shiro安全框架

最新推荐文章于 2025-06-17 01:30:00 发布

李济号

最新推荐文章于 2025-06-17 01:30:00 发布

阅读量358

点赞数

CC 4.0 BY-SA版权

分类专栏： java 文章标签： shiro

本文链接：https://blog.csdn.net/XiaoOu7/article/details/117195737

java 专栏收录该内容

8 篇文章

订阅专栏

这篇博客详细介绍了 Apache Shiro 的用户认证流程，包括 DefaultSecurityManager、IniRealm 的设置以及 Subject 的登录过程。还探讨了 AuthenticatingRealm 中的 doGetAuthenticationInfo 方法用于验证用户名，assertCredentialsMatch 方法用于校验密码。此外，展示了如何自定义 Realm，包括 MD5 加密和 Salt 的使用。最后，给出了 SpringBoot 集成 Shiro 的配置，包括 ShiroFilterFactoryBean、DefaultWebSecurityManager 和自定义 Realm 的创建。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

shiro学习

shiro中的第一个程序用户认证

 //1.创建安全管理器对象
        DefaultSecurityManager securityManager=new DefaultSecurityManager();

        //2.给安全管理器设置realm
        securityManager.setRealm(new IniRealm("classpath:shiro.ini"));

        //3.SecurityUtils 给全局安全工具类设置安全管理器
        SecurityUtils.setSecurityManager(securityManager);

        //4.关键对象subject主体
        Subject subject=SecurityUtils.getSubject();

        //5.创建令牌
        UsernamePasswordToken   token=new UsernamePasswordToken("xiaoou","1123");
        try {
            subject.login(token);
            System.out.println("认证状态:"+subject.isAuthenticated());
        }catch (UnknownAccountException w){
            System.out.println("账号不存在!");
        }catch (IncorrectCredentialsException e){
            System.out.println("密码错误!");
        }finally {
            System.out.println("认证结束 ");
        }

shiro中认证流程源码

认证：1.最终执行用户名比较是在SimpleAccountRealm类中的doGetAuthenticationInfo 方法中完成用户名校验的

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        SimpleAccount account = getUser(upToken.getUsername());

        if (account != null) {

            if (account.isLocked()) {
                throw new LockedAccountException("Account [" + account + "] is locked.");
            }
            if (account.isCredentialsExpired()) {
                String msg = "The credentials for account [" + account + "] are expired";
                throw new ExpiredCredentialsException(msg);
            }

        }

        return account;
    }

2.最终密码校验是在AuthenticatingRealm类中的assertCredentialsMatch方法中完成密码校验的

protected void assertCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) throws AuthenticationException {
    CredentialsMatcher cm = getCredentialsMatcher();
    if (cm != null) {
        if (!cm.doCredentialsMatch(token, info)) {
            //not successful - throw an exception to indicate this:
            String msg = "Submitted credentials for token [" + token + "] did not match the expected credentials.";
            throw new IncorrectCredentialsException(msg);
        }
    } else {
        throw new AuthenticationException("A CredentialsMatcher must be configured in order to verify " +
                "credentials during authentication.  If you do not wish for credentials to be examined, you " +
                "can configure an " + AllowAllCredentialsMatcher.class.getName() + " instance.");
    }
}

总结:

AuthenticatingRealm   认证realm          doGetAuthenticationInfo

AuthorizingRealm         授权realm         doGetAuthorizationInfo

shiro自定义Realm

测试类:

        //创建SecuirityManager
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        //设置自定义realm
        defaultSecurityManager.setRealm(new CustomerRealm());
        //将安全工具类设置安全工具类
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        //通过安全管理器获取Subject（主体）
        Subject subject = SecurityUtils.getSubject();
        //创建token
        UsernamePasswordToken usernamePasswordToken=new UsernamePasswordToken("x","6");
        try {
            subject.login(usernamePasswordToken);
            System.out.println("状态"+subject.isAuthenticated());

        }catch (UnknownAccountException e){
            System.out.println("账号错误");
        }catch (IncorrectCredentialsException e){
            System.out.println("密码错误");
        }

自定义的realm

package org.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class CustomerRealm extends AuthorizingRealm {


    //授权realm
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        //因为暂时还没有涉及到授权 所有授权可以忽略
        return null;
    }

