diff --git a/boot-service/src/main/java/com/xwbing/service/sys/SysUserService.java b/boot-service/src/main/java/com/xwbing/service/sys/SysUserService.java index ccb3156..eb30a1c 100644 --- a/boot-service/src/main/java/com/xwbing/service/sys/SysUserService.java +++ b/boot-service/src/main/java/com/xwbing/service/sys/SysUserService.java @@ -389,6 +389,33 @@ public class SysUserService { } } + /** + * 根据用户名查找用户 + * + * @param userName + * @return + */ + public SysUser getByUserName(String userName) { + return sysUserRepository.getByUserName(userName); + } + + /** + * 校验密码 + * + * @param sysPassWord 数据库密码 + * @param passWord 明文密码 + * @param salt 盐值 + * @return + */ + public boolean checkPassWord(String passWord, String sysPassWord, String salt) { + //根据盐值和明文密码进行sha1散列 + byte[] saltByte = EncodeUtils.hexDecode(salt); + byte[] hashPassword = Digests.sha1(passWord.getBytes(), saltByte, PassWordUtil.HASH_INTERATIONS); + String validatePassWord = EncodeUtils.hexEncode(hashPassword); + //比较编码后的密码和数据库的密码是否相等 + return sysPassWord.equals(validatePassWord); + } + /** * 获取excel导出列表所需数据 * @@ -411,46 +438,6 @@ public class SysUserService { return listDto; } - /** - * 根据用户名查找用户 - * - * @param userName - * @return - */ - public SysUser getByUserName(String userName) { - return sysUserRepository.getByUserName(userName); - } - - /** - * 校验密码 - * - * @param realPassWord - * @param passWord - * @param salt - * @return - */ - public boolean checkPassWord(String passWord, String realPassWord, String salt) { - String validatePassWord = getSysPassWord(passWord, salt); - //判断密码是否相同 - return realPassWord.equals(validatePassWord); - } - - /** - * 获取数据库密码 - * - * @param passWord - * @param salt - * @return - */ - public String getSysPassWord(String passWord, String salt) { - // 根据密码盐值 解码 - byte[] saltByte = EncodeUtils.hexDecode(salt); - byte[] hashPassword = Digests.sha1(passWord.getBytes(), saltByte, - PassWordUtil.HASH_INTERATIONS); - // 密码 数据库中密码 - return EncodeUtils.hexEncode(hashPassword); - } - /** * 发送邮件 * diff --git a/boot-service/src/main/java/com/xwbing/util/captcha/CaptchaException.java b/boot-service/src/main/java/com/xwbing/util/captcha/CaptchaException.java deleted file mode 100644 index 0c0f17d..0000000 --- a/boot-service/src/main/java/com/xwbing/util/captcha/CaptchaException.java +++ /dev/null @@ -1,23 +0,0 @@ -package com.xwbing.util.captcha; - -/** - * 项目名称: boot-module-demo - * 创建时间: 2018/3/28 14:51 - * 作者: xiangwb - * 说明: - */ -public class CaptchaException extends RuntimeException { - private static final long serialVersionUID = 3106485920407116428L; - - public CaptchaException(Throwable cause) { - super(cause); - } - - public CaptchaException(String message) { - super(message); - } - - public CaptchaException(String message, Throwable cause) { - super(message, cause); - } -} diff --git a/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java index 7538ed9..3c13139 100644 --- a/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java +++ b/boot-web/src/main/java/com/xwbing/controller/sys/SysUserControl.java @@ -118,9 +118,10 @@ public class SysUserControl { subject.login(token); if (subject.isAuthenticated()) { //保存登录信息 + SysUser user = (SysUser) subject.getPrincipal(); SysUserLoginInOut loginInOut = new SysUserLoginInOut(); loginInOut.setCreateTime(new Date()); - loginInOut.setUserId(""); + loginInOut.setUserId(user.getId()); loginInOut.setInoutType(CommonEnum.LoginInOutEnum.IN.getValue()); loginInOut.setIp(ip); RestMessage