1 <build>
 2         <finalName>chapter7</finalName>
 3         <plugins>
 4             <plugin>
 5                 <groupId>org.mortbay.jetty</groupId>
 6                 <artifactId>jetty-maven-plugin</artifactId>
 7                 <version>8.1.8.v20121106</version>
 8                 <configuration>
 9                     <webAppConfig>
10                         <contextPath>/${project.build.finalName}</contextPath>
11                     </webAppConfig>
12                 </configuration>
13             </plugin>
14 
15             <plugin>
16                 <groupId>org.apache.tomcat.maven</groupId>
17                 <artifactId>tomcat7-maven-plugin</artifactId>
18                 <version>2.2</version>
19                 <configuration>
20                     <path>/${project.build.finalName}</path>
21                 </configuration>
23             </plugin>
24         </plugins>
25     </build>

 1 <dependencies>
 2 ...
 3         <dependency>
 4             <groupId>org.apache.shiro</groupId>
 5             <artifactId>shiro-web</artifactId>
 6             <version>1.2.2</version>
 7         </dependency>
 8 
 9         <dependency>
10             <groupId>javax.servlet</groupId>
11             <artifactId>javax.servlet-api</artifactId>
12             <version>3.0.1</version>
13             <scope>provided</scope>
14         </dependency>
15 ...
16 </dependencies>

 1 <web-app>
 2     <!--- shiro 1.2 -->
 3     <listener>
 4         <listener-class>org.apache.shiro.web.env.EnvironmentLoaderListener</listener-class>
 5     </listener>
 6     <context-param>
 7         <param-name>shiroEnvironmentClass</param-name>
 8         <param-value>org.apache.shiro.web.env.IniWebEnvironment</param-value><!-- 默认先从/WEB-INF/shiro.ini，如果没有找classpath:shiro.ini -->
 9     </context-param>
10     <context-param>
11         <param-name>shiroConfigLocations</param-name>
12         <param-value>classpath:shiro.ini</param-value>
13     </context-param>
14 ...
15 </web-app>

 1 <web-app>
 2 ...
 3     <filter>
 4         <filter-name>shiroFilter</filter-name>
 5         <filter-class>org.apache.shiro.web.servlet.ShiroFilter</filter-class>
 6     </filter>
 7     <filter-mapping>
 8         <filter-name>shiroFilter</filter-name>
 9         <url-pattern>/*</url-pattern>
10     </filter-mapping>
11 </web-app>

 1 <web-app>
 2     <listener>
 3         <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
 4     </listener>
 5     <filter>
 6         <filter-name>shiroFilter</filter-name>
 7         <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 8         <init-param>
 9             <param-name>targetFilterLifecycle</param-name>
10             <param-value>true</param-value>
11         </init-param>
12     </filter>
13     <filter-mapping>
14         <filter-name>shiroFilter</filter-name>
15         <url-pattern>/*</url-pattern>
16     </filter-mapping>
17 </web-app>

 1 ...
 2 [main]
 3 #默认是/login.jsp
 4 authc.loginUrl=/login
 5 roles.unauthorizedUrl=/unauthorized
 6 perms.unauthorizedUrl=/unauthorized
 7 
 8 [users]
 9 zhang=123,admin
10 wang=123
11 
12 [roles]
13 admin=user:*,menu:*
14 
15 [urls]
16 /login=anon
17 /unauthorized=anon
18 /static/**=anon
19 /authenticated=authc
20 /role=authc,roles[admin]
21 /permission=authc,perms["user:create"]

1 /authenticated=authc
2 /role=authc,roles[admin]
3 /permission=authc,perms["user:create"]
4 
5 authc.loginUrl=/login

