MyJdbcRealmTest.java:

import com.alibaba.druid.pool.DruidDataSource;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.realm.jdbc.JdbcRealm;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class MyJdbcRealmTest {

    //从数据库获取对应用户密码实现认证
    protected static final String AUTHENTICATION_QUERY = "select password from test_users where user_name = ?";
    //从数据库中获取对应用户的所有角色
    protected static final String USER_ROLES_QUERY = "select role from test_user_roles where user_name = ?";
    //从数据库中获取角色对应的所有权限
    protected static final String PERMISSIONS_QUERY = "select permission from test_roles_permissions where role = ?";

    DruidDataSource druidDataSource = new DruidDataSource();
    {
        druidDataSource.setUrl("jdbc:mysql://localhost:3306/shiro");
        druidDataSource.setUsername("root");
        druidDataSource.setPassword("0113");
    }

    @Test
    public void testMyJdbcRealm(){

        //1.创建Realm并设置数据库查询语句
        JdbcRealm jdbcRealm = new JdbcRealm();
        jdbcRealm.setDataSource(druidDataSource);//配置数据源
        jdbcRealm.setPermissionsLookupEnabled(true);//设置允许查询权限，否则checkPermission抛异常，默认值为false
        jdbcRealm.setAuthenticationQuery(AUTHENTICATION_QUERY);//设置用户认证信息查询语句
        jdbcRealm.setUserRolesQuery(USER_ROLES_QUERY);//设置用户角色信息查询语句
        jdbcRealm.setPermissionsQuery(PERMISSIONS_QUERY);//设置角色权限信息查询语句

        //2.创建SecurityManager并配置环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(jdbcRealm);

        //3.创建subject
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();

        //4.Subject通过Token提交认证
        UsernamePasswordToken token = new UsernamePasswordToken("java","123");
        subject.login(token);//退出登录subject.logout();

        //验证认证与授权情况
        System.out.println("isAuthenticated: "+ subject.isAuthenticated());
        subject.hasRole("admin");
        subject.checkPermission("user:delete");
    }
}

自定义Realm

  自定义Realm，可以继承抽象类AuthorizingRealm，实现其两个方法——doGetAuthenticationInfo和doGetAuthorizationInfo，分别用来返回AuthenticationInfo(认证信息)和AuthorizationInfo(授权信息)。

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    //1.获取主体中的用户名
    String userName = (String) authenticationToken.getPrincipal();
    //2.通过用户名获取密码,getPasswordByName自定义实现
    String password = getPasswordByUserName(userName);
    if(null == password){
        return null;
    }
    //构建AuthenticationInfo返回
    SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userName,password,"MyRealm");
    return authenticationInfo;
}

@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    //1.获取用户名。principal为Object类型，是用户唯一标识，可以是用户名，用户邮箱，数据库主键等，能唯一确定一个用户的信息。
    String userName = (String) principalCollection.getPrimaryPrincipal();
    //2.获取角色信息，getRoleByUserName自定义
    Set<String> roles = getRolesByUserName(userName);
    //3.获取权限信息，getPermissionsByRole方法同样自定义，也可以通过用户名查找权限信息
    Set<String> permissions = getPermissionsByUserName(userName);
    //4.构建认证信息并返回。
    SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
    simpleAuthorizationInfo.setStringPermissions(permissions);
    simpleAuthorizationInfo.setRoles(roles);
    return simpleAuthorizationInfo;
}

完整的，包含添加用户功能的自定义Realm
MyRealm.java:

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.CollectionUtils;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.locks.ReadWriteLock;
import java.util.concurrent.locks.ReentrantReadWriteLock;

public class MyRealm extends AuthorizingRealm {

    /**存储用户名和密码*/
    protected final Map<String,String> userMap;
    /**存储用户及其对应的角色*/
    protected final Map<String, Set<String>> roleMap;
    /**存储所有角色以及角色对应的权限*/
    protected final Map<String,Set<String>> permissionMap;

    {
        //设置Realm名
        super.setName("MyRealm")  ;
    }

    public MyRealm(){
        userMap = new ConcurrentHashMap<>(16);
        roleMap = new ConcurrentHashMap<>(16);
        permissionMap = new ConcurrentHashMap<>(16);
    }

    /**
     * 身份认证必须实现的方法
     * @param authenticationToken token
     * @return org.apache.shiro.authc.AuthenticationInfo
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //1.获取主体中的用户名
        String userName = (String) authenticationToken.getPrincipal();
        //2.通过用户名获取密码,getPasswordByName自定义实现
        String password = getPasswordByUserName(userName);
        if(null == password){
            return null;
        }
        //构建AuthenticationInfo返回
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userName,password,"MyRealm");
        return authenticationInfo;
    }

