【shiro教程】ssm+maven+shiro实现登录案例

小灰灰 2022-05-31 09:51 192阅读 0赞

# 作者前言： #

这几天在网上找了一些shiro相关的文章看了看，结合自己的理解写一篇文章以加深印象并希望能帮助初学者更好的使用shiro框架，老鸟请忽略~~

shiro的相关概念什么的我就不多说了，大家可以自己在网上找找，都是一样的话，我这里就不复制了，直接开始吧！

[shiroDemo.rar项目下载地址][shiroDemo.rar]

## **1.创建数据库** ##

数据库准备三张表：t\_user用户表，t\_role角色表，t\_permission权限表

CREATE TABLE `t_user` (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `username` varchar(255) DEFAULT NULL,
      `password` varchar(255) DEFAULT NULL,
      `role_id` int(11) DEFAULT NULL,
      PRIMARY KEY (`id`)
    ) ENGINE=InnoDB AUTO_INCREMENT=5 DEFAULT CHARSET=utf8;

CREATE TABLE `t_role` (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `rolename` varchar(255) DEFAULT NULL,
      PRIMARY KEY (`id`)
    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;

CREATE TABLE `t_permission` (
      `id` int(11) NOT NULL AUTO_INCREMENT,
      `permission_name` varchar(255) DEFAULT NULL,
      `role_id` int(11) DEFAULT NULL,
      PRIMARY KEY (`id`)
    ) ENGINE=InnoDB AUTO_INCREMENT=3 DEFAULT CHARSET=utf8;

//分别向三张表中插入数据
    INSERT INTO `t_permission` VALUES ('1', 'user:create', '1');
    INSERT INTO `t_permission` VALUES ('2', 'student:*', '2');
    INSERT INTO `t_permission` VALUES ('3', 'student:*', '1');
    
    
    INSERT INTO `t_role` VALUES ('1', 'admin');
    INSERT INTO `t_role` VALUES ('2', 'teacher');
    
    
    INSERT INTO `t_user` VALUES ('1', 'yangqing', '123', '1');
    INSERT INTO `t_user` VALUES ('2', 'jack', '1', '2');
    INSERT INTO `t_user` VALUES ('3', 'marry', '234', null);
    INSERT INTO `t_user` VALUES ('4', 'json', '1234', null);

## **2.创建maven工程** ##

配置文件

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
    	http://maven.apache.org/xsd/maven-4.0.0.xsd">
    	<modelVersion>4.0.0</modelVersion>
    	<groupId>com.yang</groupId>
    	<artifactId>shiroDemo</artifactId>
    	<version>0.0.1-SNAPSHOT</version>
    	<packaging>war</packaging>
    
    	<dependencies>
    		<dependency>
    			<groupId>junit</groupId>
    			<artifactId>junit</artifactId>
    			<version>3.8.1</version>
    			<scope>test</scope>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>javax.servlet-api</artifactId>
    			<version>3.1.0</version>
    		</dependency>
    
    		<dependency>
    			<groupId>javax.servlet.jsp</groupId>
    			<artifactId>javax.servlet.jsp-api</artifactId>
    			<version>2.3.1</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>javax.servlet</groupId>
    			<artifactId>jstl</artifactId>
    			<version>1.2</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-core</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-beans</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-tx</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-context-support</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-web</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-webmvc</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aop</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-aspects</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.springframework</groupId>
    			<artifactId>spring-jdbc</artifactId>
    			<version>4.1.7.RELEASE</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis-spring</artifactId>
    			<version>1.2.3</version>
    		</dependency>
    
    
    		
    		<dependency>
    			<groupId>log4j</groupId>
    			<artifactId>log4j</artifactId>
    			<version>1.2.17</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>org.mybatis</groupId>
    			<artifactId>mybatis</artifactId>
    			<version>3.3.0</version>
    		</dependency>
    
    		
    		<dependency>
    			<groupId>mysql</groupId>
    			<artifactId>mysql-connector-java</artifactId>
    			<version>5.1.37</version>
    		</dependency>
    
    		<dependency>
    			<groupId>c3p0</groupId>
    			<artifactId>c3p0</artifactId>
    			<version>0.9.1</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-core</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.slf4j</groupId>
    			<artifactId>slf4j-log4j12</artifactId>
    			<version>1.7.12</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-web</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    
    		<dependency>
    			<groupId>org.apache.shiro</groupId>
    			<artifactId>shiro-spring</artifactId>
    			<version>1.2.4</version>
    		</dependency>
    
