# =============================================================================
# Quickstart INI Realm configuration
#
# For those that might not understand the references in this file, the
# definitions are all based on the classic Mel Brooks' film "Spaceballs". ;)
# =============================================================================# -----------------------------------------------------------------------------
# Users and their assigned roles
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setUserDefinitions JavaDoc
# -----------------------------------------------------------------------------
[users]
# user 'root' with password 'secret' and the 'admin' role
root = secret, admin
# user 'guest' with the password 'guest' and the 'guest' role
guest = guest, guest
# user 'presidentskroob' with password '12345' ("That's the same combination on
# my luggage!!!" ;)), and role 'president'
presidentskroob = 12345, president
# user 'darkhelmet' with password 'ludicrousspeed' and roles 'darklord' and 'schwartz'
darkhelmet = ludicrousspeed, darklord, schwartz
# user 'lonestarr' with password 'vespa' and roles 'goodguy' and 'schwartz'
lonestarr = vespa, goodguy, schwartz# -----------------------------------------------------------------------------
# Roles with assigned permissions
#
# Each line conforms to the format defined in the
# org.apache.shiro.realm.text.TextConfigurationRealm#setRoleDefinitions JavaDoc
# -----------------------------------------------------------------------------
[roles]
# 'admin' role has all permissions, indicated by the wildcard '*'
admin = *
# The 'schwartz' role can do anything (*) with any lightsaber:
schwartz = lightsaber:*
# The 'goodguy' role is allowed to 'delete' (action) the user (type) with
# license plate 'zhangsan' (instance specific id)
#user可以删除zhangsan
goodguy = user:delete:zhangsan

package cn.xyl.shiro;import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.config.IniSecurityManagerFactory;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.session.Session;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.util.Factory;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;public class HelloWord {private static final transient Logger log = LoggerFactory.getLogger(HelloWord.class);public static void main(String[] args) {// The easiest way to create a Shiro SecurityManager with configured// realms, users, roles and permissions is to use the simple INI config.// We'll do that by using a factory that can ingest a .ini file and// return a SecurityManager instance:// Use the shiro.ini file at the root of the classpath// (file: and url: prefixes load from files and urls respectively):Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");SecurityManager securityManager = factory.getInstance();// for this simple example quickstart, make the SecurityManager// accessible as a JVM singleton. Most applications wouldn't do this// and instead rely on their container configuration or web.xml for// webapps. That is outside the scope of this simple quickstart, so// we'll just do the bare minimum so you can continue to get a feel// for things.//绑定给SecurityUtils    这是一个全局设置，设置一次即可；SecurityUtils.setSecurityManager(securityManager);// Now that a simple Shiro environment is set up, let's see what you can do:// get the currently executing user:// 获取当前的 Subject. 调用 SecurityUtils.getSubject();   //通过SecurityUtils得到Subject，其会自动绑定到当前线程Subject subject = SecurityUtils.getSubject();// Do some stuff with a Session (no need for a web or EJB container!!!)// 测试使用 Session// 获取 Session: Subject#getSession()Session session = subject.getSession();session.setAttribute("someKey", "aValue");String value = (String) session.getAttribute("someKey");if (value.equals("aValue")) {log.info("---> Retrieved the correct value! [" + value + "]");}// let's login the current user so we can check against roles and permissions:// 测试当前的用户是否已经被认证. 即是否已经登录.// 调动 Subject 的 isAuthenticated()if (!subject.isAuthenticated()) {// 把用户名和密码封装为 UsernamePasswordToken 对象UsernamePasswordToken token = new UsernamePasswordToken("lonestarr", "vespa");// remembermetoken.setRememberMe(true);try {// 执行登录.subject.login(token);}// 若没有指定的账户, 则 shiro 将会抛出 UnknownAccountException 异常.catch (UnknownAccountException uae) {log.info("----> There is no user with username of " + token.getPrincipal());return;}// 若账户存在, 但密码不匹配, 则 shiro 会抛出 IncorrectCredentialsException 异常。catch (IncorrectCredentialsException ice) {log.info("----> Password for account " + token.getPrincipal() + " was incorrect!");return;}// 用户被锁定的异常 LockedAccountExceptioncatch (LockedAccountException lae) {log.info("The account for username " + token.getPrincipal() + " is locked.  "+ "Please contact your administrator to unlock it.");}// ... catch more exceptions here (maybe custom ones specific to your// application?// 所有认证时异常的父类.catch (AuthenticationException ae) {// unexpected condition? error?}}// say who they are:// print their identifying principal (in this case, a username):log.info("----> User [" + subject.getPrincipal() + "] logged in successfully.");// test a role:// 测试是否有某一个角色. 调用 Subject 的 hasRole 方法.if (subject.hasRole("schwartz")) {log.info("----> May the Schwartz be with you!");} else {log.info("----> Hello, mere mortal.");return;}// test a typed permission (not instance-level)// 测试用户是否具备某一个行为. 调用 Subject 的 isPermitted() 方法。if (subject.isPermitted("lightsaber:weild")) {log.info("----> You may use a lightsaber ring.  Use it wisely.");} else {log.info("Sorry, lightsaber rings are for schwartz masters only.");}// a (very powerful) Instance Level permission:// 测试用户是否具备某一个行为.if (subject.isPermitted("user:delete:zhangsan")) {log.info("----> You are permitted to 'drive' the winnebago with license plate (id) 'eagle5'.  "+ "Here are the keys - have fun!");} else {log.info("Sorry, you aren't allowed to drive the 'eagle5' winnebago!");}// all done - log out!0// 执行登出. 调用 Subject 的 Logout() 方法.System.out.println("---->" + subject.isAuthenticated());subject.logout();System.out.println("---->" + subject.isAuthenticated());System.exit(0);}}

