"
系统采用spring mvc + hibernate + shiro开发, 有两张用户表 admin_member(后台用户)和 u_member(前台用户)。
admin_member表中密码是用md5,而u_member表中密码采用 SHA。
Shiro realm该如何配置?
initCredentialsMatcher()该如何配置?
登录是否要分两个入口? 求思路。
另附一张表实现代码:
<description>Shiro安全配置</description> <!-- Shiro's main business-tier object for web-enabled applications --> <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"> <property name="realm" ref="shiroDbRealm" /> <!-- <property name="cacheManager" ref="shiroEhcacheManager" /> --> </bean> <!-- 項目自定义的Realm --> <bean id="shiroDbRealm" class="cn.sample.auth.service.ShiroDbRealm" > <property name="AuthUserManager" ref="authUserManager"/> </bean> <!-- Shiro Filter --> <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"> <property name="securityManager" ref="securityManager" /> <property name="loginUrl" value="/login" /> <property name="successUrl" value="/" /> <property name="filterChainDefinitions"> <value> /login = authc /logout = logout /admin/auth/** = user </value> </property> </bean> <!-- 用户授权信息Cache, 采用EhCache --> <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"> <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/> </bean> <!-- 保证实现了Shiro内部lifecycle函数的bean执行 --> <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> <!-- AOP式方法级权限检查 --> <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"> <property name="proxyTargetClass" value="true" /> </bean> <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"> <property name="securityManager" ref="securityManager"/> </bean>
public class ShiroDbRealm extends AuthorizingRealm { @Autowired private AuthUserManager authUserManager; /** * 认证回调函数,登录时调用. */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException { UsernamePasswordToken token = (UsernamePasswordToken) authcToken; AuthUser user = authUserManager.getMember(token.getUsername()); if (user != null) { if (!user.getEnabled().equals(1)) { throw new DisabledAccountException(); } return new SimpleAuthenticationInfo(new ShiroUser(user.getUserName(), user.getNickName()), user.getPassword(), getName()); } else { return null; } } /** * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用. */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) { ShiroUser shiroUser = (ShiroUser) principals.getPrimaryPrincipal(); AuthUser user = authUserManager.getMember(shiroUser.loginName); SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(); List<String> permissionList = new ArrayList<String>(); ...... return info; } /** * 设定Password校验的Hash算法与迭代次数. */ @PostConstruct public void initCredentialsMatcher() { HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(Md5Hash.ALGORITHM_NAME); // matcher.setHashIterations(1); setCredentialsMatcher(matcher); } ......"
配2个shiro拦截不同请求######定义两个shiroFilter,后台可拦截"/admin/",前端url相对来说没有这么有规则。如果前端配置“/” ,是不是两个Subject有冲突?针对这个问题有没有更好的解决方式。######Authenticator默认实现是ModularRealmAuthenticator,它既支持单一Realm也支持多个Realm。######请问你的问题解决了么,怎么配置可以有两个登录入口呢,谢谢######登录方式有很多处理,比如自己接收用户参数执行SecurityUtils.getSubject().login(usernamePasswordToken);
版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。