    	</dependencies>
    
    </project>

web.xml

<?xml version="1.0" encoding="UTF-8"?>
    <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns="http://java.sun.com/xml/ns/javaee"
    	xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    	id="WebApp_ID" version="2.5">
    
    	
    	<filter>
    		<filter-name>shiroFilter</filter-name>
    		<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    		<init-param>
    			
    			<param-name>targetFilterLifecycle</param-name>
    			<param-value>true</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>shiroFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    
    	
    	<context-param>
    		<param-name>contextConfigLocation</param-name>
    		<param-value>classpath:applicationContext.xml</param-value>
    	</context-param>
    	
    	
    	<listener>
    		<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    	</listener>
    	
    	
    	<filter>
    		<filter-name>encodingFilter</filter-name>
    		<filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
    		<async-supported>true</async-supported>
    		<init-param>
    			<param-name>encoding</param-name>
    			<param-value>UTF-8</param-value>
    		</init-param>
    	</filter>
    	<filter-mapping>
    		<filter-name>encodingFilter</filter-name>
    		<url-pattern>/*</url-pattern>
    	</filter-mapping>
    
    	
    	<servlet>
    		<servlet-name>springMVC</servlet-name>
    		<servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
    		<init-param>
    			<param-name>contextConfigLocation</param-name>
    			<param-value>classpath:spring-mvc.xml</param-value>
    		</init-param>
    		<load-on-startup>1</load-on-startup>
    		<async-supported>true</async-supported>
    	</servlet>
    	<servlet-mapping>
    		<servlet-name>springMVC</servlet-name>
    		<url-pattern>/</url-pattern>
    	</servlet-mapping>
    
    </web-app>

applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
    <beans xmlns="http://www.springframework.org/schema/beans"
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns:aop="http://www.springframework.org/schema/aop"
    	xmlns:context="http://www.springframework.org/schema/context"
    	xmlns:tx="http://www.springframework.org/schema/tx"
    	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    		http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd
    		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd">    
            
    	
    	<context:property-placeholder location="classpath:db.properties"/>
    	
    	
    	<context:component-scan base-package="com.yang.service" />
    		
    	
    	<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource">
    		<property name="jdbcUrl" value="${jdbc.jdbcUrl}"></property>
    		<property name="driverClass" value="${jdbc.driverClass}"></property>
    		<property name="user" value="${jdbc.user}"></property>
    		<property name="password" value="${jdbc.password}"></property>
    	</bean>
    	
    	
    	<bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
    		<property name="dataSource" ref="dataSource" />
    		
    		<property name="mapperLocations" value="classpath:mapper/*.xml"></property>
    		
    		<property name="configLocation" value="classpath:mybatis-config.xml"></property>
    	</bean>
    
    
    	
    	<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
    		<property name="basePackage" value="com.yang.dao" />
    	</bean>
    
    
    	
    	<bean id="transactionManager"
    		class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
    		<property name="dataSource" ref="dataSource" />
    	</bean>
    	
    	
    	<bean id="myRealm" class="com.yang.realm.MyRealm"/>  
    	
    	
    	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
      	  <property name="realm" ref="myRealm"/>  
    	</bean>  
    	
    	
    	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
    	      
    	    <property name="securityManager" ref="securityManager"/>
    	      
    	    <property name="loginUrl" value="/login.jsp"/>
    	      
    	    <property name="unauthorizedUrl" value="/unauthorized.jsp"/>  
    	      
    	    <property name="filterChainDefinitions">  
    	        <value>  
    	            /login=anon
    	            /logout=logout
    		    /admin=authc
    		    /student=roles[teacher]
    		    /teacher=perms["user:create"]
    		    /**=authc
    	        </value>  
    	    </property>
    	</bean>  
    	
    	  
    	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>  
    	
    	
    	<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>  
      		<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">  
      	  <property name="securityManager" ref="securityManager"/>  
        </bean>  
      
