一. Shiro 集成 Web

可以参考http://shiro.apache.org/web.html

实例代码可参考这里

1. 新建maven项目
   
   
   上边使用webapp是开发maven下的jsp项目，需要修改JRE到1.8。
   
   
   
   
   
   webapp/下就是存放jsp等静态网络资源的地方。

2. pom.xml配置如下：

<project xmlns="http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"><modelVersion>4.0.0</modelVersion><groupId>com.bee</groupId><artifactId>ShiroWeb</artifactId><packaging>war</packaging><version>0.0.1-SNAPSHOT</version><name>ShiroWeb Maven Webapp</name><url>http://maven.apache.org</url><dependencies><dependency><groupId>junit</groupId><artifactId>junit</artifactId><version>3.8.1</version><scope>test</scope></dependency><!-- 添加servlet支持 --><dependency><groupId>javax.servlet</groupId><artifactId>javax.servlet-api</artifactId><version>3.1.0</version></dependency><dependency><groupId>javax.servlet.jsp</groupId><artifactId>javax.servlet.jsp-api</artifactId><version>2.3.1</version></dependency><!-- 添加jstl支持 --><dependency><groupId>javax.servlet</groupId><artifactId>jstl</artifactId><version>1.2</version></dependency><!-- 添加日志支持 --><dependency><groupId>log4j</groupId><artifactId>log4j</artifactId><version>1.2.17</version></dependency><dependency><groupId>commons-logging</groupId><artifactId>commons-logging</artifactId><version>1.2</version></dependency><!-- 添加shiro支持 --><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-core</artifactId><version>1.2.4</version></dependency><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-web</artifactId><version>1.2.4</version></dependency><dependency><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId><version>1.7.12</version></dependency></dependencies><build><finalName>ShiroWeb</finalName></build>
</project>

3. 调整web根目录webapp/
   
   测试一下：
   选中项目->右键->Debug As->Debug on Server

注意：WEB-INF/下的内容客户端是访问不了的。

二. 默认的过滤器变量

Filter Name	Class
anon	org.apache.shiro.web.filter.authc.AnonymousFilter
authc	org.apache.shiro.web.filter.authc.FormAuthenticationFilter
authcBasic	org.apache.shiro.web.filter.authc.BasicHttpAuthenticationFilter
authcBearer	org.apache.shiro.web.filter.authc.BearerHttpAuthenticationFilter
logout	org.apache.shiro.web.filter.authc.LogoutFilter
noSessionCreation	org.apache.shiro.web.filter.session.NoSessionCreationFilter
perms	org.apache.shiro.web.filter.authz.PermissionsAuthorizationFilter
port	org.apache.shiro.web.filter.authz.PortFilter
rest	org.apache.shiro.web.filter.authz.HttpMethodPermissionFilter
roles	org.apache.shiro.web.filter.authz.RolesAuthorizationFilter
ssl	org.apache.shiro.web.filter.authz.SslFilter
user	org.apache.shiro.web.filter.authc.UserFilter

认证的顺序：

• 身份认证 -> 角色认证
• 身份认证 -> 权限认证

认证一旦通过，Shiro会在底层将登录用户计入会话session
（

Subject subject = SecurityUtils.getSubject();
...
subject.login(token);
...
Session session = subject.getSession();

）。然后后续的角色/权限的认证都是基于session记录的登录用户来进行。

Shiro有自己的session与HttpServlet的session是相互独立的。但一般使用HttpServlet的session就够了。

三. URL匹配方式

通配符	含义	说明
?	匹配一个字符	/admin? 可以匹配 /admin1 和 /admin2 但是不能匹配 /admin12 和 /admin
*	匹配零个或者一个或者多个字符	/admin* 可以匹配 /admin 或 /admin1 或/admin12 但是不能匹配/admin/abc
**	匹配零个或者多个路径	/admin/** 可以匹配/admin 或 /admin/a 或 /admin/a/b

