"
系统采用spring mvc + hibernate + shiro开发, 有两张用户表 admin_member(后台用户)和 u_member(前台用户)。
admin_member表中密码是用md5,而u_member表中密码采用 SHA。
Shiro realm该如何配置?
initCredentialsMatcher()该如何配置?
登录是否要分两个入口? 求思路。
另附一张表实现代码:
<description>Shiro安全配置</description>
<!-- Shiro's main business-tier object for web-enabled applications -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<property name="realm" ref="shiroDbRealm" />
<!-- <property name="cacheManager" ref="shiroEhcacheManager" /> -->
</bean>
<!-- 項目自定义的Realm -->
<bean id="shiroDbRealm" class="cn.sample.auth.service.ShiroDbRealm" >
<property name="AuthUserManager" ref="authUserManager"/>
</bean>
<!-- Shiro Filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager" />
<property name="loginUrl" value="/login" />
<property name="successUrl" value="/" />
<property name="filterChainDefinitions">
<value>
/login = authc
/logout = logout
/admin/auth/** = user
</value>
</property>
</bean>
<!-- 用户授权信息Cache, 采用EhCache -->
<bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
<property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
</bean>
<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
<!-- AOP式方法级权限检查 -->
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
<property name="proxyTargetClass" value="true" />
</bean>
<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
<property name="securityManager" ref="securityManager"/>
</bean>
public class ShiroDbRealm extends AuthorizingRealm {
@Autowired
private AuthUserManager authUserManager;
/**
* 认证回调函数,登录时调用.
*/
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
AuthUser user = authUserManager.getMember(token.getUsername());
if (user != null) {
if (!user.getEnabled().equals(1)) {
throw new DisabledAccountException();
}
return new SimpleAuthenticationInfo(new ShiroUser(user.getUserName(), user.getNickName()), user.getPassword(), getName());
} else {
return null;
}
}
/**
* 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
*/
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
ShiroUser shiroUser = (ShiroUser) principals.getPrimaryPrincipal();
AuthUser user = authUserManager.getMember(shiroUser.loginName);
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
List<String> permissionList = new ArrayList<String>();
......
return info;
}
/**
* 设定Password校验的Hash算法与迭代次数.
*/
@PostConstruct
public void initCredentialsMatcher() {
HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(Md5Hash.ALGORITHM_NAME);
// matcher.setHashIterations(1);
setCredentialsMatcher(matcher);
}
......"
版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。
配2个shiro拦截不同请求######定义两个shiroFilter,后台可拦截"/admin/",前端url相对来说没有这么有规则。如果前端配置“/” ,是不是两个Subject有冲突?针对这个问题有没有更好的解决方式。######Authenticator默认实现是ModularRealmAuthenticator,它既支持单一Realm也支持多个Realm。######请问你的问题解决了么,怎么配置可以有两个登录入口呢,谢谢######登录方式有很多处理,比如自己接收用户参数执行SecurityUtils.getSubject().login(usernamePasswordToken);