SpringMVC整合Shiro

原文：https://my.oschina.net/miger/blog/283526

摘要: SpringMVC整合Shiro，Shiro是一个强大易用的Java安全框架,提供了认证、授权、加密和会话管理等功能。

第一步：配置web.xml

<!-- 配置Shiro过滤器,先让Shiro过滤系统接收到的请求 -->  
<!-- 这里filter-name必须对应applicationContext.xml中定义的<bean id="shiroFilter"/> -->  
<!-- 使用[/*]匹配所有请求,保证所有的可控请求都经过Shiro的过滤 -->  
<!-- 通常会将此filter-mapping放置到最前面(即其他filter-mapping前面),以保证它是过滤器链中第一个起作用的 -->  
<filter>  
    <filter-name>shiroFilter</filter-name>  
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>  
    <init-param>  
    <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 -->  
    <param-name>targetFilterLifecycle</param-name>  
    <param-value>true</param-value>  
    </init-param>  
</filter>  
<filter-mapping>  
        <filter-name>shiroFilter</filter-name>  
        <url-pattern>/*</url-pattern>  
</filter-mapping>

第二步：配置applicationContext.xml

<!-- 继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户登录的类为自定义的ShiroDbRealm.java -->  
<bean id="myRealm" class="com.jadyer.realm.MyRealm"/>  
  
<!-- Shiro默认会使用Servlet容器的Session,可通过sessionMode属性来指定使用Shiro原生Session -->  
<!-- 即<property name="sessionMode" value="native"/>,详细说明见官方文档 -->  
<!-- 这里主要是设置自定义的单Realm应用,若有多个Realm,可使用'realms'属性代替 -->  
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">  
    <property name="realm" ref="myRealm"/>  
</bean>  
  
<!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 -->  
<!-- Web应用中,Shiro可控制的Web请求必须经过Shiro主过滤器的拦截,Shiro对基于Spring的Web应用提供了完美的支持 -->  
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
    <!-- Shiro的核心安全接口,这个属性是必须的 -->  
    <property name="securityManager" ref="securityManager"/>  
    <!-- 要求登录时的链接(可根据项目的URL进行替换),非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->  
    <property name="loginUrl" value="/"/>  
    <!-- 登录成功后要跳转的连接(本例中此属性用不到,因为登录成功后的处理逻辑在LoginController里硬编码为main.jsp了) -->  
    <!-- <property name="successUrl" value="/system/main"/> -->  
    <!-- 用户访问未对其授权的资源时,所显示的连接 -->  
    <!-- 若想更明显的测试此属性可以修改它的值,如unauthor.jsp,然后用[玄玉]登录后访问/admin/listUser.jsp就看见浏览器会显示unauthor.jsp -->  
    <property name="unauthorizedUrl" value="/"/>  
    <!-- Shiro连接约束配置,即过滤链的定义 -->  
    <!-- 此处可配合我的这篇文章来理解各个过滤连的作用http://blog.csdn.net/jadyer/article/details/12172839 -->  
    <!-- 下面value值的第一个'/'代表的路径是相对于HttpServletRequest.getContextPath()的值来的 -->  
    <!-- anon：它对应的过滤器里面是空的,什么都没做,这里.do和.jsp后面的*表示参数,比方说login.jsp?main这种 -->  
    <!-- authc：该过滤器下的页面必须验证后才能访问,它是Shiro内置的一个拦截器org.apache.shiro.web.filter.authc.FormAuthenticationFilter -->  
    <property name="filterChainDefinitions">  
        <value>  
             /mydemo/login=anon  
             /mydemo/getVerifyCodeImage=anon  
             /main**=authc  
             /user/info**=authc  
             /admin/listUser**=authc,perms[admin:manage]  
        </value>  
    </property>
</bean>  
  
<!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->  
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>  
  
