springmvc 整合shiro

1、引用maven

　　<dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-core</artifactId>
        <version>1.2.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-web</artifactId>
        <version>1.2.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-ehcache</artifactId>
        <version>1.2.1</version>
    </dependency>
    <dependency>
        <groupId>org.apache.shiro</groupId>
        <artifactId>shiro-spring</artifactId>
        <version>1.2.1</version>
    </dependency>

2、实现AuthorizingRealm类

package com.controller;


import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
import org.apache.commons.lang3.builder.ToStringStyle;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;


public class MyRealm extends AuthorizingRealm{


    /**
     * 该方法在用户检查 角色、权限时调用，实际当中会在这里从数据库中检查用户角色及权限，并存在缓存当中，以便下次快速查询
     * 从数据库检出对应的角色权限后存入 SimpleAuthorizationInfo 对象中。
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {         
        String currentUsername = (String)super.getAvailablePrincipal(arg0);  
        SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();
        if(currentUsername.equals("admin")){ 
            simpleAuthorInfo.addStringPermission("admin:edit");  //这里硬编码写入 admin角色的edit权限
            //实际中可能会像上面注释的那样从数据库取得  
            return simpleAuthorInfo;  
        }
        return null;
        
    }

    /**
     * 该回调方法在用户调用Subject 对象的login方法时调用，这里可以用户名密码检验功能
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken authcToken) throws AuthenticationException {
              UsernamePasswordToken token = (UsernamePasswordToken)authcToken;             
            if("user".equals(token.getUsername())||"admin".equals(token.getUsername())){  
                AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(token.getUsername(), token.getPassword(), this.getName());  
                this.setSession("currentUser", token.getUsername());  
                return authcInfo;  
            }  
            //没有返回登录用户名对应的SimpleAuthenticationInfo对象时,就会在LoginController中抛出UnknownAccountException异常  
            return null;        
    }
    
     /** 
     * 将一些数据放到ShiroSession中,以便于其它地方使用 
     * 比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到 
     */  
    private void setSession(Object key, Object value){  
        Subject currentUser = SecurityUtils.getSubject();  
        if(null != currentUser){  
            Session session = currentUser.getSession();  
            System.out.println("Session默认超时时间为[" + session.getTimeout() + "]毫秒");  
            if(null != session){  
                session.setAttribute(key, value);  
            }  
        }  
    }  

}

3、配置applicationContex.xml

    <!-- Shiro Filter -->
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <property name="securityManager" ref="securityManager" />
    
    <!-- 登录页面 ，用户 登录不成功自动 返回该页面 -->
    <property name="loginUrl" value="/login" />
    
    <!-- 登录成功页面，登录成功后跳转到该页面  -->
    <property name="successUrl" value="/index" />
    
    <!-- 无权访问跳转页面  -->
    <property name="unauthorizedUrl" value="permNo" />
    
    <!-- 自定义权限页面设置url的访问权限。anon表示不用验证，都可以访问。anthc：authc filter 监听，不登陆不能访问。logout：logout filter监听。没有列出的常用配置：perms["remote:invoke"] ：需要角色romote 和权限invoke才能访问。roles["admin"]需要角色admin才能访问。设置可用“,”隔开，如：
    /admin/test = authc,roles[admin]  -->

    <property name="filterChainDefinitions">
        <value>
        
        <!-- 无参,表示可匿名使用,可以理解为匿名用户或游客 -->
            /login = anon
            
            
            /index = authc    
            
            <!--  只有admin:edit权限才可以访问 index -->
            /permOk = authc,perms[admin:edit]
         
        </value>
    </property>
</bean>
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="myRealm" />
    </bean>
    
    <bean id="myRealm" class="com.controller.MyRealm" />

注：黑色部分是上面实现的类，注意包名

4、controller部分

     @RequestMapping(value = "/login",method = {RequestMethod.GET})
        public String login(Model model){        
         return "/login";
     }
     
     @RequestMapping(value = "/login",method = {RequestMethod.POST})
        public String login(HttpServletRequest request, HttpServletResponse response){
         UsernamePasswordToken token = new UsernamePasswordToken(request.getParameter("userName"), request.getParameter("password"));  
            token.setRememberMe(true);
            
            try{
           
                //获取当前的Subject  
                Subject currentUser = SecurityUtils.getSubject();
                
                currentUser.login(token);  
                //验证是否登录成功  
                if(currentUser.isAuthenticated()){  
                    System.out.println("用户[" + "admin" + "]登录认证通过(这里可以进行一些认证通过后的一些系统参数初始化操作)");  
                    return "forward:/index";
                }else{  
                    token.clear();  
                }               
            }
            catch(Exception ex){
                
            }
            
         return "/login";
     }
     
     
     @RequestMapping(value = "/index")
     public String index(HttpServletRequest request, HttpServletResponse response){
         return "/index";
     }
     
     @RequestMapping(value = "/permNo")    
        public String permNo(HttpServletRequest request, HttpServletResponse response){
         return "/permNo";
     }
     
     @RequestMapping(value = "/permOk")    
        public String permOk(HttpServletRequest request, HttpServletResponse response){
         return "/permOk";
     }

所需jsp页面

login.jsp

<%@ page language="java"  pageEncoding="UTF-8" contentType="text/html;charset=UTF-8" %>
<html>
<body>
<form id="contentModel" action="login" method="post">  
        <span id="contentModel.errors" class="error">可分别用user、admin用户 测试 密码任意</span>  
        <table>  
            <tr>  
                <td>Name</td>  
                <td><input id="userName" name="userName" type="text" value=""/>  
                </td>  
                <td><span id="userName.errors" class="error"></span>  
                </td>  
            </tr>  
            <tr>  
                <td>password</td>  
                <td><input id="password" name="password" type="text" value=""/>  
                </td>  
                <td>  
                </td>  
            </tr>  
      
            <tr>  
                <td colspan="3"><input type="submit" />  
                </td>  
            </tr>  
        </table>  
    </form>  
</body>
</html>

index.jsp

<%@ page language="java"  pageEncoding="UTF-8" contentType="text/html;charset=UTF-8" %>
<html>
<body>
<h2>${userid}</h2>
<a href="permOk">进入</a>
</body>
</html>

permNo.jsp

<%@ page language="java"  pageEncoding="UTF-8" contentType="text/html;charset=UTF-8" %>
<html>
<body>
<h2>你没有权限访问 </h2>
</body>
</html>

permOk.jsp

<%@ page language="java"  pageEncoding="UTF-8" contentType="text/html;charset=UTF-8" %>
<html>
<body>
<h2>成功 </h2>
</body>
</html>

最终效果：访问login页面使用user用户登录可以进入到index页面，但不能再进入里面的页面，换成admin用户可以继续往下点击。