<filter>

<filter-name>shiroFilter</filter-name>

<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>

</filter>

<filter-mapping>

<filter-name>shiroFilter</filter-name>

<url-pattern>/*</url-pattern>

</filter-mapping>

<!-- 配置shiro的过滤器bean -->

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">

<property name="securityManager" ref="securityManager"></property>

<!-- 登录页面路径 -->

<property name="loginUrl" value="/login.jsp"/>

<!-- 登录成功后显示的路径 -->

<property name="successUrl" value="/index.jsp"></property>

<!-- 未授权的页面提示 -->

<property name="unauthorizedUrl" value="/unauthorize.jsp"></property>

<!-- url拦截规则  -->

<property name="filterChainDefinitions">

<value>

/validatecode.jsp* = anon

/userAction_login = anon

/* = authc

</value>

</property>

</bean>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

</bean>

public String login(){

HttpServletRequest request = ServletActionContext.getRequest();

String checkCodeInSession = (String) request.getSession().getAttribute("key");

if(StringUtils.isNotBlank(checkCodeInSession) && checkCodeInSession.equals(this.checkcode)){

//1.返回当前的用户，未认证状态

Subject subject = SecurityUtils.getSubject();

//2.构造一个用户令牌

String pwd = MD5Utils.md5(model.getPassword());

String name = model.getUsername();

AuthenticationToken token = new UsernamePasswordToken(name,pwd);

try {

//登录验证

subject.login(token);

//登录失败会抛出异常

} catch (AuthenticationException  e) {

//UnknownAccountException

this.addActionError("用户名密码不正确");

return "loginfailure";

}

User user = (User) subject.getPrincipal();

ServletActionContext.getRequest().getSession().setAttribute("loginUser", user);

return "home";

}else{

this.addActionError("验证码不正确");

return "loginfailure";

}

}

public class BOSRealm extends AuthorizingRealm{

@Autowired

private IUserDao userDao;

//认证方法

@Override

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {

// TODO Auto-generated method stub

// TODO Auto-generated method stub

UsernamePasswordToken upToken = (UsernamePasswordToken) token;

String username = upToken.getUsername();

User user = userDao.findByUsername(username);

if(user == null){

//用户不存在

}else{

//获取密码

String pwd = user.getPassword();

/*返回简单认证信息对象

 * principal the 'primary' principal associated with the specified realm

 * .credentials the credentials that verify the given principal

 * .realmName the realm from where the principal and credentials were acquired

 * 参数1：与指定realm关联的主体(用户)

 * 参数2：密码

 * 参数3：当前类名

 * */

SimpleAuthenticationInfo info = new SimpleAuthenticationInfo

(user, pwd, this.getClass().getSimpleName());

return info;//返回后，由安全管理器比较密码是否正确

}

System.out.println("AuthenticatingRealm-doGetAuthenticationInfo");

return null;

}

//授权方法

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

return null;

}

}

//授权方法

@Override

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {

SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();

info.addStringPermission("staff");

return info;

}

<!-- 开启shiro注解 -->

<!-- 自动代理 -->

<bean id="defaultAdvisorAutoProxyCreator" 

class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator">

<!-- 强制使用cglib为Action创建代理对象 -->

<property name="proxyTargetClass" value="true"></property>

</bean>

<!-- 切面类 -->

<bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"/>

@RequiresPermissions(value="staff")

public String save(){

return "list";

}

<shiro:hasPermission name="staff">

<a id="save" icon="icon-save" href="#" class="easyui-linkbutton" plain="true" >保存</a>

</shiro:hasPermission>

<ehcache xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="../config/ehcache.xsd">

    <diskStore path="java.io.tmpdir"/>

    <defaultCache

            maxElementsInMemory="10000"

            eternal="false"

            timeToIdleSeconds="120"

            timeToLiveSeconds="120"

            overflowToDisk="true"

            maxElementsOnDisk="10000000"

            diskPersistent="false"

            diskExpiryThreadIntervalSeconds="120"

            memoryStoreEvictionPolicy="LRU"

            />

</ehcache>  

    <bean id="realm" class="com.gyf.bos.web.shiro.BOSRealm"></bean>

<!-- 注册缓存管理器 -->

<bean id="cacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">

<!-- 注入ehcache配置文件 -->

<property name="cacheManagerConfigFile" value="classpath:ehcache.xml"/>

</bean>

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">

<property name="realm" ref="realm"></property>

<!-- 注入缓存管理器 -->

<property name="cacheManager" ref="cacheManager"/>

</bean>