    //认证realm
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //在token中获取用户名
        Object principal = token.getPrincipal();
       //模拟使用mybatis查询数据库
        if (principal.toString().equals("x")){
            //参数一 返回数据库中正确的用户名  参数二返回数据库中的正确密码   参数三 提供当前realm的名字
            SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(principal.toString(),"6",this.getName());
            return simpleAuthenticationInfo;
        }
        return null;
    }
}

MD5+Salt实现

自定realm

package org.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

public class Md5realm extends AuthorizingRealm {
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        return null;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //获取身份信息
        Object principal = token.getPrincipal();

        //根据用户名查询数据库
        if (principal.toString().equals("xiaoou")){
            //参数一返回数据库中正确的用户名  参数二返回数据库中的正确密码  参数三注册时使用的随机盐  参数四提供当前realm的名字
            return new SimpleAuthenticationInfo(principal.toString(),"66bd74861c4a331b7c6e55df3101fa63", ByteSource.Util.bytes("6*asdas55**-"),this.getName());
        }

        return null;
    }
}

测试类

package org.shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.realm.CustomerRealm;
import org.realm.Md5realm;

public class TestShiro3 {
    public static void main(String[] args) {
        //创建安全管理器
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();

        //自定义realm
        Md5realm md5realm = new Md5realm();



        HashedCredentialsMatcher credentialsMatcher=new HashedCredentialsMatcher();
        credentialsMatcher.setHashAlgorithmName("md5");
        credentialsMatcher.setHashIterations(1024);

        //设置realm使用hash凭证匹配器
        md5realm.setCredentialsMatcher(credentialsMatcher);

        //注入自定义realm
        defaultSecurityManager.setRealm(md5realm);

        //将安全管理器注入到安全工具
        SecurityUtils.setSecurityManager(defaultSecurityManager);

        //通过安全工具类获取subject
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken token = new UsernamePasswordToken("xiaoou","633633");

        try {
            subject.login(token);
            System.out.println("登录成功!");
        }catch (UnknownAccountException e){
            System.out.println("用户名错误!");
        }catch (IncorrectCredentialsException e){
            System.out.println("密码错误");
        }




    }
}

java练习shiro (不涉及数据库) demo

自定义realm

package org.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

public class Md5realm extends AuthorizingRealm {
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        Object primaryPrincipal = principals.getPrimaryPrincipal();  //拿到用户
        System.out.println(primaryPrincipal.toString());
        SimpleAuthorizationInfo d=new SimpleAuthorizationInfo();
        d.addRole("admin");
        d.addRole("user");
        d.addStringPermission("user:*:01 ");
        return d;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //获取身份信息
        Object principal = token.getPrincipal();

        //根据用户名查询数据库
        if (principal.toString().equals("xiaoou")){
            //参数一返回数据库中正确的用户名  参数二返回数据库中的正确密码  参数三注册时使用的随机盐  参数四提供当前realm的名字
            return new SimpleAuthenticationInfo(principal.toString(),"66bd74861c4a331b7c6e55df3101fa63", ByteSource.Util.bytes("6*asdas55**-"),this.getName());
        }

        return null;
    }
}

main测试

package org.shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.realm.CustomerRealm;
import org.realm.Md5realm;

import java.util.Arrays;

public class TestShiro3 {
    public static void main(String[] args) {
        //创建安全管理器
        DefaultSecurityManager defaultSecurityManager=new DefaultSecurityManager();

        //自定义realm
        Md5realm md5realm = new Md5realm();


        HashedCredentialsMatcher credentialsMatcher=new HashedCredentialsMatcher();
        credentialsMatcher.setHashAlgorithmName("md5");
        credentialsMatcher.setHashIterations(1024);

        //设置realm使用hash凭证匹配器
        md5realm.setCredentialsMatcher(credentialsMatcher);

        //注入自定义realm
        defaultSecurityManager.setRealm(md5realm);

        //将安全管理器注入到安全工具
        SecurityUtils.setSecurityManager(defaultSecurityManager);

