<!-- shiro begin -->

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-core</artifactId>

<version>1.2.3</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-web</artifactId>

<version>1.2.3</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-ehcache</artifactId>

<version>1.2.3</version>

</dependency>

<dependency>

<groupId>org.apache.shiro</groupId>

<artifactId>shiro-spring</artifactId>

<version>1.2.3</version>

</dependency>

<!-- shiro end -->  

<?xml version="1.0" encoding="UTF-8"?>

<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"

    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"

    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"

    version="2.5">

     <display-name>abel-shiro Application</display-name>  

     <!-- 指定上下文配置文件 -->

     <context-param>

        <param-name>contextConfigLocation</param-name>

        <param-value>

                 classpath:applicationContext.xml

        </param-value>

    </context-param>  

    <!-- spring监听器，监听springMvc环境 -->

    <listener>

        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>

    </listener>  

    <!-- 压入项目路径 -->

    <listener>

       <listener-class>org.springframework.web.util.WebAppRootListener</listener-class>

    </listener>  

    <!-- 配置Shiro过滤器,先让Shiro过滤系统接收到的请求 -->

    <!-- 通常将这段代码中的filter-mapping放在所有filter-mapping之前，以达到shiro是第一个对web请求进行拦截过滤之目的。

        这里的fileter-name(shiroFilter) 对应下面applicationContext.xml中的<bean id="shiroFilter" />

        DelegatingFilterProxy会自动到Spring容器中查找名字为shiroFilter的bean并把filter请求交给它处理-->

    <!-- 使用[/*]匹配所有请求,保证所有的可控请求都经过Shiro的过滤 -->

    <filter>

        <filter-name>shiroFilter</filter-name>

        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

        <init-param>

            <!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理   -->

            <param-name>targetFilterLifecycle</param-name>

            <param-value>true</param-value>

        </init-param>

    </filter>

    <filter-mapping>

        <filter-name>shiroFilter</filter-name>

        <url-pattern>/*</url-pattern>

    </filter-mapping>  

     <!-- springMvc前置总控制器，在分发其它的控制器前都要经过这个总控制器 -->

     <servlet>

        <servlet-name>spring</servlet-name>

        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>

        <init-param>

            <param-name>contextConfigLocation</param-name>

            <param-value>/WEB-INF/spring-shiro.xml</param-value>

        </init-param>

        <!-- 启动顺序 -->

        <load-on-startup>1</load-on-startup>

    </servlet>  

    <servlet-mapping>

        <servlet-name>spring</servlet-name>

        <url-pattern>/</url-pattern>

        <!--

        <url-pattern>/</url-pattern>  会匹配到/login这样的路径型url，不会匹配到模式为*.jsp这样的后缀型url

        <url-pattern>/*</url-pattern> 会匹配所有url：路径型的和后缀型的url(包括/login,*.jsp,*.js和*.html等)

         -->

    </servlet-mapping>  

</web-app>  

package com.abel.shiro.security;  

import java.util.List;  

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.authc.AuthenticationException;

import org.apache.shiro.authc.AuthenticationInfo;

import org.apache.shiro.authc.AuthenticationToken;

import org.apache.shiro.authc.SimpleAuthenticationInfo;

import org.apache.shiro.authz.AuthorizationInfo;

import org.apache.shiro.authz.SimpleAuthorizationInfo;

import org.apache.shiro.realm.AuthorizingRealm;

import org.apache.shiro.session.InvalidSessionException;

import org.apache.shiro.session.Session;

import org.apache.shiro.subject.PrincipalCollection;

import org.apache.shiro.subject.Subject;

import org.springframework.beans.factory.annotation.Autowired;  

import com.abel.shiro.Constants;

import com.abel.shiro.model.MemberModel;

import com.abel.shiro.model.PermissionModel;

import com.abel.shiro.model.RoleModel;

import com.abel.shiro.services.MemberService;  

/**

 * 自定义的指定Shiro验证用户登录的类

 * @author abel.lin

 */

public class SystemAuthorizingRealm extends AuthorizingRealm {

    @Autowired

    private MemberService memberService;

    /**

     * 授权查询回调函数, 进行鉴权但缓存中无用户的授权信息时调用

     */

    @Override

    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals){

        //获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()

        String currentUsername = (String)super.getAvailablePrincipal(principals);

        MemberModel member = memberService.getMemberByName(currentUsername);

        if(member == null){

            throw new AuthenticationException("msg:用户不存在。");

        }

        SimpleAuthorizationInfo simpleAuthorInfo = new SimpleAuthorizationInfo();  

        List<RoleModel> roleList = memberService.selectRoleByMemberId(member.getId());

        List<PermissionModel> permList = memberService.selectPermissionByMemberId(member.getId());  

        if(roleList != null && roleList.size() > 0){

            for(RoleModel role : roleList){

                if(role.getRoleCode() != null){

                    simpleAuthorInfo.addRole(role.getRoleCode());

                }

            }

        }  

        if(permList != null && permList.size() > 0){

            for(PermissionModel perm : permList){

                if(perm.getCode() != null){

                    simpleAuthorInfo.addStringPermission(perm.getCode());

