ShiroSpring整合

1.引入相关依赖

<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.11</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-context</artifactId>
<version>4.3.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
<version>4.3.3.RELEASE</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-core</artifactId>
<version>1.2.2</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.2.2</version>
</dependency>
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-web</artifactId>
<version>1.2.2</version>
</dependency>

2.添加shiroFilter入口 以及Spring入口

<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath:spring-shiro.xml</param-value>
</context-param>
<servlet>
<servlet-name>DispatcherServlet</servlet-name><!--在DispatcherServlet的初始化过程中，框架会在web应用的WEB-INF文件夹下寻找名为[servlet-name]-servlet.xml的配置文件，生成文件中定义的bean。-->
<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
<!--指明了配置文件的文件名，不使用默认配置文件名，而使用dispatcher-servlet.xml配置文件。-->
<init-param>
<param-name>contextConfigLocation</param-name>
<!--其中<param-value>**.xml</param-value>这里可以使用多种写法-->
<!--1、不写,使用默认值:/WEB-INF/<servlet-name>-servlet.xml-->
<!--2、<param-value>/WEB-INF/classes/dispatcher-servlet.xml</param-value>-->
<!--3、<param-value>classpath*:dispatcher-servlet.xml</param-value>-->
<!--4、多个值用逗号分隔-->
<param-value>classpath:springmvc.xml</param-value>
</init-param>
<load-on-startup>1</load-on-startup><!--是启动顺序，让这个Servlet随Servletp容器一起启动。-->
</servlet>
<servlet-mapping>
<!--这个Servlet的名字是dispatcher，可以有多个DispatcherServlet，是通过名字来区分的。每一个DispatcherServlet有自己的WebApplicationContext上下文对象。同时保存的ServletContext中和Request对象中.-->
<!--ApplicationContext是Spring的核心，Context我们通常解释为上下文环境，我想用“容器”来表述它更容易理解一些，ApplicationContext则是“应用的容器”了:P，Spring把Bean放在这个容器中，在需要的时候，用getBean方法取出-->
<servlet-name>DispatcherServlet</servlet-name>
<!--Servlet拦截匹配规则可以自已定义，当映射为@RequestMapping("/user/add")时，为例,拦截哪种URL合适？-->
<!--1、拦截*.do、*.htm，例如：/user/add.do,这是最传统的方式，最简单也最实用。不会导致静态文件（jpg,js,css）被拦截。-->
<!--2、拦截/，例如：/user/add,可以实现现在很流行的REST风格。很多互联网类型的应用很喜欢这种风格的URL。弊端：会导致静态文件（jpg,js,css）被拦截后不能正常显示。-->
<url-pattern>*.action</url-pattern><!--会拦截URL中带“/”的请求。-->
</servlet-mapping>

3.配置Shiro-Spring.xml

<!--设置shiroFilterd对象实例化ShiroFilterFactory设置securityManager-->
<beanid="shiroFilter"class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<propertyname="securityManager"ref="securityManager"/>
<propertyname="loginUrl"value="login.html"/>
<propertyname="unauthorizedUrl"value="403.html"/>
<propertyname="filterChainDefinitions">
<value>
/login.html=anon
/login.action=anon
/*=authc
</value>
</property>
</bean>
<!--设置securityManager并且配置相应的realm-->
<beanclass="org.apache.shiro.web.mgt.DefaultWebSecurityManager"id="securityManager">
<propertyname="realm"ref="realm"/>
</bean>
<!--实例化自定义realm-->
<beanid="realm"class="com.shirospring.realm.MyRealm">
</bean>

4.配置Spring-mvc.xml

<context:component-scanbase-package="com.shirospring"></context:component-scan>
<!--添加mvc注解支持-->
<mvc:annotation-driven></mvc:annotation-driven>
<mvc:resourcesmapping="/*"location="/"/>

5.简单的登陆验证
设置controller

@RequestMapping(value="login",produces="application/json;charset=utf-8",method=RequestMethod.POST)
@ResponseBody
public String Login(Useruser){
System.out.println("开始验证");
Subject subject=SecurityUtils.getSubject();
UsernamePasswordToken usernamePasswordToken=new UsernamePasswordToken(user.getUsername(),user.getPassword());
try{
subject.login(usernamePasswordToken);
}catch(Exceptione){
returne.getMessage();
}
return"登陆成功";
}

Login.html
<htmllang="en">
<head>
<title>登录</title>
<style>.error{color:red;}</style>
</head>
<body>
<divclass="error">${error}</div>
<formaction="login.action"method="post">
用户名：<inputtype="text"name="username"><br/>
密码：<inputtype="password"name="password"><br/>
<inputtype="submit"value="登录">
</form>
</body>
</html>
6.自定义realm

Public class MyRealm extends AuthorizingRealm{
@Override
protected AuthorizationInfodoGetAuthorizationInfo(PrincipalCollectionprincipalCollection){
returnnull;
}
@Override
protected AuthenticationInfodoGetAuthenticationInfo(AuthenticationTokenauthenticationToken)throwsAuthenticationException{
String username=(String)authenticationToken.getPrincipal();
String password=new String((char[])authenticationToken.getCredentials());
if(!"zhang".equals(username)){
throw new UnknownAccountException();
}
if(!"123".equals(password)){
new IncorrectCredentialsException();
}
return new SimpleAuthenticationInfo(username,password,getName());
}
}