SSM项目整合shiro

1.首先，导入shiro的依赖

    org.apache.shiro
    shiro-core
    ${shiro.version}


    org.apache.shiro
    shiro-web
    ${shiro.version}


    org.apache.shiro
    shiro-ehcache
    ${shiro.version}


    org.apache.shiro
    shiro-quartz
    ${shiro.version}


    org.apache.shiro
    shiro-spring
    ${shiro.version}

其中${shiro.version}是1.3.2

2.在web.xml里配置shiro的过滤器

  shiroFilter
  org.springframework.web.filter.DelegatingFilterProxy
  
    targetFilterLifecycle
    true
  



  shiroFilter
  /tologin


  shiroFilter
  /login

注意：要把classpath:spring-mybatis.xml改成classpath:spring-*.xml，以加载所有与spring相关的配置文件。

3.添加配置文件spring-shiro.xml

    
    
        
        
        
        
        
        
        
            
                
            
        
        
        
            
                
                /css/** = anon
                /image/** = anon
                /js/** = anon

                
                /login = anon
                /tologin = anon


                
                /logout = logout

                
                /home = user

                
                /** = user
            
        
    

    
    
        
        
        
    

    
    
        
    

    
    

4.UserRealm的代码实现

package com.lzw.emall.realm;

import com.lzw.emall.bean.User;
import com.lzw.emall.service.UserService;
import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.beans.factory.annotation.Autowired;

public class UserRealm extends AuthorizingRealm {
    @Autowired
    private UserService userService;

    /**
     * 权限校验
     */
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
        return authorizationInfo;
    }

    /**
     * 身份校验
     */
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String username = (String) token.getPrincipal();
        User user = userService.findByName(username);
        if (user == null) {
            throw new UnknownAccountException(); //没有找到账号
        }
        //交给AuthenticationRealm使用CredentialsMatcher进行密码匹配
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(
                user.getUsername(), //用户名
                user.getPassword(), //密码
                getName() //realm name
        );
        return authenticationInfo;
    }
}

5.LoginController的实现

//登陆
@RequestMapping("/login")
public String login(HttpServletRequest request, Model model) {
    String username = request.getParameter("username");
    String password = request.getParameter("password");
    User user = userService.findByName(username);
    Subject subject = SecurityUtils.getSubject();
    UsernamePasswordToken token = new UsernamePasswordToken(username, password);
    try {
        subject.login(token);
        Session session = subject.getSession();
        session.setAttribute("subject", subject);
       /* request.getSession().setAttribute("username",user.getUsername());
        request.getSession().setAttribute("userid",user.getUserId());
        request.getSession().setAttribute("address",user.getAddress());
        request.getSession().setAttribute("realname",user.getRealname());
        request.getSession().setAttribute("telephone",user.getTelephone());
        request.getSession().setAttribute("sex",user.getSex());
        if(request.getSession().getAttribute("carts")!=null)
            orderService.sessionToCart(request);*/
        return "home";
    } catch (AuthenticationException e) {
        return "redirect:/tologin?state=error";
    }
    }