package cn.project.ssm.shiro;import java.security.acl.Permission;
import java.util.ArrayList;
import java.util.List;import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;import com.sun.org.apache.bcel.internal.generic.ACONST_NULL;import cn.project.ssm.pojo.ActiveUser;
import cn.project.ssm.pojo.SysPermission;
import cn.project.ssm.pojo.SysUser;
import cn.project.ssm.service.LoginService;/*** * <p>* Title: CustomRealm* </p>* <p>* Description:自定义realm,实际开发中一般都是自定义realm* </p>* <p>* Company: www.itcast.com* </p>* * @date 2015-3-23下午4:54:47* @version 1.0*/
public class CustomRealm extends AuthorizingRealm {@Autowiredprivate LoginService loginService;// 设置realm的名称@Overridepublic void setName(String name) {super.setName("customRealm");}//用于认证@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {//第一步：从token中取出用户名，这个用户名是用户在页面输入的信息，传递给tokenString userCode=(String) token.getCredentials();//根据用户名查询用户信息SysUser sysUser=null;sysUser=loginService.findByUserCode(userCode);if (sysUser==null) {return null; }String password=sysUser.getPassword();//加盐String salt=sysUser.getSalt();//将用户身份信息写入activeUserActiveUser activeUser=new ActiveUser();activeUser.setUserid(sysUser.getId());activeUser.setUsercode(sysUser.getUsercode());activeUser.setUsername(sysUser.getUsername());//通过service取出菜单List<SysPermission> menus= loginService.findmenusByUserId(sysUser.getId());activeUser.setMenus(menus);//写到这里我们看到realm其实主要是从数据库中获取数据SimpleAuthenticationInfo simpleAuthenticationInfo=new SimpleAuthenticationInfo(activeUser,password,ByteSource.Util.bytes(salt), this.getName());return simpleAuthenticationInfo;}//用于授权@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principal) {//从princal中获取主身份信息，将返回值转为真实的身份信息，填充到上面认证的身份中ActiveUser activeUser=(ActiveUser) principal.getPrimaryPrincipal();//从数据库中获取到权限数据List<SysPermission> permissionsList = loginService.findpermissionByUserId(activeUser.getUserid());List<String> permissions=new ArrayList<>();for (SysPermission sysPermission : permissionsList) {permissions.add(sysPermission.getPercode());}//将集合内容填充认证中SimpleAuthorizationInfo simpleAuthorizationInfo=new SimpleAuthorizationInfo();simpleAuthorizationInfo.addStringPermissions(permissions);return simpleAuthorizationInfo;}//清除缓存public void clearCached() {PrincipalCollection principals = SecurityUtils.getSubject().getPrincipals();super.clearCache(principals);}}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:mvc="http://www.springframework.org/schema/mvc"xmlns:context="http://www.springframework.org/schema/context"xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd http://www.springframework.org/schema/mvc http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-3.2.xsd http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-3.2.xsd http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd "><!-- web.xml中shiro的filter对应的bean -->
<!-- Shiro 的Web过滤器 --><bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><property name="securityManager" ref="securityManager" /><!-- loginUrl认证提交地址，如果没有认证将会请求此地址进行认证，请求此地址将由formAuthenticationFilter进行表单认证 --><property name="loginUrl" value="/login.action" /><!-- 认证成功统一跳转到first.action，建议不配置，shiro认证成功自动到上一个请求路径 --><!-- <property name="successUrl" value="/first.action"/> --><!-- 通过unauthorizedUrl指定没有权限操作时跳转页面--><property name="unauthorizedUrl" value="/refuse.jsp" /><!-- 过虑器链定义，从上向下顺序执行，一般将/**放在最下边 --><property name="filterChainDefinitions"><value> <!-- 对静态资源设置访问，不然都拦截了 -->/images/**=anon/js/**=anon/styles/**=anon<!-- 请求logout.action地址，shiro清除session -->/logout.action=logout<!-- /** = authc所有url都可以认证通过才能访问 -->   /** = authc<!-- /** = anon所有url都可以匿名访问 -->  /** = anon             </value></property></bean><!-- securityManager安全管理器 -->
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"><property name="realm" ref="customRealm" />   <!-- 注入缓存管理器 --><property name="cacheManager" ref="cacheManager"/></bean><!-- realm -->
<bean id="customRealm" class="cn.project.ssm.shiro.CustomRealm"><!-- 将凭证匹配器设置到realm中，realm按照凭证匹配器的要求进行散列 --><property name="credentialsMatcher" ref="credentialsMatcher"/>
</bean><!-- 散列加盐凭证匹配器 -->
<bean id="credentialsMatcher"class="org.apache.shiro.authc.credential.HashedCredentialsMatcher"><property name="hashAlgorithmName" value="md5" /><property name="hashIterations" value="1" />
</bean>
<!-- 缓存管理器 -->
<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager"><property name="cacheManagerConfigFile" value="classpath:shiro-ehcache.xml"/></bean>
</beans>