Shiro集成Spring

1、Shiro集成Spring，使用maven进行jar包的依赖与管理，pom.xml的配置文件，如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
         http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <parent>
        <artifactId>shiro</artifactId>
        <groupId>com.bie</groupId>
        <version>1.0-SNAPSHOT</version>
    </parent>
    <modelVersion>4.0.0</modelVersion>

    <artifactId>spring-shiro</artifactId>
    <packaging>war</packaging>

    <name>spring-shiro Maven Webapp</name>
    <!-- FIXME change it to the project's website -->
    <url>http://www.example.com</url>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <maven.compiler.source>1.7</maven.compiler.source>
        <maven.compiler.target>1.7</maven.compiler.target>
    </properties>

    <dependencies>
        <!-- junit单元测试 -->
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.11</version>
            <scope>test</scope>
        </dependency>
        <!-- 引入spring的包 -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>
        <!-- 引入spring-webmvc才可以使用mvc:resources配置 -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>4.3.12.RELEASE</version>
        </dependency>

        <!-- 引入shiro的包 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-core</artifactId>
            <version>1.2.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-web</artifactId>
            <version>1.2.2</version>
        </dependency>

        <!-- shiro集成spring的包 -->
        <dependency>
            <groupId>org.apache.shiro</groupId>
            <artifactId>shiro-spring</artifactId>
            <version>1.2.2</version>
        </dependency>
    </dependencies>

    <build>
        <finalName>spring-shiro</finalName>
        <pluginManagement><!-- lock down plugins versions to avoid using Maven defaults (may be moved to parent pom) -->
            <plugins>
                <plugin>
                    <artifactId>maven-clean-plugin</artifactId>
                    <version>3.1.0</version>
                </plugin>
                <!-- see http://maven.apache.org/ref/current/maven-core/default-bindings.html#Plugin_bindings_for_war_packaging -->
                <plugin>
                    <artifactId>maven-resources-plugin</artifactId>
                    <version>3.0.2</version>
                </plugin>
                <plugin>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.8.0</version>
                </plugin>
                <plugin>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>2.22.1</version>
                </plugin>
                <plugin>
                    <artifactId>maven-war-plugin</artifactId>
                    <version>3.2.2</version>
                </plugin>
                <plugin>
                    <artifactId>maven-install-plugin</artifactId>
                    <version>2.5.2</version>
                </plugin>
                <plugin>
                    <artifactId>maven-deploy-plugin</artifactId>
                    <version>2.8.2</version>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>

</project>

2、配置web.xml配置文件，里面需要指定shiro提供的过滤器、指定springmvc的配置文件、指定spring的配置文件。

<!DOCTYPE web-app PUBLIC
        "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
        "http://java.sun.com/dtd/web-app_2_3.dtd" >

<web-app>
    <display-name>Archetype Created Web Application</display-name>

    <!-- 加载Spring的bean.xml文件 -->
    <context-param>
        <param-name>contextConfigLocation</param-name>
        <param-value>
            classpath:spring/spring.xml
        </param-value>
    </context-param>
    <listener>
        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
    </listener>

    <listener>
        <listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
    </listener>

    <servlet>
        <servlet-name>springmvc</servlet-name>
        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>
        <init-param>
            <param-name>contextConfigLocation</param-name>
            <param-value>classpath:spring/spring-mvc.xml</param-value>
        </init-param>
    </servlet>
    <servlet-mapping>
        <servlet-name>springmvc</servlet-name>
        <!-- 拦截后缀为.action的文件,*.*,可以配置/来拦截 -->
        <url-pattern>/</url-pattern>
    </servlet-mapping>

    <!-- shiro提供的filter过滤器 -->
    <filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <!-- 拦截所有的请求 -->
        <url-pattern>/*</url-pattern>
    </filter-mapping>

    <welcome-file-list>
        <welcome-file>login.html</welcome-file>
    </welcome-file-list>
</web-app>

3、配置spring-mvc.xml配置，由于这里使用的是模拟数据库，所以配置较少，后续将新增读取数据库的数据。

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:mvc="http://www.springframework.org/schema/mvc"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
    http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
    http://www.springframework.org/schema/context
    http://www.springframework.org/schema/context/spring-context-3.2.xsd


    http://www.springframework.org/schema/mvc
    http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">

    <!-- 扫描的路径包 -->
    <context:component-scan base-package="com.bie.controller"></context:component-scan>

