shiro

web.xml

<filter> 
	<filter-name>shiroFilter</filter-name> 
	<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter> 

<filter-mapping> 
	<filter-name>shiroFilter</filter-name> 
	<url-pattern>/*</url-pattern> 
</filter-mapping>

applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
       
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="filterChainDefinitions">
            <value>
            	//<!--路径可以拼接*,/**表示路径下所有文件-->
                路径=anon <!--anon表示不认证可以访问-->
                路径=authc <!--anon表示需要认证可以访问-->
                
				<!--
				访问路径需要""权限,
				或在方法中加入权限校验SecurityUtils.getSubject().checkPermission("");
				或使用注解
				 -->
                路径=perms[""]
            </value>
        </property>
        <property name="loginUrl" value="/login.jsp"/><!--没登录重定向页面-->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/><!--没权限重定向页面-->
    </bean>

    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="realm"/>
    </bean>
    
    <bean id="realm" class="包.CustomRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher"/><!--凭证匹配,用来加密-->
    </bean>
    
    <bean id="credentialsMatcher" class="包.CustomCredentialsMatcher"></bean>

	<!--权限验证注解-->
	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/> 
	<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCr eator"depends-on="lifecycleBeanPostProcessor"/> 
	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSo urceAdvisor"> 
		<property name="securityManager" ref="securityManager"/>
	</bean>

	<!--Aop自动代理-->
	<aop:aspectj-autoproxy/>
	
	<!--/权限验证注解-->
</beans>

登录和授权

进入controller

public String login(String email, String password) {
	Subject subject = SecurityUtils.getSubject();

    UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, password);

   try {
		subject.login(usernamePasswordToken);//进入realm的doGetAuthenticationInfo(AuthenticationToken token);
		
		User user = (User)SecurityUtils.getSubject().getPrincipal();//登录成功可以获取AuthenticationInfo中的对象
		return "";
	}catch(Exception e){
		//登陆失败	
		return "";
	}
}

CustomRealm

public class CustomRealm extends AuthorizingRealm {
    @Override
    //授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    	//获取登录用户
    	Subject subject = SecurityUtils.getSubject(); 
    	User user = (User)subject.getPrincipal();

		//查询用户权限

		//封装权限
		Set<String> permissions = new HashSet<>();

		//存入授权对象
		SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(); 
		simpleAuthorizationInfo.addStringPermissions(permissions);
		
        return simpleAuthorizationInfo;
    }


    @Override
    //进行用户验证
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
		//SecurityUtils.getSubject().login(UsernamePasswordToken usernamePasswordToken)会进入
		//强转成UsernamePasswordToken获取用户名
		UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
		
		//用用户名从数据库查出用户对象
		String username = usernamePasswordToken.getUsername();
		User user = userService.findUser(username);

		//传入 用户对象, 数据库中密码, realm对象名,会进入credentialsMatcher进行密码验证
		return new SimpleAuthenticationInfo(user,user.getPassword(),this.getName());	
    }
}

CustomCredentialsMatcher

public class CustomCredentialSMatcher extends SimpleCredentialsMatcher {
    @Override
    public boolean doCredentialsMatch(AuthenticationToken token, AuthenticationInfo info) {
    	//获取用户输入密码
        UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) token;
        String password = new String(usernamePasswordToken.getPassword());

		//进行加盐加密
        Md5Hash md5Hash = new Md5Hash(password,String salt);
		//获取加密后密码
        String md5password = md5Hash.toString();

		//获取AuthenticationInfo中数据库查出的密码
        String dbPassword = (String) info.getCredentials();

		//对比密码
        return dbPassword.equals(md5password);
    }
}

验证权限

html标签

<shiro:authenticated >	已登录
<shiro:notAuthenticated >	未登录
<shiro:hasAnyRoles name="," >	拥有其中一个权限
<shiro:hasRole name="">	拥有角色
<shiro:hasPermission name="">	拥有权限

applicationContext.xml中配置

路径=perms[""]

方法中加入验证

没有权限会抛出异常

SecurityUtils.getSubject().checkPermission("")

使用注解

@RequiresPermissions("")
public Object function(){}

退出

SecurityUtils.getSubject().logout();