    	  
        <tx:advice id="txAdvice" transaction-manager="transactionManager">  
              
            <tx:attributes>  
                <tx:method name="insert*" propagation="REQUIRED" />  
                <tx:method name="update*" propagation="REQUIRED" />  
                <tx:method name="edit*" propagation="REQUIRED" />  
                <tx:method name="save*" propagation="REQUIRED" />  
                <tx:method name="add*" propagation="REQUIRED" />  
                <tx:method name="new*" propagation="REQUIRED" />  
                <tx:method name="set*" propagation="REQUIRED" />  
                <tx:method name="remove*" propagation="REQUIRED" />  
                <tx:method name="delete*" propagation="REQUIRED" />  
                <tx:method name="change*" propagation="REQUIRED" />  
                <tx:method name="check*" propagation="REQUIRED" />  
                <tx:method name="get*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="find*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="load*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="*" propagation="REQUIRED" read-only="true" />  
            </tx:attributes>  
        </tx:advice>  
      
          
        <aop:config>  
            <aop:pointcut id="txPoint"  
                expression="execution(* com.yang.service.*.*(..))" />  
            <aop:advisor advice-ref="txAdvice" pointcut-ref="txPoint" />  
        </aop:config>     
    </beans>
    	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    	xmlns:aop="http://www.springframework.org/schema/aop"
    	xmlns:context="http://www.springframework.org/schema/context"
    	xmlns:tx="http://www.springframework.org/schema/tx"
    	xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd
    		http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd
    		http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd
    		http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd">    
            
    	
    	<context:property-placeholder location="classpath:db.properties"/>
    	
    	
    	<context:component-scan base-package="com.yang.service" />
    		
    	
    	<bean id="dataSource" class="com.mchange.v2.c3p0.ComboPooledDataSource">
    		<property name="jdbcUrl" value="${jdbc.jdbcUrl}"></property>
    		<property name="driverClass" value="${jdbc.driverClass}"></property>
    		<property name="user" value="${jdbc.user}"></property>
    		<property name="password" value="${jdbc.password}"></property>
    	</bean>
    	
    	
    	<bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean">
    		<property name="dataSource" ref="dataSource" />
    		
    		<property name="mapperLocations" value="classpath:mapper/*.xml"></property>
    		
    		<property name="configLocation" value="classpath:mybatis-config.xml"></property>
    	</bean>
    
    
    	
    	<bean class="org.mybatis.spring.mapper.MapperScannerConfigurer">
    		<property name="basePackage" value="com.yang.dao" />
    	</bean>
    
    
    	
    	<bean id="transactionManager"
    		class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
    		<property name="dataSource" ref="dataSource" />
    	</bean>
    	
    	
    	<bean id="myRealm" class="com.yang.realm.MyRealm"/>  
    	
    	
    	<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
      	  <property name="realm" ref="myRealm"/>  
    	</bean>  
    	
    	
    	<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
    	      
    	    <property name="securityManager" ref="securityManager"/>
    	      
    	    <property name="loginUrl" value="/login.jsp"/>
    	      
    	    <property name="unauthorizedUrl" value="/unauthorized.jsp"/>  
    	      
    	    <property name="filterChainDefinitions">  
    	        <value>  
    	            /login=anon
    	            /logout=logout
    		    /admin=authc
    		    /student=roles[teacher]
    		    /teacher=perms["user:create"]
    		    /**=authc
    	        </value>  
    	    </property>
    	</bean>  
    	
    	  
    	<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>  
    	
    	
    	<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>  
      		<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">  
      	  <property name="securityManager" ref="securityManager"/>  
        </bean>  
      
    	  
        <tx:advice id="txAdvice" transaction-manager="transactionManager">  
              
            <tx:attributes>  
                <tx:method name="insert*" propagation="REQUIRED" />  
                <tx:method name="update*" propagation="REQUIRED" />  
                <tx:method name="edit*" propagation="REQUIRED" />  
                <tx:method name="save*" propagation="REQUIRED" />  
                <tx:method name="add*" propagation="REQUIRED" />  
                <tx:method name="new*" propagation="REQUIRED" />  
                <tx:method name="set*" propagation="REQUIRED" />  
                <tx:method name="remove*" propagation="REQUIRED" />  
                <tx:method name="delete*" propagation="REQUIRED" />  
                <tx:method name="change*" propagation="REQUIRED" />  
                <tx:method name="check*" propagation="REQUIRED" />  
                <tx:method name="get*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="find*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="load*" propagation="REQUIRED" read-only="true" />  
                <tx:method name="*" propagation="REQUIRED" read-only="true" />  
            </tx:attributes>  
        </tx:advice>  
      
