欧美bbbwbbbw肥妇,免费乱码人妻系列日韩,一级黄片

springboot整合shiro多驗(yàn)證登錄功能的實(shí)現(xiàn)(賬號(hào)密碼登錄和使用手機(jī)驗(yàn)證碼登錄)

 更新時(shí)間:2021年07月12日 15:06:51   作者:張含韻好可愛(ài)  
這篇文章給大家介紹springboot整合shiro多驗(yàn)證登錄功能的實(shí)現(xiàn)方法,包括賬號(hào)密碼登錄和使用手機(jī)驗(yàn)證碼登錄功能,本文通過(guò)實(shí)例代碼給大家介紹的非常詳細(xì),需要的朋友參考下吧

1. 首先新建一個(gè)shiroConfig shiro的配置類(lèi),代碼如下:

@Configuration
public class SpringShiroConfig {


    /**
     * @param realms 這兒使用接口集合是為了實(shí)現(xiàn)多驗(yàn)證登錄時(shí)使用的
     * @return
     */
    @Bean
    public SecurityManager securityManager(Collection<Realm> realms) {
        DefaultWebSecurityManager sManager = new DefaultWebSecurityManager();
        sManager.setRealms(realms);
        return sManager;
    }

    @Bean
    public ShiroFilterFactoryBean shiroFilterFactory(SecurityManager securityManager) {
        ShiroFilterFactoryBean sfBean = new ShiroFilterFactoryBean();
        sfBean.setSecurityManager(securityManager);
        //如果是匿名訪問(wèn)時(shí),訪問(wèn)了不能訪問(wèn)的資源跳轉(zhuǎn)的位置
        sfBean.setLoginUrl("/index");
        //定義map指定請(qǐng)求過(guò)濾規(guī)則(哪些資源允許匿名訪問(wèn),哪些必須認(rèn)證訪問(wèn))
        LinkedHashMap<String, String> map = new LinkedHashMap<>();
        //靜態(tài)資源允許匿名訪問(wèn):"anon" 靜態(tài)資源授權(quán)時(shí)不能寫(xiě)static下面所有的開(kāi)放,要將static下面的所有文件夾一個(gè)一個(gè)的開(kāi)放,templates同理
        //map的key可以為文件的位置,也可以為請(qǐng)求的路徑
        map.put("/bower_components/**", "anon");
        map.put("/json/**", "anon");
        map.put("/pages", "anon");
        map.put("/user/userPasswordLogin", "anon");
        map.put("/user/login", "anon");
        map.put("/user/reg", "anon");
        //訪問(wèn)這個(gè)路徑時(shí)不會(huì)進(jìn)入controller,會(huì)在這兒直接攔截退出,問(wèn)為什么的,自己想請(qǐng)求流程去
        map.put("/user/userLogout", "logout");
        //攔截除上面之外的所有請(qǐng)求路徑
        map.put("/**", "user");
        sfBean.setFilterChainDefinitionMap(map);
        return sfBean;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

2. 寫(xiě)Realms的實(shí)現(xiàn)類(lèi),一般繼承自AuthorizingRealm(這個(gè)是實(shí)現(xiàn)用戶名,密碼登錄),代碼如下:

@Service
public class ShioUserRealm extends AuthorizingRealm {

    //注入userdao
    @Autowired
    private UserDao userDao;
    /**
     * 設(shè)置憑證匹配器
     *
     * @param credentialsMatcher
     */
    @Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        /*這里設(shè)置了MD5鹽值加密,這兒就必須使用HashedCredentialsMatcher才能有下面兩個(gè)方法*/
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        //這里是設(shè)置加密方式
        matcher.setHashAlgorithmName("MD5");
        //這里是設(shè)置加密的次數(shù)
        matcher.setHashIterations(2);
        super.setCredentialsMatcher(matcher);
    }

    /**
     * 這兒是設(shè)置授權(quán)的
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        return null;
    }

