shiro学习笔记

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>com.xie</groupId>
    <artifactId>ShiroDemo</artifactId>
    <packaging>war</packaging>
    <version>0.0.1-SNAPSHOT</version>
    <name>ShiroDemo Maven Webapp</name>
    <url>http://maven.apache.org</url>
    <dependencies>
        <dependency>  
            <groupId>junit</groupId>  
            <artifactId>junit</artifactId>  
            <version>4.9</version>  
        </dependency>  
        <dependency>  
            <groupId>commons-logging</groupId>  
            <artifactId>commons-logging</artifactId>  
            <version>1.1.3</version>  
        </dependency>  
        <dependency>  
            <groupId>org.apache.shiro</groupId>  
            <artifactId>shiro-core</artifactId>  
            <version>1.2.2</version>  
        </dependency>
    </dependencies>
    <build>
        <finalName>ShiroDemo</finalName>
    </build>
</project>

[users]  
#用户zhang的密码是123，此用户具有role1和role2两个角色  
zhang=123,role1,role2  
wang=123,role2
  
[roles]  
#角色role1对资源user拥有create、update权限  
role1=user1:create,user1:update  
#角色role2对资源user拥有create、delete权限  
role2=user:create,user:delete  
#角色role3对资源user拥有create权限  
role3=user:create  

import java.util.Arrays;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.authc.AccountException;
import org.apache.shiro.authc.ConcurrentAccessException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.junit.Test;

public class HelloWorld {
    
    public static void main(String[] args) {
        
    }
    
    @Test  
    public void testHelloworld() {  
        //1、获取SecurityManager工厂，此处使用Ini配置文件初始化SecurityManager  
        Factory<SecurityManager> factory =  
                new IniSecurityManagerFactory("classpath:shiro.ini");  
        //2、得到SecurityManager实例 并绑定给SecurityUtils  
        SecurityManager securityManager = factory.getInstance();  
        SecurityUtils.setSecurityManager(securityManager);  
        //3、得到Subject及创建用户名/密码身份验证Token（即用户身份/凭证）  
        Subject subject = SecurityUtils.getSubject();  
        UsernamePasswordToken token = new UsernamePasswordToken("zhang", "1231");  
        token.setRememberMe(true);
        
        try { 
            if(subject.hasRole("admin")){
                // 
            }
            //4、登录，即身份验证  
            subject.login(token);
            System.out.println("登录，即身份验证");
        } catch (UnknownAccountException e) {
            System.out.println("用户不存在"); // 用户不存在
        } catch (IncorrectCredentialsException e) {
            System.out.println("密码不正确"); // 密码不正确
        } catch (ConcurrentAccessException e) {
            System.out.println("用户重复登录"); // 用户重复登录
        } catch (AccountException e) {
            System.out.println("其他账户异常"); // 其他账户异常
        }
        
      
        // 用户认证状态          
        Boolean isAuthenticated = subject.isAuthenticated();  
        System.out.println("用户认证状态：" + isAuthenticated);  
  
        // 用户退出    
        subject.logout();    
        isAuthenticated = subject.isAuthenticated();    
        System.out.println("用户认证状态：" + isAuthenticated); 
    }
    
    
    @Test
    public void testPermission(){
        // 从ini文件中创建SecurityManager工厂  
        Factory<SecurityManager> factory = new IniSecurityManagerFactory(  
                "classpath:shiro-permission.ini");
        
        // 创建SecurityManager
        SecurityManager securityManager = factory.getInstance();
        
        // 将securityManager设置到运行环境
        SecurityUtils.setSecurityManager(securityManager);
        
        // 创建主体对象
        Subject subject = SecurityUtils.getSubject();
        
        // 对主体对象进行认证  
        // 用户登陆  
        // 设置用户认证的身份(principals)和凭证(credentials) 
        UsernamePasswordToken token = new UsernamePasswordToken("zhang1","123");
        System.out.println(token.getPrincipal());
        System.out.println(token.getHost());
        System.out.println(token.getUsername());
        System.out.println(token.getPassword());
        subject.login(token);
        
        // 用户认证状态 
        Boolean isAuthenticated = subject.isAuthenticated();
        System.out.println("用户认证状态：" + isAuthenticated);
        
        // 用户授权检测 基于角色授权  
        // 是否有某一个角色 
        System.out.println("用户是否拥有一个角色：" + subject.hasRole("role1"));  
        // 是否有多个角色  
        System.out.println("用户是否拥有多个角色：" + subject.hasAllRoles(Arrays.asList("role1", "role2")));
        System.out.println("用户是否拥有多个角色：" + subject.hasAllRoles(Arrays.asList("role1", "role2", "role3")));
        
        subject.checkRole("role1");
        subject.checkRoles(Arrays.asList("role1", "role2"));
        
        // 基于资源授权  
        System.out.println("是否拥有某一个权限：" + subject.isPermitted("user:delete"));  
        System.out.println("是否拥有多个权限：" + subject.isPermittedAll("user1:create:3","user:delete","user1:update"));  
        
    }
    
    @Test
    public void MD5Test(){
        // 有权限
        String password_md5 = new Md5Hash("111111").toString();
        System.out.println("md5加密，不加盐="+password_md5);
        
        String password_md5_sale_1 = String.valueOf(new Md5Hash("111111", "2",1)).toString();
        System.out.println("password_md5_sale_1="+password_md5_sale_1);
        
        String simpleHash  = String.valueOf(new SimpleHash("MD5", "111111", "2",1)).toString();
        System.out.println("simpleHash ="+simpleHash );
        
    }

}