<!-- 开启Shiro的注解(如@RequiresRoles,@RequiresPermissions),需借助SpringAOP扫描使用Shiro注解的类,并在必要时进行安全逻辑验证 -->  
<!-- 配置以下两个bean即可实现此功能 -->  
<!-- Enable Shiro Annotations for Spring-configured beans. Only run after the lifecycleBeanProcessor has run -->  
<!-- 由于本例中并未使用Shiro注解,故注释掉这两个bean(个人觉得将权限通过注解的方式硬编码在程序中,查看起来不是很方便,没必要使用) -->  
<!--   
<bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/>  
  <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">  
    <property name="securityManager" ref="securityManager"/>  
  </bean>  
-->

第三步：自定义的Realm类

public class MyRealm extends AuthorizingRealm {  
    /** 
     * 为当前登录的Subject授予角色和权限 
     * @see  经测试:本例中该方法的调用时机为需授权资源被访问时 
     * @see  经测试:并且每次访问需授权资源时都会执行该方法中的逻辑,这表明本例中默认并未启用AuthorizationCache 
     * @see  个人感觉若使用了Spring3.1开始提供的ConcurrentMapCache支持,则可灵活决定是否启用AuthorizationCache 
     * @see  比如说这里从数据库获取权限信息时,先去访问Spring3.1提供的缓存,而不使用Shior提供的AuthorizationCache 
     */  
    @Override  
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals){  
        //获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()  
        String currentUsername = (String)super.getAvailablePrincipal(principals);  
//      List<String> roleList = new ArrayList<String>();  
//      List<String> permissionList = new ArrayList<String>();  
//      //从数据库中获取当前登录用户的详细信息  
//      User user = userService.getByUsername(currentUsername);  
//      if(null != user){  
//          //实体类User中包含有用户角色的实体类信息  
//          if(null!=user.getRoles() && user.getRoles().size()>0){  
//              //获取当前登录用户的角色  
//              for(Role role : user.getRoles()){  
//                  roleList.add(role.getName());  
//                  //实体类Role中包含有角色权限的实体类信息  
//                  if(null!=role.getPermissions() && role.getPermissions().size()>0){  
//                      //获取权限  
//                      for(Permission pmss : role.getPermissions()){  
//                          if(!StringUtils.isEmpty(pmss.getPermission())){  
//                              permissionList.add(pmss.getPermission());  
//                          }  
//                      }  
//                  }  
//              }  
//          }  
//      }else{  
//          throw new AuthorizationException();  
//      }  
//      //为当前用户设置角色和权限  
//      SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();  
//      simpleAuthorInfo.addRoles(roleList);  
//      simpleAuthorInfo.addStringPermissions(permissionList);  
        SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();  
        //实际中可能会像上面注释的那样从数据库取得  
        if(null!=currentUsername && "mike".equals(currentUsername)){  
            //添加一个角色,不是配置意义上的添加,而是证明该用户拥有admin角色    
            simpleAuthorInfo.addRole("admin");  
            //添加权限  
            simpleAuthorInfo.addStringPermission("admin:manage");  
            System.out.println("已为用户[mike]赋予了[admin]角色和[admin:manage]权限");  
            return simpleAuthorInfo;  
        }
        //若该方法什么都不做直接返回null的话,就会导致任何用户访问/admin/listUser.jsp时都会自动跳转到unauthorizedUrl指定的地址  
        //详见applicationContext.xml中的<bean id="shiroFilter">的配置  
        return null;  
    }  
  
