Shiro+SpringMVC

pom.xml

    org.apache.shiro
    shiro-core
    1.3.2


    org.apache.shiro
    shiro-web
    1.3.2


    org.apache.shiro
    shiro-spring
    1.3.2


    org.apache.shiro
    shiro-ehcache
    1.3.2

web.xml

    contextConfigLocation
    classpath*:applicationContext-mvc.xml,classpath*:applicationContext.xml,classpath*:applicationContext-shiro.xml



    shiroFilter
    org.springframework.web.filter.DelegatingFilterProxy
    
        
        targetFilterLifecycle
        true
    


        shiroFilter
        /*

ehcache.xml

applicationContext-shiro.xml

	
	
		
		
		
		
	

	
	
		
	

	
	
		
	

	
	
		
	

	
	
		
		
		
		
		
		
		
		
		
		
		
		
		
		
			
				/user/login.do = anon
				/cust/list.do = authc
				/cust/chancelist.do = roles[manager]
			
		
	

	
	

ShiroDbRealm.java

import com.htjx.crm.model.Empl;
import com.htjx.crm.model.Role;
import com.htjx.crm.model.SysPermission;
import com.htjx.crm.service.EmplService;
import com.htjx.crm.service.RoleService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

import javax.annotation.Resource;
import java.util.HashSet;
import java.util.List;
import java.util.Set;

/**
 * Created by yangbin on 2017/5/13.
 */
public class ShiroDbRealm extends AuthorizingRealm {

    @Resource
    private EmplService emplService;

    @Resource
    private RoleService roleService;

    /**
     * 提供用户信息返回权限信息
     * @param principalCollection
     * @return
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        Empl user = (Empl)principalCollection.getPrimaryPrincipal();
        Role role = emplService.getRoleByEmplId(user.getId());

        Set sysPermissionSet = new HashSet<>();
            List permissionList = roleService.getPermissionListByRoleId(role.getId());
            permissionList.forEach(permission -> {
                sysPermissionSet.add(permission.getUrl());
            });
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo(sysPermissionSet);
        return simpleAuthorizationInfo;
    }

    /**
     * 提供账户信息返回认证信息
     * @param authenticationToken
     * @return
     * @throws AuthenticationException
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;
        Empl user = emplService.checkUserName(token.getUsername());

        if (user == null) {
            // 用户名不存在抛出异常
            throw new UnknownAccountException();
        }
        if (0 == user.getStatus()) {
            // 用户被管理员锁定抛出异常
            throw new LockedAccountException();
        }
        // 数据库数据库中的密码只做了一次md5，因此不传salt
        return new SimpleAuthenticationInfo(user, user.getUserPwd(), user.getUserName());
    }
}

LoginController.java

import com.per.crm.constants.UserConstants;
import com.per.crm.service.EmplService;
import com.per.crm.util.BaseController;
import com.per.crm.util.MD5Utils;
import com.per.crm.vo.EmplVo;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;

import javax.annotation.Resource;

@Controller
@RequestMapping("/user")
public class LoginController extends BaseController {

	private Logger logger = LoggerFactory.getLogger(LoginController.class);

	@Resource
	private EmplService emplService;

	@RequestMapping(value = "/login", method = RequestMethod.POST)
	public String login(String userName, String pwd) {
		EmplVo empl = emplService.emplLogin(userName, MD5Utils.toMD5(pwd));

		Subject subject = SecurityUtils.getSubject();
		UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(userName, pwd);
		usernamePasswordToken.setRememberMe(true);
		subject.login(usernamePasswordToken);

		// 将用户信息放入session
		session.setAttribute(UserConstants.SESSION_KEY_USER_ID, empl);
		return "redirect:/cust/list.do";
	}
}