1、导包

shiro-all-1.3.2.jar

2、web.xml配置 拦截器

<filter><filter-name>shiroFilter</filter-name><filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping><filter-name>shiroFilter</filter-name><url-pattern>/*</url-pattern>
</filter-mapping>

3、applicationContext.xml配置------spring配置

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean"><property name="securityManager" ref="securityManager"></property><property name="loginUrl" value="/login.jsp"></property><property name="filterChainDefinitions"><value>/validatecode.jsp*=anon/userAction_login.action =anon/* =authc</value></property>
</bean>
<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager"><property name="realm" ref="realm"></property>
</bean>
<bean id="realm" class="com.dong.bos.web.realm.BosRealm"></bean>

4、新建BosRealm类

public class BosRealm extends AuthorizingRealm {@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {return null;}@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {return null;}
}

二、登陆中使用：

1、action

package com.dong.bos.web.action;import com.dong.bos.model.User;
import com.dong.bos.service.IUserService;
import com.dong.bos.utils.MD5Utils;
import com.dong.bos.web.action.base.BaseAction;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.apache.struts2.ServletActionContext;
import org.springframework.beans.factory.annotation.Autowired;import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.prefs.NodeChangeEvent;public class UserAction extends BaseAction<User> {public String logout() {ServletActionContext.getRequest().getSession().invalidate();return "login";}public String login() {String username = getModel().getUsername();String password = getModel().getPassword();HttpServletRequest httpServletRequest = ServletActionContext.getRequest();String servercode = (String) httpServletRequest.getSession().getAttribute("key");String clientcode = httpServletRequest.getParameter("checkcode");if (servercode.equalsIgnoreCase(clientcode)) {
//////////////////////////原来的
//            User user = iUserService.login(username, password);
////            if (user != null) {
////                System.out.println("登录成功");
////                httpServletRequest.getSession().setAttribute("loginUser", user);
////                return "home";
////            } else {
////                System.out.println("登录失败");
////                addActionError("登录失败");
////            }try {Subject subject = SecurityUtils.getSubject();UsernamePasswordToken usernamePasswordToken = new UsernamePasswordToken(username, MD5Utils.text2md5(password));subject.login(usernamePasswordToken);User user = (User) subject.getPrincipal();subject.getSession().setAttribute("loginUser", user);return "home";} catch (AuthenticationException e) {e.printStackTrace();addActionError("登录失败");}} else {System.out.println("验证码不正确");addActionError("验证码不正确");}return "failure";}@Overridepublic String save() {System.out.println(getModel());return NONE;}@Overridepublic String update() {return NONE;}@Overridepublic String delete() {return NONE;}@Overridepublic String list() {return NONE;}public String editpwd() throws IOException {HttpServletResponse httpServletResponse = ServletActionContext.getResponse();User user = (User) ServletActionContext.getRequest().getSession().getAttribute("loginUser");String id = user.getId();String password = ServletActionContext.getRequest().getParameter("txtNewPass");System.out.println(id + "-----" + password);iUserService.UpdateUser(password, id);httpServletResponse.setHeader("Content-Type", "text/json;charset=utf-8");httpServletResponse.getWriter().write("111");return NONE;}
}

2、realm类

public class BosRealm extends AuthorizingRealm {@Autowiredprivate IUserDao iUserDao;@Overrideprotected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {return null;}@Overrideprotected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;String username = token.getUsername();User user = iUserDao.findByUsername(username);if (user != null) {/*** Object principal, 把数据库查询的对象* Object credentials,证书：写密码自动验证，查询出来的密码* String realmName,当前的类名*///返回AuthenticationInfo对象,【这个对象会自动验证密码】SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(user, user.getPassword(), this.getClass().getSimpleName());return simpleAuthenticationInfo;}return null;}
}