      
    /** 
     * 验证当前登录的Subject 
     * @see  经测试:本例中该方法的调用时机为LoginController.login()方法中执行Subject.login()时 
     */  
    @Override  
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {  
        //获取基于用户名和密码的令牌  
        //实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的  
        //两个token的引用都是一样的
        UsernamePasswordToken token = (UsernamePasswordToken)authcToken;  
        System.out.println("验证当前Subject时获取到token为" + ReflectionToStringBuilder.toString(token, ToStringStyle.MULTI_LINE_STYLE));  
//      User user = userService.getByUsername(token.getUsername());  
//      if(null != user){  
//          AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(user.getUsername(), user.getPassword(), user.getNickname());  
//          this.setSession("currentUser", user);  
//          return authcInfo;  
//      }else{  
//          return null;  
//      }  
        //此处无需比对,比对的逻辑Shiro会做,我们只需返回一个和令牌相关的正确的验证信息  
        //说白了就是第一个参数填登录用户名,第二个参数填合法的登录密码(可以是从数据库中取到的,本例中为了演示就硬编码了)  
        //这样一来,在随后的登录页面上就只有这里指定的用户和密码才能通过验证  
        if("mike".equals(token.getUsername())){  
            AuthenticationInfo authcInfo = new SimpleAuthenticationInfo("mike", "mike", this.getName());  
            this.setSession("currentUser", "mike");  
            return authcInfo;  
        }
        //没有返回登录用户名对应的SimpleAuthenticationInfo对象时,就会在LoginController中抛出UnknownAccountException异常  
        return null;  
    }  
      
      
    /** 
     * 将一些数据放到ShiroSession中,以便于其它地方使用 
     * @see  比如Controller,使用时直接用HttpSession.getAttribute(key)就可以取到 
     */  
    private void setSession(Object key, Object value){  
        Subject currentUser = SecurityUtils.getSubject();  
        if(null != currentUser){  
            Session session = currentUser.getSession();  
            System.out.println("Session默认超时时间为[" + session.getTimeout() + "]毫秒");  
            if(null != session){  
                session.setAttribute(key, value);  
            }  
        }  
    }  
}

 自己项目配置如下：

<properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <shiro.version>1.2.2</shiro.version>
    </properties>


　　　　<dependency>
                <groupId>org.apache.shiro</groupId>
                <artifactId>shiro-spring</artifactId>
                <version>${shiro.version}</version>
　　　　</dependency>
　　　　<dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-ehcache</artifactId>
            <version>${shiro.version}</version>
        </dependency>
        
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>${shiro.version}</version>
        </dependency>

shiro.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
    xmlns:aop="http://www.springframework.org/schema/aop"
    xmlns:util="http://www.springframework.org/schema/util"
    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd 
                        http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd 
                        http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util-2.0.xsd"
                        default-lazy-init="true">

    
    <bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>
    </bean>
    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="shiroDbRealm" />
        <property name="sessionManager" ref="sessionManager" />
        <property name="cacheManager" ref="shiroCacheManager" />
    </bean>

    <!-- 凭证匹配器 -->
    <bean id="credentialsMatcher"
        class="cn.zsmy.utils.MyHashedCredentialsMatcher">
        <constructor-arg ref="shiroCacheManager" />
        <property name="hashAlgorithmName" value="md5" />
        <property name="hashIterations" value="2" />
        <property name="storedCredentialsHexEncoded" value="true" />
    </bean>
    <!-- 項目自定义的 Realm -->
    <bean id="shiroDbRealm" class="cn.zsmy.shiro.BackAuthRealm">
        <property name="exUserService" ref="exUserService" />
        <property name="exRoleService" ref="exRoleService" />
        <property name="logService" ref="logService" />
        <property name="permitService" ref="permitService" />
        <!-- MD5 加密 -->
        <property name="credentialsMatcher" ref="credentialsMatcher" />
        <!-- 可配置 cache token 认证信息的cache，用于 REST 等需要频繁认证的场景 -->
        <property name="cachingEnabled" value="false" /><!--false时每次登录都会验证 -->
        <property name="authenticationCachingEnabled" value="false" /><!--false时每次登录都会验证 -->
        <property name="authenticationCacheName" value="authenticationCache" />
        <property name="authorizationCachingEnabled" value="false" /><!-- false时会实时检查该用户的权限 -->
        <property name="authorizationCacheName" value="authorizationCache" />
    </bean>

    <!-- 会话ID生成器 -->
    <bean id="sessionIdGenerator"
        class="org.apache.shiro.session.mgt.eis.JavaUuidSessionIdGenerator" />

    <!-- 会话Cookie模板 -->
    <bean id="sessionIdCookie" class="org.apache.shiro.web.servlet.SimpleCookie">
        <constructor-arg value="sid" />
        <property name="httpOnly" value="true" />
        <property name="maxAge" value="3600000" />
    </bean>