    <!-- 开启注解 -->
    <mvc:annotation-driven></mvc:annotation-driven>

    <!-- 过滤静态资源 -->
    <mvc:resources mapping="/*" location="/"/>

    <!-- 过滤静态资源 -->
    <!--<mvc:resources mapping="/**/*.html" location="/"/>-->

</beans>

配置spring.xml，将对象注入到spring容器中，让spring进行对象的管理，如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">


    <!-- 将ShiroFilterFactoryBean注入到spring容器中 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 配置SecurityManager对象 -->
        <property name="securityManager" ref="securityManager"></property>
        <!-- 设置登陆页的url -->
        <property name="loginUrl" value="login.html"></property>
        <!-- 未认证的界面 -->
        <property name="unauthorizedUrl" value="403.html"></property>
        <!-- 过滤器链 -->
        <!-- shiro给我们内置了很多Filter，这里设置过滤器链 -->
        <property name="filterChainDefinitions">
            <!-- authc经过认证之后才可以访问相应的路径、anon不需要任何验证就可以访问 -->
            <!-- 过滤器链是有顺序的，从上到下，需要认证的放到下面 -->
            <!-- 根路径下面的/subLogin也不需要进行认证 -->
            <!-- authc表示需要经过认证之后才可以访问相应数据，anon表示不需要认证，直接可以访问 -->
            <!-- 这个过滤器链是有顺序的，从上往下匹配，匹配到之后就直接返回了，所以匹配到login.jsp不需要认证，/*需要认证，所以放在下面 -->
            <value>
                /login.html=anon
                /subLogin=anon
                /*=authc
            </value>
        </property>
    </bean>

    <!-- 第一步，创建SecurityManager对象 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 将自定义的Realm设置到SecurityManager环境中 -->
        <!-- 主体提交请求之后就交给我们自定义Realm来认证和授权 -->
        <property name="realm" ref="customRealm"></property>
    </bean>

    <!-- 第二步，创建自定义Realm -->
    <bean id="customRealm" class="com.bie.realm.CustomRealm">
        <!-- 将加密的设置到自定义的Realm中 -->
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
    </bean>

    <!-- 第三步，加密管理器对象 -->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <!-- 设置加密的算法为md5 -->
        <property name="hashAlgorithmName" value="md5"></property>
        <!-- 设置加密次数 -->
        <property name="hashIterations" value="1"></property>
    </bean>

</beans>

4、创建一个用户实体类，主要是用户的账号字段、用户密码字段，如下所示：

package com.bie.po;

/**
 * @ProjectName: shiro
 * @Package: com.bie.po
 * @ClassName: User
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 16:40
 * @Version: 1.0
 */
public class User {

    private String username;
    private String password;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    @Override
    public String toString() {
        return "User{" +
                "username='" + username + '\'' +
                ", password='" + password + '\'' +
                '}';
    }
}

这里使用自定义Realm，这里使用的模拟数据库进行登陆操作，如下所示：

package com.bie.realm;

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;

import java.util.HashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;

/**
 * 自定义Realm
 *
 * @ProjectName: shiro
 * @Package: com.bie.shiro
 * @ClassName: CustomRealm
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 14:58
 * @Version: 1.0
 */
public class CustomRealm extends AuthorizingRealm {

    // 模拟数据表的登陆
    private Map<String, String> userMap = new HashMap<String, String>();

    {
        // userMap.put("admin", "123456");
        userMap.put("admin", "496edd8064892864b76c5fd3a732544b");

        // 设置RealName名称
        super.setName("customRealm");
    }

    /**
     * 授权使用
     *
     * @param principals
     * @return
     */
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 1、第一步，从认证信息中获取到用户信息。
        String userName = (String) principals.getPrimaryPrincipal();
        // 2、第二步，从数据库中或者缓存中通过用户姓名获取到角色信息
        Set<String> roles = getRolesByUserName(userName);
        // 3、第三步，从数据库中或者缓存中通过用户姓名获取到权限信息
        Set<String> permissions = getPermissionsByUserName(userName);
        // 4、第四步，将获取到角色信息和权限信息返回
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        // 设置权限
        simpleAuthorizationInfo.setStringPermissions(permissions);
        // 设置角色
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    /**
     * 通过用户名获取到权限信息
     *
     * @param userName
     * @return
     */
    private Set<String> getPermissionsByUserName(String userName) {
        // 创建一个集合对象
        Set<String> sets = new HashSet<String>();
        // 设置权限名称
        sets.add("user:select");
        sets.add("user:insert");
        sets.add("user:delete");
        sets.add("user:update");
        return sets;
    }

