开发者社区> 问答> 正文

请教Apache Shiro 与spring3登录问题 - java报错

"

    系统采用spring mvc + hibernate + shiro开发, 有两张用户表 admin_member(后台用户)和 u_member(前台用户)。

admin_member表中密码是用md5,而u_member表中密码采用 SHA。

Shiro realm该如何配置?

initCredentialsMatcher()该如何配置?

登录是否要分两个入口? 求思路。

另附一张表实现代码:

<description>Shiro安全配置</description>

	<!-- Shiro's main business-tier object for web-enabled applications -->
	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
		<property name="realm" ref="shiroDbRealm" />
		<!-- <property name="cacheManager" ref="shiroEhcacheManager" /> -->
		
	</bean>

	<!-- 項目自定义的Realm -->
	<bean id="shiroDbRealm" class="cn.sample.auth.service.ShiroDbRealm" >
		<property name="AuthUserManager" ref="authUserManager"/>
	</bean>
	
	<!-- Shiro Filter -->
	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
		<property name="securityManager" ref="securityManager" />
		<property name="loginUrl" value="/login" />
		<property name="successUrl" value="/" />
		<property name="filterChainDefinitions">
			<value>
				/login = authc
				/logout = logout
				/admin/auth/** = user
			</value>
		</property>
	</bean>

	<!-- 用户授权信息Cache, 采用EhCache -->
	<bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
		<property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
	</bean>
	
	<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
	
	<!-- AOP式方法级权限检查  -->
	<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
		<property name="proxyTargetClass" value="true" />
	</bean>
	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    	<property name="securityManager" ref="securityManager"/>
	</bean>
public class ShiroDbRealm extends AuthorizingRealm {

	@Autowired
	private AuthUserManager authUserManager;

	/**
	 * 认证回调函数,登录时调用.
	 */
	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {
		UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
		AuthUser user = authUserManager.getMember(token.getUsername());
		if (user != null) {
			if (!user.getEnabled().equals(1)) {
				throw new DisabledAccountException();
			}
			return new SimpleAuthenticationInfo(new ShiroUser(user.getUserName(), user.getNickName()), user.getPassword(), getName());
		} else {
			return null;
		}
	}

	/**
	 * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用.
	 */
	@Override
	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
		ShiroUser shiroUser = (ShiroUser) principals.getPrimaryPrincipal();
		AuthUser user = authUserManager.getMember(shiroUser.loginName);

		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
		List<String> permissionList = new ArrayList<String>();
		......
		
		return info;
	}

	/**
	 * 设定Password校验的Hash算法与迭代次数.
	 */
	@PostConstruct
	public void initCredentialsMatcher() {
		HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(Md5Hash.ALGORITHM_NAME);
	//	matcher.setHashIterations(1);
		setCredentialsMatcher(matcher);
	}
......
"

展开
收起
montos 2020-06-04 21:04:41 12617 0
1 条回答
写回答
取消 提交回答
  • 配2个shiro拦截不同请求######定义两个shiroFilter,后台可拦截"/admin/",前端url相对来说没有这么有规则。如果前端配置“/” ,是不是两个Subject有冲突?针对这个问题有没有更好的解决方式。######Authenticator默认实现是ModularRealmAuthenticator,它既支持单一Realm也支持多个Realm。######请问你的问题解决了么,怎么配置可以有两个登录入口呢,谢谢######登录方式有很多处理,比如自己接收用户参数执行SecurityUtils.getSubject().login(usernamePasswordToken);

    2020-06-05 11:59:46
    赞同 展开评论 打赏
问答排行榜
最热
最新

相关电子书

更多
Spring Cloud Alibaba - 重新定义 Java Cloud-Native 立即下载
The Reactive Cloud Native Arch 立即下载
JAVA开发手册1.5.0 立即下载

相关镜像