shiro安全框架学习

完整教程how2j

备忘

1.权限系统设计基础RBAC : Role-Based Access Control，基于角色的访问控制/Resource-Based Access Control，基于资源的访问控制

2.表的设计

基于 ORAC 概念，就会存在3 张基础表：用户，角色，权限，以及 2 张中间表来建立用户与角色的多对多关系，角色与权限的多对多关系

DROP DATABASE IF EXISTS shiro;
CREATE DATABASE shiro DEFAULT CHARACTER SET utf8;
USE shiro;

drop table if exists user;
drop table if exists role;
drop table if exists permission;
drop table if exists user_role;
drop table if exists role_permission;

create table user (
  id bigint auto_increment,
  name varchar(100),
  password varchar(100),
  constraint pk_users primary key(id)
) charset=utf8 ENGINE=InnoDB;

create table role (
  id bigint auto_increment,
  name varchar(100),
  constraint pk_roles primary key(id)
) charset=utf8 ENGINE=InnoDB;

create table permission (
  id bigint auto_increment,
  name varchar(100),
  constraint pk_permissions primary key(id)
) charset=utf8 ENGINE=InnoDB;

create table user_role (
  uid bigint,
  rid bigint,
  constraint pk_users_roles primary key(uid, rid)
) charset=utf8 ENGINE=InnoDB;

create table role_permission (
  rid bigint,
  pid bigint,
  constraint pk_roles_permissions primary key(rid, pid)
) charset=utf8 ENGINE=InnoDB;

实操

1.md5加密 123变成202CB962AC59075B964B07152D234B70

1	String encodePassword=new Md5Hash(password).oString();

2.加盐后= 多次md5（password+随机数（盐））123变成。。。。。。。。。。。。

String password = "123";
String salt = new SecureRandomNumberGenerator().nextBytes().toString();//生成随机数
int times = 2;
String algorithmName = "md5";
String encodedPassword = new SimpleHash(algorithmName,password,salt,times).toString();//算法名 密码 盐 运算次数