    /**
     * 模拟通过用户姓名获取到角色信息
     *
     * @param userName
     * @return
     */
    private Set<String> getRolesByUserName(String userName) {
        // 创建一个集合对象
        Set<String> sets = new HashSet<String>();
        // 设置角色名称
        sets.add("admin");
        sets.add("user");
        return sets;
    }

    /**
     * 认证使用
     *
     * @param token 主体传过来的认证信息
     * @return
     * @throws AuthenticationException
     */
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        // 1、第一步，通过主体传过来的认证信息获取用户名
        String username = (String) token.getPrincipal();
        // 2、通过用户名到数据库中获取凭证
        // 如果使用了shiro的HashedCredentialsMatcher加密，那么这里保存的是加密后的密文
        String password = getPasswordByUserName(username);
        // 判断获取到的密码是否存在，不存在直接返回null
        if (password == null) {
            return null;
        }
        // 如果对象存在
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo("admin", password, "customRealm");

        // 如果加了盐salt,认证返回的时候需要见盐salt设置进去的
        authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes("654321"));
        // 将加了盐的认证用户返回
        return authenticationInfo;
    }

    /**
     * 通过用户姓名获取到用户的密码
     *
     * @param username
     * @return
     */
    private String getPasswordByUserName(String username) {
        // 正常情况下，需要读取数据库，这里进行模拟
        return this.userMap.get(username);
    }

    public static void main(String[] args) {
        // 加盐salt让密码更加难以识破
        Md5Hash md5Hash = new Md5Hash("123456", "654321");
        System.out.println(md5Hash);
    }

}

创建一个Controller进行测试，看看shiro整合的spring是否好使，如下所示：

package com.bie.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

/**
 * @ProjectName: shiro
 * @Package: com.bie.controller
 * @ClassName: UserController
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 16:36
 * @Version: 1.0
 */
@Controller
// @RequestMapping(value = "/user")
public class UserController {

    @RequestMapping(value = "/subLogin", method = RequestMethod.POST)
    @ResponseBody
    public String subLogin(@RequestParam(value = "username") String username,
                           @RequestParam(value = "password") String password) {
        // 获取到主体信息
        Subject subject = SecurityUtils.getSubject();
        // 创建一个token
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        // 主体登陆验证
        try {
            subject.login(token);
        } catch (AuthenticationException e) {
            e.printStackTrace();
        }
        return "login success!";
    }

}

项目结构，如下所示：

项目测试，如下所示：

 

---

2020-08-08  14:29:48

1、Shiro集成Spring从数据库获取数据，首先需要引入mysql的jar包，如下所示：

<!-- 引入mysql的jar包 -->
<dependency>
    <groupId>mysql</groupId>
    <artifactId>mysql-connector-java</artifactId>
    <version>5.1.46</version>
</dependency>

<!-- 引入druid数据源管理 -->
<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>druid</artifactId>
    <version>1.1.18</version>
</dependency>

<!-- 引入spring-jdbc -->
<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-jdbc</artifactId>
    <version>4.3.12.RELEASE</version>
</dependency>

新建一个spring-dao.xml用来管理数据源信息，如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd">

    <!-- 配置连接数据库的账号密码，数据库 -->
    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource">
        <property name="url" value="jdbc:mysql://127.0.0.1:3306/test"></property>
        <property name="username" value="root"></property>
        <property name="password" value="123456"></property>
    </bean>

    <!-- 使用spring的jdbcTemplate进行管理 -->
    <bean class="org.springframework.jdbc.core.JdbcTemplate" id="jdbcTemplate">
        <property name="dataSource" ref="dataSource"></property>
    </bean>
</beans>

在spring.xml配置文件中引入spring-dao.xml配置文件，配置扫描的路径，如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <!-- 将新建的spring-dao.xml引入进来 -->
    <import resource="spring-dao.xml"></import>

    <!-- 配置扫描的路径 -->
    <context:component-scan base-package="com.bie"></context:component-scan>

