springboot整合shiro登录失败次数限制功能的实现代码

package com.springboot.test.shiro.config.shiro;

import java.util.concurrent.atomic.atomicinteger;

import com.springboot.test.shiro.modules.user.dao.usermapper;

import com.springboot.test.shiro.modules.user.dao.entity.user;

import org.apache.log4j.logger;

import org.apache.shiro.authc.authenticationinfo;

import org.apache.shiro.authc.authenticationtoken;

import org.apache.shiro.authc.lockedaccountexception;

import org.apache.shiro.authc.credential.simplecredentialsmatcher;

import org.apache.shiro.cache.cache;

import org.apache.shiro.cache.cachemanager;

import org.springframework.beans.factory.annotation.autowired;

/**

  * @author: wangsaichao

  * @date: 2018/5/25

  * @description: 登陆次数限制

  */

public class retrylimithashedcredentialsmatcher extends simplecredentialsmatcher {

  private static final logger logger = logger.getlogger(retrylimithashedcredentialsmatcher. class );

  @autowired

  private usermapper usermapper;

  private cache<string, atomicinteger> passwordretrycache;

  public retrylimithashedcredentialsmatcher(cachemanager cachemanager) {

   passwordretrycache = cachemanager.getcache( "passwordretrycache" );

  }

  @override

  public boolean docredentialsmatch(authenticationtoken token, authenticationinfo info) {

   //获取用户名

   string username = (string)token.getprincipal();

   //获取用户登录次数

   atomicinteger retrycount = passwordretrycache.get(username);

   if (retrycount == null ) {

    //如果用户没有登陆过,登陆次数加1 并放入缓存

    retrycount = new atomicinteger( 0 );

    passwordretrycache.put(username, retrycount);

   }

   if (retrycount.incrementandget() > 5 ) {

    //如果用户登陆失败次数大于5次 抛出锁定用户异常 并修改数据库字段

    user user = usermapper.findbyusername(username);

    if (user != null && "0" .equals(user.getstate())){

     //数据库字段 默认为 0 就是正常状态 所以 要改为1

     //修改数据库的状态字段为锁定

     user.setstate( "1" );

     usermapper.update(user);

    }

    logger.info( "锁定用户" + user.getusername());

    //抛出用户锁定异常

    throw new lockedaccountexception();

   }

   //判断用户账号和密码是否正确

   boolean matches = super .docredentialsmatch(token, info);

   if (matches) {

    //如果正确,从缓存中将用户登录计数 清除

    passwordretrycache.remove(username);

   }

   return matches;

  }

  /**

   * 根据用户名 解锁用户

   * @param username

   * @return

   */

  public void unlockaccount(string username){

   user user = usermapper.findbyusername(username);

   if (user != null ){

    //修改数据库的状态字段为锁定

    user.setstate( "0" );

    usermapper.update(user);

    passwordretrycache.remove(username);

   }

  }

}

/**

  * 配置密码比较器

  * @return

  */

@bean ( "credentialsmatcher" )

public retrylimithashedcredentialsmatcher retrylimithashedcredentialsmatcher(){

  retrylimithashedcredentialsmatcher retrylimithashedcredentialsmatcher = new retrylimithashedcredentialsmatcher(ehcachemanager());

  //如果密码加密,可以打开下面配置

  //加密算法的名称

  //retrylimithashedcredentialsmatcher.sethashalgorithmname("md5");

  //配置加密的次数

  //retrylimithashedcredentialsmatcher.sethashiterations(1024);

  //是否存储为16进制

  //retrylimithashedcredentialsmatcher.setstoredcredentialshexencoded(true);

  return retrylimithashedcredentialsmatcher;

}

/**

  * 身份认证realm; (这个需要自己写，账号密码校验；权限等)

  * @return

  */

@bean

public shirorealm shirorealm(){

  shirorealm shirorealm = new shirorealm();

  ......

  //配置自定义密码比较器

  shirorealm.setcredentialsmatcher(retrylimithashedcredentialsmatcher());

  return shirorealm;

}

<!-- 登录失败次数缓存

   注意 timetoliveseconds 设置为 300 秒 也就是 5 分钟

   可以根据自己的需求更改

  -->

<cache name= "passwordretrycache"

   maxentrieslocalheap= "2000"

   eternal= "false"

   timetoidleseconds= "0"

   timetoliveseconds= "300"

   overflowtodisk= "false"

   statistics= "true" >

</cache>

/**

  * 解除admin 用户的限制登录

  * 写死的 方便测试

  * @return

  */

@requestmapping ( "/unlockaccount" )

public string unlockaccount(model model){

  model.addattribute( "msg" , "用户解锁成功" );

  retrylimithashedcredentialsmatcher.unlockaccount( "admin" );

  return "login" ;

}

<a href= "/unlockaccount" rel= "external nofollow" >解锁admin用户</a></button>