          
        <aop:config>  
            <aop:pointcut id="txPoint"  
                expression="execution(* com.yang.service.*.*(..))" />  
            <aop:advisor advice-ref="txAdvice" pointcut-ref="txPoint" />  
        </aop:config>     
    </beans>

db.properties

jdbc.driverClass=com.mysql.jdbc.Driver
    jdbc.jdbcUrl=jdbc:mysql://localhost:3306/db_shiro?characterEncoding=utf8
    jdbc.user=root
    jdbc.password=root

log4j.properties

log4j.rootLogger=DEBUG, Console  
      
    #Console  
    log4j.appender.Console=org.apache.log4j.ConsoleAppender  
    log4j.appender.Console.layout=org.apache.log4j.PatternLayout  
    log4j.appender.Console.layout.ConversionPattern=%d [%t] %-5p [%c] - %m%n  
      
    log4j.logger.java.sql.ResultSet=INFO  
    log4j.logger.org.apache=INFO  
    log4j.logger.java.sql.Connection=DEBUG  
    log4j.logger.java.sql.Statement=DEBUG  
    log4j.logger.java.sql.PreparedStatement=DEBUG

mybatis-config.xml

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE configuration
    PUBLIC "-//mybatis.org//DTD Config 3.0//EN"
    "http://mybatis.org/dtd/mybatis-3-config.dtd">
    <configuration>
    	<settings>
    		
    		<setting name="mapUnderscoreToCamelCase" value="true"/>
    	</settings>
    	
    	
    	<typeAliases>
    		<package name="com.yang.entity"/>
    	</typeAliases>
    </configuration>
    	<settings>
    		
    		<setting name="mapUnderscoreToCamelCase" value="true"/>
    	</settings>
    	
    	
    	<typeAliases>
    		<package name="com.yang.entity"/>
    	</typeAliases>
    </configuration>

spring-mvc.xml

## 3.后端代码实现 ##

实体类

User.java

package com.yang.entity;
    
    /**  
     * created by yangqing on 2018年2月19日 下午9:27:56
     */
    public class User {
    
    	private Integer id;
    	private String username;
    	private String password;
    	private Integer roleId;
    
    	public Integer getId() {
    		return id;
    	}
    
    	public void setId(Integer id) {
    		this.id = id;
    	}
    
    	public String getUsername() {
    		return username;
    	}
    
    	public void setUsername(String username) {
    		this.username = username;
    	}
    
    	public String getPassword() {
    		return password;
    	}
    
    	public void setPassword(String password) {
    		this.password = password;
    	}
    
    	public Integer getRoleId() {
    		return roleId;
    	}
    
    	public void setRoleId(Integer roleId) {
    		this.roleId = roleId;
    	}
    }

dao接口

UserDao.java

package com.yang.dao;
    
    import java.util.Set;
    
    import com.yang.entity.User;
    /**
     * created by yangqing on 2018年2月19日 下午9:32:29
     */
    public interface UserDao {
    
    	/**
    	 *  通过用户名查找用户
    	 *  @param username
    	 *  @return User
    	 */
    	public User getByUserName(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的角色并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */	
    	public Set<String> getRoles(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的权限并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */	 
    	public Set<String> getPermissions(String username);
    }

UserDao接口的实现

UserMapper.xml   （该文件在src/main/resources/mapper文件夹下）

<?xml version="1.0" encoding="UTF-8" ?>
    <!DOCTYPE mapper
    PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
    "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    <mapper namespace="com.yang.dao.UserDao">
    		
    	<select id="getByUserName" parameterType="String" resultType="User">
    		select * from t_user where username=#{username}
    	</select>
    	
    	<select id="getRoles" parameterType="String" resultType="String">
    		select r.rolename from t_user u,t_role r where u.role_id=r.id and u.username=#{username}
    	</select>
    	
    	<select id="getPermissions" parameterType="String" resultType="String">
    		select p.permission_name from t_user u,t_role r,t_permission p where u.role_id=r.id and p.role_id=r.id and u.username=#{username}
    	</select>
    
    
    </mapper>

服务层

UserService.java

package com.yang.service;
    
    import java.util.Set;
    import com.yang.entity.User;
    
    /**
     * 
     * created by yangqing on 2018年2月19日 下午9:44:23
     */
    public interface UserService {
    	/**
    	 *  通过用户名查找用户
    	 *  @param username
    	 *  @return User
    	 */
    	public User getByUserName(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的角色并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */
    	public Set<String> getRoles(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的权限并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */	
    	public Set<String> getPermissions(String username);
    }
    	/**
    	 *  通过用户名查找用户
    	 *  @param username
    	 *  @return User
    	 */
    	public User getByUserName(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的角色并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */
    	public Set<String> getRoles(String username);
    	
