[main]
securityManager.属性=值
xiaolin=123456
securityManager.对象属性=$xiaolin
复制代码

[users]
# 定义用户名为zhangsan 密码为zs
zhangsan=zs
# 定义用户名lisi密码为lisi同时具有role1和role2两个角色
lisi=lisi,role1,role2
复制代码

[roles]
role1=权限名1,权限名2 
role2=权限3,权限4
复制代码

[urls]
#url地址=内置filter或自定义filter
# 访问时出现/login的url必须去认证.支持authc对应的Filter 
/login=authc
# 任意的url都不需要进行认证等功能.
/** = anon
# 所有的内容都必须保证用户已经登录.
/**=user
# url abc 访问时必须保证用户具有role1和role2角色.
/abc=roles[“role1,role2”]
复制代码

<dependency>
    <groupId>commons-logging</groupId>
    <artifactId>commons-logging</artifactId>
    <version>1.1.3</version>
</dependency>
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.5.2</version>
</dependency>
<dependency>
    <groupId>junit</groupId>
    <artifactId>junit</artifactId>
    <version>4.13.2</version>
</dependency>
<dependency>
    <groupId>org.projectlombok</groupId>
    <artifactId>lombok</artifactId>
    <version>1.16.22</version>
    <scope>provided</scope>
</dependency>
复制代码

[users]
xiaolin=666
zs=13
复制代码

/**
  * 用于测试Shiro基础
  */
  @Test
  public void testShiroBase(){
    // 创建Shiro安全管理器，是Shiro的核心
    DefaultSecurityManager securityManager = new DefaultSecurityManager();
    // 加载ini配置文件，得到配置文件中配置的用户信息
    IniRealm iniRealm = new IniRealm("classpath:shiro-authc.ini");
    // 将realm对象注入到securityManager中
    securityManager.setRealm(iniRealm);
    // 将安全管理器注入到当前环境中
    SecurityUtils.setSecurityManager(securityManager);
    // 获取subject主体对象，无论是否登录都可以获取
    Subject subject = SecurityUtils.getSubject();
    // 打印一下认证状态
    System.out.println("认证状态"+subject.isAuthenticated());
    // 创建一个携带了账号和密码的令牌
    UsernamePasswordToken token = new UsernamePasswordToken("xiaolin", "666");
    // 调用subject传入令牌进行登录
    subject.login(token);
    System.out.println("认证状态"+subject.isAuthenticated());
  }
复制代码

// 认证
public class SimpleAccountRealm extends AuthorizingRealm {
    //.......省略
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) token;
        SimpleAccount account = getUser(upToken.getUsername());
        if (account != null) {
            if (account.isLocked()) {
                throw new LockedAccountException("Account [" + account + "] is locked.");
            }
            if (account.isCredentialsExpired()) {
                String msg = "The credentials for account [" + account + "] are expired";
                throw new ExpiredCredentialsException(msg);
            }
        }
        return account;
    }
    // 授权
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        String username = getUsername(principals);
        USERS_LOCK.readLock().lock();
        try {
            return this.users.get(username);
        } finally {
            USERS_LOCK.readLock().unlock();
        }
    }
}
复制代码

<properties>
  <shiro.version>1.5.2</shiro.version>
</properties>
<!--shiro 核心-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 的 Web 模块-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-web</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 和 Spring 集成-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 底层使用的 ehcache 缓存-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-ehcache</artifactId>
    <version>${shiro.version}</version>
</dependency>
<!--shiro 依赖的日志包-->
<dependency>
    <groupId>commons-logging</groupId>
    <artifactId>commons-logging</artifactId>
    <version>1.2</version>
</dependency>
<!--Freemarker 的 shiro 标签库-->
<dependency>
    <groupId>net.mingsoft</groupId>
    <artifactId>shiro-freemarker-tags</artifactId>
    <version>1.0.1</version>
</dependency>
复制代码

<filter>
    <filter-name>shiroFilter</filter-name>
    <filter-class>
        org.springframework.web.filter.DelegatingFilterProxy
    </filter-class>
</filter>
<filter-mapping>
    <filter-name>shiroFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>
复制代码

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd">
    <!--自定义Realm-->
  <bean id="myRealm" class="cn.linstudy.shiro.CarBusinessRealm"/>
    <!--创建安全管理器-->
  <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="myRealm"/>
  </bean>
  <bean id="shiroFilter"
    class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <!--引用指定的安全管理器-->
    <property name="securityManager" ref="securityManager"/>
    <!--shiro默认的登录地址是/login.jsp 现在要指定我们自己的登录页面地址-->
    <property name="loginUrl" value="/login.html"/>
    <!--路径对应的规则-->
    <property name="filterChainDefinitions">
      <!--配置请求拦截的方式，是可以匿名还是-->
      <value>
        /empLogin=anon
        /static/**=anon
        /upload/**=anon
        /getImage=anon
        /getEmailCode=anon
        /checkEmail=anon
        /checkUsername=anon
        /error=anon
        /fronted/**=anon
        /**=authc
      </value>
    </property>
  </bean>
</beans>
复制代码

<import resource="classpath:shiro.xml"/>
复制代码

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"></bean>
复制代码

public class CarBusinessRealm extends AuthorizingRealm {  
@Autowired
  private EmployeeService employeeService;
  // 认证
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token)
      throws AuthenticationException {
    // 通过token获取用户名（用户登录的时候）
    String username = (String) token.getPrincipal();
    // 判断是否存在在数据库
    Employee employee = employeeService.selectByUsername(username);
    if (employee != null) {
      // 说明此时用户名是对的，返回一个身份对象
      return new SimpleAuthenticationInfo(employee, employee.getPassword(), this.getName());
    }
    return null;
  }
}
复制代码

<bean id="myRealm" class="cn.linstudy.shiro.CarBusinessRealm"/>
  <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm" ref="myRealm"/>
  </bean> 
复制代码

try {
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        SecurityUtils.getSubject().login(token);
        Employee employee = employeeMapper.selectByUsername(username);
        return employee;
      } catch (UnknownAccountException e) {
        throw new CarBussinessException("用户名错误");
      } catch (IncorrectCredentialsException e) {
        throw new CarBussinessException("密码错误");
      }
复制代码