<!-- 这里别忘了配置，否则会导致自定义的Realm的属性值无法注入 --><context:component-scan base-package="com.lishun"></context:component-scan><!-- 继承自AuthorizingRealm的自定义Realm,即指定Shiro验证用户登录的类为自定义的UserRealm.java --><bean id="shiroRealm" class="com.lishun.shiro.realm.UserRealm" ></bean> <!-- 基于Form表单的身份验证过滤器 --><bean id="formAuthenticationFilter"class="org.apache.shiro.web.filter.authc.FormAuthenticationFilter"><property name="usernameParam" value="username" /><property name="passwordParam" value="password" /><property name="loginUrl" value="/users/index.html" /><property name="successUrl" value="/index/index.html" /></bean><context:component-scan base-package="com.lishun"></context:component-scan><beanclass="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"depends-on="lifecycleBeanPostProcessor"><property name="proxyTargetClass" value="true" /></bean><!-- 这里主要是设置自定义的单Realm应用,若有多个Realm,可使用'realms'属性代替 --><bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"><property name="realm" ref="shiroRealm" /></bean><bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><!-- 调用自定义的权限管理器 --><property name="securityManager" ref="securityManager" /><!-- 配置登陆成功后跳转地址 --><property name="successUrl" value="/index/index" /><!-- 配置登陆时请求的地址 --><property name="loginUrl" value="/users/index" /><!-- 如果请求的资源不再你的权限范围内，则跳转到error.htm --><property name="unauthorizedUrl" value="/users/noAuth" /><property name="filters"><map><entry key="authc" value-ref="formAuthenticationFilter"></entry></map></property><property name="filterChainDefinitions"><value><!-- anon表示此地址不需要任何权限即可访问 -->/users/*=anon<!--login页面和logout页面不需要验证 -->/login* = anon<!--访问所有文件,authc必须通过验证后才能访问 -->/** = authc</value></property></bean><!-- 相当于调用SecurityUtils.setSecurityManager(securityManager) --><beanclass="org.springframework.beans.factory.config.MethodInvokingFactoryBean"><property name="staticMethod"value="org.apache.shiro.SecurityUtils.setSecurityManager" /><property name="arguments" ref="securityManager" /></bean><!-- Shiro生命周期处理器 --><bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />

<!-- 自动扫描且只扫描@Controller --><context:component-scan base-package="com.lishun"use-default-filters="false"><context:include-filter type="annotation"expression="org.springframework.stereotype.Controller" /><context:include-filter type="annotation"expression="org.springframework.web.bind.annotation.ControllerAdvice" /></context:component-scan><!-- 启用SpringMVC的注解功能,它会自动注册HandlerMapping、HandlerAdapter、ExceptionResolver的相关实例 --><mvc:annotation-driven /><!-- 配置SpringMVC的视图解析器 httl视图 --><bean id="viewResolver" class="httl.web.springmvc.HttlViewResolver"><property name="contentType" value="text/html; charset=UTF-8" /></bean><!-- 在spring-mvc.xml配置文件添加Shiro Spring AOP权限注解的支持： --><aop:config proxy-target-class="true"></aop:config><beanclass="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"><property name="securityManager" ref="securityManager" /></bean><!-- 当前用户没有权限时跳转到的页面： --><bean class="org.springframework.web.servlet.handler.SimpleMappingExceptionResolver">    <property name="exceptionMappings">    <props>    <prop key="org.apache.shiro.authz.UnauthorizedException">/users/unauthorizedView</prop>  </props>    </property>    </bean>

public class User {private String name;private String password;private Role role;@Overridepublic String toString() {return "User [name=" + name + ", password=" + password + ", role="+ role + "]";}public String getName() {return name;}public User() {super();}public void setName(String name) {this.name = name;}public User(String name, String password) {super();this.name = name;this.password = password;}public String getPassword() {return password;}public void setPassword(String password) {this.password = password;}public Role getRole() {return role;}public void setRole(Role role) {this.role = role;}
}
---------------------------------------------------分割线public class Role {private String roleName;private Set<String> rolePermissions;public Set<String> getRolePermissions() {return rolePermissions;}public void setRolePermissions(Set<String> rolePermissions) {this.rolePermissions = rolePermissions;}public String getRoleName() {return roleName;}public void setRoleName(String roleName) {this.roleName = roleName;}
}