    /**
     * 通過(guò)此方法完成認(rèn)證數(shù)據(jù)的獲取及封裝,系統(tǒng)底層會(huì)將認(rèn)證數(shù)據(jù)傳遞認(rèn)證管理器,有認(rèn)證管理器完成認(rèn)證操作
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        //先判斷這個(gè)是否是來(lái)及這個(gè)令牌的數(shù)據(jù):我們這兒分為了UsernamePasswordToken(shiro給我們提供的。)、UserPhoneToken
        if (!(authenticationToken instanceof UsernamePasswordToken)) {
            return null;
        }
        //獲取controller傳過(guò)來(lái)的數(shù)據(jù)
        UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken;
        //upToken.setRememberMe(true);shiro默認(rèn)為false,是是否記住我的功能
        //這兒為用戶提交的username
        String username = upToken.getUsername();
        //去數(shù)據(jù)更加name取到用戶的信息
        User user = userDao.findUserByUserName(username);
        //判斷數(shù)據(jù)庫(kù)是否有這用戶
        if (user == null) {
            throw new UnknownAccountException();
        }
        //判斷用戶的狀態(tài)是否被禁用(數(shù)據(jù)庫(kù)的字段)
        if (user.getState() == 0) {
            throw new LockedAccountException();
        }
        //這兒是取到用戶信息中的鹽值,鹽值要轉(zhuǎn)換為ByteSource這個(gè)類(lèi)型才能使用
        ByteSource credentialsSalt = ByteSource.Util.bytes(user.getSalt());
        //這兒是將這個(gè)用戶的信息交給shiro(user為用戶對(duì)象,user.getPassword()是要加密的對(duì)象,credentialsSalt為鹽值,getName()當(dāng)前對(duì)象)
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPassword(), credentialsSalt, getName());
        return info;
    }
}

3. 此時(shí)用戶的賬號(hào)密碼登錄已經(jīng)可以使用了controller代碼如下:

@RequestMapping("userPasswordLogin")
    @ResponseBody
    public JsonResult userPasswordLogin(String username, String password) {
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        subject.login(token);
        return new JsonResult("login Ok");
    }

4. 我們現(xiàn)在來(lái)實(shí)現(xiàn)短信驗(yàn)證碼登錄實(shí)現(xiàn):

4.1 先寫(xiě)UserPhoneToken,我放在l和springShiroConfig同一目錄下:

@Component
public class UserPhoneToken extends UsernamePasswordToken implements Serializable {

    private static final long serialVersionUID = 6293390033867929958L;
    // 手機(jī)號(hào)碼
    private String phoneNum;
    //無(wú)參構(gòu)造
    public UserPhoneToken(){}
    
    //獲取存入的值
    @Override
    public Object getPrincipal() {
        if (phoneNum == null) {
            return getUsername();
        } else {
            return getPhoneNum();
        }
    }

    @Override
    public Object getCredentials() {
        if (phoneNum == null) {
            return getPassword();
        }else {
            return "ok";
        }

    }

    public UserPhoneToken(String phoneNum) {
        this.phoneNum = phoneNum;
    }

    public UserPhoneToken(final String userName, final String password) {
        super(userName, password);
    }

    public String getPhoneNum() {
        return phoneNum;
    }

    public void setPhoneNum(String phoneNum) {
        this.phoneNum = phoneNum;
    }
    @Override
    public String toString() {
        return "PhoneToken [PhoneNum=" + phoneNum + "]";
    }

}

4.2 在寫(xiě)shiroUserPhoneRealm,代碼如下:

@Service
public class ShioUserPhoneRealm extends AuthorizingRealm {

    @Autowired
    private UserDao userDao;

    @Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        //這兒的CredentialsMatcher的new的對(duì)象必須是AllowAllCredentialsMatcher
        CredentialsMatcher matcher = new AllowAllCredentialsMatcher();
        super.setCredentialsMatcher(matcher);
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }

