SpringBoot简单集成Shiro登录验证

先导入pom.xml的依赖

<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.4.1</version>
        </dependency>

<!--配置日志文件-->
    <dependency>
    <groupId>org.slf4j</groupId>
    <artifactId>jcl-over-slf4j</artifactId>
</dependency>
<dependency>
    <groupId>log4j</groupId>
    <artifactId>log4j</artifactId>
    <version>1.2.17</version>
</dependency>

第二步，Shiro框架怎么用，直接配置相关信息即可，这里要注意，我们从下往上走，理解会更加的简单

@Configuration
public class ShiroConfig {

    //shiroFilterFactoryBean
    @Bean                                                      //此处Qualifier绑定的是getDefaultSecurityManager这个bean对象
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager defaultWebSecurityManager){
        //前两步固定套路，工厂模式创建一个shiroFilterFactoryBean,然后将下面的defaultWebSecurityManager设置进来
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        bean.setSecurityManager(defaultWebSecurityManager);

        // <!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
//        Map<String, String> filterMap = new LinkedHashMap<>();
//        //注意此处的页面路劲不是网页名称，而是MVC中的方法
//        filterMap.put("/main","anon");
//        bean.setFilterChainDefinitionMap(filterMap);

        //设置登录时路径
//        bean.setLoginUrl("/index");
        return bean;
    }

    //DefaultWebSecurityManager,中间商，处理用户 授权 以及 认证 的合法性，以此转交给上面的FilterFactorBean进行过滤
    @Bean(name = "securityManager")                             //此处Qualifier绑定的是userRealm这个bean对象
    public DefaultWebSecurityManager getDefaultSecurityManager(@Qualifier("userRealm") UserRealm userRealm){
        DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();

        //关联Realm
        defaultWebSecurityManager.setRealm(userRealm);

        return defaultWebSecurityManager;
    }

    //创建Realm对象,用来进行授权以及认证功能,完毕后转交给SecurityManager进行合法性验证
    @Bean
    public UserRealm userRealm(){
        return new UserRealm();
    }
}

然后我们来配置UserRealm的登录验证逻辑

public class UserRealm extends AuthorizingRealm {


    @Autowired
    UserMapper userMapper;

    //授权
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("执行了授权");
        return null;
    }

    //认证
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        System.out.println("执行了认证");

        //获取当前用户token
        UsernamePasswordToken userToken = (UsernamePasswordToken) token;

        //mybatis-plus查询
        QueryWrapper<User> queryWrapper = new QueryWrapper<>();
        queryWrapper.eq("username",userToken.getUsername());
        User user = userMapper.selectOne(queryWrapper);

        //后台测试打印用户是否正确获取
        System.out.println(user.getUsername()+" "+user.getPassword());

        //如果用户不存在
        if(user.getUsername() == null)
            return null; //自动抛出UnknownAccountException
　　　　　
        System.out.println(userToken.getUsername()+"......");

        //password siro处理 不交由用户处理
        return new SimpleAuthenticationInfo("",user.getPassword(),"");
    }
}

最后，新建一个log4j.properties配置一下日志文件即可

log4j.rootLogger=INFO, stdout

log4j.appender.stdout=org.apache.log4j.ConsoleAppender
log4j.appender.stdout.layout=org.apache.log4j.PatternLayout
log4j.appender.stdout.layout.ConversionPattern=%d %p [%c] - %m %n

# General Apache libraries
log4j.logger.org.apache=WARN

# Spring
log4j.logger.org.springframework=WARN

# Default Shiro logging
log4j.logger.org.apache.shiro=INFO

# Disable verbose logging
log4j.logger.org.apache.shiro.util.ThreadContext=WARN
log4j.logger.org.apache.shiro.cache.ehcache.EhCache=WARN

至此，登录验证用户名密码功能已经实现了。