save = loginInOutService.save(loginInOut); @@ -146,6 +147,7 @@ public class SysUserControl { loginInOut.setIp(IpUtil.getIpAddr(request)); RestMessage out = loginInOutService.save(loginInOut); if (out.isSuccess()) { + subject.logout(); return JsonResult.toJSONObj("保存用户登出信息失败"); } } diff --git a/boot-web/src/main/java/com/xwbing/handler/GlobalExceptionHandler.java b/boot-web/src/main/java/com/xwbing/handler/GlobalExceptionHandler.java index c767395..b05e79e 100644 --- a/boot-web/src/main/java/com/xwbing/handler/GlobalExceptionHandler.java +++ b/boot-web/src/main/java/com/xwbing/handler/GlobalExceptionHandler.java @@ -3,7 +3,6 @@ package com.xwbing.handler; import com.alibaba.fastjson.JSONObject; import com.xwbing.exception.BusinessException; import com.xwbing.util.JsonResult; -import com.xwbing.util.captcha.CaptchaException; import org.apache.shiro.authc.AuthenticationException; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -52,7 +51,7 @@ public class GlobalExceptionHandler { } /** - * shiro登录认证 + * shiro登录认证异常 * * @param ex * @return @@ -65,6 +64,12 @@ public class GlobalExceptionHandler { return JsonResult.toJSONObj(ex.getMessage()); } + /** + * completableFuture完成结果或任务过程中出现的异常 + * + * @param ex + * @return + */ @ExceptionHandler(value = CompletionException.class) @ResponseStatus(value = HttpStatus.OK) @ResponseBody @@ -79,20 +84,6 @@ public class GlobalExceptionHandler { return JsonResult.toJSONObj(errorMessages); } - /** - * 验证码异常 - * - * @param ex - * @return - */ - @ExceptionHandler(value = CaptchaException.class) - @ResponseStatus(value = HttpStatus.OK) - @ResponseBody - public JSONObject handlerCaptchaException(CaptchaException ex) { - logger.error(ex.getMessage()); - return JsonResult.toJSONObj(ex.getMessage()); - } - /** * 表单检验(validator) 异常 * diff --git a/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java b/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java index 31da822..63890e4 100644 --- a/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java +++ b/boot-web/src/main/java/com/xwbing/shiro/MyShiroRealm.java @@ -1,12 +1,10 @@ package com.xwbing.shiro; -import com.xwbing.constant.CommonConstant; import com.xwbing.domain.entity.sys.SysAuthority; import com.xwbing.domain.entity.sys.SysRole; import com.xwbing.domain.entity.sys.SysUser; import com.xwbing.service.sys.SysRoleService; import com.xwbing.service.sys.SysUserService; -import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.AuthenticationException; import org.apache.shiro.authc.AuthenticationInfo; import org.apache.shiro.authc.AuthenticationToken; @@ -76,23 +74,29 @@ public class MyShiroRealm extends AuthorizingRealm { * @throws AuthenticationException */ @Override - protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException { + protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) { UsernamePasswordCaptchaToken captchaToken = (UsernamePasswordCaptchaToken) authenticationToken; - String captcha = captchaToken.getCaptcha(); - String imgCode = (String) SecurityUtils.getSubject().getSession().getAttribute(CommonConstant.KEY_CAPTCHA); + //1.校验验证码 +// String captcha = captchaToken.getCaptcha(); +// String imgCode = (String) SecurityUtils.getSubject().getSession().getAttribute(CommonConstant.KEY_CAPTCHA); // if (StringUtils.isEmpty(captcha) || !captcha.equalsIgnoreCase(imgCode)) { // throw new AuthenticationException("验证码错误"); // } + //2.