Springboot下Shiro+Token使用Redis做安全认证方案的详细指南

2023-10-04 12:18:11

Springboot下Shiro+Token使用Redis做安全认证方案是一个非常有效且安全的解决方案。本文将提供一个详细的指南，帮助您轻松实现这一方案。

1. 引入依赖

在pom.xml文件中添加以下依赖：

<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.7.0</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-redis</artifactId>
    <version>2.5.5</version>
</dependency>

2. 配置Shiro

在application.yml文件中添加以下配置：

shiro:
  # 开启Shiro
  enabled: true
  # Realm实现类
  realm: com.example.shiro.MyRealm
  # 加密算法
  hashAlgorithmName: md5
  # 哈希散列次数
  hashIterations: 2
  # 会话超时时间（毫秒）
  sessionTimeout: 300000
  # 是否开启记住我功能
  rememberMeEnabled: true
  # 记住我功能超时时间（秒）
  rememberMeTimeout: 86400

3. 创建Realm

@Service
public class MyRealm extends AuthorizingRealm {

    @Autowired
    private UserService userService;

    @Autowired
    private RedisTemplate<String, Object> redisTemplate;

    /**
     * 授权
     *
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        // 获取用户名
        String username = (String) principalCollection.getPrimaryPrincipal();

        // 从数据库中获取用户角色和权限
        Set<String> roles = userService.findRolesByUsername(username);
        Set<String> permissions = userService.findPermissionsByUsername(username);

        // 构建AuthorizationInfo对象
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        authorizationInfo.setRoles(roles);
        authorizationInfo.setStringPermissions(permissions);

        return authorizationInfo;
    }

    /**
     * 认证
     *
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        // 获取用户名
        String username = (String) authenticationToken.getPrincipal();

        // 从数据库中获取用户密码
        String password = userService.findPasswordByUsername(username);

        // 如果用户不存在或密码不正确，则抛出异常
        if (password == null || !password.equals(authenticationToken.getCredentials())) {
            throw new AuthenticationException();
        }

        // 从Redis中获取用户Token
        String token = (String) redisTemplate.opsForValue().get(username);

        // 如果Token不存在或已过期，则重新生成Token
        if (token == null || isTokenExpired(token)) {
            token = generateToken();

            // 将Token存入Redis
            redisTemplate.opsForValue().set(username, token);
        }

        // 构建AuthenticationInfo对象
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(username, password, getName());
        authenticationInfo.addInfo("token", token);

        return authenticationInfo;
    }

    /**
     * 判断Token是否过期
     *
     * @param token
     * @return
     */
    private boolean isTokenExpired(String token) {
        // 根据Token生成过期时间
        Date expireTime = token.substring(0, token.indexOf("."));

        // 获取当前时间
        Date now = new Date();

        // 如果当前时间大于过期时间，则Token已过期
        return now.after(expireTime);
    }

    /**
     * 生成Token
     *
     * @return
     */
    private String generateToken() {
        // 生成随机数
        String random = UUID.randomUUID().toString();

        // 生成过期时间
        Date expireTime = new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 24);

        // 将随机数和过期时间拼接成Token
        return random + "." + expireTime.getTime();
    }
}

4. 配置Filter

在src/main/resources/META-INF/spring/shiro-filter.xml文件中添加以下配置：

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.1.xsd">

    <bean id="anon" class="org.apache.shiro.web.filter.authc.AnonymousFilter"/>
    <bean id="authc" class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter">
        <property name="loginUrl" value="/login"/>
        <property name="successUrl" value="/index"/>
    </bean>
    <bean id="perms" class="org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter"/>

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/login"/>
        <property name="successUrl" value="/index"/>
        <property name="unauthorizedUrl" value="/unauthorized"/>
        <property name="filterChainDefinitions">
            <value>
                /login = anon
                /index = authc
                /admin/** = perms["admin"]
                /** = anon
            </value>
        </property>
    </bean>

</beans>