    	/**
    	 *  通过用户名查找该用户所有的权限并保存在Set集合中
    	 *  @param username
    	 *  @return Set<String>
    	 */	
    	public Set<String> getPermissions(String username);
    }

UserServiceImpl.java

package com.yang.service.impl;
    
    import java.util.Set;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Service;
    
    import com.yang.dao.UserDao;
    import com.yang.entity.User;
    import com.yang.service.UserService;
    /**
     * created by yangqing on 2018年2月19日 下午9:45:51
     */
    @Service
    public class UserServiceImpl implements UserService{
    
    	@Autowired
    	private UserDao userDao;
    	
    	public User getByUserName(String username) {
    		return userDao.getByUserName(username);
    	}
    
    	public Set<String> getRoles(String username) {
    		return userDao.getRoles(username);
    	}
    
    	public Set<String> getPermissions(String username) {
    		return userDao.getPermissions(username);
    	}
    	
    }

Controller层

UserController.java

package com.yang.controller;
    
    
    import javax.servlet.http.HttpServletRequest;
    
    
    import org.apache.shiro.SecurityUtils;
    import org.apache.shiro.authc.UsernamePasswordToken;
    import org.apache.shiro.subject.Subject;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    
    
    import com.yang.entity.User;
    
    
    /**
     * 
     * created by yangqing on 2018年2月19日 下午9:48:55
     */
    @Controller
    public class UserController {
    		
    	@RequestMapping("/login")
    	public String login(User user,HttpServletRequest request){
    		
    		//获取当前用户
    		Subject subject=SecurityUtils.getSubject();
    		UsernamePasswordToken token=new UsernamePasswordToken(user.getUsername(), user.getPassword());
    		try{
    			//为当前用户进行认证，授权
    			subject.login(token);
    			request.setAttribute("user", user);
    			return "success";
    			
    		}catch(Exception e){
    			e.printStackTrace();
    			request.setAttribute("user", user);
    			request.setAttribute("errorMsg", "用户名或密码错误！");
    			return "login";
    		}
    	}
    	
    	@RequestMapping("/teacher")
    	public String index() {
    		return "index";
    	}
    }		
    	@RequestMapping("/login")
    	public String login(User user,HttpServletRequest request){
    		
    		//获取当前用户
    		Subject subject=SecurityUtils.getSubject();
    		UsernamePasswordToken token=new UsernamePasswordToken(user.getUsername(), user.getPassword());
    		try{
    			//为当前用户进行认证，授权
    			subject.login(token);
    			request.setAttribute("user", user);
    			return "success";
    			
    		}catch(Exception e){
    			e.printStackTrace();
    			request.setAttribute("user", user);
    			request.setAttribute("errorMsg", "用户名或密码错误！");
    			return "login";
    		}
    	}
    	
    	@RequestMapping("/teacher")
    	public String index() {
    		return "index";
    	}
    }

自定义realm

MyRealm.java

package com.yang.realm;
    
    import java.util.Set;
    
    import org.apache.shiro.authc.AuthenticationException;
    import org.apache.shiro.authc.AuthenticationInfo;
    import org.apache.shiro.authc.AuthenticationToken;
    import org.apache.shiro.authc.SimpleAuthenticationInfo;
    import org.apache.shiro.authz.AuthorizationInfo;
    import org.apache.shiro.authz.SimpleAuthorizationInfo;
    import org.apache.shiro.realm.AuthorizingRealm;
    import org.apache.shiro.subject.PrincipalCollection;
    import org.springframework.beans.factory.annotation.Autowired;
    
    import com.yang.entity.User;
    import com.yang.service.UserService;
    
    /**
     * created by yangqing on 2018年2月19日 下午9:57:09
     */
    public class MyRealm extends AuthorizingRealm {
    
    	@Autowired
    	private UserService userService;
    
    	/**
    	 * 授权方法
    	 */
    	@Override
    	protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
    		
    		/**
    		 * 注意principals.getPrimaryPrincipal()对应
    		 * new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(), getName())的第一个参数
    		 */
    		//获取当前身份
    		String userName = (String) principals.getPrimaryPrincipal();
    		SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
    		
    		//从数据库中查找该用户有何角色和权限
    		Set<String> roles = userService.getRoles(userName);
    		Set<String> permissions = userService.getPermissions(userName);
    		
