<!--

@Autowired
private Environment env;//跳到登录页
@RequestMapping(value = {"/to/login","/unauth"})
public String toLogin(){return "login";
}//登录认证
@RequestMapping(value = "/login",method = RequestMethod.POST)
public String login(@RequestParam String userName, @RequestParam String password, ModelMap modelMap){String errorMsg="";try {if (!SecurityUtils.getSubject().isAuthenticated()){String newPsd=new Md5Hash(password,env.getProperty("shiro.encrypt.password.salt")).toString();UsernamePasswordToken token=new UsernamePasswordToken(userName,newPsd);SecurityUtils.getSubject().login(token);}}catch (UnknownAccountException e){errorMsg=e.getMessage();modelMap.addAttribute("userName",userName);}catch (DisabledAccountException e){errorMsg=e.getMessage();modelMap.addAttribute("userName",userName);}catch (IncorrectCredentialsException e){errorMsg=e.getMessage();modelMap.addAttribute("userName",userName);}catch (Exception e){errorMsg="用户登录异常，请联系管理员!";e.printStackTrace();}if (StringUtils.isBlank(errorMsg)){return "redirect:/index";}else{modelMap.addAttribute("errorMsg",errorMsg);return "login";}
}//退出登录
@RequestMapping(value = "/logout")
public String logout(){SecurityUtils.getSubject().logout();return "login";
}

/*** 用户自定义的realm-用于shiro的认证、授权* @Author:debug (SteadyJack)* @Date: 2019/7/2 17:55**/
public class CustomRealm extends AuthorizingRealm{private static final Logger log= LoggerFactory.getLogger(CustomRealm.class);private static final Long sessionKeyTimeOut=3600_000L;@Autowiredprivate UserMapper userMapper;//授权@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {return null;}//认证-登录@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {UsernamePasswordToken token= (UsernamePasswordToken) authenticationToken;String userName=token.getUsername();String password=String.valueOf(token.getPassword());log.info("当前登录的用户名={} 密码={} ",userName,password);User user=userMapper.selectByUserName(userName);if (user==null){throw new UnknownAccountException("用户名不存在!");}if (!Objects.equals(1,user.getIsActive().intValue())){throw new DisabledAccountException("当前用户已被禁用!");}if (!user.getPassword().equals(password)){throw new IncorrectCredentialsException("用户名密码不匹配!");}SimpleAuthenticationInfo info=new SimpleAuthenticationInfo(user.getUserName(),password,getName());setSession("uid",user.getId());return info;}/*** 将key与对应的value塞入shiro的session中-最终交给HttpSession进行管理(如果是分布式session配置，那么就是交给redis管理)* @param key* @param value*/private void setSession(String key,Object value){Session session=SecurityUtils.getSubject().getSession();if (session!=null){session.setAttribute(key,value);session.setTimeout(sessionKeyTimeOut);}}
}

<!--根据用户名查询-->
<select id="selectByUserName" resultType="com.debug.kill.model.entity.User">SELECT <include refid="Base_Column_List"/>FROM userWHERE user_name = #{userName}
</select>

/*** shiro的通用化配置* @Author:debug (SteadyJack)* @Date: 2019/7/2 17:54**/
@Configuration
public class ShiroConfig {@Beanpublic CustomRealm customRealm(){return new CustomRealm();}@Beanpublic SecurityManager securityManager(){DefaultWebSecurityManager securityManager=new DefaultWebSecurityManager();securityManager.setRealm(customRealm());securityManager.setRememberMeManager(null);return securityManager;}@Beanpublic ShiroFilterFactoryBean shiroFilterFactoryBean(){ShiroFilterFactoryBean bean=new ShiroFilterFactoryBean();bean.setSecurityManager(securityManager());bean.setLoginUrl("/to/login");bean.setUnauthorizedUrl("/unauth");//对于一些授权的链接URL进行拦截Map<String, String> filterChainDefinitionMap=new HashMap<>();filterChainDefinitionMap.put("/to/login","anon");filterChainDefinitionMap.put("/**","anon");filterChainDefinitionMap.put("/kill/execute","authc");filterChainDefinitionMap.put("/item/detail/*","authc");bean.setFilterChainDefinitionMap(filterChainDefinitionMap);return bean;}}