    <!-- 会话DAO -->
    <bean id="sessionDAO"
        class="org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO">
        <property name="activeSessionsCacheName" value="shiro-activeSessionCache" />
        <property name="sessionIdGenerator" ref="sessionIdGenerator" />
    </bean>

    <!-- 会话验证调度器 -->
    <bean id="sessionValidationScheduler"
        class="org.apache.shiro.session.mgt.quartz.QuartzSessionValidationScheduler">
        <property name="sessionValidationInterval" value="3600000" /><!-- 相隔多久检查一次session的有效性 -->
        <property name="sessionManager" ref="sessionManager" />
    </bean>

    <!-- 会话管理器 -->
    <bean id="sessionManager"
        class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="globalSessionTimeout" value="3600000" /><!-- session 有效时间为半小时 （毫秒单位）-->
        <property name="deleteInvalidSessions" value="true" />
        <property name="sessionValidationSchedulerEnabled" value="true" />
        <property name="sessionValidationScheduler" ref="sessionValidationScheduler" />
        <property name="sessionDAO" ref="sessionDAO" />
        <property name="sessionIdCookieEnabled" value="true" />
        <property name="sessionIdCookie" ref="sessionIdCookie" />
    </bean>


    <!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) -->
    <bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
        <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />
        <property name="arguments" ref="securityManager" />
    </bean>


      <!-- 自定义验证拦截器 -->  
    <bean id="myAuthenFilter" class="cn.zsmy.filter.CaptchaFormAuthenticationFilter" >
        <property name="usernameParam" value="username" />
        <property name="passwordParam" value="password" />
        <property name="loginUrl" value="/login.jsp" />
    </bean>  
    
    <!-- 自定义鉴权拦截器 -->  
    <bean id="URLPermissionsFilter" class="cn.zsmy.filter.URLPermissionsFilter" />  

    <!-- Shiro 过滤器设置 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager" />
        <property name="loginUrl" value="/login.do" />
        <property name="successUrl" value="/home.do" />
        <property name="unauthorizedUrl" value="/page/unauthorized.jsp" />
        <property name="filters">
            <util:map>              
                  <!-- 启用验证码检验 -->
                <entry key="myauth" value-ref="myAuthenFilter" />
                 <!-- 启用权限检验 -->
                <entry key="perms" value-ref="URLPermissionsFilter" />
                
            </util:map>
        </property>
        <property name="filterChainDefinitions">
            <value>
                /logout.do = logout
                /home.do = myauth
                /admin/** = myauth,perms
                /wx/** = myauth,perms
                /sys/** = myauth,perms
                /biz/** = myauth,perms
                /doctor/** = myauth,perms
                /patient/** = myauth,perms                
                /login.do = myauth
                /statistics/** = myauth,perms
                /refreshBaseData/** = myauth,perms
                /** = anon
                
                <!--  /logout.do = logout
                /home.do = myauth
                /admin/** = myauth
                /sys/** = myauth
                /biz/** = myauth
                /doctor/** = myauth
                /patient/** = myauth                
                /login.do = myauth
                /statistics/** = user
                /** = anon  -->
                
            </value>
        </property>
    </bean>

    <!-- 保证实现了 Shiro 内部 lifecycle 函数的 bean 执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

    <!-- AOP 式方法级权限检查 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
        depends-on="lifecycleBeanPostProcessor">
        <property name="proxyTargetClass" value="true" />
    </bean>
    

</beans>

 BackAuthRealm.java

package cn.zsmy.shiro;

import java.util.List;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.ByteSource;

import cn.zsmy.constant.Constant;
import cn.zsmy.entity.Log;
import cn.zsmy.entity.Permit;
import cn.zsmy.entity.Role;
import cn.zsmy.entity.User;
import cn.zsmy.form.PermitForm;
import cn.zsmy.form.UserForm;
import cn.zsmy.service.admin.PermitService;
import cn.zsmy.service.sys.LogService;
import cn.zsmy.service.tmp.ExRoleService;
import cn.zsmy.service.tmp.ExUserService;

public class BackAuthRealm extends AuthorizingRealm {

    private ExUserService exUserService;
    private ExRoleService exRoleService;
    private LogService logService;
    private PermitService permitService;
    