Object getPrincipal(); //Primary Principal  PrincipalCollection getPrincipals(); // PrincipalCollection

void login(AuthenticationToken token) throws AuthenticationException; boolean isAuthenticated(); boolean isRemembere();

boolean hasRole(String roleIdentifier);  boolean[] hasRoles(List<String> roleIdentifiers);  boolean hasAllRoles(Collection<String> roleIdentifiers);  void checkRole(String roleIdentifier) throws AuthorizationException;  void checkRoles(Collection<String> roleIdentifiers) throws AuthorizationException;  void checkRoles(String... roleIdentifiers) throws AuthorizationException;

itted(String permission);  boolean isPermitted(Permission permission);  boolean[] isPermitted(String... permissions);  boolean[] isPermitted(List<Permission> permissions);  boolean isPermittedAll(String... permissions);  boolean isPermittedAll(Collection<Permission> permissions);  void checkPermission(String permission) throws AuthorizationException;  void checkPermission(Permission permission) throws AuthorizationException;  void checkPermissions(String... permissions) throws AuthorizationException;  void checkPermissions(Collection<Permission> permissions) throws AuthoriationException;

Session getSession(); //相当于getSession(true)
Session getSession(boolean create);

void logout();

public interface AuthenticationToken extends Serializable {  Object getPrincipal(); //身份  Object getCredentials(); //凭据  }

public interface PrincipalCollection extends Iterable, Serializable {  Object getPrimaryPrincipal(); //得到主要的身份  <T> T oneByType(Class<T> type); //根据身份类型获取第一个  <T> Collection<T> byType(Class<T> type); //根据身份类型获取一组  List asList(); //转换为List  Set asSet(); //转换为Set  Collection fromRealm(String realmName); //根据Realm名字获取  Set<String> getRealmNames(); //获取所有身份验证通过的Realm名字  boolean isEmpty(); //判断是否为空  }

public interface AuthorizationInfo extends Serializable {  Collection<String> setRoles(); //获取角色字符串信息  Collection<String> getStringPermissions(); //获取权限字符串信息  Collection<Permission> getObjectPermissions(); //获取Permission对象信息
}

SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
info.addRole(u.getRoles().getRolename());
for (Funs fun : u.getFuns()) {info.addStringPermission(fun.getFunurl());
}
return info;