-
Notifications
You must be signed in to change notification settings - Fork 122
G、密码错误重试次数限制
wangjie edited this page Dec 25, 2019
·
3 revisions
#jsets-shiro配置
jsets:
shiro:
#密码错误最多重试次数,不配置默认无限次
passwd-max-retries: 5
@Service
public class PasswdRetryLimitHandler implements PasswdRetryLimitListener{
private static final Logger LOGGER = LoggerFactory.getLogger(PasswdRetryLimitHandler.class);
@Autowired
private UserService userService;
@Override
public void handle(String account, int maxRetries, int retries) throws AuthenticationException{
//锁定账号
userService.updateStatus(account, UserEntity.USER_STATUS_LOCKED);
LOGGER.warn("账号:"+account+"密码错误超过"+maxRetries+"次,已锁定");
throw new AuthenticationException("密码错误超过"+maxRetries+"次,已锁定。请联系管理员");
}
}
PasswdRetryLimitHandler是一个回调接口,如果密码输入错误次数到达passwd-max-retries设置的阈值,将会调用这个实现,如果应用系统没有实现或者注入这个接口,则passwd-max-retries的设置无效。
@Configuration
public class ApplicationConfig{
// 账号数据提供服务
@Autowired
private AccountProviderImpl accountProviderImpl;
// 自定义的加密实现
@Autowired
private MyDESPasswordProvider myDESPasswordProvider;
// 自定义的验证码实现
@Autowired
private MyCaptchaService myCaptchaService;
// 密码输入错误次数超限处理器
@Autowired
private PasswdRetryLimitHandler passwdRetryLimitHandler;
@Bean
public ShiroCustomizer shiroCustomizer() {
ShiroCustomizer customizer = new ShiroCustomizer();
// 设置账号数据提供服务
customizer.setShiroAccountProvider(accountProviderImpl);
// 设置加密实现
customizer.setPasswordProvider(myDESPasswordProvider);
// 设置验证码实现
customizer.setCaptchaProvider(myCaptchaService);
// 设置密码输入错误次数超限处理器
customizer.setPasswdRetryLimitListener(passwdRetryLimitHandler);
return customizer;
}
}
当用户密码输入错误时会出现如下效果:
密码输入错误次数超过5次用户账号将被锁定: