1
步骤 解压缩
unzip shiro-root-1.4.1-source-release.zip
进入目录
cd shiro-root-1.4.1/samples/quickstar
运行
mvn compile exec:java
概念 subject/session,然后判断user是否登录，没有则用subject（user）来使用 token登录，
subject 是用户，但不这么叫，安全领域都这么做，session的好处是 不需要web
Subject currentUser = SecurityUtils.getSubject();
Session session = currentUser.getSession();
session.setAttribute( "someKey", "aValue" );
if ( !currentUser.isAuthenticated() ) {
//collect user principals and credentials in a gui specific manner
//such as username/password html form, X509 certificate, OpenID, etc.
//We'll use the username/password example here since it is the most common.
//(do you know what movie this is from? ;)
UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");
//this is all you have to do to support 'remember me' (no config - built in!):
token.setRememberMe(true);
currentUser.login(token);
}
如果失败的话会有四种 错误
try {
currentUser.login( token );
//if no exception, that's it, we're done!
} catch ( UnknownAccountException uae ) {
//username wasn't in the system, show them an error message?
} catch ( IncorrectCredentialsException ice ) {
//password didn't match, try again?
} catch ( LockedAccountException lae ) {
//account for that username is locked - can't login. Show them a message?
}
... more types exceptions to check if you want ...
} catch ( AuthenticationException ae ) {
//unexpected condition - error?
}
获取 principal就是用户名，判断角色和权限
log.info( "User [" + currentUser.getPrincipal() + "] logged in successfully." );
if ( currentUser.hasRole( "schwartz" ) ) {
log.info("May the Schwartz be with you!" );
} else {
log.info( "Hello, mere mortal." );
}
检测访问特定类型的示例
if ( currentUser.isPermitted( "lightsaber:weild" ) ) {
log.info("You may use a lightsaber ring. Use it wisely.");
} else {
log.info("Sorry, lightsaber rings are for schwartz masters only.");
}
用户的退出
currentUser.logout();
2 具体的流程
1) 认证，remberme就是记住了用户标示，有两个概念 主体和 凭证，主体Principals 是用户名，凭证是秘钥Credentials
UsernamePasswordToken token = new UsernamePasswordToken(username, password);
//"Remember Me" built-in:
token.setRememberMe(true);
2）登录
3）处理异常，和上面代码一样，处理异常确保有人是否是黑客输入了错误密码
4） 记住我和认证过是互斥的，记住我只记住了名字，认证是登录后的认证
记住我不适合做敏感操作，比如买书会推荐给你，但 交易会让强制登录
，退出后建议重定向新页面为了清理cookie,因为也要清理rememberme
认证流程就是上四个，涉及到了realm
授权的流程：
分为单个realm和多个，单个直接，多个会有策略，如必须全部，第三个第一个必须成功，其他无所谓，任何一个等等
配置文件例子
[main]
...
authenticator = com.foo.bar.CustomAuthenticator
securityManager.authenticator = $authenticator
AtLeastOneSuccessfulStrategy
FirstSuccessfulStrategy
AllSuccessfulStrategy
策略配置：
[main]
...
authcStrategy = org.apache.shiro.authc.pam.FirstSuccessfulStrategy
securityManager.authenticator.authenticationStrategy = $authcStrategy
还有认证的顺序排序：
http://shiro.apache.org/authentication.html
3 ） 授权
http://shiro.apache.org/authorization.html#Authorization-ObjectbasedPermissionChecks
各种的 check / is / role /permission/ string /object
检查的，权限的，字符串的，对象的，全部的，单个的等等的组合
4）各种注解版
@RequiresPermissions("account:create")
@RequiresRoles("administrator")