        //通过安全工具类获取subject
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken token = new UsernamePasswordToken("xiaoou","633633");

        try {
            subject.login(token);
            System.out.println("登录成功!");
        }catch (UnknownAccountException e){
            System.out.println("用户名错误!");
        }catch (IncorrectCredentialsException e){
            System.out.println("密码错误");
        }

        if (subject.isAuthenticated()){  //认证成功进行授权

            //基于单角色权限控制
            System.out.println("***"+subject.hasRole("admin"));

            //基于多角色权限控制
            System.out.println(subject.hasAllRoles(Arrays.asList("admin","user")));

            //是否具有其中一个角色
            System.out.println(subject.hasRoles(Arrays.asList("admin"))[0]);

            //基于权限字符串的访问控制 资源访问标识符：操作：资源类型
            System.out.println("访问控制:"+subject.isPermitted("user:*:01"));

            System.out.println("访问控制:"+subject.isPermitted("user:update:02"));

            //分别具有哪些权限
            boolean[] permitted = subject.isPermitted("user:*:01", "admin:*:10");

            for (boolean b:permitted
                 ) {
                System.out.println("id权限"+b);
            }

            //同时具有哪些权限
            boolean permittedAll = subject.isPermittedAll("user:*:01", "admin:update:02");
            System.out.println(permittedAll);


        }




    }
}

springboot集成shiro

Shiro依赖

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring-boot-starter</artifactId>
    <version>1.5.3</version>
</dependency>

ShiroConfig (配置类)

package com.shiro.bootshiro;

import com.shiro.shiro.CutomerRealm;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.HashMap;
import java.util.Map;

/**
 * 用来整合shiro相关的配置类
 */
@Configuration
public class ShiroConfig {
    //1.创建shiroFilter      负责拦截所有请求
    @Bean
    public ShiroFilterFactoryBean getShirodFilterFactortBean(DefaultWebSecurityManager defaultWebSecurityManager){

        ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
        //给filter设置安全管理器
        shiroFilterFactoryBean.setSecurityManager(defaultWebSecurityManager);

        Map<String,String> map=new HashMap<String,String>();
        //配置系统公共资源
        map.put("/user/login","anon");
        map.put("/zhu.html","anon");
        map.put("/user/zhu","anon");
        //配置系统受限资源
        map.put("/**","authc");  //authc 请求这个资源需要认证和授权

        shiroFilterFactoryBean.setLoginUrl("/login.html");

        shiroFilterFactoryBean.setFilterChainDefinitionMap(map);

        return shiroFilterFactoryBean;
    }

    //2.创建安全管理器
    @Bean
    public DefaultWebSecurityManager getDefaultWebSecurityManager(Realm realm){
        DefaultWebSecurityManager defaultWebSecurityManager=new DefaultWebSecurityManager();
        //给安全管理器设置realm
        defaultWebSecurityManager.setRealm(realm);

        return defaultWebSecurityManager;
    }
    //3.创建自定义的realm
    @Bean
    public Realm getRealm(){
        CutomerRealm cutomerRealm=new CutomerRealm();
        //修改凭证校验匹配器
        HashedCredentialsMatcher hashedCredentialsMatcher = new HashedCredentialsMatcher();
        //设置加密算法为md5
        hashedCredentialsMatcher.setHashAlgorithmName("md5");
        //设置散列次数
        hashedCredentialsMatcher.setHashIterations(1024);
        cutomerRealm.setCredentialsMatcher(hashedCredentialsMatcher);
        return cutomerRealm;
    }
}

MvcExecption（异常处理类）

package com.shiro.controller;

import org.apache.shiro.authz.AuthorizationException;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RequestMapping;

@ControllerAdvice
public class MvcExecption {

    @ExceptionHandler({AuthorizationException.class})   //负责处理AuthorizationException异常。
    public String handlerExceptio() {
        System.out.println("你没有权限删除用户!");
        return "redirect:/index.html";
    }

}

Shirocontroller(控制器类)

package com.shiro.controller;

import com.shiro.pojo.Shiro;
import com.shiro.service.ShiroService;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.subject.Subject;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;



@Controller
@RequestMapping("/user")
public class Shirocontroller {

    @Autowired
    private ShiroService shiroService;

