Shrio登陆验证实例详细解读

清疚 2021-09-10 16:48 289阅读 0赞

摘要：本文采用了Spring+SpringMVC+Mybatis+Shiro+Msql来写了一个登陆验证的实例，下面来看看过程吧！整个工程基于Mavevn来创建，运行环境为JDK1.6+WIN7+tomcat7.

这里主要说了Shiro的搭建过程，Spring+SpringMVC+Mybatis的搭建过可以看这里[Spring+Mybatis+SpringMVC+Maven+MySql搭建实例][Spring_Mybatis_SpringMVC_Maven_MySql]

整体工程免费下载：[http://download.csdn.net/detail/evankaka/9331135][http_download.csdn.net_detail_evankaka_9331135]

最终效果如下：

![20151206164637507][]

工程整体的目录如下：

**java代码如下：**

![20151206164245933][]

**配置文件如下：**

![20151206164254016][]

**页面资源如下：**

![20151206171000597][]

好了，下面来简单说下过程吧！

准备工作：

先建表：

drop table if exists user;
     CREATE TABLE `user` (
      `id` int(11) primary key auto_increment,
      `name` varchar(20)  NOT NULL,
      `age` int(11) DEFAULT NULL,
      `birthday` date DEFAULT NULL,
      `password` varchar(20)  NOT NULL
    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
    
     insert into user values(1,'lin',12,'2013-12-01','123456');
     insert into user values(2,'apple',34,'1999-12-01','123456');
     insert into user values(3,'evankaka',23,'2017-12-01','123456');

建好后，新建一个Maven的webApp的工程，记得把结构设置成上面的那样！

下面来看看一些代码和配置

1、POM文件

注意不要少导包了，如果项目出现红叉，一般都是JDK版本的设置问题，自己百度一下就可以解决

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
    	<modelVersion>4.0.0</modelVersion>
    	<groupId>com.lin</groupId>
    	<artifactId>ShiroLearn1</artifactId>
    	<packaging>war</packaging>
    	<version>0.0.1-SNAPSHOT</version>
    	<name>ShiroLearn1 Maven Webapp</name>
    	<url>http://maven.apache.org</url>
    	<properties>
    		
    		<spring.version>3.2.8.RELEASE</spring.version>
    		
    		<slf4j.version>1.6.6</slf4j.version>
    		<log4j.version>1.2.12</log4j.version>
    		
    		<junit.version>4.10</junit.version>
    		
    		<mybatis.version>3.2.1</mybatis.version>
    	</properties>
    	<dependencies>
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-core</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-webmvc</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context-support</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aop</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aspects</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-tx</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-jdbc</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-web</artifactId>
    			<version>${spring.version}</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>junit</groupId>
    			<artifactId>junit</artifactId>
    			<version>${junit.version}</version>
    			<scope>test</scope>
    		</dependency>
    
    		
    		
    		<dependency>
    			<groupId>log4j</groupId>
    			<artifactId>log4j</artifactId>
    			<version>${log4j.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.slf4j</groupId>
    			<artifactId>slf4j-api</artifactId>
    			<version>${slf4j.version}</version>
    		</dependency>
    		<dependency>
    			<groupId>org.slf4j</groupId>
    			<artifactId>slf4j-log4j12</artifactId>
    			<version>${slf4j.version}</version>
    		</dependency>
    		
    
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-test</artifactId>
    			<version>${spring.version}</version>
    			<scope>test</scope>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis</artifactId>
    			<version>${mybatis.version}</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis-spring</artifactId>
    			<version>1.2.0</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>mysql</groupId>
    			<artifactId>mysql-connector-java</artifactId>
    			<version>5.1.29</version>
    		</dependency>
    
                 
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>servlet-api</artifactId>
    			<version>3.0-alpha-1</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-core</artifactId>
    			<version>1.2.1</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-web</artifactId>
    			<version>1.2.1</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-ehcache</artifactId>
    			<version>1.2.1</version>
    		</dependency>
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-spring</artifactId>
    			<version>1.2.1</version>
    		</dependency>
    		
    
    	</dependencies>
    	<build>
    		<finalName>ShiroLearn1</finalName>
    		<plugins>
    			
    			<plugin>
    				<artifactId>maven-war-plugin</artifactId>
    				<configuration>
    					<version>2.4</version>
    				</configuration>
    			</plugin>
    			
