spring整合apache-shiro的简单使用

<!--shiro和spring整合-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-spring</artifactId>
    <version>1.3.2</version>
</dependency>
<!--shiro核心包-->
<dependency>
    <groupId>org.apache.shiro</groupId>
    <artifactId>shiro-core</artifactId>
    <version>1.3.2</version>
</dependency>

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:aop="http://www.springframework.org/schema/aop"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
        http://www.springframework.org/schema/beans/spring-beans.xsd
        http://www.springframework.org/schema/context
        http://www.springframework.org/schema/context/spring-context.xsd
        http://www.springframework.org/schema/aop
        http://www.springframework.org/schema/aop/spring-aop.xsd">
    <!--由spring整合shiro文件-->
    <!--主要三个东西:shiroFilter,SaasRealm,SecrityManager-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!--shiro核心类-->
        <property name="securityManager" ref="securityManager"/>
        <!--登录页面,如果没有登录,会跳转到登录界面,-->
        <property name="loginUrl" value="/login.jsp"/>
        <!--登录后,在访问没有经过授权的方法或界面时,直接跳转到这个界面-->
        <property name="unauthorizedUrl" value="/unauthorized.jsp"/>
        <!--配置过滤器链-->
        <property name="filterChainDefinitions">
            <value>
                /login.jsp = anon
                /css/** = anon
                /img/** = anon
                /plugins/** = anon
                /make/** = anon
                /login.do = anon
                /company/list.do = perms["企业管理"]
                 /system/log/list.do=perms["日志管理"]
                 /system/module/list.do=perms["模块管理"]
                 /company/list.do=perms["企业管理"]
                 /=perms["SaaS管理"]
                 /cargo=perms["货运管理"]
                 /stat=perms["统计分析"]
                 /baseinfo=perms["基础信息"]
                 /sysadmin=perms["系统管理"]
                 /cargo/contract/list.do=perms["购销合同"]
                 /cargo/contract/print.do=perms["出货表"]
                 /cargo/export/contractList.do=perms["合同管理"]
                 /cargo/export/list.do=perms["出口报运"]
                 /stat/toCharts.do=perms["生产厂家销售情况"]
                 /stat/toCharts.do=perms["产品销售排行"]
                 /stat/toCharts.do=perms["系统访问压力图"]
                 /system/dept/list.do=perms["部门管理"]
                 /system/user/list.do=perms["用户管理"]
                 /system/role/list.do=perms["角色管理"]
                 /cargo/packing/list.do=perms["装箱管理"]
                 /cargo/shipping/list.do=perms["委托管理"]
                 /cargo/invoice/list.do=perms["发票管理"]
                 /cargo/finance/list.do=perms["财务管理"]
                 /sysadmin/deptAction_toview=perms["查看部门"]
                 /sysadmin/deptAction_tocreate=perms["新增部门"]
                 /sysadmin/deptAction_toupdate=perms["修改部门"]
                 /sysadmin/deptAction_delete=perms["删除部门"]
                /** = authc
            </value>
        </property>
    </bean>


    <!--注入自定义的SaasRealm-->
    <bean id="saamRealm" class="com.ahd.realm.SaasRealm"/>

    <!--配置shiro核心类-->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="saamRealm"/>
    </bean>

    <!--后来编写的-->
    <!-- 安全管理器 -->
    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <property name="securityManager" ref="securityManager"/>
    </bean>

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行 -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>

    <!-- 生成代理，通过代理进行控制 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"
          depends-on="lifecycleBeanPostProcessor">
        <property name="proxyTargetClass" value="true"/>
    </bean>

    <aop:aspectj-autoproxy proxy-target-class="true"/>

</beans>

public class SaasRealm extends AuthorizingRealm {
    @Autowired
    private UserService us;
    @Autowired
    private ModuleService ms;
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        //将用户所有权限存入对象中
        //获取登录的用户对象
        User user = (User) principalCollection.getPrimaryPrincipal();
        //通过查询数据库,查找该用户所具有的的权限
        List<Module> moduleByUser = ms.findModuleByUser(user);
//        Set<String> perms=new HashSet<>();
        //创建SimpleAuthorizationInfo权限对象
        SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();

        for (Module module : moduleByUser) {
            info.addStringPermission(module.getName());
        }

        return info;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        UsernamePasswordToken token= (UsernamePasswordToken) authenticationToken;
        //获取页面传递过来的账号密码
        String username_page = token.getUsername();//email
        String password_page = new String(token.getPassword());

        //从数据库中查找该账号的信息
        User user_db = us.findByEmail(username_page);
        String password_db = user_db.getPassword();

        //进行信息比较,如果密码不匹配,返回null,调用者会抛出异常
        if(!password_page.equals(password_db)){
            return null;
        }
        return new SimpleAuthenticationInfo(user_db,user_db.getPassword(),getName());
    }
}

@RequestMapping(value="login",name = "用户登录")
public String login(String email,String password){
    //登录分析
    //1.首先判断用户邮箱和密码是否为空
    if(StringUtils.isEmpty(email)||StringUtils.isEmpty(password)){
        request.setAttribute("error","邮箱或密码不能为空");
        return "forward:/login.jsp";
    }
    password=new Md5Hash(password,email,1).toString();
    UsernamePasswordToken token=new UsernamePasswordToken(email,password);
    Subject subject = SecurityUtils.getSubject();

    try {
        subject.login(token);
    } catch (AuthenticationException e) {
        request.setAttribute("error","邮箱或密码有误");
        return "forward:/login.jsp";
    }
    //执行到这里,证明登录成功,所以继续封装数据
    //通过shiro的Session域获取user对象
    User user = (User) subject.getPrincipal();

    List<Module> moduleList =ms.findModuleByUser(user);//存入session
    session.setAttribute("modules",moduleList);

    //将登录数据存入session域
    session.setAttribute("loginUser",user);
    return "home/main";
}

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>

<shiro:hasPermission name="删除部门">
    <button type="button" class="btn btn-default" title="删除" onclick=‘deleteById()‘><i class="fa fa-trash-o"></i> 删除</button>
</shiro:hasPermission>

public class MyPermsFilter extends AuthorizationFilter {
    public MyPermsFilter() {
    }

    public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {
        Subject subject = this.getSubject(request, response);
        String[] perms = (String[])((String[])mappedValue);

//       perms =  ["部门管理","删除部门"]
        if (perms != null && perms.length > 0) {
            for (String perm : perms) {
                if (subject.isPermitted(perm)) {
                    return true;
                }
            }
            return false;
                  }

        return true;
    }
}