四. 自定义Realm把用户，角色和权限信息存入数据库

• 表的关系
  
  外键定义在“多方”。

五. 加密

import org.apache.shiro.codec.Base64;
import org.apache.shiro.crypto.hash.Md5Hash;public class CryptographyUtil {/*** base64加密* * @param str* @return*/public static String encBase64(String str) {return Base64.encodeToString(str.getBytes());}/*** base64解密* * @param str* @return*/public static String decBase64(String str) {return Base64.decodeToString(str);}/*** Md5加密* * @param str* @param salt* @return*/public static String md5(String str, String salt) {return new Md5Hash(str, salt).toString();}public static void main(String[] args) {String password = "123456";System.out.println("Base64加密：" + CryptographyUtil.encBase64(password));System.out.println("Base64解密：" + CryptographyUtil.decBase64(CryptographyUtil.encBase64(password)));System.out.println("Md5加密：" + CryptographyUtil.md5(password, "bee"));}
}

注意：为了避免相同的密码MD5之后结果相同的问题，可以使用如下类似方式处理。

CryptographyUtil.md5(username+"*"+password, "salt");

六. Shiro整合Spring

可以参考：http://shiro.apache.org/spring.html

• pom.xml

......<dependencies><dependency><groupId>junit</groupId><artifactId>junit</artifactId><version>3.8.1</version><scope>test</scope></dependency><!-- 添加Servlet支持 --><dependency><groupId>javax.servlet</groupId><artifactId>javax.servlet-api</artifactId><version>3.1.0</version></dependency><dependency><groupId>javax.servlet.jsp</groupId><artifactId>javax.servlet.jsp-api</artifactId><version>2.3.1</version></dependency><!-- 添加jtl支持 --><dependency><groupId>javax.servlet</groupId><artifactId>jstl</artifactId><version>1.2</version></dependency><!-- 添加Spring支持 --><dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-beans</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-tx</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-context</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-context-support</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-web</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-webmvc</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-aop</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-aspects</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.springframework</groupId><artifactId>spring-jdbc</artifactId><version>4.1.7.RELEASE</version></dependency><dependency><groupId>org.mybatis</groupId><artifactId>mybatis-spring</artifactId><version>1.2.3</version></dependency><!-- 添加日志支持 --><dependency><groupId>log4j</groupId><artifactId>log4j</artifactId><version>1.2.17</version></dependency><!-- 添加mybatis支持 --><dependency><groupId>org.mybatis</groupId><artifactId>mybatis</artifactId><version>3.3.0</version></dependency><!-- jdbc驱动包  --><dependency><groupId>mysql</groupId><artifactId>mysql-connector-java</artifactId><version>5.1.37</version></dependency><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-core</artifactId><version>1.2.4</version></dependency><dependency><groupId>org.slf4j</groupId><artifactId>slf4j-log4j12</artifactId><version>1.7.12</version></dependency><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-web</artifactId><version>1.2.4</version></dependency><dependency><groupId>org.apache.shiro</groupId><artifactId>shiro-spring</artifactId><version>1.2.4</version></dependency></dependencies>......

• webapp/WEB-INF/web.xml

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5"><display-name>ShiroWeb</display-name><welcome-file-list><welcome-file>index.jsp</welcome-file></welcome-file-list><!-- shiro过滤器定义 --><filter><filter-name>shiroFilter</filter-name><filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class><init-param><!-- 该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理 --><param-name>targetFilterLifecycle</param-name><param-value>true</param-value></init-param></filter><filter-mapping><filter-name>shiroFilter</filter-name><url-pattern>/*</url-pattern></filter-mapping><!-- Spring配置文件 --><context-param><param-name>contextConfigLocation</param-name><param-value>classpath:applicationContext.xml</param-value></context-param><!-- 编码过滤器 --><filter><filter-name>encodingFilter</filter-name><filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class><async-supported>true</async-supported><init-param><param-name>encoding</param-name><param-value>UTF-8</param-value></init-param></filter><filter-mapping><filter-name>encodingFilter</filter-name><url-pattern>/*</url-pattern></filter-mapping><!-- Spring监听器 --><listener><listener-class>org.springframework.web.context.ContextLoaderListener</listener-class></listener><!-- 添加对springmvc的支持 --><servlet><servlet-name>springMVC</servlet-name><servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class><init-param><param-name>contextConfigLocation</param-name><param-value>classpath:spring-mvc.xml</param-value></init-param><load-on-startup>1</load-on-startup><async-supported>true</async-supported></servlet><servlet-mapping><servlet-name>springMVC</servlet-name><url-pattern>*.do</url-pattern></servlet-mapping>
</web-app>