查是否有此用户 SysUser user = sysUserService.getByUserName(captchaToken.getUsername()); if (user == null) { throw new AuthenticationException("账号或密码错误"); } + //3.校验密码 + String password = new String(captchaToken.getPassword()); String sysPassWord = user.getPassword(); String salt = user.getSalt(); - boolean flag = sysUserService.checkPassWord(String.valueOf(captchaToken.getPassword()), sysPassWord, salt); - if (!flag) { + boolean checkPassWord = sysUserService.checkPassWord(password, sysPassWord, salt); + if (!checkPassWord) { throw new AuthenticationException("账号或密码错误"); } + //重新把数据库密码放置到token中 + captchaToken.setPassword(sysPassWord.toCharArray()); return new SimpleAuthenticationInfo(user, sysPassWord, ByteSource.Util.bytes(salt), getName()); } } diff --git a/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java b/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java index 82faa8d..b6f6774 100644 --- a/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java +++ b/boot-web/src/main/java/com/xwbing/shiro/ShiroConfig.java @@ -37,23 +37,19 @@ public class ShiroConfig { shiroFilterFactoryBean.setSecurityManager(securityManager()); //配置访问权限 Map chains = new LinkedHashMap<>(); - // 配置不会被拦截的链接 顺序判断 //配置登录的url和登录成功的url shiroFilterFactoryBean.setLoginUrl("/user/login"); -// shiroFilterFactoryBean.setSuccessUrl("/index"); - // 未授权界面; shiroFilterFactoryBean.setUnauthorizedUrl("/403"); -// chains.put("/favicon.ico", "anon"); -// chains.put("/static/**", "anon"); -// chains.put("/", "anon"); -// chains.put("/doc", "anon"); -// chains.put("/captcha", "anon"); -// chains.put("/v2/api-docs", "anon"); -// chains.put("/swagger-resources", "anon"); -// chains.put("/configuration/ui", "anon"); -// chains.put("/configuration/security", "anon"); -// chains.put("/druid", "anon"); -// chains.put("/**", "authc"); + chains.put("/user/logout", "logout"); + chains.put("/", "anon"); + chains.put("/doc", "anon"); + chains.put("/captcha", "anon"); + chains.put("/v2/api-docs", "anon"); + chains.put("/swagger-resources", "anon"); + chains.put("/configuration/ui", "anon"); + chains.put("/configuration/security", "anon"); + chains.put("/druid", "anon"); + chains.put("/**", "authc"); shiroFilterFactoryBean.setFilterChainDefinitionMap(chains); return shiroFilterFactoryBean; } @@ -63,7 +59,6 @@ public class ShiroConfig { return new MyShiroRealm(); } - @Bean public SecurityManager securityManager() { DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); diff --git a/boot-web/src/main/java/com/xwbing/shiro/UsernamePasswordCaptchaToken.java b/boot-web/src/main/java/com/xwbing/shiro/UsernamePasswordCaptchaToken.java index 10bd979..b177339 100644 --- a/boot-web/src/main/java/com/xwbing/shiro/UsernamePasswordCaptchaToken.java +++ b/boot-web/src/main/java/com/xwbing/shiro/UsernamePasswordCaptchaToken.java @@ -8,7 +8,7 @@ import org.apache.shiro.authc.UsernamePasswordToken; * 项目名称: boot-module-demo * 创建时间: 2018/3/28 14:44 * 作者: xiangwb - * 说明: :扩展默认的用户认证的bean + * 说明: :扩展默认的用户认证token */ @EqualsAndHashCode(callSuper = true) @Data diff --git a/boot-web/src/main/resources/application.yml b/boot-web/src/main/resources/application.yml index 6c55fb9..eb9d9a5 100644 --- a/boot-web/src/main/resources/application.yml +++ b/boot-web/src/main/resources/application.yml @@ -1,6 +1,6 @@ #server server: - port: 8080 + port: 8088 session: timeout: 60 context-path: /