框架概述
Apache Shiro是专为Java应用设计的轻量级安全框架，提供身份验证、权限控制、数据加密及会话管理四大核心功能。作为Apache基金会的开源项目，其设计目标是解决企业级应用的安全管理难题。
核心优势
1. 环境适配性：支持独立应用/集群部署，无需依赖特定容器
2. 模块化架构：提供可插拔的认证授权机制
3. Web增强功能：支持URL级权限控制和JSP标签库
4. 多线程安全：保障高并发场景下的会话一致性
5. 第三方集成：与Spring Boot、微服务框架无缝整合
核心组件解析
- Subject：安全操作的执行主体，封装用户认证状态
- SecurityManager：安全核心控制器，协调Realm与Session管理
- Realm：数据适配层，实现安全数据与业务系统的解耦
Spring Boot整合实践
Maven依赖配置
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring-boot-starter</artifactId>
<version>1.9.1</version>
</dependency>
认证接口实现
@RestController
public class AuthController {
@PostMapping("/login")
public ResponseEntity authenticate(@RequestParam String username,
@RequestParam String credentials) {
Subject subject = SecurityUtils.getSubject();
AuthToken token = new UsernamePasswordToken(username, credentials);
try {
subject.login(token);
return ResponseEntity.ok("认证成功");
} catch (AuthenticationException e) {
return ResponseEntity.status(401).body("认证失败");
}
}
}
安全配置类
@Configuration
public class SecurityConfig {
@Bean
public Realm customRealm() {
return new CustomRealm();
}
@Bean
public SecurityManager securityManager(Realm realm) {
DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
manager.setRealm(realm);
return manager;
}
@Bean
public ShiroFilterChainDefinition shiroFilterChain() {
return new ShiroFilterChainDefinition() {
@Override
public Map getFilterChainMap() {
Map chainMap = new LinkedHashMap<>();
chainMap.put("/api/admin/**", "authc,roles[admin]");
chainMap.put("/api/user/**", "authc");
chainMap.put("/**", "anon");
return chainMap;
}
};
}
}
自定义Realm实现
public class CustomRealm extends AuthorizingRealm {
@Autowired
private UserService userService;
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
String username = (String) principals.getPrimaryPrincipal();
User user = userService.find(username);
SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
info.addStringPermissions(user.getPermissions());
info.addRoles(user.getRoles());
return info;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) {
UsernamePasswordToken authToken = (UsernamePasswordToken) token;
User user = userService.find(authToken.getUsername());
if (user == null) throw new UnknownAccountException();
if (!user.isActive()) throw new LockedAccountException();
return new SimpleAuthenticationInfo(
user.getUsername(),
user.getPassword(),
getName()
);
}
}
安全控制流程
核心API使用示例
// 获取当前主体
Subject subject = SecurityUtils.getSubject();
// 权限校验
if(subject.hasRole("admin")) { /*...*/ }
if(subject.isPermitted("user:delete")) { /*...*/ }
// 会话管理
Session session = subject.getSession();
session.setAttribute("loginTime", new Date());
// 登出操作
subject.logout();