 1 import org.apache.shiro.SecurityUtils;
 2 import org.apache.shiro.authc.AuthenticationException;
 3 import org.apache.shiro.authc.IncorrectCredentialsException;
 4 import org.apache.shiro.authc.UnknownAccountException;
 5 import org.apache.shiro.authc.UsernamePasswordToken;
 6 import org.apache.shiro.subject.Subject;
 7 
 8 import javax.servlet.ServletException;
 9 import javax.servlet.annotation.WebServlet;
10 import javax.servlet.http.HttpServlet;
11 import javax.servlet.http.HttpServletRequest;
12 import javax.servlet.http.HttpServletResponse;
13 import java.io.IOException;
14 
15 @WebServlet(name = "loginServlet", urlPatterns = "/login")
16 public class LoginServlet extends HttpServlet {
17 
18     @Override
19     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
20         req.getRequestDispatcher("/WEB-INF/jsp/login.jsp").forward(req, resp);
21     }
22 
23     @Override
24     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
25         String error = null;
26         String username = req.getParameter("username");
27         String password = req.getParameter("password");
28         Subject subject = SecurityUtils.getSubject();
29         UsernamePasswordToken token = new UsernamePasswordToken(username, password);
30         token.setRememberMe(true);
31         try {
32             subject.login(token);
33         } catch (UnknownAccountException e) {
34             error = "用户名/密码错误";
35         } catch (IncorrectCredentialsException e) {
36             error = "用户名/密码错误";
37         } catch (AuthenticationException e) {
38             //其他错误，比如锁定，如果想单独处理请单独catch处理
39             error = "其他错误：" + e.getMessage();
40         }
41 
42         if(error != null) {//出错了，返回登录页面
43             req.setAttribute("error", error);
44             req.getRequestDispatcher("/WEB-INF/jsp/login.jsp").forward(req, resp);
45         } else {//登录成功
46             req.getRequestDispatcher("/WEB-INF/jsp/loginSuccess.jsp").forward(req, resp);
47         }
48     }
49 }

1 [main]
2 authcBasic.applicationName=please login
3 ………省略 users
4 [urls]
5 /role=authcBasic,roles[admin]

1 [main]
2 authc.loginUrl=/formfilterlogin
3 authc.usernameParam=username
4 authc.passwordParam=password
5 authc.successUrl=/
6 authc.failureKeyAttribute=shiroLoginFailure
7 [urls]
8 /role=authc,roles[admin]

1 @WebServlet(name = "formFilterLoginServlet", urlPatterns = "/formfilterlogin")
2 public class FormFilterLoginServlet extends HttpServlet {
3 ...
4 }

1 [main]
2 roles.unauthorizedUrl=/unauthorized
3 perms.unauthorizedUrl=/unauthorized
4 [urls]
5 /role=authc,roles[admin]
6 /permission=authc,perms["user:create"]

 1 @WebServlet(name = "roleServlet", urlPatterns = "/role")
 2 public class RoleServlet extends HttpServlet {
 3 
 4     @Override
 5     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
 6         Subject subject = SecurityUtils.getSubject();
 7         subject.checkRole("admin");
 8         req.getRequestDispatcher("/WEB-INF/jsp/hasRole.jsp").forward(req, resp);
 9     }
10 }

 1 @WebServlet(name = "permissionServlet", urlPatterns = "/permission")
 2 public class PermissionServlet extends HttpServlet {
 3 
 4     @Override
 5     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
 6         Subject subject = SecurityUtils.getSubject();
 7         subject.checkPermission("user:create");
 8         req.getRequestDispatcher("/WEB-INF/jsp/hasPermission.jsp").forward(req, resp);
 9     }
10 }

1 [urls]
2 /logout=anon

1 @WebServlet(name = "logoutServlet", urlPatterns = "/logout")
2 public class LogoutServlet extends HttpServlet {
3 
4     @Override
5     protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
6         SecurityUtils.getSubject().logout();
7         req.getRequestDispatcher("/WEB-INF/jsp/logoutSuccess.jsp").forward(req, resp);
8     }
9 }

1 [main]
2 logout.redirectUrl=/login
3 [urls]
4 /logout2=logout