简单三步理解Shiro权限验证/登录

通过请求方式来判断是初始请求还是验证请求
一、

@RequestMapping(value = "/login", method = RequestMethod.GET)
    public String showLoginPage() {
  
        return "user/login";
    }
    @RequestMapping(value = "/login", method = RequestMethod.POST)
    public String submitLoginForm(User user, HttpServletRequest request,
            Model model) {
  
        String errorClassName = (String) request
                .getAttribute("shiroLoginFailure");
        String authticationError = null;
        if (UnknownAccountException.class.getName().equals(errorClassName)) {
  
            authticationError = "用户名/密码错误";
        } else if (IncorrectCredentialsException.class.getName().equals(
                errorClassName)) {
  
            authticationError = "用户名/密码错误";
        } else if (errorClassName != null) {
  
            authticationError = "未知错误：" + errorClassName;
        }
        model.addAttribute("authticationError", authticationError);
        return showLoginPage();
    }


Shiro配置文件中进行请求拦截管理
二、

------------------------------------------------------第一种配置方式---------------------------------------------------
 <!-- 凭证匹配器 这里简单写了一个无需加密的匹配 -->
    <bean id="credentialsMatcher" class="com.zhu.prototype.shiro.credential.PlainPasswordMatcher">
    </bean>
    <bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
        <property name="authenticationQuery" value="select password from user where username = ?"></property>
        <property name="dataSource" ref="dataSource"></property>
    </bean>
    <