    <!-- 将ShiroFilterFactoryBean注入到spring容器中 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 配置SecurityManager对象 -->
        <property name="securityManager" ref="securityManager"></property>
        <!-- 设置登陆页的url -->
        <property name="loginUrl" value="login.html"></property>
        <!-- 未认证的界面 -->
        <property name="unauthorizedUrl" value="403.html"></property>
        <!-- 过滤器链 -->
        <!-- shiro给我们内置了很多Filter，这里设置过滤器链 -->
        <property name="filterChainDefinitions">
            <!-- authc经过认证之后才可以访问相应的路径、anon不需要任何验证就可以访问 -->
            <!-- 过滤器链是有顺序的，从上到下，需要认证的放到下面 -->
            <!-- 根路径下面的/subLogin也不需要进行认证 -->
            <!-- authc表示需要经过认证之后才可以访问相应数据，anon表示不需要认证，直接可以访问 -->
            <!-- 这个过滤器链是有顺序的，从上往下匹配，匹配到之后就直接返回了，所以匹配到login.jsp不需要认证，/*需要认证，所以放在下面 -->
            <value>
                /login.html=anon
                /subLogin=anon
                /*=authc
            </value>
        </property>
    </bean>

    <!-- 第一步，创建SecurityManager对象 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 将自定义的Realm设置到SecurityManager环境中 -->
        <!-- 主体提交请求之后就交给我们自定义Realm来认证和授权 -->
        <property name="realm" ref="customRealm"></property>
    </bean>

    <!-- 第二步，创建自定义Realm -->
    <bean id="customRealm" class="com.bie.realm.CustomRealm">
        <!-- 将加密的设置到自定义的Realm中 -->
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
    </bean>

    <!-- 第三步，加密管理器对象 -->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <!-- 设置加密的算法为md5 -->
        <property name="hashAlgorithmName" value="md5"></property>
        <!-- 设置加密次数 -->
        <property name="hashIterations" value="1"></property>
    </bean>

</beans>

创建用户实体类、角色实体类、权限实体类，如下所示：

package com.bie.po;

/**
 * @ProjectName: shiro
 * @Package: com.bie.po
 * @ClassName: User
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 16:40
 * @Version: 1.0
 */
public class User {

    private String username;
    private String password;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }

    @Override
    public String toString() {
        return "User{" +
                "username='" + username + '\'' +
                ", password='" + password + '\'' +
                '}';
    }
}

package com.bie.po;

/**
 * @ProjectName: shiro
 * @Package: com.bie.po
 * @ClassName: Roles
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 14:56
 * @Version: 1.0
 */
public class Roles {

    private String userName;
    private String roleName;

    public String getUserName() {
        return userName;
    }

    public void setUserName(String userName) {
        this.userName = userName;
    }

    public String getRoleName() {
        return roleName;
    }

    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }

    @Override
    public String toString() {
        return "Roles{" +
                "userName='" + userName + '\'' +
                ", roleName='" + roleName + '\'' +
                '}';
    }
}

package com.bie.po;

/**
 * @ProjectName: shiro
 * @Package: com.bie.po
 * @ClassName: Permissions
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 16:57
 * @Version: 1.0
 */
public class Permissions {

    private String roleName;
    private String permission;

    public String getRoleName() {
        return roleName;
    }

    public void setRoleName(String roleName) {
        this.roleName = roleName;
    }

    public String getPermission() {
        return permission;
    }

    public void setPermission(String permission) {
        this.permission = permission;
    }

    @Override
    public String toString() {
        return "Permissions{" +
                "roleName='" + roleName + '\'' +
                ", permission='" + permission + '\'' +
                '}';
    }
}

创建用户Dao层、角色Dao层、权限Dao层，如下所示：

package com.bie.dao;

import com.bie.po.User;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao
 * @ClassName: UserDao
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 14:38
 * @Version: 1.0
 */
public interface UserDao {

    User getUserByUserName(String username);
}

package com.bie.dao;

import java.util.List;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao
 * @ClassName: RolesDao
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 14:57
 * @Version: 1.0
 */
public interface RolesDao {

    List<String> queryRolesByUserName(String userName);
}

package com.bie.dao;

import java.util.List;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao
 * @ClassName: PermissionsDao
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 16:58
 * @Version: 1.0
 */
public interface PermissionsDao {

    List<String> getPermissionsByRoleName(String roleName);
}

创建用户Dao层实现类、角色Dao层实现类、权限Dao层实现类，如下所示：

package com.bie.dao.impl;

import com.bie.dao.UserDao;
import com.bie.po.User;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.stereotype.Component;
import org.springframework.util.CollectionUtils;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.List;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao.impl
 * @ClassName: UserDaoImpl
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 14:38
 * @Version: 1.0
 */
@Component
public class UserDaoImpl implements UserDao {

