spring-shiro 实现权限管理，单点登录

      在spring的整合xml配置信息
  




  
     
     




    



    
    
    
    




    
    









    
    
    
    
    
    
    
    
    
    
    
    
        
            
            
            
            
            
            
            
            
            /b5e160ba-2132-494d-8c56-30029ea5ff0b=anon
            /BTVhtml/css/**=anon
            /BTVhtml/fonts/**=anon
            /BTVhtml/images/**=anon
            /BTVhtml/img/**=anon
            /BTVhtml/js/**=anon


            /BTVhtml/page/login/login.html=anon
            /erro.jsp=anon
            /user/login=anon
            /system=anon
            
            /BTVhtml/index.html=perms[sys_survey]
            /index=perms[sys_survey]
            
            /BTVhtml/page/baseResource/**=perms[sys_survey]
            /baseResource/**=perms[sys_survey]

        
    











    
    



    

//UserRealm 实现单点登录，用户权限认证
public class UserRealm extends AuthorizingRealm {

    @Autowired
    private DefaultWebSecurityManager securityManager;

    @Autowired
    private HisiUserMapper btvUserMapper;
    @Autowired
    private HisiUserPowerMapper btvUserPowerMapper;

    /**
     * 用户身份验证
     * 
     * @param token
     * @throws 匹配失败会抛出异常
     * @return
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(
            AuthenticationToken token) {
        String userName = (String) token.getPrincipal();
        Session sessionLocal = SecurityUtils.getSubject().getSession();
        DefaultWebSessionManager sessionManager = (DefaultWebSessionManager) securityManager
                .getSessionManager();
        Collection sessions = sessionManager.getSessionDAO()
                .getActiveSessions();// 获取当前已登录的用户session列表
        for (Session session : sessions) {
            // 实现单点登录
            if (userName
                    .equals(String.valueOf(session
                            .getAttribute(DefaultSubjectContext.PRINCIPALS_SESSION_KEY)))) {
                if (!sessionLocal.getId().equals(session.getId())) {
                    sessionManager.getSessionDAO().delete(session);
                }
            }
        }
        HisiUser btvUser = btvUserMapper.selectByUserName(userName);
        if (btvUser != null) {
            AuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                    btvUser.getUserName(), btvUser.getUserPwd(), getClass()
                            .getName());
            return authenticationInfo;
        } else {
            throw new UnknownAccountException(); // 如果用户名为空
        }
    }

    /**
     * 用户权限认证
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principals) {
        String userName = principals.getPrimaryPrincipal().toString();
        // 取登录用户下的session里面的系统的ID。
        String sysId = String.valueOf(SecurityUtils.getSubject().getSession()
                .getAttribute(Constant.HTTP_SESSION_SYSTEM_ID));
        // 用户信息
        HisiUser btvUser = btvUserMapper.selectByUserName(userName);
        // 用户权限信息
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        List powers = btvUserPowerMapper.listByUserIdAndSysId(
                btvUser.getId(), Integer.parseInt(sysId));
        Set userPowerSet = new HashSet();
        for (HisiUserPower e : powers) {
            userPowerSet.add(e.getPowerVal());
        }
        // 设置当前用户在指定系统下的权限
        simpleAuthorizationInfo.setStringPermissions(userPowerSet);
        return simpleAuthorizationInfo;
    }
}