    /**
     * 用于授权
     * @return org.apache.shiro.authz.AuthorizationInfo
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //1.获取用户名。principal为Object类型，是用户唯一标识，可以是用户名，用户邮箱，数据库主键等，能唯一确定一个用户的信息。
        String userName = (String) principalCollection.getPrimaryPrincipal();
        //2.获取角色信息，getRoleByUserName自定义
        Set<String> roles = getRolesByUserName(userName);
        //3.获取权限信息，getPermissionsByRole方法同样自定义，也可以通过用户名查找权限信息
        Set<String> permissions = getPermissionsByUserName(userName);
        //4.构建认证信息并返回。
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    /**
     * 自定义部分,通过用户名获取权限信息
     * @return java.util.Set<java.lang.String>
     */
    private Set<String> getPermissionsByUserName(String userName) {
        //1.先通过用户名获取角色信息
        Set<String> roles = getRolesByUserName(userName);
        //2.通过角色信息获取对应的权限
        Set<String> permissions = new HashSet<String>();
        //3.添加每个角色对应的所有权限
        roles.forEach(role -> {
            if(null != permissionMap.get(role)) {
                permissions.addAll(permissionMap.get(role));
            }

        });
        return permissions;
    }

    /**
     * 自定义部分，通过用户名获取密码，可改为数据库操作
     * @param userName 用户名
     * @return java.lang.String
     */
    private String getPasswordByUserName(String userName){
        return userMap.get(userName);
    }

    /**
     * 自定义部分，通过用户名获取角色信息,可改为数据库操作
     * @param userName 用户名
     * @return java.util.Set<java.lang.String>
     */
    private Set<String> getRolesByUserName(String userName){
        return roleMap.get(userName);
    }

    /**
     * 往realm添加账号信息,变参不传值会接收到长度为0的数组。
     */
    public void addAccount(String userName,String password) throws UserExistException{
        addAccount(userName,password,(String[]) null);
    }

    /**
     * 往realm添加账号信息
     * @param userName 用户名
     * @param password 密码
     * @param roles 角色(变参)
     */
    public void addAccount(String userName,String password,String... roles) throws UserExistException{
        if( null != userMap.get(userName) ){
            throw new UserExistException("user \""+ userName +" \" exists");
        }
        userMap.put(userName, password);
        roleMap.put(userName, CollectionUtils.asSet(roles));
    }

    /**
     * 从realm删除账号信息
     * @param userName 用户名
     */
    public void delAccount(String userName){
        userMap.remove(userName);
        roleMap.remove(userName);
    }

    /**
     * 添加角色权限,变参不传值会接收到长度为0的数组。
     * @param roleName 角色名
     */
    public void addPermission(String roleName,String...permissions){
        permissionMap.put(roleName,CollectionUtils.asSet(permissions));
    }

    /**用户已存在异常*/
    public class UserExistException extends Exception{
        public UserExistException(String message){super(message);}
    }
}

测试代码
MyRealmTest.java:

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

public class MyRealmTest {

    @Test
    public void testMyRealm(){

        //1.创建Realm并添加数据
        MyRealm myRealm = new MyRealm();
        try {
            myRealm.addAccount("java", "123", "admin");
        }catch (Exception e){
            e.printStackTrace();
        }
        myRealm.addPermission("admin","user:delete");

        //2.创建SecurityManager并配置环境
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager();
        defaultSecurityManager.setRealm(myRealm);

        //3.创建subject
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();

        //4.Subject通过Token提交认证
        UsernamePasswordToken token = new UsernamePasswordToken("java","123");
        subject.login(token);//退出登录subject.logout();

        //验证认证与授权情况
        System.out.println("isAuthenticated: "+ subject.isAuthenticated());
        subject.hasRole("admin");
        subject.checkPermission("user:delete");
    }
}

加密

  使用加密，只需要在Realm返回的AuthenticationInfo添加用户密码对应的盐值:

@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
    //1.获取主体中的用户名
    String userName = (String) authenticationToken.getPrincipal();
    //2.通过用户名获取密码,getPasswordByName自定义实现
    String password = getPasswordByUserName(userName);
    if(null == password){
        return null;
    }
    //3.构建authenticationInfo认证信息
    SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userName,password,"MyRealm");
    //设置盐值
    String salt = getSaltByUserName(userName);
    authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes(salt));
    return authenticationInfo;
}