    // 注入spring的jdbcTemplate
    @Autowired
    private JdbcTemplate jdbcTemplate;

    @Override
    public User getUserByUserName(String username) {
        String sql = "select username,password from users where username = ? ";

        List<User> userList = jdbcTemplate.query(sql, new String[]{username}, new RowMapper<User>() {
            @Override
            public User mapRow(ResultSet resultSet, int i) throws SQLException {
                User user = new User();
                user.setUsername(resultSet.getString("username"));
                user.setPassword(resultSet.getString("password"));
                return user;
            }
        });
        // 判断集合是否为空，如果为空就返回空
        if (CollectionUtils.isEmpty(userList)) {
            return null;
        }
        // 返回查询到的第一条数据
        return userList.get(0);
    }

}

package com.bie.dao.impl;

import com.bie.dao.RolesDao;
import com.bie.po.Roles;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.stereotype.Component;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.List;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao.impl
 * @ClassName: RolesDaoImpl
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 14:57
 * @Version: 1.0
 */
@Component
public class RolesDaoImpl implements RolesDao {

    // 注入spring的jdbcTemplate
    @Autowired
    private JdbcTemplate jdbcTemplate;

    @Override
    public List<String> queryRolesByUserName(String userName) {
        String sql = "select role_name from user_roles where username = ? ";

        List<String> roleNameList = jdbcTemplate.query(sql, new String[]{userName}, new RowMapper<String>() {
            @Override
            public String mapRow(ResultSet resultSet, int i) throws SQLException {
                return resultSet.getString("role_name");
            }
        });
        return roleNameList;
    }

}

package com.bie.dao.impl;

import com.bie.dao.PermissionsDao;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.stereotype.Component;

import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.List;

/**
 * @ProjectName: shiro
 * @Package: com.bie.dao.impl
 * @ClassName: PermissionsDaoImpl
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/8 16:58
 * @Version: 1.0
 */
@Component
public class PermissionsDaoImpl implements PermissionsDao {

    @Autowired
    private JdbcTemplate jdbcTemplate;

    @Override
    public List<String> getPermissionsByRoleName(String roleName) {
        String sql = "select permission from roles_permissions where role_name = ? ";

        List<String> permissionsNameList = jdbcTemplate.query(sql, new String[]{roleName}, new RowMapper<String>() {
            @Override
            public String mapRow(ResultSet resultSet, int i) throws SQLException {
                return resultSet.getString("permission");
            }
        });
        return permissionsNameList;
    }

创建用户登陆的控制层，进行用户登陆，角色验证，权限验证，如下所示：

package com.bie.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

/**
 * @ProjectName: shiro
 * @Package: com.bie.controller
 * @ClassName: UserController
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 16:36
 * @Version: 1.0
 */
@Controller
// @RequestMapping(value = "/user")
public class UserController {

    @RequestMapping(value = "/subLogin", method = RequestMethod.POST,produces = "application/json;charset=utf-8")
    @ResponseBody
    public String subLogin(@RequestParam(value = "username") String username,
                           @RequestParam(value = "password") String password) {
        // 获取到主体信息
        Subject subject = SecurityUtils.getSubject();
        // 创建一个token
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        // 主体登陆验证
        try {
            subject.login(token);
        } catch (AuthenticationException e) {
            e.printStackTrace();
        }

        // 第四步，Realm验证
        boolean authenticated = subject.isAuthenticated();
        System.out.println("isAuthenticated是否进行了认证：" + authenticated);
        if (authenticated) {
            System.out.println("该账号通过了认证：" + authenticated);
            // 检查角色,检查管理员的角色,给用户admin配备角色admin
            subject.checkRole("admin");
            System.out.println("开始检查管理员admin！");
            if (subject.hasRole("admin")) {
                System.out.println(username + "拥有管理员admin角色！");
                // 检查权限,检查admin角色是否拥有用户删除的权限
                subject.checkPermission("admin:delete");
                System.out.println("检查管理员拥有用户删除admin:delete的权限！");

