源码下载 我的GITHUB
shiro 相比与spring security配置上简单很多。
加载shiro config
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>
classpath:shiro-config.xml
</param-value>
</context-param>
添加shrio过滤器，这里需要注意的是，过滤器的名字shiroFilter必须与配置文件里面的bean名字相同
<filter>
<filter-name>shiroFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
<init-param>
<param-name>targetFilterLifecycle</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>shiroFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
shiroFilter配置，这里需要配置一个 formAuthenticationFilter，作用在后面会提到，主要是因为extjs的ajax请求。
<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
<property name="securityManager" ref="securityManager"/>
<!-- override these for application-specific URLs if you like:-->
<property name="loginUrl" value="/login.html"/>
<property name="successUrl" value="/index.html"/>
<property name="unauthorizedUrl" value="/unauthorized.html"/>
<property name="filters">
<util:map>
<entry key="authc" value-ref="formAuthenticationFilter"/>
</util:map>
</property>
<property name="filterChainDefinitions">
<value>
/comp/** = anon
/pages/** = anon
/resources/** = anon
/view/** = anon
/** = authc
</value>
</property>
</bean>
shiroFilter中引用了 securityManageer。如果参考shiro官网的同学请注意，官网documentation中的manager是org.apache.shiro.mgt.DefaultWebSecurityManager。在1.2.2中，这个类是没有实现WebSecurityManager的，所以会跑出unimplement WebSecurityManager的异常。
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
<!-- Single realm app. If you have multiple realms, use the 'realms' property instead. 如果有多个realm，需要用reamls参数，为实践。-->
<property name="realm" ref="fastRealm"/>
</bean>
引用的realm是可以重写的。
<bean id="fastRealm" class="com.chinadreamer.contacts.filter.shiro.UserRealm"></bean>
重写realm。
重写的doGetAuthorizationInfo与doGetAuthenticationInfo在官网中已经很明确的说明了，这里不再解释。
我说下这里会遇到的一个问题。shiro跟spring的filter并没有优先级之分，而用户验证，一般都会涉及到datasource bean的引用，比方这里的userservice。所以需要注意的是必须在spring bean加载之后，进入shiro，否则是无法加载的。
我的做法是在applicationContext.xml 结尾才引入shiro-config.xml，这样就可以获取到bean了。
引入方式比较常规
<import resource="shiro-config.xml"/>
public class UserRealm extends AuthorizingRealm{
private final static Logger LOGGER = Logger.getLogger(UserRealm.class);
@Autowired
private UserService userService;
public UserRealm(){
super();
LOGGER.info(" init user realm ");
setAuthenticationTokenClass(UsernamePasswordToken.class);
}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(
PrincipalCollection principals) {
User user = ShiroUtils.getUser();
SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo();
return authorizationInfo;
}
@Override
protected AuthenticationInfo doGetAuthenticationInfo(
AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken upToken = (UsernamePasswordToken) token;
String username = upToken.getUsername();
String password = new String(upToken.getPassword());
User user;
try {
user = this.userService.userLogin(username, password);
} catch (Exception e) {
throw new AuthenticationException(e.getMessage(),e);
}
SimpleAuthenticationInfo info = new SimpleAuthenticationInfo(user, password.toCharArray(), getName());
return info;
}
}
<bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/>
简单的shiro到这就可以了。但是如果配合extjs，就需要控制ajax返回，大家知道extj是根据response会写的success 字段来判断的。
<!--替换默认的form 验证过滤器-->
<bean id="formAuthenticationFilter" class="com.chinadreamer.contacts.filter.shiro.FastFormAuthenticationFilter">
</bean>
提供一份源码，根据各自的需求改动，这是其他大大提供的。
package com.chinadreamer.contacts.filter.shiro;
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.log4j.Logger;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authc.FormAuthenticationFilter;
public class FastFormAuthenticationFilter extends FormAuthenticationFilter{
private static final Logger LOGGER = Logger.getLogger(FastFormAuthenticationFilter.class);
/*
* 主要是针对登入成功的处理方法。对于请求头是AJAX的之间返回JSON字符串。
*/
@Override
protected boolean onLoginSuccess(AuthenticationToken token,
Subject subject, ServletRequest request, ServletResponse response)
throws Exception {
HttpServletRequest httpServletRequest = (HttpServletRequest) request;
HttpServletResponse httpServletResponse = (HttpServletResponse) response;
if (!"XMLHttpRequest".equalsIgnoreCase(httpServletRequest
.getHeader("X-Requested-With"))) {// 不是ajax请求
issueSuccessRedirect(request, response);
} else {
httpServletResponse.setCharacterEncoding("UTF-8");
PrintWriter out = httpServletResponse.getWriter();
out.println("{success:true,message:'登入成功'}");
out.flush();
out.close();
}
return false;
}
/**
* 主要是处理登入失败的方法
*/
@Override
protected boolean onLoginFailure(AuthenticationToken token,
AuthenticationException e, ServletRequest request,
ServletResponse response) {
if (!"XMLHttpRequest".equalsIgnoreCase(((HttpServletRequest) request)
.getHeader("X-Requested-With"))) {// 不是ajax请求
setFailureAttribute(request, e);
return true;
}
try {
response.setCharacterEncoding("UTF-8");
PrintWriter out = response.getWriter();
String message = e.getClass().getSimpleName();
if ("IncorrectCredentialsException".equals(message)) {
out.println("{success:false,message:'密码错误'}");
} else if ("UnknownAccountException".equals(message)) {
out.println("{success:false,message:'账号不存在'}");
} else if ("LockedAccountException".equals(message)) {
out.println("{success:false,message:'账号被锁定'}");
} else {
out.println("{success:false,message:'未知错误'}");
}
out.flush();
out.close();
} catch (IOException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
return false;
}
/**
* 所有请求都会经过的方法。
*/
@Override
protected boolean onAccessDenied(ServletRequest request,
ServletResponse response) throws Exception {
if (isLoginRequest(request, response)) {
if (isLoginSubmission(request, response)) {
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Login submission detected. Attempting to execute login.");
}
if ("XMLHttpRequest"
.equalsIgnoreCase(((HttpServletRequest) request)
.getHeader("X-Requested-With"))) {// 不是ajax请求
// String vcode = request.getParameter("vcode");
// HttpServletRequest httpservletrequest = (HttpServletRequest) request;
// String vvcode = (String) httpservletrequest
// .getSession()
// .getAttribute(
// com.google.code.kaptcha.Constants.KAPTCHA_SESSION_KEY);
// if (vvcode == null || "".equals(vvcode)
// || !vvcode.equals(vcode)) {
// response.setCharacterEncoding("UTF-8");
// PrintWriter out = response.getWriter();
// out.println("{success:false,message:'验证码错误'}");
// out.flush();
// out.close();
// return false;
// }
}
return executeLogin(request, response);
} else {
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Login page view.");
}
// allow them to see the login page ;)
return true;
}
} else {
if (LOGGER.isTraceEnabled()) {
LOGGER.trace("Attempting to access a path which requires authentication. Forwarding to the "
+ "Authentication url [" + getLoginUrl() + "]");
}
if (!"XMLHttpRequest"
.equalsIgnoreCase(((HttpServletRequest) request)
.getHeader("X-Requested-With"))) {// 不是ajax请求
saveRequestAndRedirectToLogin(request, response);
} else {
// response.setCharacterEncoding("UTF-8");
// PrintWriter out = response.getWriter();
// out.println("{success:true,message:'login'}");
// out.flush();
// out.close();
return true;
}
return false;
}
}
}
![springboot整合shiro实现认证授权源码shiro-admin前端请求案例[图]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)