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(
            PrincipalCollection principalCollection) {
        User user = (User) principalCollection.fromRealm(getName())
                .iterator().next();
        //user.setRoles();
        List<Role> roles = exRoleService.findRolesByUserId(user.getId());
        //List<Permit> permits =exUserService.findPermitsByUserId(user.getId());
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        if(roles != null && roles.size() > 0){
            PermitForm form = new PermitForm();
            form.setRoleId(roles.get(0).getId());
            List<Permit> permits =permitService.findByForm(form);
            if (roles != null) {
                for (Role role : roles) {
                    // 基于Role的角色信息
                    info.addRole(role.getName());
                }
            }
            if (permits != null) {
                for (Permit permit : permits) {
                    // 基于Role的权限信息
                    info.addStringPermission(permit.getFunctionUrl());
                }
            }
        }
        
        //后台用户个人信息修改
        info.addStringPermission("/admin/user/toUpdate.do");
        info.addStringPermission("/admin/user/updateInfo.do");
        
        //公用的上传图片
        info.addStringPermission("/uploadImage.do");
        
        //医生登录直接获取接诊的所有权限
        if(Constant.User.USER_TYPE_DOCTOR_STR.equals(user.getUserType())){
            info.addStringPermission("/biz/case/sendMsgByOpenfire.do");
            info.addStringPermission("/biz/case/queryData.do");
            info.addStringPermission("/biz/case/addAdvice.do");
            info.addStringPermission("/biz/case/chat_list.do");
            info.addStringPermission("/biz/case/case_advice_add.do");
            info.addStringPermission("/biz/case/clinicalReceptionByOpenfire.do");
            info.addStringPermission("/biz/case/queryChatByPage.do");
            info.addStringPermission("/biz/case/waitingQuery.do");
            info.addStringPermission("/biz/case/waiting.do");
        }
        
        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken)
            throws AuthenticationException {
        UsernamePasswordToken upToken = (UsernamePasswordToken) authenticationToken;
        //User user = exUserService.findByUsername(upToken.getUsername());
        UserForm userForm = new UserForm();
        userForm.setUsername(upToken.getUsername());
        //userForm.setUserType(Constants.User.USER_TYPE_BACK_STR);
        
        User user = exUserService.findByUsernameAndUserType(userForm);
        
        if (user == null) {
            throw new UnknownAccountException("No account found for user ["+ upToken.getUsername() + "]");
        } else if(!Constant.User.USER_TYPE_BACK_STR.equals(user.getUserType()) && !Constant.User.USER_TYPE_DOCTOR_STR.equals(user.getUserType())){
            throw new UnknownAccountException("No account found for user ["+ upToken.getUsername() + "]");
        }
        //登录日志
        Log log = new Log();
        log.setOperator(upToken.getUsername());
                
        log.setTypeFlag(Constant.TS_Log.TYPE_FLAG_LOGIN);
        log.setReqUrl("/admin/login.do");
        log.setCreator(user.getId());
        logService.add(log);
        
        setSessionInfo(user);
        
        return new SimpleAuthenticationInfo(user, user.getPassword(),
                ByteSource.Util.bytes(user.getCredentialsSalt()), getName());
    }

    /**
     * 存放一些信息到session中，便于获取，可以通过httpsession获取相应的信息
     * @param user
     */
    private void setSessionInfo(User user){
        Subject sub = SecurityUtils.getSubject();
        Session session = sub.getSession();
        session.setAttribute("LOGIN_USER_INFO", user);
    }
    
    public ExUserService getExUserService() {
        return exUserService;
    }

    public void setExUserService(ExUserService exUserService) {
        this.exUserService = exUserService;
    }

    public ExRoleService getExRoleService() {
        return exRoleService;
    }

    public void setExRoleService(ExRoleService exRoleService) {
        this.exRoleService = exRoleService;
    }

    public LogService getLogService() {
        return logService;
    }

    public void setLogService(LogService logService) {
        this.logService = logService;
    }

    public PermitService getPermitService() {
        return permitService;
    }

    public void setPermitService(PermitService permitService) {
        this.permitService = permitService;
    }