                }

            }

        }

        return simpleAuthorInfo;  

    }  

    /**

     * 认证回调函数, 登录时调用

     */

    @Override

    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {

        //获取基于用户名和密码的令牌

        //实际上这个authcToken是从LoginController里面currentUser.login(token)传过来的

        UsernamePasswordToken token = (UsernamePasswordToken)authcToken;  

        Session session = getSession();

        String code = (String)session.getAttribute(Constants.VALIDATE_CODE);

        if (token.getCaptcha() == null || !token.getCaptcha().toUpperCase().equals(code)){

            throw new AuthenticationException("msg:验证码错误, 请重试.");

        }

        MemberModel member = memberService.getMemberByName(token.getUsername());

        if(member != null){

            if(member.getIslock() !=null && member.getIslock() == 1){

                throw new AuthenticationException("msg:该已帐号禁止登录.");

            }

            AuthenticationInfo authcInfo = new SimpleAuthenticationInfo(member.getLoginName(), member.getPwd(), this.getName());

            this.setSession("currentUser", member.getLoginName());  

            return authcInfo;

        }

        return null;  

    }  

    /**

     * 保存登录名

     */

    private void setSession(Object key, Object value){

        Session session = getSession();

        System.out.println("Session默认超时时间为[" + session.getTimeout() + "]毫秒");

        if(null != session){

            session.setAttribute(key, value);

        }

    }  

    private Session getSession(){

        try{

            Subject subject = SecurityUtils.getSubject();

            Session session = subject.getSession(false);

            if (session == null){

                session = subject.getSession();

            }

            if (session != null){

                return session;

            }

        }catch (InvalidSessionException e){  

        }

        return null;

    }

}  

package com.abel.shiro.controller;  

import java.awt.Color;

import java.awt.image.BufferedImage;

import java.io.IOException;  

import javax.imageio.ImageIO;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;  

import org.apache.shiro.SecurityUtils;

import org.apache.shiro.subject.Subject;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

import org.springframework.web.bind.annotation.ResponseBody;  

import com.abel.shiro.Constants;

import com.abel.shiro.security.UsernamePasswordToken;  

/**

 * @author abel.lin

 */

@Controller

public class LoginController {  

    @RequestMapping("login")

    public String login(HttpServletRequest request){  

        return "login";

    }  

    @RequestMapping("login/auth")

    public String doLogin(HttpServletRequest request){

        String username = request.getParameter("loginname");

        String pwd = request.getParameter("password");

        String captcha = request.getParameter("captcha");

        UsernamePasswordToken token = new UsernamePasswordToken(username, pwd, captcha);

        Subject currentUser = SecurityUtils.getSubject();

        currentUser.login(token);

        return "redirect:/admin/index";

    }  

    @ResponseBody

    @RequestMapping("admin/index")

    public String index(HttpServletRequest request){

        return "wellcome index";

    }

    @ResponseBody

    @RequestMapping("admin/channel")

    public String channel(HttpServletRequest request){

        return "wellcome channel";

    }

    @ResponseBody

    @RequestMapping("admin/content")

    public String content(HttpServletRequest request){

        return "wellcome content";

    }

    @ResponseBody

    @RequestMapping("admin/sys")

    public String sys(HttpServletRequest request){

        return "wellcome sys";

    }  

    @RequestMapping("logout")

    public String logout(HttpServletRequest request){

        SecurityUtils.getSubject().logout();

        return "redirect:/login";

    }  

    /**

     * 获取验证码图片和文本(验证码文本会保存在HttpSession中)

     */

    @RequestMapping("/genCaptcha")

    public void genCaptcha(HttpServletRequest request, HttpServletResponse response) throws IOException {

        //设置页面不缓存

        response.setHeader("Pragma", "no-cache");

        response.setHeader("Cache-Control", "no-cache");

        response.setDateHeader("Expires", 0);

        String verifyCode = VerifyCodeUtil.generateTextCode(VerifyCodeUtil.TYPE_NUM_ONLY, 4, null);

        //将验证码放到HttpSession里面

        request.getSession().setAttribute(Constants.VALIDATE_CODE, verifyCode);

        System.out.println("本次生成的验证码为[" + verifyCode + "],已存放到HttpSession中");

        //设置输出的内容的类型为JPEG图像

        response.setContentType("image/jpeg");

        BufferedImage bufferedImage = VerifyCodeUtil.generateImageCode(verifyCode, 90, 30, 5, true, Color.WHITE, null, null);

        //写给浏览器

        ImageIO.write(bufferedImage, "JPEG", response.getOutputStream());

    }    

}  

<!DOCTYPE html>

<html>

<head>

<meta charset="UTF-8">

<title>Shiro login</title>

</head>

<body>

<form action="/login/auth" method="post">

<div><label>用户名</label><input type="text" name="loginname" /></div>

<div><label>密 码</label><input type="text" name="password" /></div>

<div><label>验证码</label><input type="text" name="captcha" /><img src="/genCaptcha" /></div>

<div><input type="submit" value="登录" /></div>

</form>

</body>

</html>