                subject.checkPermission("admin:update");
                subject.checkPermission("admin:select");
                subject.checkPermission("admin:insert");
                System.out.println("检查管理员拥有用户删除admin:delete,admin:update,admin:select,admin:insert的权限！");
            }
            if (subject.hasRole("user")) {
                System.out.println(username + "拥有普通账号user角色！");
                // 检查权限,检查admin角色是否拥有用户删除的权限
                subject.checkPermission("user:delete");
                System.out.println("检查普通账号拥有用户删除user:delete的权限！");

                subject.checkPermission("user:update");
                subject.checkPermission("user:select");
                subject.checkPermission("user:insert");
                System.out.println("检查普通账号拥有用户删除user:delete,user:update,user:select,user:insert的权限！");
            }
            return "该账号通过认证具备该角色且具备此权限";
        }
        return "login fail!";
    }

}

自定义Realm，如下所示：

package com.bie.realm;

import com.alibaba.druid.util.StringUtils;
import com.bie.dao.PermissionsDao;
import com.bie.dao.RolesDao;
import com.bie.dao.UserDao;
import com.bie.po.User;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Set;

/**
 * 自定义Realm
 *
 * @ProjectName: shiro
 * @Package: com.bie.shiro
 * @ClassName: CustomRealm
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 14:58
 * @Version: 1.0
 */
public class CustomRealm extends AuthorizingRealm {

    // 将userDao注入进来
    @Autowired
    private UserDao userDao;

    @Autowired
    private RolesDao rolesDao;

    @Autowired
    private PermissionsDao permissionsDao;

    /**
     * 授权使用
     *
     * @param principals
     * @return
     */
    public AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 1、第一步，从认证信息中获取到用户信息。
        String userName = (String) principals.getPrimaryPrincipal();
        // 2、第二步，从数据库中或者缓存中通过用户姓名获取到角色信息
        Set<String> roles = getRolesByUserName(userName);
        // 3、第三步，从数据库中或者缓存中通过用户姓名获取到权限信息
        Set<String> permissions = getPermissionsByRoleName(roles);
        // 4、第四步，将获取到角色信息和权限信息返回
        SimpleAuthorizationInfo simpleAuthorizationInfo = new SimpleAuthorizationInfo();
        // 设置权限
        simpleAuthorizationInfo.setStringPermissions(permissions);
        // 设置角色
        simpleAuthorizationInfo.setRoles(roles);
        return simpleAuthorizationInfo;
    }

    /**
     * 通过用户名获取到权限信息
     *
     * @param roles
     * @return
     */
    public Set<String> getPermissionsByRoleName(Set<String> roles) {
        Set<String> sets = new HashSet<String>();
        Iterator<String> iterator = roles.iterator();
        while (iterator.hasNext()) {
            String roleName = iterator.next();
            List<String> list = permissionsDao.getPermissionsByRoleName(roleName);
            sets.addAll(list);
        }
        return sets;
    }

    /**
     * 模拟通过用户姓名获取到角色信息
     *
     * @param userName
     * @return
     */
    public Set<String> getRolesByUserName(String userName) {
        List<String> list = rolesDao.queryRolesByUserName(userName);
        Set<String> sets = new HashSet<String>(list);
        return sets;
    }

    /**
     * 认证使用
     *
     * @param token 主体传过来的认证信息
     * @return
     * @throws AuthenticationException
     */
    public AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        // 1、第一步，通过主体传过来的认证信息获取用户名
        String username = (String) token.getPrincipal();
        // 2、通过用户名到数据库中获取凭证
        // 如果使用了shiro的HashedCredentialsMatcher加密，那么这里保存的是加密后的密文
        String password = getPasswordByUserName(username);
        // 判断获取到的密码是否存在，不存在直接返回null
        if (StringUtils.isEmpty(password)) {
            return null;
        }
        // 如果对象存在
        SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(username, password, "customRealm");

        // 如果加了盐salt,认证返回的时候需要见盐salt设置进去的
        authenticationInfo.setCredentialsSalt(ByteSource.Util.bytes("654321"));
        // 将加了盐的认证用户返回
        return authenticationInfo;
    }

    /**
     * 通过用户姓名获取到用户的密码
     *
     * @param username
     * @return
     */
    public String getPasswordByUserName(String username) {
        // 正常情况下，需要读取数据库，这里进行模拟
        User user = this.userDao.getUserByUserName(username);
        return user != null ? user.getPassword() : null;
    }

    public static void main(String[] args) {
        // 加盐salt让密码更加难以识破
        Md5Hash md5Hash = new Md5Hash("123456", "654321");
        System.out.println(md5Hash);
    }