    			<plugin>
    				<groupId>org.apache.maven.plugins</groupId>
    				<artifactId>maven-compiler-plugin</artifactId>
    				<version>2.3.2</version>
    				<configuration>
    					<source>1.6</source>
    					<target>1.6</target>
    				</configuration>
    			</plugin>
    		</plugins>
    	</build>
    </project>

2、自定义Shiro拦截器

这里这个拦截器完成了用户名和密码的验证，验证成功后又给用赋角色和权限（注意，这里赋角色和权限我直接写进去了，没有使用数据库，一般都是要通过service层找到用户名后，再去数据库查该用户对应的角色以及权限，然后再加入到shiro中去）

![20151206163530278][]

代码如下：

package com.lin.realm;
    
    import java.util.HashSet;
    import java.util.Set;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.cache.Cache;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.apache.shiro.subject.SimplePrincipalCollection;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    
    import com.lin.domain.User;
    import com.lin.service.UserService;
    import com.lin.utils.CipherUtil;
    
    public class ShiroDbRealm extends AuthorizingRealm {
    	private static Logger logger = LoggerFactory.getLogger(ShiroDbRealm.class);
    	private static final String ALGORITHM = "MD5";
    	
    	@Autowired
    	private UserService userService;
    
    	public ShiroDbRealm() {
    		super();
    	}
    	
    	/**
    	 * 验证登陆
    	 */
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(
    			AuthenticationToken authcToken) throws AuthenticationException {
    		UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
    		System.out.println(token.getUsername());
    		User user = userService.findUserByLoginName(token.getUsername());
    		System.out.println(user);
    		CipherUtil cipher = new CipherUtil();//MD5加密
    		if (user != null) {
    			return new SimpleAuthenticationInfo(user.getName(), cipher.generatePassword(user.getPassword()), getName());
    		}else{
    			throw new AuthenticationException();
    		}
    	}
    
    	/**
    	 * 登陆成功之后，进行角色和权限验证
    	 */
    	@Override
    	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    		/*这里应该根据userName使用role和permission 的serive层来做判断，并将对应 的权限加进来，下面简化了这一步*/
    		Set<String> roleNames = new HashSet<String>();
    	    Set<String> permissions = new HashSet<String>();
    	    roleNames.add("admin");//添加角色。对应到index.jsp
    	    roleNames.add("administrator");
    	    permissions.add("create");//添加权限,对应到index.jsp
    	    permissions.add("login.do?main");
    	    permissions.add("login.do?logout");
    		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo(roleNames);
    	    info.setStringPermissions(permissions);
    		return info;
    	}
    
    
    	/**
    	 * 清除所有用户授权信息缓存.
    	 */
    	public void clearCachedAuthorizationInfo(String principal) {
    		SimplePrincipalCollection principals = new SimplePrincipalCollection(principal, getName());
    		clearCachedAuthorizationInfo(principals);
    	}
    
    
    	/**
    	 * 清除所有用户授权信息缓存.
    	 */
    	public void clearAllCachedAuthorizationInfo() {
    		Cache<Object, AuthorizationInfo> cache = getAuthorizationCache();
    		if (cache != null) {
    			for (Object key : cache.keys()) {
    				cache.remove(key);
    			}
    		}
    	}
    
    //	@PostConstruct
    //	public void initCredentialsMatcher() {//MD5鍔犲瘑
    //		HashedCredentialsMatcher matcher = new HashedCredentialsMatcher(ALGORITHM);
    //		setCredentialsMatcher(matcher);
    //	}
    }

3、shiro的配置文件 ：spring-shiro.xml

内容如下：

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://www.springframework.org/schema/beans 
    						http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"
    	default-lazy-init="true">
    
    	<description>Shiro Configuration</description>
    
    	
    	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    		<property name="realm" ref="shiroDbRealm" />
    		<property name="cacheManager" ref="cacheManager" />
    	</bean>
    
    	
    	<bean id="shiroDbRealm" class="com.lin.realm.ShiroDbRealm">
    		<property name="cacheManager" ref="cacheManager" />
    	</bean>
    
