登录部分

    @RequestMapping(value = "/login", method = RequestMethod.GET)@ResponseBodypublic Map<String, Object> login(HttpServletRequest request){Map<String, Object> resultMap = new LinkedHashMap<String, Object>();try{ShiroToken token = new ShiroToken("admin", "21232f297a57a5a743894a0e4a801fc3");token.setRememberMe(false);SecurityUtils.getSubject().login(token);ShiroToken token2 = (ShiroToken) SecurityUtils.getSubject().getPrincipal();logger.info(token2.getUsername() + "," + token2.getPswd());resultMap.put("status", 200);resultMap.put("message", "登录成功");/*** 获取登录之前的地址*/SavedRequest savedRequest = WebUtils.getSavedRequest(request);String url = null;if (null != savedRequest){url = savedRequest.getRequestUrl();}// 跳转地址resultMap.put("back_url", url);}catch (DisabledAccountException e){resultMap.put("status", 500);resultMap.put("message", "帐号已经禁用。");}catch (Exception e){resultMap.put("status", 500);resultMap.put("message", "帐号或密码错误");}return resultMap;}

   @Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0){ShiroToken token = (ShiroToken) arg0;String username = token.getUsername();// 根据username从数据库查找用户，得到密码// 假设找到的用户如下// User user = userService.findByUsername(username)User user = new User();user.setName(username);user.setPassword("21232f297a57a5a743894a0e4a801fc3"); // 数据库中的密码md5加密的if (null == user){throw new AccountException("username is not exist");}else if (!user.getPassword().equals(token.getPswd())){throw new AccountException("password is not right");}else{// 登陆成功logger.info("{} login success.", username);}return new SimpleAuthenticationInfo(arg0, user.getPassword(), username);}

    @Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0){ShiroToken token = (ShiroToken) SecurityUtils.getSubject().getPrincipal();String username = token.getUsername();logger.info(username + "授权...");// 从数据库中查找该用户的角色和权限SimpleAuthorizationInfo sainfo = new SimpleAuthorizationInfo();Set<String> roles = new HashSet<String>();roles.add("admin");//roles.add("role1");Set<String> permissions = new HashSet<String>();permissions.add("add");permissions.add("delete");sainfo.setRoles(roles);sainfo.setStringPermissions(permissions);return sainfo;}

    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><property name="securityManager" ref="securityManager"></property><property name="loginUrl" value="/security/view/login"></property><property name="successUrl" value="/successUrl"></property><!-- 用户访问未对其授权的资源时，所显示的连接 --><property name="unauthorizedUrl" value="/unauthorizedUrl"></property><property name="filters"><map><entry key="anyRoles"><bean class="cn.edu.hdu.ssd.core.shiro.AnyRolesAuthorizationFilter" /></entry></map></property><property name="filterChainDefinitions"><value>/security/**=anon/test/**=roles[role1]/users/**=anyRoles[admin,role1]/**=authc</value></property></bean>

public class AnyRolesAuthorizationFilter extends AuthorizationFilter
{// private Logger logger =  LoggerFactory.getLogger(ShiroCasAuthFilter.class);
    @Overrideprotected boolean isAccessAllowed(ServletRequest req, ServletResponse resp, Object mappedValue)throws Exception{Subject subject = getSubject(req, resp);String[] rolesArray = (String[]) mappedValue;if (rolesArray == null || rolesArray.length == 0){return true;}for (int i = 0; i < rolesArray.length; i++){if (subject.hasRole(rolesArray[i])){return true;}}return false;}
}

        <property name="filters"><map><entry key="anyRoles"><bean class="cn.edu.hdu.ssd.core.shiro.AnyRolesAuthorizationFilter" /></entry></map></property>

本文转自风一样的码农博客园博客，原文链接：http://www.cnblogs.com/chenpi/p/6247956.html，如需转载请自行联系原作者