springboot整合shiro多驗證登錄功能的實現（賬號密碼登錄和使用手機驗證碼登錄）

@Configuration
public class SpringShiroConfig {


    /**
     * @param realms 這兒使用接口集合是為瞭實現多驗證登錄時使用的
     * @return
     */
    @Bean
    public SecurityManager securityManager(Collection<Realm> realms) {
        DefaultWebSecurityManager sManager = new DefaultWebSecurityManager();
        sManager.setRealms(realms);
        return sManager;
    }

    @Bean
    public ShiroFilterFactoryBean shiroFilterFactory(SecurityManager securityManager) {
        ShiroFilterFactoryBean sfBean = new ShiroFilterFactoryBean();
        sfBean.setSecurityManager(securityManager);
        //如果是匿名訪問時，訪問瞭不能訪問的資源跳轉的位置
        sfBean.setLoginUrl("/index");
        //定義map指定請求過濾規則(哪些資源允許匿名訪問,哪些必須認證訪問)
        LinkedHashMap<String, String> map = new LinkedHashMap<>();
        //靜態資源允許匿名訪問:"anon" 靜態資源授權時不能寫static下面所有的開放，要將static下面的所有文件夾一個一個的開放，templates同理
        //map的key可以為文件的位置，也可以為請求的路徑
        map.put("/bower_components/**", "anon");
        map.put("/json/**", "anon");
        map.put("/pages", "anon");
        map.put("/user/userPasswordLogin", "anon");
        map.put("/user/login", "anon");
        map.put("/user/reg", "anon");
        //訪問這個路徑時不會進入controller，會在這兒直接攔截退出，問為什麼的，自己想請求流程去
        map.put("/user/userLogout", "logout");
        //攔截除上面之外的所有請求路徑
        map.put("/**", "user");
        sfBean.setFilterChainDefinitionMap(map);
        return sfBean;
    }

    @Bean
    public LifecycleBeanPostProcessor lifecycleBeanPostProcessor() {
        return new LifecycleBeanPostProcessor();
    }

@Service
public class ShioUserRealm extends AuthorizingRealm {

    //註入userdao
    @Autowired
    private UserDao userDao;
    /**
     * 設置憑證匹配器
     *
     * @param credentialsMatcher
     */
    @Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        /*這裡設置瞭MD5鹽值加密，這兒就必須使用HashedCredentialsMatcher才能有下面兩個方法*/
        HashedCredentialsMatcher matcher = new HashedCredentialsMatcher();
        //這裡是設置加密方式
        matcher.setHashAlgorithmName("MD5");
        //這裡是設置加密的次數
        matcher.setHashIterations(2);
        super.setCredentialsMatcher(matcher);
    }

    /**
     * 這兒是設置授權的
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        return null;
    }

    /**
     * 通過此方法完成認證數據的獲取及封裝，系統底層會將認證數據傳遞認證管理器，有認證管理器完成認證操作
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        //先判斷這個是否是來及這個令牌的數據：我們這兒分為瞭UsernamePasswordToken（shiro給我們提供的。）、UserPhoneToken
        if (!(authenticationToken instanceof UsernamePasswordToken)) {
            return null;
        }
        //獲取controller傳過來的數據
        UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken;
        //upToken.setRememberMe(true);shiro默認為false,是是否記住我的功能
        //這兒為用戶提交的username
        String username = upToken.getUsername();
        //去數據更加name取到用戶的信息
        User user = userDao.findUserByUserName(username);
        //判斷數據庫是否有這用戶
        if (user == null) {
            throw new UnknownAccountException();
        }
        //判斷用戶的狀態是否被禁用(數據庫的字段)
        if (user.getState() == 0) {
            throw new LockedAccountException();
        }
        //這兒是取到用戶信息中的鹽值，鹽值要轉換為ByteSource這個類型才能使用
        ByteSource credentialsSalt = ByteSource.Util.bytes(user.getSalt());
        //這兒是將這個用戶的信息交給shiro（user為用戶對象，user.getPassword()是要加密的對象，credentialsSalt為鹽值，getName()當前對象）
        SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, user.getPassword(), credentialsSalt, getName());
        return info;
    }
}

@RequestMapping("userPasswordLogin")
    @ResponseBody
    public JsonResult userPasswordLogin(String username, String password) {
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        subject.login(token);
        return new JsonResult("login Ok");
    }

@Component
public class UserPhoneToken extends UsernamePasswordToken implements Serializable {

    private static final long serialVersionUID = 6293390033867929958L;
    // 手機號碼
    private String phoneNum;
    //無參構造
    public UserPhoneToken(){}
    
    //獲取存入的值
    @Override
    public Object getPrincipal() {
        if (phoneNum == null) {
            return getUsername();
        } else {
            return getPhoneNum();
        }
    }

    @Override
    public Object getCredentials() {
        if (phoneNum == null) {
            return getPassword();
        }else {
            return "ok";
        }

    }

    public UserPhoneToken(String phoneNum) {
        this.phoneNum = phoneNum;
    }

    public UserPhoneToken(final String userName, final String password) {
        super(userName, password);
    }

    public String getPhoneNum() {
        return phoneNum;
    }

    public void setPhoneNum(String phoneNum) {
        this.phoneNum = phoneNum;
    }
    @Override
    public String toString() {
        return "PhoneToken [PhoneNum=" + phoneNum + "]";
    }

}

@Service
public class ShioUserPhoneRealm extends AuthorizingRealm {

    @Autowired
    private UserDao userDao;

    @Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        //這兒的CredentialsMatcher的new的對象必須是AllowAllCredentialsMatcher
        CredentialsMatcher matcher = new AllowAllCredentialsMatcher();
        super.setCredentialsMatcher(matcher);
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        return null;
    }

    /**
     * 通過此方法完成認證數據的獲取及封裝，系統底層會將認證數據傳遞認證管理器，有認證管理器完成認證操作
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {

        UserPhoneToken token = null;
        if (authenticationToken instanceof UserPhoneToken) {
            token = (UserPhoneToken) authenticationToken;
        }else {
            return null;
        }
        //獲取我發送驗證碼是存入session中的驗證碼和手機號
        String verificationCode = (String) SecurityUtils.getSubject().getSession().getAttribute("verificationCode");
        String phone = (String) SecurityUtils.getSubject().getSession().getAttribute("phone");
        //獲取controller傳過來的數據
        String verificationCode1 = (String) token.getPrincipal();
        //去數據庫根據手機號查詢用戶信息
        User user = userDao.findUserByUserPhone(phone);
        if (StringUtils.isEmpty(verificationCode)) {
            throw new ServiceException("網絡錯誤");
        }
        //比對手機號
        if (!verificationCode.equals(verificationCode1)) {
            throw new ServiceException("驗證碼不正確");
        }
        if (user == null) {
            throw new UnknownAccountException();
        }
        if (user.getState() == 0) {
            throw new LockedAccountException();
        }
        return new SimpleAuthenticationInfo(user,phone,getName());
    }
}

@PostMapping("verificationCodeLogin")
    @ResponseBody
    public JsonResult verificationCodeLogin(String password) {
        Subject subject = SecurityUtils.getSubject();
        UserPhoneToken token = new UserPhoneToken(password);
        subject.login(token);
        return new JsonResult("login OK");
    }

@Override
    public void setCredentialsMatcher(CredentialsMatcher credentialsMatcher) {
        //這兒的CredentialsMatcher的new的對象必須是AllowAllCredentialsMatcher
        CredentialsMatcher matcher = new AllowAllCredentialsMatcher();
        super.setCredentialsMatcher(matcher);
    }