    @RequestMapping("/login")   //登录
    public String login(String name,String password){
            //获取主体对象
        Subject subject= SecurityUtils.getSubject();
        try {
            subject.login(new UsernamePasswordToken(name,password));
            return "redirect:/index.html";  //登录成功去主页
        }catch (UnknownAccountException e){
            System.out.println("用户名错误！");
        }catch (IncorrectCredentialsException e){
            System.out.println("密码错误！");
        }
        return "redirect:/login.html";  //登录页
    }

    @RequestMapping("/exit")   //退出登录
    public String login1(){
    Subject subject=SecurityUtils.getSubject();
    subject.logout();  //登出
        return "redirect:/login.html";
    }

    @RequestMapping("/zhu")  //注册用户
    public String login2(Shiro shiro){   //逻辑处理层在service
   int i= shiroService.save(shiro);
   if (i>0){
       System.out.println("注册成功");
       return "redirect:/login.html";    //成功与否都去登录页面
   }
        System.out.println("注册失败");
        return "redirect:/login.html";
    }
    //注解方式的鉴别身份
/*@RequiresRoles("admin1")                                  //判断角色是否是admin*/
@RequiresRoles(value = {"admin","user"})                    //判断主角色是否同时具有两个角色
/*@RequiresPermissions(value = {"admin:*:01","admin:*:02"})  判断著角色是否同时具有当前权限*/
/*@RequiresPermissions("user:update:01")                    判断当前角色是否具有当前权限*/
    @RequestMapping("/jia")
    public String deleteuser(){           //根据权限执行本方法
    System.out.println("删除一位普通用户!");
/*
        //代码方式的鉴别身份
        Subject admin=SecurityUtils.getSubject();
        if (admin.hasRole("admin1")){
            //执行业务逻辑
            System.out.println("删除了一位普通用户！");
        }else{
            System.out.println("无权删除");

        }
*/
        return "redirect:/index.html";
    }

}

ShiroMapper（Dao层）

package com.shiro.dao;

import com.baomidou.mybatisplus.core.mapper.BaseMapper;
import com.shiro.pojo.Pers;
import com.shiro.pojo.Shiro;

import java.util.List;

public interface ShiroMapper extends BaseMapper<Shiro> {
    int save(Shiro shiro);

    Shiro selectshiro(String name);

    List<Pers> selectshiro1(Integer tid);
}

ShiroMapper（Dao接口映射文件）

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.shiro.dao.ShiroMapper">


    <resultMap id="sedome" type="Shiro" >
        <id property="id" column="id"></id>
        <result property="username" column="username"></result>
<collection property="roles" javaType="list" ofType="Role" >
    <id property="id" column="id1"></id>
    <result property="name" column="name" ></result>
</collection>
    </resultMap>

    <select id="selectshiro" parameterType="String" resultMap="sedome" >
SELECT so.id,so.username,re.id AS id1,re.name FROM shiro so
INNER JOIN usrole us ON so.id=us.uid
INNER JOIN role re ON re.id=us.rid WHERE so.username=#{nmae}
    </select>


    <select id="selectshiro1" parameterType="int" resultType="Pers" >
SELECT ps.id,ps.name  FROM pers ps
INNER JOIN ropers rs ON rs.persid=ps.id
INNER JOIN role re ON re.id=rs.roleid WHERE re.id=#{tid}
    </select>

</mapper>

Pers(权限实体类)

package com.shiro.pojo;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import lombok.experimental.Accessors;

@Data
@AllArgsConstructor
@Accessors(chain =true)
@NoArgsConstructor
/**
 * 权限
 */
public class Pers {
    private Integer id;
    private String name;
}

Role(角色实体类)

package com.shiro.pojo;

import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import lombok.experimental.Accessors;

@Data
@AllArgsConstructor
@Accessors(chain =true)
@NoArgsConstructor
/**
 * 角色
 */
public class Role {
    private int id;
    private String name;
}

Shiro(用户实体类)

package com.shiro.pojo;

import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableField;
import com.baomidou.mybatisplus.annotation.TableId;
import lombok.AllArgsConstructor;
import lombok.Data;
import lombok.NoArgsConstructor;
import lombok.experimental.Accessors;

import java.util.List;

@Data
@Accessors(chain =true)
@AllArgsConstructor
@NoArgsConstructor
/**
 * 用户
 */
public class Shiro {
    @TableId(value = "id", type = IdType.AUTO)
    private Integer id;
    private String username;
    private String userpassword;
    private String salt;
    @TableField(exist = false)
    private List<Role> roles;