    
}

 CaptchaFormAuthenticationFilter.java

package cn.zsmy.filter;

import java.util.Date;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
import org.apache.shiro.web.util.WebUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import cn.zsmy.constant.Constant;
import cn.zsmy.entity.User;
import cn.zsmy.service.admin.UserService;
import cn.zsmy.util.CaptchaUsernamePasswordToken;
import cn.zsmy.util.IncorrectCaptchaException;

/**
 *     DisabledAccountException （禁用的帐号）
    LockedAccountException （锁定的帐号）
    UnknownAccountException（错误的帐号）
    ExcessiveAttemptsException（登录失败次数过多）
    IncorrectCredentialsException （错误的凭证）
    ExpiredCredentialsException （过期的凭证）

 *
 */
public class CaptchaFormAuthenticationFilter extends FormAuthenticationFilter {
    @Autowired
    private UserService userService;
    
    public CaptchaFormAuthenticationFilter() {
    }
    @Override
    /**
     * 登录验证
     */
    protected boolean executeLogin(ServletRequest request,
            ServletResponse response) throws Exception {
        CaptchaUsernamePasswordToken token = createToken(request, response);
        try {
            /*图形验证码验证*/
            doCaptchaValidate(token);
            Subject subject = getSubject(request, response);
            subject.login(token);//正常验证
            //销毁验证码
            HttpServletRequest httpRequest = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
            httpRequest.getSession().removeAttribute("rand");
            Constant.MY_LOG.info(token.getUsername()+"登录成功");
            
            //更新登录用户的session与最后登录时间
            User user = (User) subject.getPrincipal();
            User tmpUser = new User();
            tmpUser.setId(user.getId());
            tmpUser.setSessionId(httpRequest.getSession().getId());
            tmpUser.setLastLoginTime(new Date());
            userService.update(tmpUser);
            
            return onLoginSuccess(token, subject, request, response);
        }catch (AuthenticationException e) {
            Constant.MY_LOG.info(token.getUsername()+"登录失败--"+e);
            return onLoginFailure(token, e, request, response);
        }
    }

    /**
     * 主要是处理登入失败的方法
     */
    
    // 验证码校验
    protected void doCaptchaValidate(CaptchaUsernamePasswordToken token) {
//session中的图形码字符串
        /*String captcha = (String) request.getSession().getAttribute(
                com.google.code.kaptcha.Constants.KAPTCHA_SESSION_KEY);*/
        HttpServletRequest httpRequest = ((ServletRequestAttributes) RequestContextHolder.getRequestAttributes()).getRequest();
        String rand = (String) httpRequest.getSession().getAttribute("rand");
//比对
        if (rand != null && !rand.equalsIgnoreCase(token.getCaptcha())) {
            throw new IncorrectCaptchaException();//可以传递参数
        }
    }

    @Override
    protected CaptchaUsernamePasswordToken createToken(ServletRequest request,
            ServletResponse response) {
        String username = getUsername(request);
        String password = getPassword(request);
        String captcha = getCaptcha(request);
        boolean rememberMe = isRememberMe(request);
        String host = getHost(request);

        request.setAttribute("username", username);
        request.setAttribute("password", password);
        return new CaptchaUsernamePasswordToken(username,
                password, rememberMe, host, captcha);
    }

    public static final String DEFAULT_CAPTCHA_PARAM = "captcha";

    private String captchaParam = DEFAULT_CAPTCHA_PARAM;

    public String getCaptchaParam() {
        return captchaParam;
    }

    public void setCaptchaParam(String captchaParam) {
        this.captchaParam = captchaParam;
    }

    protected String getCaptcha(ServletRequest request) {
        return WebUtils.getCleanParam(request, getCaptchaParam());
    }
    