  并且在测试代码中给Realm设置加密:

//设置加密
HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
matcher.setHashAlgorithmName("MD5");//设置加密算法
matcher.setHashIterations(3);//设置加密次数
myEncryptedRealm.setCredentialsMatcher(matcher);

  CredentialMatcher用来匹配用户密码。shiro通过Realm获取AuthenticationInfo，AuthenticationInfo里面包含该用户的principal、credential、salt。principal就是用户名或手机号或其他，credential就是密码（加盐加密后，存到数据源中的密码），salt就是密码对应的“盐”。shiro获取到这些信息之后，利用CredentialMatcher中配置的信息(加密算法，加密次数等)，对token中用户输入的、待校验的密码，进行加盐加密，然后比对结果是否和AuthenticationInfo中的credential一致，若一致，则用户通过认证。
  “加密”算法一般用的是hash算法，hash算法并不是用来加密的，而是用来生成信息摘要，该过程是不可逆的，不能从结果逆推得出用户的密码的原文。下文这一段话也是相对于hash算法而言，其他算法不在考虑范围内。shiro的CredentialMatcher并没有“解密”这个概念，因为不能解密，不能把数据库中“加密”后的密码还原，只能对用户输入的密码，进行一次相同的“加密”，然后比对数据库的“加密”后的密码，从而判断用户输入的密码是否正确。

  必要地，在存密码时，要存储加盐加密后的密码:

public void addAccount(String userName,String password,String... roles) throws UserExistException {
    if(null != userMap.get(userName)){
        throw new UserExistException("user \""+ userName +"\" exist");
    }
    //如果配置的加密次数大于0，则进行加密
    if(iterations > 0){
        //使用随机数作为密码，可改为UUID或其它
        String salt = String.valueOf(Math.random()*10);
        saltMap.put(userName,salt);
        password = doHash(password, salt);
    }
    userMap.put(userName, password);
    roleMap.put(userName, CollectionUtils.asSet(roles));
}

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.apache.shiro.util.CollectionUtils;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;

public class MyEncryptedRealm extends AuthorizingRealm {

    /** 加密次数 */
    private int iterations;
    /** 算法名 */
    private String algorithmName;

    /** 存储用户名和密码 */
    private final Map userMap;
    /** 存储用户及其对应的角色 */
    private final Map> roleMap;
    /** 存储所有角色以及角色对应的权限 */
    private final Map> permissionMap;
    /** 存储用户盐值 */
    private Map saltMap;

    {
        //设置Realm名
        super.setName("MyRealm");
    }

    public MyEncryptedRealm(){
        this.iterations = 0;
        this.algorithmName = "MD5";
        this.userMap = new ConcurrentHashMap<>(16);
        this.roleMap = new ConcurrentHashMap<>(16);
        this.permissionMap  = new ConcurrentHashMap<>(16);
        this.saltMap = new ConcurrentHashMap<>(16);
    }

    /**
     * 身份认证必须实现的方法
     * @param authenticationToken token
     * @return org.apache.shiro.authc.AuthenticationInfo
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        //1.获取主体中的用户名
        String userName = (String) authenticationToken.getPrincipal();
        //2.通过用户名获取密码,getPasswordByName自定义实现
        String password = getPasswordByUserName(userName);
        if(null == password){
            return null;
        }
        //3.构建authenticationInfo认证信息
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userName,password,"MyRealm");
        //设置盐值
        String salt = getSaltByUserName(userName);
        authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes(salt));
        return authenticationInfo;
    }


    /**
     * 用于授权
     * @return org.apache.shiro.authz.AuthorizationInfo
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //1.获取用户名。principal为Object类型，是用户唯一凭证，可以是用户名，用户邮箱，数据库主键等，能唯一确定一个用户的信息。
        String userName = (String) principalCollection.getPrimaryPrincipal();
        //2.获取角色信息，getRoleByUserName自定义
        Set roles = getRolesByUserName(userName);
        //3.获取权限信息，getPermissionsByRole方法同样自定义，也可以通过用户名查找权限信息
        Set permissions = getPermissionsByUserName(userName);
        //4.构建认证信息并返回。
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        simpleAuthorizationInfo.setStringPermissions(permissions);
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    /**
     * 自定义部分,通过用户名获取权限信息
     * @return java.util.Set
     */
    private Set getPermissionsByUserName(String userName) {
        //1.先通过用户名获取角色信息
        Set roles = getRolesByUserName(userName);
        //2.通过角色信息获取对应的权限
        Set permissions = new HashSet<>();
        //3.添加每个角色对应的所有权限
        roles.forEach(role -> {
            if (null != permissionMap.get(role)) {
                permissions.addAll(permissionMap.get(role));
            }
        });
        return permissions;
    }