}

Saltutils(随机盐生成工具类)

package com.shiro.saltutils;

import java.util.Random;

/**
 * /随机盐工具类
 */
public class Saltutils {
    public static String getSalt(int n){  //根据传入的用户密码长度随机生成盐
        //定义随机盐
        char [] chars="qwertyuiopasdfghjklzxcvbnm,963852741/*-+123457890--=".toCharArray();
        StringBuffer stringBuffer=new StringBuffer();
        for (int i=0;i<n;i++){
            char aChar = chars[new Random().nextInt(chars.length - 1)];
            stringBuffer.append(aChar);
        }
        return stringBuffer.toString();
    }

}

ShiroService（逻辑层）

package com.shiro.service;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.shiro.pojo.Pers;
import com.shiro.pojo.Shiro;

import java.util.List;

public interface ShiroService {
    int save(Shiro shiro);

    Shiro selectshiro(QueryWrapper<Shiro> queryWrapper);

    List<Pers> selectshiro1(Integer tid);

    Shiro list(String name);
}

ShiroServiceImpl(逻辑层实现类)

package com.shiro.service;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.shiro.dao.ShiroMapper;
import com.shiro.pojo.Pers;
import com.shiro.pojo.Shiro;
import com.shiro.saltutils.Saltutils;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;

@Service
public class ShiroServiceImpl implements ShiroService {
    @Autowired
    private ShiroMapper shirodao;

    @Override
    public int save(Shiro shiro) {  //处理注册逻辑
        String salt= Saltutils.getSalt(shiro.getUserpassword().length());  //拿到随机生成的salt
        shiro.setSalt(salt);
        Md5Hash md5Hash = new Md5Hash(shiro.getUserpassword(),salt,1024); //设置md5+sqlt+hash
        shiro.setUserpassword(md5Hash.toHex());
        return shirodao.insert(shiro);
    }

    @Override
    public Shiro selectshiro(QueryWrapper<Shiro> queryWrapper) {
        return shirodao.selectOne(queryWrapper);
    }

    @Override
    public Shiro list(String name) {
        return shirodao.selectshiro(name);
    }

    @Override
    public List<Pers> selectshiro1(Integer tid) {
        return shirodao.selectshiro1(tid);
    }
}

CutomerRealm（自定义realm）

package com.shiro.shiro;

import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
import com.shiro.pojo.Pers;
import com.shiro.pojo.Shiro;
import com.shiro.service.ShiroService;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.apache.shiro.util.CollectionUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.util.ObjectUtils;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.List;

public class CutomerRealm extends AuthorizingRealm {

    @Autowired
    private ShiroService shiroService;

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

           String name=(String) principals.getPrimaryPrincipal();  //获取用户身份信息

        Shiro usernamelist = shiroService.list(name);  //根据用户信息(名字)查询用户角色
        SimpleAuthorizationInfo simpleAuthorizationInfo=new SimpleAuthorizationInfo();

               if (!CollectionUtils.isEmpty(usernamelist.getRoles())){   //查询到该用户角色新消息

            usernamelist.getRoles().forEach(r->{  //循环角色信息

                simpleAuthorizationInfo.addRole(r.getName());  //赋予角色

                List<Pers> persList=shiroService.selectshiro1(r.getId());  //拿到当前的角色具有的全部权限

                if (!CollectionUtils.isEmpty(persList)){   //判断不为空

                    persList.forEach(t->{  //循环权限信息

                        simpleAuthorizationInfo.addStringPermission(t.getName());  //赋予权限

                    });
                }

            });
        }
        return simpleAuthorizationInfo;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

        String prin=(String) token.getPrincipal();  //获取用户名

        Shiro shiro=shiroService.selectshiro(new QueryWrapper<Shiro>().eq("username",prin)); //拿到当前用户信息

       if (!ObjectUtils.isEmpty(shiro)){   //判断不为空
           // 用户名+密码(MD5+盐+hash散列)+自定义盐值+当前域名
           return new SimpleAuthenticationInfo(shiro.getUsername(),shiro.getUserpassword(), ByteSource.Util.bytes(shiro.getSalt()),this.getName());
       }
        return null;
    }



}