• src/main/resources/applicationContext.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns:jee="http://www.springframework.org/schema/jee" xmlns:tx="http://www.springframework.org/schema/tx" xsi:schemaLocation="             http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd           http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-4.0.xsd           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd"><!-- 自动扫描 --><context:component-scan base-package="com.bee.service"/><!-- 配置数据源 --><bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource"><property name="driverClassName" value="com.mysql.jdbc.Driver"/><property name="url" value="jdbc:mysql://localhost:3306/db_shiro"/><property name="username" value="root"/><property name="password" value="123456"/></bean><!-- 配置mybatis的sqlSessionFactory --><bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean"><property name="dataSource" ref="dataSource"/><!-- 自动扫描mappers.xml文件 --><property name="mapperLocations" value="classpath:com/bee/mappers/*.xml"/><!-- mybatis配置文件 --><property name="configLocation" value="classpath:mybatis-config.xml"/></bean><!-- DAO接口所在包名，Spring会自动查找其下的类 --><bean class="org.mybatis.spring.mapper.MapperScannerConfigurer"><property name="basePackage" value="com.bee.dao"/><property name="sqlSessionFactoryBeanName" value="sqlSessionFactory"/></bean><!-- (事务管理)transaction manager, use JtaTransactionManager for global tx --><bean id="transactionManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager"><property name="dataSource" ref="dataSource"/></bean><!-- 自定义Realm --><bean id="myRealm" class="com.bee.realm.MyRealm"/><!-- 安全管理器 --><bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"><property name="realm" ref="myRealm"/></bean><!-- Shiro过滤器 --><bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><!-- Shiro的核心安全接口,这个属性是必须的 --><property name="securityManager" ref="securityManager"/><!-- 身份认证失败，则跳转到登录页面的配置 --><property name="loginUrl" value="/index.jsp"/><!-- 权限认证失败，则跳转到指定页面 --><property name="unauthorizedUrl" value="/unauthor.jsp"/><!-- Shiro连接约束配置,即过滤链的定义 --><property name="filterChainDefinitions"><value>/login=anon/admin*=authc/student=roles[teacher]/teacher=perms["user:create"]</value></property></bean><!-- 保证实现了Shiro内部lifecycle函数的bean执行 --><bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"/><!-- 开启Shiro注解 --><bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor"/><bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor"><property name="securityManager" ref="securityManager"/></bean><!-- 配置事务通知属性 --><tx:advice id="txAdvice" transaction-manager="transactionManager"><!-- 定义事务传播属性 --><tx:attributes><tx:method name="insert*" propagation="REQUIRED"/><tx:method name="update*" propagation="REQUIRED"/><tx:method name="edit*" propagation="REQUIRED"/><tx:method name="save*" propagation="REQUIRED"/><tx:method name="add*" propagation="REQUIRED"/><tx:method name="new*" propagation="REQUIRED"/><tx:method name="set*" propagation="REQUIRED"/><tx:method name="remove*" propagation="REQUIRED"/><tx:method name="delete*" propagation="REQUIRED"/><tx:method name="change*" propagation="REQUIRED"/><tx:method name="check*" propagation="REQUIRED"/><tx:method name="get*" propagation="REQUIRED" read-only="true"/><tx:method name="find*" propagation="REQUIRED" read-only="true"/><tx:method name="load*" propagation="REQUIRED" read-only="true"/><tx:method name="*" propagation="REQUIRED" read-only="true"/></tx:attributes></tx:advice><!-- 配置事务切面 --><aop:config><aop:pointcut id="serviceOperation" expression="execution(* com.bee.service.*.*(..))"/><aop:advisor advice-ref="txAdvice" pointcut-ref="serviceOperation"/></aop:config>
</beans>

• src/main/resources/spring-mvc.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p" xmlns:aop="http://www.springframework.org/schema/aop" xmlns:context="http://www.springframework.org/schema/context" xmlns:jee="http://www.springframework.org/schema/jee" xmlns:tx="http://www.springframework.org/schema/tx" xsi:schemaLocation="             http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-4.0.xsd           http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.0.xsd           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-4.0.xsd           http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-4.0.xsd           http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-4.0.xsd"><!-- 使用注解的包，包括子集 --><context:component-scan base-package="com.bee.controller"/><!-- 视图解析器 --><bean id="viewResolver" class="org.springframework.web.servlet.view.InternalResourceViewResolver"><property name="prefix" value="/"/><property name="suffix" value=".jsp"/></bean>
</beans>