[successbox title=”Shiro加密”]
Shiro加密可以让密码安全的保存，不明文保存密码。
[/successbox]
1.导入Maven。
[sourcecode language=”xml” title=”pom.xml”]
<dependencies>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.2.2</version>
</dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>RELEASE</version>
</dependency>
<dependency>
<groupId>mysql</groupId>
<artifactId>mysql-connector-java</artifactId>
<version>5.1.45</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>druid</artifactId>
<version>1.1.6</version>
</dependency>
</dependencies>
[/sourcecode]
2.编写自定义Realm。
[sourcecode language=”java” title=”CustomRealm.java”]
package com.benzhu.shiro.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.realm.SimpleAccountRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

public class CustomRealm extends AuthorizingRealm {

Map<String,String> userMap = new HashMap<String, String>(16);

{
userMap.put("benzhu","5282d562ad1f43221a173ab92c1793d2");
super.setName("customRealm");
}

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String username = (String) principals.getPrimaryPrincipal();
//从缓存中拿到角色数据
Set<String> roles = getRolesByUserName(username);
//从缓存中拿到权限数据
Set<String> permissions = getPermissionUserName(username);
//返回对象
SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
authorizationInfo.setRoles(roles);
authorizationInfo.setStringPermissions(permissions);
return authorizationInfo;
}

private Set<String> getPermissionUserName(String username) {
Set<String> sets = new HashSet<String>();
sets.add("admin:update");
return sets;
}

private Set<String> getRolesByUserName(String username) {
Set<String> sets = new HashSet<String>();
sets.add("admin");
return sets;
}

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
//1.从主体传过来的认证信息中获取用户名
String username = (String) token.getPrincipal();
//2.通过用户名到数据库中获取凭证
String password = getPasswordByUserName(username);
if(password == null){
return null;
}
SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(username,password,"customRealm");
//加盐验证（重要节点）
authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes("benzhu"));
return authenticationInfo;

}

private String getPasswordByUserName(String username) {
//模拟数据库查询
return userMap.get(username);
}

public static void main(String[] args) {
//计算加密结果的主方法 用来计算加密的密码结果 非必需
Md5Hash md5Hash = new Md5Hash("123456","benzhu");
System.out.println(md5Hash);
}
}
[/sourcecode]
3.编写测试类。
[sourcecode language=”java” title=”CustomRealmTest.java”]
package com.benzhu.test;

import com.benzhu.shiro.realm.CustomRealm;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.authz.UnauthorizedException;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class CustomRealmTest {
@Test
public void tsetAuthentication(){

CustomRealm customRealm = new CustomRealm();

//1.构建SecurityManager环境
DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
defaultSecurityManager.setRealm(customRealm);
//shiro加密（重点）
HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(); //创建加密对象
matcher.setHashAlgorithmName("md5"); //加密的算法
matcher.setHashIterations(1);//加密次数
customRealm.setCredentialsMatcher(matcher); //放入自定义Realm

//2.主体提交认证请求
SecurityUtils.setSecurityManager(defaultSecurityManager);
Subject subject = SecurityUtils.getSubject();

UsernamePasswordToken token = new UsernamePasswordToken("benzhu","123456");
try {
subject.login(token);
try {
subject.checkRole("admin");
subject.checkPermission("admin:update");
}catch (UnauthorizedException exception){
System.out.println("角色授权或者权限授权失败！");
}

}catch (AuthenticationException e){
System.out.println("认证失败！");
}

System.out.println("isAuthenticated:"+subject.isAuthenticated());
subject.logout();
System.out.println("isAuthenticated:"+subject.isAuthenticated());
}
}
[/sourcecode]
效果图：