张志敏的技术专栏

public class Sha256PasswordEncoder implements PasswordEncoder {

    @Override
    public String encode(CharSequence rawPassword) {
        try {
            var digest = MessageDigest.getInstance("SHA-256");
            var hash = digest.digest(rawPassword.toString().getBytes(StandardCharsets.UTF_8));
            var result = Base64.getEncoder().encodeToString(hash);
            return result;
        }
        catch (Exception ex) {
            return null;
        }
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
        var encoded = encode(rawPassword);
        if (encoded == null) {
            return false;
        }
        return encoded.equals(encodedPassword);
    }
}

@Configuration
@EnableWebSecurity()
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    
    private DataSource dataSource;

    /// 注入配置的数据源
    @Autowired
    public WebSecurityConfig(DataSource dataSource) {
        this.dataSource = dataSource;
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        // 基本的安全配置
        http.authorizeRequests()
            .antMatchers("/", "/home").permitAll()
            .anyRequest().authenticated()
            .and()
            .formLogin()
            .loginPage("/login")
            .permitAll()
            .and()
            .logout()
            .permitAll();
    }
    
    @Bean
    @Override
    protected UserDetailsService userDetailsService() {
        // 使用内置的 JdbcDaoImpl 作为 UserDetailsService 。
        var jdbcDao = new JdbcDaoImpl();
        jdbcDao.setDataSource(dataSource);
        // 禁用对单个用户的直接权限
        jdbcDao.setEnableAuthorities(false);
        // 启用用户组（角色）权限
        jdbcDao.setEnableGroups(true);
        jdbcDao.setUsernameBasedPrimaryKey(false);
        // 从 aspnet_users 表中查询用户信息
        jdbcDao.setUsersByUsernameQuery(
            "select user_name as username, password_hash as password, email_confirmed as enabled\n" + 
            "from public.aspnet_users\n" +
            "where normalized_user_name = upper(?);"
        );
        // 从 aspnet_role_claims 中查询用户所在角色的权限列表
        jdbcDao.setGroupAuthoritiesByUsernameQuery(
            "select r.id, r.name as group_name, rc.claim_value as authority\n" +
            "from public.aspnet_roles r\n" +
            "inner join public.aspnet_role_claims rc\n" +
            "    on rc.role_id = r.id and rc.claim_type = 'AppPrivilege'\n" +
            "inner join public.aspnet_user_roles ur on ur.role_id = r.id\n" +
            "inner join public.aspnet_users u on ur.user_id = u.id\n" +
            "    and u.normalized_user_name = upper(?);"
        );
        return jdbcDao;
    }
    // 使用自定义的 Sha256PasswordEncoder 
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new Sha256PasswordEncoder();
    }
}

@GetMapping("/info")
public String getInfo(Authentication authentication) {
    SecurityExpressionRoot root;
    UserDetails user = (UserDetails) authentication.getPrincipal();
    return "Hello, " + authentication.getName();
}

 @Bean
public Realm realm(DataSource dataSource) {
    var realm = new JdbcRealm();
    realm.setDataSource(dataSource);
    // 查询 aspnet_users 中的 password_hash 作为 password 返回
    realm.setAuthenticationQuery(
        "select password_hash as password " +
        "from public.aspnet_users where user_name = ?"
    );
    // 查询 aspnet_roles 表中的角色名称；
    realm.setUserRolesQuery(
        "select r.name as role_name from public.aspnet_roles r " +
        "inner join public.aspnet_user_roles ur on ur.role_id = r.id " +
        "inner join public.aspnet_users u on u.id = ur.user_id " +
        "where u.normalized_user_name = upper(?)"
    );
    // 启用权限查询
    realm.setPermissionsLookupEnabled(true);
    // 从 aspnet_role_claims 查询角色的权限
    realm.setPermissionsQuery(
        "select claim_value as permission from public.aspnet_role_claims rc " +
        "inner join public.aspnet_roles r on r.id = rc.role_id " +
        "and rc.claim_type = 'AppPrivilege' and r.name = ?"
    );
    // 使用 SHA-256 散列算法来加密存储密码
    var matcher = new HashedCredentialsMatcher();
    matcher.setHashAlgorithmName("SHA-256");
    matcher.setStoredCredentialsHexEncoded(false);
    realm.setCredentialsMatcher(matcher);
    return realm;
}

@Bean
public ShiroFilterChainDefinition shiroFilterChainDefinition() {
    var chainDef = new DefaultShiroFilterChainDefinition();
    // chainDef.addPathDefinition("/**", "authc");
    return chainDef;
}

@PostMapping("/login")
public String login(
    @RequestBody LoginInfo info
) {
    try {
        var user = SecurityUtils.getSubject();
        var token = new UsernamePasswordToken(
            info.getUsername(),
            info.getPassword(),
            info.isRememberMe()
        );
        user.login(token);
        return user.getPrincipal().toString();
    }
    catch (AuthenticationException ex) {
        return ex.getMessage();
    }
}

@GetMapping("/info")
public String getInfo() {
    var user = SecurityUtils.getSubject();
    return user.isAuthenticated()
        ? user.getPrincipal().toString()
        : "anonymous";
}