    	
    	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    		<property name="securityManager" ref="securityManager" />
    		<property name="loginUrl" value="/login.do" />
    		<property name="successUrl" value="/view/index.html" />
    		<property name="unauthorizedUrl" value="/error/noperms.jsp" />
    		<property name="filterChainDefinitions">
    			<value>
    				/index.html = authc
    				/checkLogin.do = anon
    				/login.do = anon
    				/logout.html = anon
    				/** = authc
    			</value>
    		</property>
    	</bean>
    
    	
    	<bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />
    
    	
    	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />
    
    	
    	<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
    		depends-on="lifecycleBeanPostProcessor">
    		<property name="proxyTargetClass" value="true" />
    	</bean>
    
    	<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
    		<property name="securityManager" ref="securityManager" />
    	</bean>
    </beans>

**这里简要说明下：**

**（1）**

**securityManager：这个属性是必须的。  
  
loginUrl：没有登录的用户请求需要登录的页面时自动跳转到登录页面，不是必须的属性，不输入地址的话会自动寻找项目web项目的根目录下的”/login.jsp”页面。  
  
successUrl：登录成功默认跳转页面，不配置则跳转至”/”。如果登陆前点击的一个需要登录的页面，则在登录自动跳转到那个需要登录的页面。不跳转到此。  
  
unauthorizedUrl：没有权限默认跳转的页面。**

**（2）**

**anon:例子/admins/\*\*=anon 没有参数，表示可以匿名使用。  
  
authc:例如/admins/user/\*\*=authc表示需要认证(登录)才能使用，没有参数  
  
roles：例子/admins/user/\*\*=roles\[admin\],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，当有多个参数时，例如admins/user/\*\*=roles\["admin,guest"\],每个参数通过才算通过，相当于hasAllRoles()方法。  
  
perms：例子/admins/user/\*\*=perms\[user:add:\*\],参数可以写多个，多个时必须加上引号，并且参数之间用逗号分割，例如/admins/user/\*\*=perms\["user:add:\*,user:modify:\*"\]，当有多个参数时必须每个参数都通过才通过，想当于isPermitedAll()方法。  
  
rest：例子/admins/user/\*\*=rest\[user\],根据请求的方法，相当于/admins/user/\*\*=perms\[user:method\] ,其中method为post，get，delete等。  
  
port：例子/admins/user/\*\*=port\[8081\],当请求的url的端口不是8081是跳转到schemal://serverName:8081?queryString,其中schmal是协议http或https等，serverName是你访问的host,8081是url配置里port的端口，queryString  
  
是你访问的url里的？后面的参数。  
  
authcBasic：例如/admins/user/\*\*=authcBasic没有参数表示httpBasic认证  
  
ssl:例子/admins/user/\*\*=ssl没有参数，表示安全的url请求，协议为https  
  
user:例如/admins/user/\*\*=user没有参数表示必须存在用户，当登入操作时不做检查  
  
注：anon，authcBasic，auchc，user是认证过滤器，  
  
perms，roles，ssl，rest，port是授权过滤器**

4、web.xml配置解读shiro的配置文件（上面的）

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	id="WebApp_ID" version="2.5">
    	<display-name>Archetype Created Web Application</display-name>
    	
    	<welcome-file-list>
    		<welcome-file>/login.do</welcome-file>
    	</welcome-file-list>
    
    	
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:application.xml,classpath:shiro/spring-shiro.xml</param-value>
    	</context-param>
    	
    	<context-param>
    		<param-name>webAppRootKey</param-name>
    		<param-value>springmvc.root</param-value>
    	</context-param>
    
    
    	
    	<filter>
    		<filter-name>SpringEncodingFilter</filter-name>
    		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    		<init-param>
    			<param-name>encoding</param-name>
    			<param-value>UTF-8</param-value>
    		</init-param>
    		<init-param>
    			<param-name>forceEncoding</param-name>
    			<param-value>true</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>SpringEncodingFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    	
    	<filter>
    		<filter-name>shiroFilter</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    		<init-param>
    			<param-name>targetFilterLifecycle</param-name>
    			<param-value>true</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>shiroFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    
    	
    	<context-param>
    		
    		<param-name>log4jConfigLocation</param-name>
    		<param-value>classpath:log4j.properties</param-value>
    	</context-param>
    	<context-param>
    		
    		<param-name>log4jRefreshInterval</param-name>
    		<param-value>6000</param-value>
    	</context-param>
    	<listener>
    		<listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    	</listener>
    
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	
    	
    	<listener>
    		<listener-class>org.springframework.web.util.IntrospectorCleanupListener</listener-class>
    	</listener>
    
