基于Spring框架的Shiro配置

一、在web.xml中添加shiro过滤器

 <!-- Shiro filter-->
 < filter >
     < filter-name > shiroFilter </ filter-name >
     < filter-class >
         org.springframework.web.filter.DelegatingFilterProxy
     </ filter-class >
 </ filter >
 < filter-mapping >
     < filter-name > shiroFilter </ filter-name >
     < url-pattern > /* </ url-pattern >
 </ filter-mapping >

二、在Spring的applicationContext.xml中添加shiro配置
1、添加shiroFilter定义

 <!-- Shiro Filter -->
 < bean   id = "shiroFilter"   class = "org.apache.shiro.spring.web.ShiroFilterFactoryBean" >
     < property   name = "securityManager"   ref = "securityManager"   />
     < property   name = "loginUrl"   value = "/login"   />
     < property   name = "successUrl"   value = "/user/list"   />
     < property   name = "unauthorizedUrl"   value = "/login"   />
     < property   name = "filterChainDefinitions" >
         < value >
             /login  =  anon
             /user/** = authc
             /role/edit/* = perms[role:edit]
             /role/save  =  perms [role:edit]
             /role/list  =  perms [role:view]
             /** = authc
         </ value >
     </ property >
 </ bean >

2、添加securityManager定义

 < bean   id = "securityManager"   class = "org.apache.shiro.web.mgt.DefaultWebSecurityManager" >
     < property   name = "realm"   ref = "myRealm"   />
 </ bean >

3、添加realm定义

 < bean   id = " myRealm"   class = "com...MyRealm"   />

三、实现MyRealm：继承AuthorizingRealm，并重写认证授权方法

 public   class  MyRealm  extends  AuthorizingRealm{

     private  AccountManager accountManager;
     public   void  setAccountManager(AccountManager accountManager) {
         this .accountManager = accountManager;
     }

     /**
      * 授权信息
      */
     protected  AuthorizationInfo doGetAuthorizationInfo(
                 PrincipalCollection principals) {
         String username=(String)principals.fromRealm(getName()).iterator().next();
         if ( username !=  null  ){
             User user = accountManager.get( username );
             if ( user !=  null  && user.getRoles() !=  null  ){
                 SimpleAuthorizationInfo info = new  SimpleAuthorizationInfo();
                 for ( SecurityRole each: user.getRoles() ){
                         info.addRole(each.getName());
                         info.addStringPermissions(each.getPermissionsAsString());
                 }
                 return  info;
             }
         }
         return   null ;
     }

     /**
      * 认证信息
      */
     protected  AuthenticationInfo doGetAuthenticationInfo(
                 AuthenticationToken authcToken ) throws  AuthenticationException {
         UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
         String userName = token.getUsername();
         if ( userName !=  null  && ! "" .equals(userName) ){
             User user = accountManager.login(token.getUsername(),
                             String.valueOf(token.getPassword()));

             if ( user !=  null  )
                 return   new  SimpleAuthenticationInfo(
                             user.getLoginName(),user.getPassword(), getName());
         }
         return   null ;
     }

 }

参考资料： 让Apache Shiro保护你的应用

(http://kdboy.iteye.com/blog/1103794)