shiro的简单使用

<?xml version="1.0" encoding="utf-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="WebApp_ID" version="3.0">

    <!-- Spring -->
    <!-- 配置Spring配置文件路径 -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath*:applicationContext.xml
            classpath*:applicationContext-shiro.xml
            <!-- classpath*:spring-jms.xml -->
        </param-value>
    </context-param>
    <!-- 配置Spring上下文监听器 -->
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>
<!--     <listener> -->
<!--         <listener-class>org.activemq.web.SpringBrokerContextListener</listener-class> -->
<!--     </listener> -->
    <!-- Spring -->

    <!-- 配置Spring字符编码过滤器 -->
    <filter>
        <filter-name>encodingFilter</filter-name>
        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>
        <init-param>
            <param-name>encoding</param-name>
            <param-value>UTF-8</param-value>
        </init-param>
        <init-param>
            <param-name>forceEncoding</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>encodingFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- shiro 安全过滤器 -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <async-supported>true</async-supported>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <!-- 配置log4j配置文件路径 -->
    <context-param>
        <param-name>log4jConfigLocation</param-name>
        <param-value>classpath:log4j.properties</param-value>
    </context-param>
    <!-- 60s 检测日志配置 文件变化 -->
    <context-param>
        <param-name>log4jRefreshInterval</param-name>
        <param-value>60000</param-value>
    </context-param>

    <!-- 配置Log4j监听器 -->
    <listener>
        <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>
    </listener>

    <!-- Spring MVC 核心控制器 DispatcherServlet 配置 -->
    <servlet>
        <servlet-name>dispatcher</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath*:spring-mvc.xml</param-value>
        </init-param>
        <load-on-startup>1</load-on-startup>
    </servlet>
    <servlet-mapping>
        <servlet-name>dispatcher</servlet-name>
        <!-- 拦截所有/rest/* 的请求,交给DispatcherServlet处理,性能最好 -->
        <url-pattern>/rest/*</url-pattern>
    </servlet-mapping>

    <!-- 首页 -->
    <welcome-file-list>
        <welcome-file>rest/index</welcome-file>
    </welcome-file-list>

    <!-- 错误页 -->
    <error-page>
        <error-code>404</error-code>
        <location>/rest/page/404</location>
    </error-page>
    <error-page>
        <error-code>500</error-code>
        <location>/rest/page/500</location>
    </error-page>
    <error-page>
        <exception-type>org.apache.shiro.authz.AuthorizationException</exception-type>
        <location>/rest/page/401</location>
    </error-page>

</web-app>

web.xml  用到了shiro的过滤器和配置文件

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:util="http://www.springframework.org/schema/util"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="
       http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd">

    <description>apache shiro配置</description>

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"/>
        <property name="loginUrl" value="/rest/page/index"/>
        <property name="successUrl" value="/rest/index"/>
        <property name="unauthorizedUrl" value="/rest/page/401"/>
        <property name="filterChainDefinitions">
            <value>
                <!-- 静态资源允许访问 -->
                /app/** = anon
                <!-- 登录页（静态）允许访问 -->
                /rest/users/index = anon
                <!-- 登录页（动态）允许访问 -->
                /rest/users/login = anon
                <!-- app登录页面 -->
                /rest/users/apploginindex = anon
                <!-- app登录页面 -->
                rest/users/login2 = anon
                <!-- 其他资源需要认证 -->
                /** = authc
            </value>
        </property>
    </bean>

    <!-- 缓存管理器 使用Ehcache实现 -->
    <bean id="shiroEhcacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">
        <property name="cacheManagerConfigFile" value="classpath:ehcache-shiro.xml"/>
    </bean>

    <!-- 会话DAO -->
    <bean id="sessionDAO" class="org.apache.shiro.session.mgt.eis.MemorySessionDAO"/>

    <!-- 会话管理器 -->
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <property name="sessionDAO" ref="sessionDAO"/>
    </bean>

    <!-- 安全管理器 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realms">
            <list>
                <ref bean="securityRealm"/>                    ------------------这里的验证来自于下面
            </list>
        </property>
<!--         cacheManager,集合spring缓存工厂 -->
<!--         <property name="cacheManager" ref="shiroEhcacheManager" /> -->
<!--         <property name="sessionManager" ref="sessionManager" /> -->
    </bean>

    <!-- Shiro生命周期处理器 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

</beans>

applicationContext-shiro.xml 配置了shiro的静态登录页面，允许登录页面（这里有两个登录，一个是app登录，一个是pc登录），允许运行的路径等。

package com.timestech.wsgk.web.security;

import java.util.List;

import javax.annotation.Resource;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.springframework.stereotype.Component;

import com.timestech.wsgk.web.model.SysRole;
import com.timestech.wsgk.web.model.SysUser;
import com.timestech.wsgk.web.service.SysRoleService;
import com.timestech.wsgk.web.service.SysUserService;

@Component(value = "securityRealm")
public class SecurityRealm extends AuthorizingRealm {
    
    @Resource
    private SysUserService sysUserService;
    @Resource
    private SysRoleService sysRoleService;

    /**
     * 登录验证
     */
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        String account = String.valueOf(token.getPrincipal());
        String password = new String((char[]) token.getCredentials());
        // 通过数据库进行验证
        
        final SysUser authentication = sysUserService.authentication(account,password);
        if (authentication == null) {
            throw new AuthenticationException("用户名或密码错误.");
        }
        final List<SysRole> sysRoles = sysRoleService.selectRoleByUserId(authentication.getId());                    --------service从数据库中查询验证
        if(sysRoles.size() == 0)
            throw new AuthenticationException("权限信息不完整，请联系管理员!");
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(account, password, getName());
        return authenticationInfo;
    }

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
        return null;
    }

}