Shrio安全框架的配置

项目需求：

1、网站任何页面都必须登录成功之后才能浏览，除了登录页面之外。

2、登录成功之后，不同的用户有不同的权限。比如，积分低于10的用户不能发帖，高于10积分的才 能发帖。

一、导包

<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-core</artifactId>
  <version>1.4.0</version>
</dependency>

<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-web -->
<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-web</artifactId>
  <version>1.4.0</version>
</dependency>

<!-- https://mvnrepository.com/artifact/commons-logging/commons-logging -->
<dependency>
  <groupId>commons-logging</groupId>
  <artifactId>commons-logging</artifactId>
  <version>1.2</version>
</dependency>

<!-- https://mvnrepository.com/artifact/org.apache.shiro/shiro-spring -->
<dependency>
  <groupId>org.apache.shiro</groupId>
  <artifactId>shiro-spring</artifactId>
  <version>1.4.0</version>
</dependency>

二、web.xml配置

ShiroFilter
org.springframework.web.filter.DelegatingFilterProxy

targetFilterLifecycle
true

ShiroFilter /* spring org.springframework.web.servlet.DispatcherServlet contextConfigLocation classpath:spring.xml 1 spring /

三、spring.xml中配置
<context:component-scan base-package=“com.wcmShrio”/>

四、spring-mvc.xml中配置
mvc:default-servlet-handler/
mvc:annotation-driven/

五、spring-shiro.xml中配置








/login.jsp=anon
/login=anon
/**=authc

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="jdbcRealm"/>
</bean>
<bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
    <property name="dataSource" ref="dataSources"/>
</bean>
<bean id="dataSources" class="com.mchange.v2.c3p0.ComboPooledDataSource">
    <property name="driverClass" value="com.mysql.jdbc.Driver"/>
    <property name="jdbcUrl" value="jdbc:mysql://localhost:3306/db1806"/>
    <property name="user" value="root"/>
    <property name="password" value="123456"/>
</bean>