/** 在httl模板上可以直接使用的函数*/
public class ShiroKit {/*** 禁止初始化*/private ShiroKit() {}/*** 获取 Subject* * @return Subject*/protected static Subject getSubject() {return SecurityUtils.getSubject();}/*** 验证当前用户是否拥有指定权限,使用时与lacksPermission 搭配使用* * @param permission*            权限名* @return 拥有权限：true，否则false*/public static boolean hasPermission(String permission) {boolean ret = getSubject() != null && permission != null && permission.length() > 0 && getSubject().isPermitted(permission);return ret;}/*** 与hasPermission标签逻辑相反，当前用户没有制定权限时，验证通过。* * @param permission*            权限名* @return 拥有权限：true，否则false*/public static boolean lacksPermission(String permission) {return !hasPermission(permission);}}

public class UserRealm extends AuthorizingRealm {@Autowired@Qualifier("userDao")private UserDao userDao;/** 权限认证*/@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {// 根据用户配置用户与权限if (principals == null) {throw new AuthorizationException("PrincipalCollection method argument cannot be null.");}String name = (String) getAvailablePrincipal(principals);List<String> roles = new ArrayList<String>();User user = userDao.getUserByName(name);SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();// 把当前用户的角色保存到Subject中
        roles.add(user.getRole().getRoleName());info.addRoles(roles);// 把当前用户的权限保存到Subject中
        info.setStringPermissions(user.getRole().getRolePermissions());return info;}/** 登陆认证*/@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {UsernamePasswordToken token = (UsernamePasswordToken) authcToken;//获取页面输入用户名String username=(String) token.getPrincipal();//从dao层获取该用户
        System.out.println(userDao);User user = userDao.getUserByName(username);if (user == null) {throw new AuthorizationException();}SimpleAuthenticationInfo info = null;//存储令牌信息if (user.getName().equals(token.getUsername())) {info = new SimpleAuthenticationInfo(user.getName(),user.getPassword(), getName());}return info;}}

/** 这里我就不查询数据数据了，侧重点不在这里，所以写死用户数据*/
public class UserDao {private static List<User> list=new ArrayList<User>();private static Set<String> userPermissions=new HashSet<String>();private static Set<String> adminPermissions=new HashSet<String>();static {//lishun普通用户User lishun =new User();lishun.setName("lishun");lishun.setPassword("123");Role lishunRole=new Role();lishunRole.setRoleName("user");//lishun普通用户只拥有一个权限userPermissions.add("user:lishun:view");lishunRole.setRolePermissions(userPermissions);lishun.setRole(lishunRole);//admin超级用户User admin =new User();admin.setName("admin");admin.setPassword("123");Role adminRole=new Role();adminRole.setRoleName("admin");//admin用户拥有所有权限adminPermissions.add("user:lishun:view");adminPermissions.add("manager:lishun:view");adminRole.setRolePermissions(adminPermissions);admin.setRole(adminRole);list.add(admin);list.add(lishun);}public User getUserByName(String name){for (User u : list) {if(u.getName().equals(name)){return u;}}return null;}

//不用任何权限都可以访问该控制器的方法
@Controller
public class UserController {/** 登陆页面*/@RequestMapping(value = "users/index", method = RequestMethod.GET)public String index() {return "users/login";}/** 验证用户*/@RequestMapping(value = "users/login", method = RequestMethod.POST)public String login(String username,String password,Model model){//获取到当前用户的的Subject及创建用户名/密码身份验证Token（即用户身份/凭证）Subject subject = SecurityUtils.getSubject();UsernamePasswordToken token = new UsernamePasswordToken(username, password);String error = null;try {//验证登陆
            subject.login(token);} catch (AuthenticationException e) {error = "warning message:Login failed,please check your username and password"; model.addAttribute("errorMessage", error);}if (error==null) {        return "redirect:../index/index";} else {return "redirect:index";}}/** 没有权限后跳转的页面*/@RequestMapping(value = "users/unauthorizedView", method = RequestMethod.GET)public String unauthorizedView() {return "users/unauthorizedView";}
}

<!--#set(String msg="httl模板测试") -->
<!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html>
<body><form action="${manageHost}/users/login" method="post"><label style="color: red">${errorMessage}</label><table><tr><td>UserName:</td><td><input type="text" name="username" /></td></tr><tr><td>Password:</td><td><input type="password" name="password" /></td></tr><tr><td colspan="2"><input type="submit" value="Login" /></td></tr></table></form>
</body>
</html>
-----------------------分隔符

@Controller
public class IndexController {/** 普通用户就可以访问该页面*/@RequiresPermissions("user:lishun:view")@RequestMapping(value = "index/index", method = RequestMethod.GET)public String index() {System.out.println(SecurityUtils.getSubject().isPermitted("user:lishun:view"));return "index/index";}
}
-------------------------------------------分割线

<!--#set(String msg="httl模板测试") -->
<!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html>
<body>#if(hasPermission("manager:lishun:view"))超级用户登陆<a href="${manageHost}/manager/user">管理用户</a>#else(hasPermission("user:lishun:view"))普通用户登陆#end
</body>
</html>

@Controller
@RequestMapping("manager")
public class ManagerController {/** 只有管理员才有权限查看本页面*/@RequiresPermissions("manager:lishun:view")@RequestMapping(value = "/user", method = RequestMethod.GET)public String index() {return "manager/userManager";}}
-------------------------------------------分割线

<!--#set(String msg="httl模板测试") -->
<!--#set(String manageHost = request.getScheme()+"://"+request.serverName+":"+"a".valueOf(request.serverPort)+request.getContextPath())--><html>
<body><h1>只有admin角色才可以访问</h1>
</body>
</html>