Shiro与Spring整合

首先把Spring、springmvc环境搭建好（跑起来可以访问页面没报错.）.....此处省略一万行代码

第一步、在web.xml中配置shiro filter 
<filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
</filter>

<filter-mapping>
       <filter-name>shiroFilter</filter-name>
       <url-pattern>/*</url-pattern>
</filter-mapping>

第二步、在spring的配置文件applicationContext.xml中配置
<!-- 1.配置securityManager -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">   
        <!-- 缓存管理器 -->
        <property name="cacheManager" ref="cacheManager"/>
        <!-- property name="realm" ref="jdbcRealm"/ -->
        <property name="authenticator" ref="authenticator"></property>
        <property name="realms">
           <list>
               <ref bean="jdbcRealm"/>
               <ref bean="secondRealm"/>
           </list>
        </property>
        <!-- 还可以配置session，此次不使用 -->
    </bean>
<!-- 2.配置cacheManager -->
<!-- 2.1 需要加入ehcache的jar包及配置文件（hibernate的开源代码里有）-->
 <bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"> 
     <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/> 
 </bean>
<!-- 3.配置Realm，需要创建一个类实现Realm接口--><!-- 3.1 直接配置实现了org.apache.shiro.realm.Realm 接口的bean-->
<bean id="jdbcRealm" class="com.shiro.realms.ShiroRealm">
         <!-- 此处的作用：把前台传来的密码封装成的token加密成MD5 -->
         <property name="credentialsMatcher">
             <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
                  <!-- 使用MD5算法加密 -->
                  <property name="hashAlgorithmName" value="MD5"></property>
                  <!-- 加密1024次 -->
                  <property name="hashIterations" value="1024"></property>
            </bean>
        </property>
</bean>

<!-- 4. 配置lifecycleBeanPostProcessor 可以自动的来调用Spring IOC容器中的shiro bean的生命周期方法--> 
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
<!-- 5.要想在IOC容器中使用Shiro的注解 必须配置lifecycleBeanPostProcessor --> 
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>    
  <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">    
  <property name="securityManager" ref="securityManager"/> 
</bean>

<!-- 6. 配置shiroFilter
           6.1 id必须和web.xml文件中配置的DelegatingFilterProxy <filter-name>一致
           6.2 
     -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/login.jsp"/>
        <property name="successUrl" value="/list.jsp"/>
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
        <!-- 
       配置哪些页面需要受保护，
       以及访问这些页面需要的权限 (url=拦截器  的形式)
   1）    anon可以被匿名访问
   2）    authc必须认证即登录后才可以访问的页面    
   3）   logout 登出
    -->
        <property name="filterChainDefinitions">
            <value>
                /login.jsp = anon
                /shiro/login = anon
                /shiro/logout = logout
                # everything else requires authentication:
                /** = authc
                <!-- /list.jsp = anon 第一次匹配优先，此处无效。依然属于authc-->
            </value>
        </property>
    </bean>


bean类：ShiroRealm
public class ShiroRealm extends AuthenticatingRealm{

	@Override
	protected AuthenticationInfo doGetAuthenticationInfo(
			AuthenticationToken token) throws AuthenticationException {
	
		//1.AuthenticationToken转换成UsernamePasswordToken
		UsernamePasswordToken upToken = (UsernamePasswordToken) token;
		
		//2.从UsernamePasswordToken中获取username
		String username = upToken.getUsername();
		
		//3.调用数据库的方法，从数据库中查询username对应的记录 
		   //调用dao.....
		
		//4.若用户不存在，则可以抛出UnknownAccountException异常
		if("unknown".equals(username)){
			throw new UnknownAccountException("用户不存在！");
		}
		
		//5.根据用户信息的情况决定是否需要抛出其他的异常
		if("sb".equals(username)){
			throw new LockedAccountException("用户被锁定！");
		}
		
		//6.根据用户的情况来构建AuthenticationInfo对象并返回
		//以下信息是从数据中获取的
		//1) principal：认证的实体信息，可以是username，也可以是对应的实体对象
		Object principal = username;
		//2) credentials:密码
		Object credentials = null;
		if("admin".equals(username)){
			credentials="038bdaf98f2037b31f1e75b5b4c9b26e";
		}else if("user".equals(username)){
			credentials="098d2c478e9c11555ce2823231e02ec1";
		}
		//3) realmName:当前realm对象的name，调用父类的getName()方法即可
		String realmName = getName();
		//4) salt盐值：相同的密码，不同的盐值，加密后的字符串不同
		ByteSource credentialsSalt = ByteSource.Util.bytes(username);//这里使用了用户名作为原始值
		
		SimpleAuthenticationInfo info = null;//new SimpleAuthenticationInfo(principal, credentials, realmName);
		info = new SimpleAuthenticationInfo(principal,credentials, credentialsSalt, realmName);
		return info;
	}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
	String userName = (String) principals.getPrimaryPrincipal();
	SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
	try {
		authorizationInfo.setRoles("admin");
		authorizationInfo.setStringPermissions("delete");
	} catch (Exception e) {
		e.printStackTrace();
	}
	return authorizationInfo;
   }      
}

springmvc handler
@Controller
@RequestMapping("/shiro")
public class ShiroHandler {

	@RequestMapping("/login")
	public String login(@RequestParam("username") String username,
			@RequestParam("password") String password){
		Subject currentUser = SecurityUtils.getSubject();
		
		if(!currentUser.isAuthenticated()){
			UsernamePasswordToken token = new UsernamePasswordToken(username, password);
			token.setRememberMe(true);
			try{
				currentUser.login(token);//token传入到了realm里面
			}
			//所有认证异常的父类
			catch(AuthenticationException e){
				System.out.println("登录失败："+e.getMessage());
			}
			
		}
		
		return "redirect:/list.jsp";
	}
}

整个过程，其实就是  用户从页面传来token，然后handler执行subject.login(token),token被传到reaml
里面，执行doGetAuthenticationInfo身份认证方法和doGetAuthorizationInfo查询角色权限方法。