    	
    	<servlet>
    		<servlet-name>dispatcherServlet</servlet-name>
    		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    		<init-param>
    			<param-name>contextConfigLocation</param-name>
    			
    			<param-value>classpath:springmvc/spring-mvc.xml</param-value>
    		</init-param>
    		<load-on-startup>1</load-on-startup>
    	</servlet>
    	
    	<servlet-mapping>
    		<servlet-name>dispatcherServlet</servlet-name>
    		<url-pattern>/</url-pattern>
    	</servlet-mapping>
    
    	
    	<session-config>
    		<session-timeout>15</session-timeout>
    	</session-config>
    	<error-page>
    		<error-code>404</error-code>
    		<location>/WEB-INF/views/error/404.jsp</location>
    	</error-page>
    	<error-page>
    		<error-code>401</error-code>
    		<location>/WEB-INF/views/error/401.jsp</location>
    	</error-page>
    </web-app>

这里不仅配置了SpringMVC还要配置Shiro！

5、登陆页面login.jsp

以下是默认登陆的界面

![20151206163941544][]

<%@ page language="java" contentType="text/html; charset=UTF-8"  pageEncoding="UTF-8"%>
    <%
    	String url = request.getRequestURL().toString();
    	url = url.substring(0, url.indexOf('/', url.indexOf("//") + 2));
    	String context = request.getContextPath();
    	url += context;
    	application.setAttribute("ctx", url);
    %>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Insert title here</title>
    </head>
    <body>
    	<form action="${ctx}/checkLogin.do" method="post">
    		username: <input type="text" name="username"><br>
    		password: <input type="password" name="password"><br>
    		<input type="submit" value="登录">
    	</form>
    </body>
    </html>

6、验证成功页面index.jsp

如果用户名和密码正确后，跳转到的页面

<%@ page language="java" contentType="text/html; charset=UTF-8"
    	pageEncoding="UTF-8"%>
    <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags"%>
    <%
    	String url = request.getRequestURL().toString();
    	url = url.substring(0, url.indexOf('/', url.indexOf("//") + 2));
    	String context = request.getContextPath();
    	url += context;
    	application.setAttribute("ctx", url);
    %>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>Shiro登陆实例</title>
    </head>
    <body>
    	<h1>Shiro登陆实例</h1><a href="${ctx}/logout.html">退出</a>
    	<p>一、验证当前用户是否为"访客"，即未认证（包含未记住）的用户</p>
    	<shiro:guest>  
        	Hi there!  Please <a href="login.jsp">Login</a> or <a href="signup.jsp">Signup</a> today!  
    	</shiro:guest>
    	<p>二、认证通过或已记住的用户</p>
    	<shiro:user>  
        	Welcome back John!  Not John? Click <a href="login.jsp">here<a> to login. 
    	</shiro:user>
    	<p>三、已认证通过的用户。不包含已记住的用户，这是与user标签的区别所在。</p>
    	<shiro:authenticated>  
        	<a href="updateAccount.jsp">Update your contact information</a>.  
    	</shiro:authenticated>
    	<p>四、未认证通过用户，与authenticated标签相对应。与guest标签的区别是，该标签包含已记住用户。</p>
    	<shiro:notAuthenticated>  
    	    Please <a href="login.jsp">login</a> in order to update your credit card information.  
    	</shiro:notAuthenticated>  
    	<p>五、输出当前用户信息，通常为登录帐号信息</p>
    	Hello, <shiro:principal/>, how are you today?  
    	<p>六、验证当前用户是否属于该角色</p>
    	<shiro:hasRole name="administrator">  
    	    <a href="admin.jsp">Administer the system</a>  
    	</shiro:hasRole>  
    	<p>七、与hasRole标签逻辑相反，当用户不属于该角色时验证通过</p>
    	<shiro:lacksRole name="administrator">  
    	    Sorry, you are not allowed to administer the system.  
    	</shiro:lacksRole>  
    	<p>八、验证当前用户是否属于以下任意一个角色。</p>
    	<shiro:hasAnyRoles name="developer,manager,administrator">
    	    You are either a developer,manager, or administrator.  
    	</shiro:hasAnyRoles>
       <p>九、验证当前用户权限。</p>
    	<shiro:hasPermission name="create">  
    	  <p>当前用户拥有增加的权限！！！！！！！！！！！！！</p>
    	</shiro:hasPermission>  
    
