个人或组织，在未征得本站同意时，禁止复制、盗用、采集、发布本站内容到任何网站、书籍等各类媒体平台。如若本站内容侵犯了原著者的合法权益，可联系我们进行处理。