    /**
     * 通過(guò)此方法完成認(rèn)證數(shù)據(jù)的獲取及封裝,系統(tǒng)底層會(huì)將認(rèn)證數(shù)據(jù)傳遞認(rèn)證管理器,有認(rèn)證管理器完成認(rèn)證操作
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        UserPhoneToken token = null;
        if (authenticationToken instanceof UserPhoneToken) {
            token = (UserPhoneToken) authenticationToken;
        }else {
            return null;
        }
        //獲取我發(fā)送驗(yàn)證碼是存入session中的驗(yàn)證碼和手機(jī)號(hào)
        String verificationCode = (String) SecurityUtils.getSubject().getSession().getAttribute("verificationCode");
        String phone = (String) SecurityUtils.getSubject().getSession().getAttribute("phone");
        //獲取controller傳過(guò)來(lái)的數(shù)據(jù)
        String verificationCode1 = (String) token.getPrincipal();
        //去數(shù)據(jù)庫(kù)根據(jù)手機(jī)號(hào)查詢用戶信息
        User user = userDao.findUserByUserPhone(phone);
        if (StringUtils.isEmpty(verificationCode)) {
            throw new ServiceException("網(wǎng)絡(luò)錯(cuò)誤");
        }
        //比對(duì)手機(jī)號(hào)
        if (!verificationCode.equals(verificationCode1)) {
            throw new ServiceException("驗(yàn)證碼不正確");
        }
        if (user == null) {
            throw new UnknownAccountException();
        }
        if (user.getState() == 0) {
            throw new LockedAccountException();
        }
        return new SimpleAuthenticationInfo(user,phone,getName());
    }
}

4.3 手機(jī)號(hào)碼登錄驗(yàn)證已經(jīng)基本完成:controller代碼如下:

@PostMapping("verificationCodeLogin")
    @ResponseBody
    public JsonResult verificationCodeLogin(String password) {
        Subject subject = SecurityUtils.getSubject();
        UserPhoneToken token = new UserPhoneToken(password);
        subject.login(token);
        return new JsonResult("login OK");
    }

使用過(guò)程中遇到的bug

1.

org.apache.shiro.authc.UnknownAccountException: Realm [cn.tedu.wxacs.service.impl.ShioUserPhoneRealm@768d8431] was unable to find account data for the submitted AuthenticationToken [org.apache.shiro.authc.UsernamePasswordToken - 張三, rememberMe=false].

出現(xiàn)這個(gè)問(wèn)題是我的是因?yàn)镽ealm中的某個(gè)實(shí)現(xiàn)類(lèi)沒(méi)有加注解,我這兒演示時(shí)是應(yīng)為ShiroUserRealm為加@Service注解

2.

org.apache.shiro.authc.AuthenticationException: Authentication token of type [class org.apache.shiro.authc.UsernamePasswordToken] could not be authenticated by any configured realms.  Please ensure that at least one realm can authenticate these tokens.

這兒出現(xiàn)的問(wèn)題是應(yīng)為我的ShioUserRealm的AuthenticationInfo方法的User user = userDao.findUserByUserName(username);這行代碼出現(xiàn)的問(wèn)題,debug的時(shí)候就發(fā)現(xiàn)這一句執(zhí)行后就保錯(cuò)

原因:是因?yàn)槲业腶pplication.yml文件中沒(méi)有寫(xiě)dao對(duì)應(yīng)的mapper文件的路徑

3. 在ShioUserPhoneRealm的doGetAuthenticationInfo方法的new SimpleAuthenticationInfo(user,phone,getName())這個(gè)位置后就報(bào)錯(cuò)是應(yīng)為ShioUserPhoneRealm的這個(gè)方法中你沒(méi)有將new的對(duì)象設(shè)置為AllowAllCredentialsMatcher();

@Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        //這兒的CredentialsMatcher的new的對(duì)象必須是AllowAllCredentialsMatcher
        CredentialsMatcher matcher = new AllowAllCredentialsMatcher();
        super.setCredentialsMatcher(matcher);
    }

注解中有一些需要注意的地方,建議看看,注解不對(duì)的地方還希望在下放評(píng)論指出或者聯(lián)系我

應(yīng)為我的知識(shí)有限,此方法本人實(shí)現(xiàn)目前沒(méi)有問(wèn)題,其中有什么不對(duì)的地方還希望各位指出,謝謝!

使用的是jdk8,spring boot 的2.2.1版本,shiro的1,.4.1版本

到此這篇關(guān)于springboot整合shiro多驗(yàn)證登錄功能的實(shí)現(xiàn)(賬號(hào)密碼登錄和使用手機(jī)驗(yàn)證碼登錄)的文章就介紹到這了,更多相關(guān)springboot整合shiro驗(yàn)證登錄內(nèi)容請(qǐng)搜索腳本之家以前的文章或繼續(xù)瀏覽下面的相關(guān)文章希望大家以后多多支持腳本之家!

相關(guān)文章

最新評(píng)論