    		//为当前用户赋予对应角色和权限
    		info.setRoles(roles);
    		info.setStringPermissions(permissions);
    		
    		return info;
    	}
    
    	/**
    	 * 认证方法
    	 */
    	@Override
    	protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    		//获取用户名
    		String username = (String) token.getPrincipal();
    		
    		//从数据库中查找用户信息
    		User user = userService.getByUserName(username);
    		if (user == null) {
    			return null;			
    		}
    		AuthenticationInfo info = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), getName());
    		return info;
    	}
    
    }

## 4.前端页面展示 ##

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>登录页面</title>
    </head>
    <body>
    <form action="${pageContext.request.contextPath }/login" method="post">
    	用户名:<input type="text" name="username" value="${user.username }"/><br/>
    	密码:<input type="password" name="password" value="${user.password }"><br/>
    	<input type="submit" value="login"/><br>
    	<font color="red">${errorMsg }</font>
    </form>
    </body>
    </html>

success.jsp

<%@ page language="java" contentType="text/html; charset=UTF-8"
        pageEncoding="UTF-8"%>
    <%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
    <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
    <title>登录成功</title>
    </head>
    <body>
    
    
    欢迎你,<shiro:principal/>!<br>
    
    
    <shiro:hasRole name="admin">
    	具备admin角色才能看到这句话<br>
    </shiro:hasRole>
    
    
    <shiro:hasRole name="teacher">
    	具备teacher角色才能看到这句话<br>
    </shiro:hasRole>
    
    
    <shiro:hasPermission name="user:create">
    	具备user:create权限才能看到这句话<br>
    </shiro:hasPermission>
    
    
    <shiro:hasPermission name="student:update">
    	具备student:update权限才能看到这句话<br>
    </shiro:hasPermission>
    <br>
    
    
    <shiro:hasPermission name="{student:update,user:*}">
    	具备student:update,user:*权限才能看到这句话<br>
    </shiro:hasPermission>
    
    
    <a href="teacher">需要user:create权限才能访问</a><br>
    <a href="logout">安全退出</a>
    </body>
    </html>	具备admin角色才能看到这句话<br>
    </shiro:hasRole>
    
    
    <shiro:hasRole name="teacher">
    	具备teacher角色才能看到这句话<br>
    </shiro:hasRole>
    
    
    <shiro:hasPermission name="user:create">
    	具备user:create权限才能看到这句话<br>
    </shiro:hasPermission>
    
    
    <shiro:hasPermission name="student:update">
    	具备student:update权限才能看到这句话<br>
    </shiro:hasPermission>
    <br>
    
    
    <shiro:hasPermission name="{student:update,user:*}">
    	具备student:update,user:*权限才能看到这句话<br>
    </shiro:hasPermission>
    
    
    <a href="teacher">需要user:create权限才能访问</a><br>
    <a href="logout">安全退出</a>
    </body>
    </html>

## 5.测试结果 ##

分别使用用户名为yangqing和jack的账号登录，测试如下：

tip：如果未登录（未通过认证）在地址栏输入http://localhost:8080/shiroDemo/success.jsp默认跳回login.jsp页面（被shiro拦截了，具体请参考上述配置文件 /\*\*=authc部分）

错误用户试验

![20180220010053676][]

使用yangqing登录成功之后的页面

![20180220010206271][]

点击  需要user:create权限才能访问  链接之后的页面

![20180220010111823][]

使用jack登录成功之后的页面

![20180220011009409][]

jack用户 点击  需要user:create权限才能访问  链接之后的页面

![20180220010140144][]

小结：好累，眼睛疼，第一次写博客文章，本人也是菜鸟，正在一步一步往上爬，请大家多多指教，写的应该还算详细吧，大佬请手下留情，我还是个新手。。已经凌晨1点多了，肩膀好酸，我先睡了，晚安！

[shiroDemo.rar]: http://download.csdn.net/download/yq714588944/10253497
[20180220010053676]: /images/20220531/0cd8b48d359649378d62c240e026e0e7.png
[20180220010206271]: /images/20220531/fdc5ea54b4b648d7a5590d28cddfb914.png
[20180220010111823]: /images/20220531/8cd664ef4b6246fdba6530c4cf591242.png
[20180220011009409]: /images/20220531/21194ef1278f451b953c19866b0ad6bf.png
[20180220010140144]: /images/20220531/59a18f3f5d0a4dffa454a2a01f0e2925.png