    	<shiro:hasPermission name="delete">  
    	   <p>当前用户拥有删除的权限！！！！！！！！！！！！！</p>
    	</shiro:hasPermission>  
    </body>
    </html>

其它页面就不说了，具体看工程吧！

7、controller层来看看

这里/\{id\}/showUser主要是来验证是否连接成功（现在无法测试了），当然在工程里你也可以到src/test/java里的包com.lin.service下的UserServiceTest.java，那里我也写了一个单元测试的类。

package com.lin.controller;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Controller;
    import org.springframework.ui.Model;
    import org.springframework.web.bind.annotation.PathVariable;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.ResponseBody;
    
    import com.lin.domain.User;
    import com.lin.realm.ShiroDbRealm;
    import com.lin.service.UserService;
    import com.lin.utils.CipherUtil;
    
    @Controller
    public class UserControler {
    	private static Logger logger = LoggerFactory.getLogger(ShiroDbRealm.class);
    	@Autowired
    	private UserService userService;
    	
    	/**
    	 * 验证springmvc与batis连接成功
    	 * @param id
    	 * @param request
    	 * @return
    	 */
    	@RequestMapping("/{id}/showUser")
    	public String showUser(@PathVariable int id, HttpServletRequest request) {
    		User user = userService.getUserById(id);
    		System.out.println(user.getName());
    		request.setAttribute("user", user);
    		return "showUser";
    	}
    	
    	/**
    	 * 初始登陆界面
    	 * @param request
    	 * @return
    	 */
    	@RequestMapping("/login.do")
    	public String tologin(HttpServletRequest request, HttpServletResponse response, Model model){
    		logger.debug("来自IP[" + request.getRemoteHost() + "]的访问");
    		return "login";
    	}
    	
    	/**
    	 * 验证用户名和密码
    	 * @param request
    	 * @return
    	 */
    	@RequestMapping("/checkLogin.do")
    	public String login(HttpServletRequest request) {
    		String result = "login.do";
    		// 取得用户名
    		String username = request.getParameter("username");
    		//取得 密码，并用MD5加密
    		String password = CipherUtil.generatePassword(request.getParameter("password"));
    		//String password = request.getParameter("password");
    		UsernamePasswordToken token = new UsernamePasswordToken(username, password);
    		
    		Subject currentUser = SecurityUtils.getSubject();
    		try {
    			System.out.println("----------------------------");
    			if (!currentUser.isAuthenticated()){//使用shiro来验证
    				token.setRememberMe(true);
    				currentUser.login(token);//验证角色和权限
    			}
    			System.out.println("result: " + result);
    			result = "index";//验证成功
    		} catch (Exception e) {
    			logger.error(e.getMessage());
    			result = "login。do";//验证失败
    		}
    		return result;
    	}
      
        /**
         * 退出
         * @return
         */
        @RequestMapping(value = "/logout")  
        @ResponseBody  
        public String logout() {  
      
            Subject currentUser = SecurityUtils.getSubject();  
            String result = "logout";  
            currentUser.logout();  
            return result;  
        }  
         
    }

再来看看效果吧！

![20151206170656532][]

整体工程免费下载： [http://download.csdn.net/detail/evankaka/9331135][http_download.csdn.net_detail_evankaka_9331135]

[Spring_Mybatis_SpringMVC_Maven_MySql]: http://blog.csdn.net/evankaka/article/details/48785513
[http_download.csdn.net_detail_evankaka_9331135]: http://download.csdn.net/detail/evankaka/9331135
[20151206164637507]: /images/20210811/47929c97109e49ac8bfbf799d2b3ced6.png
[20151206164245933]: /images/20210811/6cea335e7a554deaa1fc2809ec498b5a.png
[20151206164254016]: /images/20210811/78f8baff9c1a41429aa1746f15fdee2c.png
[20151206171000597]: /images/20210811/25aac184dd0c40d4a08baf71cdefc46c.png
[20151206163530278]: /images/20210811/cfe308f2ef8744deb9c82b3a382c53de.png
[20151206163941544]: /images/20210811/cc24b45eb4b34295a32bfd34db36ca61.png
[20151206170656532]: /images/20210811/9eadc28cbe9e42ed813020150f749359.png