//保存异常对象到request
    @Override
    protected void setFailureAttribute(ServletRequest request,
            AuthenticationException ae) {
        request.setAttribute(getFailureKeyAttribute(), ae);
    }
    
    /**
     * 所有请求都会经过的方法。
     */
    @Override
    protected boolean onAccessDenied(ServletRequest request,
            ServletResponse response) throws Exception {
        if (isLoginRequest(request, response)) {
            if (isLoginSubmission(request, response)) {
                if (Constant.MY_LOG.isTraceEnabled()) {
                    Constant.MY_LOG.trace("Login submission detected.  Attempting to execute login.");
                }
                return executeLogin(request, response);
            } else {
                if (Constant.MY_LOG.isTraceEnabled()) {
                    Constant.MY_LOG.trace("Login page view.");
                }
                return true;
            }
        } else {
            if (Constant.MY_LOG.isTraceEnabled()) {
                Constant.MY_LOG.trace("Attempting to access a path which requires authentication.  Forwarding to the "
                        + "Authentication url [" + getLoginUrl() + "]");
            }
            redirectToLogin(request, response);
            return false;
        }
    }
}

URLPermissionsFilter.java

package cn.zsmy.filter;


import java.io.IOException;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter;

/**
 * 基于URL的权限判断过滤器<p>
 * 我们自动根据URL产生所谓的权限字符串，这一项在Shiro示例中是写在配置文件里面的，默认认为权限不可动态配置<p>
 * URL举例：/User/create.do?***=***  -->权限字符串：/User/create.do
 * @author 师海明 2016-05-27
 */
public class URLPermissionsFilter extends PermissionsAuthorizationFilter{
    /**
     *@param mappedValue 指的是在声明url时指定的权限字符串，如/User/create.do=perms[User:create].我们要动态产生这个权限字符串，所以这个配置对我们没用
     */
    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {
         return super.isAccessAllowed(request, response, buildPermissions(request));
    }
    
    /**
     * 根据请求URL产生权限字符串，这里只产生，而比对的事交给Realm
     * @param request
     * @return
     */
    protected String[] buildPermissions(ServletRequest request) {
        String[] perms = new String[1];
        HttpServletRequest req = (HttpServletRequest) request;
        String path = req.getServletPath();
        perms[0] = path;//path直接作为权限字符串
        /*String regex = "/(.*?)/(.*?)\.(.*)";
        if(url.matches(regex)){
            Pattern pattern = Pattern.compile(regex);
            Matcher matcher = pattern.matcher(url);
            String controller =  matcher.group(1);
            String action = matcher.group(2);
            
        }*/
        return perms;
    }
    
}

shirocache.xml

<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE xml>
<ehcache name="shirocache">

    <diskStore path="java.io.tmpdir" />
    <!-- DefaultCache setting. -->
    <defaultCache maxElementsInMemory="100" eternal="false"
        timeToIdleSeconds="300" timeToLiveSeconds="600" overflowToDisk="true" />
    <!-- 登录记录缓存 锁定10分钟 -->
    <cache name="passwordRetryCache" maxElementsInMemory="2000"
        eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0"
        overflowToDisk="false" statistics="true">
    </cache>

    <cache name="authorizationCache" maxElementsInMemory="2000"
        eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0"
        overflowToDisk="false" statistics="true">
    </cache>

    <cache name="authenticationCache" maxElementsInMemory="2000"
        eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0"
        overflowToDisk="false" statistics="true">
    </cache>

    <cache name="shiro-activeSessionCache" maxElementsInMemory="2000"
        eternal="false" timeToIdleSeconds="3600" timeToLiveSeconds="0"
        overflowToDisk="false" statistics="true">
    </cache>

</ehcache>

web.xml

<filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>*.htm</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
    </filter-mapping>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>*.do</url-pattern>
        <dispatcher>REQUEST</dispatcher>
        <dispatcher>FORWARD</dispatcher>
    </filter-mapping>