在项目添加依赖
org.apache.shiro shiro-spring 1.4.0 org.apache.shiro shiro-core 1.4.0
配置文件目录下新建spring文件夹，在文件夹内新建spring-shiro.xml文件
/statics/**=anon /login=anon /** = authc
在主入口加载spring-shiro.xml
@ImportResource({ "classpath:spring/spring-shiro.xml" })
在登录Controller内更改成
//构造登录参数
UsernamePasswordToken token = new UsernamePasswordToken(name, pwd);
try {
//交给Realm类处理
SecurityUtils.getSubject().login(token);
} catch (UnknownAccountException uae) {
map.put("msg", "未知用户");
return "login";
} catch (IncorrectCredentialsException ice) {
map.put("msg", "密码错误");
return "login";
} catch (AuthenticationException ae) {
// unexpected condition? error?
map.put("msg", "服务器繁忙");
return "login";
}
return "redirect:/toIndex";
看5行就知道登录交给了Realm类处理了，所以我们要有Realm类
在可以被主入口扫描到的地方新建AuthRealm类并且继承AuthorizingRealm，重写doGetAuthenticationInfo（登录逻辑），重写doGetAuthorizationInfo（授权逻辑）
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
public class AuthRealm extends AuthorizingRealm {
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
// TODO Auto-generated method stub
return null;
}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
// TODO Auto-generated method stub
return null;
}
}
登录验证在doGetAuthenticationInfo方法写入
// 获取Token UsernamePasswordToken token2 = (UsernamePasswordToken) token; //获取用户名 String userName = token2.getUsername(); //获取密码 String pwd = new String(token2.getPassword()); //下面我使用的是MyBatis-puls3.0 //查询条件对象 QueryWrapperqueryWrapper = new QueryWrapper(); //查询该用户 queryWrapper.eq("name", userName).or().eq("phone", userName); //查询 User user = iUserService.getOne(queryWrapper); //查回的对象为空 if (CommonUtil.isBlank(user)) { //抛出未知的账户异常 throw new UnknownAccountException(); } //查回的对象密码和输入密码不相等 if (!CommonUtil.isEquals(user.getPwd(), pwd)) { //抛出凭证不正确异常 throw new IncorrectCredentialsException(); } //上面都通过了就说明该用户存在并且密码相等 // 验证成功了 SecurityUtils.getSubject().getSession().setAttribute(Constant.SESSION_USER_KEY, user); // 返回shiro用户信息 // token传过来的密码，一定要跟验证信息传进去的密码一致，加密的密码一定要加密后传过来 return new SimpleAuthenticationInfo(user, user.getPwd(), getName());
如果要设置权限，就在对应的Controllerf方法加上
@RequiresPermissions("/system/user/list")
再doGetAuthorizationInfo方法内写
//创建简单的授权信息对象
SimpleAuthorizationInfo simpleAuthorizationInfo=new SimpleAuthorizationInfo();
//授予权限
simpleAuthorizationInfo.addStringPermission("/system/user/list");
return simpleAuthorizationInfo;
当所有Controller都加了@RequiresPermissions注解后，如果访问到没有授权的Controller会报错。