    /**
     * 自定义部分，通过用户名获取密码，可改为数据库操作
     * @return java.lang.String
     */
    private String getPasswordByUserName(String userName){
        return userMap.get(userName);
    }

    /**
     * 自定义部分，通过用户名获取角色信息,可改为数据库操作
     * @return java.util.Set
     */
    private Set getRolesByUserName(String userName){
        return roleMap.get(userName);
    }

    /**
     * 自定义部分，通过用户名获取盐值,可改为数据库操作
     * @return java.util.Set
     */
    private String getSaltByUserName(String userName) {
        return saltMap.get(userName);
    }

    /**
     * 往realm添加账号信息,变参不传值会接收到长度为0的数组。
     */
    public void addAccount(String userName,String password) throws UserExistException {
        addAccount(userName,password,(String[]) null);
    }

    /**
     * 往realm添加账号信息
     */
    public void addAccount(String userName,String password,String... roles) throws UserExistException {
        if(null != userMap.get(userName)){
            throw new UserExistException("user \""+ userName +"\" exist");
        }
        //如果配置的加密次数大于0，则进行加密
        if(iterations > 0){
            String salt = String.valueOf(Math.random()*10);
            saltMap.put(userName,salt);
            password = doHash(password, salt);
        }
        userMap.put(userName, password);
        roleMap.put(userName, CollectionUtils.asSet(roles));
    }

    /**
     * 从realm删除账号信息
     * @param userName 用户名
     */
    public void deleteAccount(String userName){
        userMap.remove(userName);
        roleMap.remove(userName);
    }


    /**
     * 添加角色权限,变参不传值会接收到长度为0的数组。
     * @param roleName 角色名
     */
    public void addPermission(String roleName,String...permissions){
        permissionMap.put(roleName, CollectionUtils.asSet(permissions));
    }

    /**
     * 设置加密次数
     * @param iterations 加密次数
     */
    public void setHashIterations(int iterations){
        this.iterations = iterations;
    }

    /**
     * 设置算法名
     * @param algorithmName 算法名
     */
    public void setAlgorithmName(String algorithmName){
        this.algorithmName = algorithmName;
    }

    /**
     * 计算哈希值
     * @param str 要进行"加密"的字符串
     * @param salt 盐
     * @return String
     */
    private String doHash(String str,String salt){
        salt = null==salt ? "" : salt;
        return new SimpleHash(this.algorithmName,str,salt,this.iterations).toString();
    }


    /**
     * 注册时，用户已存在的异常
     */
    public class UserExistException extends Exception{
        public UserExistException(String message) {super(message);}
    }

}

 
package com.lifeofcoding.shiro;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.HashedCredentialsMatcher;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.subject.Subject;
import org.junit.Test;

/**
 * @Classname MyEncryptionRealmTest
 * @Description TODO
 * @Date 2019-11-2019-11-20-17:41
 * @Created by yo
 */
public class MyEncryptedRealmTest {

    private MyEncryptedRealm myEncryptedRealm;

    @Test
    public void testShiroEncryption() {
        //1.创建Realm并添加数据
        MyEncryptedRealm myEncryptedRealm = new MyEncryptedRealm();
        myEncryptedRealm.setHashIterations(3);
        myEncryptedRealm.setAlgorithmName("MD5");
        try {
            myEncryptedRealm.addAccount("java", "123456", "admin");
        }catch (Exception e){
            e.printStackTrace();
        }
        myEncryptedRealm.addPermission("admin","user:create","user:delete");

        //2.创建SecurityManager对象
        DefaultSecurityManager defaultSecurityManager = new DefaultSecurityManager(myEncryptedRealm);

        //3.设置加密
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        matcher.setHashAlgorithmName("MD5");//设置加密算法
        matcher.setHashIterations(3);//设置加密次数
        myEncryptedRealm.setCredentialsMatcher(matcher);

        //4.创建主体并提交认证
        SecurityUtils.setSecurityManager(defaultSecurityManager);
        Subject subject = SecurityUtils.getSubject();

        UsernamePasswordToken token = new UsernamePasswordToken("java","123456");
        subject.login(token);
        System.out.println(subject.getPrincipal()+" isAuthenticated: "+subject.isAuthenticated());
        subject.checkRole("admin");
        subject.checkPermission("user:delete");
    }
}