spring+mybatis基础上添加shiro权限控制

在原有的spring+mybatis基础上，添加如下依赖

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

<version>1.2.4</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-web</artifactId>

<version>1.2.4</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-spring</artifactId>

<version>1.2.4</version>

</dependency>

然后新建一个自定义的realm，这个的作用相当于前台拿到用户信息后的验证依据，而这个里面的最重要的一个实现是 UserService ，这个从数据库里拿到用户信息进行比对，数据库里新建对应表

public class MyRealm extends AuthorizingRealm{

@Resource

private UserService userService;

/**

* 为当限前登录的用户授予角色和权

*/

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

String userName=(String)principals.getPrimaryPrincipal();

SimpleAuthorizationInfo authorizationInfo=new SimpleAuthorizationInfo();

authorizationInfo.setRoles(userService.getRoles(userName));

return authorizationInfo;

}

/**

* 验证当前登录的用户

*/

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

String userName=(String)token.getPrincipal();

User user=userService.getByUserName(userName);

if(user!=null){

AuthenticationInfo authcInfo=new SimpleAuthenticationInfo(user.getUsername(),user.getPassword(),"xx");

return authcInfo;

}else{

return null;

}

}

}

application.xml配置shiro

<!-- 自定义Realm -->

<bean id="myRealm" class="ytu.realm.MyRealm"/>

<!-- 安全管理器 -->

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="realm" ref="myRealm"/>

</bean>

<!-- Shiro过滤器 -->

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<!-- Shiro的核心安全接口,这个属性是必须的 -->

<property name="securityManager" ref="securityManager"/>

<!-- 身份认证失败，则跳转到登录页面的配置 -->

<property name="loginUrl" value="/index.jsp"/>

<!-- 权限认证失败，则跳转到指定页面 -->

<property name="unauthorizedUrl" value="/unauthor.jsp"/>

<!-- Shiro连接约束配置,即过滤链的定义 -->

<property name="filterChainDefinitions">

<value>

/login.do=anon

/admin*.do=authc

/admin*.do=roles[admin]

</value>

</property>

</bean>

<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->

<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

<!-- 开启Shiro注解 -->

<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>

<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">

<property name="securityManager" ref="securityManager"/>

</bean>

web.xml配置

<!-- shiro过滤器定义 -->

<filter>

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

<init-param>

<!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->

<param-name>targetFilterLifecycle</param-name>

<param-value>true</param-value>

</init-param>

</filter>

<filter-mapping>

<filter-name>shiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>