}

项目结构，如下所示：

数据库测试数据，如下所示：

如果想要基于注解开发shiro和spring的整合，加上这个依赖，如下所示：

<!-- 基于注解开发shiro和spring整合 -->
<dependency>
    <groupId>org.aspectj</groupId>
    <artifactId>aspectjweaver</artifactId>
    <version>1.8.9</version>
</dependency>

在spring-mvc.xml配置文件加上此配置，如下所示：

 <!-- 开启aop -->
<aop:config proxy-target-class="true"></aop:config>

在spring.xml配置文件加上此配置，如下所示：

<!-- 注入securityManager -->
    <bean id="attributeSourceAdvisor"
          class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <!-- 将securityManager注入 -->
        <property name="securityManager" ref="securityManager"></property>
    </bean>

    <!-- 注入bean对象lifecycleBeanPostProcessor -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

在控制层可以加上注解进行测试，如下所示：

@RequiresPermissions({"admin:select","admin:insert","admin:delete","admin:update"})
    @RequiresRoles(value = "admin")
    @RequestMapping(value = "getRole",method = RequestMethod.GET)
    @ResponseBody
    public String getRoles(){
        return "getRoles success!!!";
    }

5、Shiro内置过滤器，和认证相关的过滤器。

　　1）、anon：不需要任何认证就可以进行访问。
　　2）、authBasic：就是http authBasic。
　　3）、authc：需要认证才可以进行访问。
　　4）、user：需要当前存在用户才可以进行访问。
　　5）、loout：退出。

6、Shiro内置过滤器，和授权相关的过滤器。

　　1）、perms：需要具备相关的权限才可以访问。
　　2）、roles：和perms类似。
　　3）、ssl：安全的协议。
　　4）、port：要求指定的端口号。 

package com.bie.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;

/**
 * @ProjectName: shiro
 * @Package: com.bie.controller
 * @ClassName: UserController
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/6 16:36
 * @Version: 1.0
 */
@Controller
// @RequestMapping(value = "/user")
public class UserController {

    @RequestMapping(value = "/subLogin", method = RequestMethod.POST, produces = "application/json;charset=utf-8")
    @ResponseBody
    public String subLogin(@RequestParam(value = "username") String username,
                           @RequestParam(value = "password") String password) {
        // 获取到主体信息
        Subject subject = SecurityUtils.getSubject();
        // 创建一个token
        UsernamePasswordToken token = new UsernamePasswordToken(username, password);
        // 主体登陆验证
        try {
            subject.login(token);
        } catch (AuthenticationException e) {
            e.printStackTrace();
        }

        // 第四步，Realm验证
        boolean authenticated = subject.isAuthenticated();
        System.out.println("isAuthenticated是否进行了认证：" + authenticated);
        if (authenticated) {
            System.out.println("该账号通过了认证：" + authenticated);
            // 检查角色,检查管理员的角色,给用户admin配备角色admin
            subject.checkRole("admin");
            System.out.println("开始检查管理员admin！");
            if (subject.hasRole("admin")) {
                System.out.println(username + "拥有管理员admin角色！");
                // 检查权限,检查admin角色是否拥有用户删除的权限
                subject.checkPermission("admin:delete");
                System.out.println("检查管理员拥有用户删除admin:delete的权限！");

                subject.checkPermission("admin:update");
                subject.checkPermission("admin:select");
                subject.checkPermission("admin:insert");
                System.out.println("检查管理员拥有用户删除admin:delete,admin:update,admin:select,admin:insert的权限！");
            }
            if (subject.hasRole("user")) {
                System.out.println(username + "拥有普通账号user角色！");
                // 检查权限,检查admin角色是否拥有用户删除的权限
                subject.checkPermission("user:delete");
                System.out.println("检查普通账号拥有用户删除user:delete的权限！");

                subject.checkPermission("user:update");
                subject.checkPermission("user:select");
                subject.checkPermission("user:insert");
                System.out.println("检查普通账号拥有用户删除user:delete,user:update,user:select,user:insert的权限！");
            }
            return "该账号通过认证具备该角色且具备此权限";
        }
        return "login fail!";
    }

//    @RequiresPermissions({"admin:select", "admin:insert", "admin:delete", "admin:update"})
//    @RequiresRoles(value = "admin")
//    @RequestMapping(value = "getRole", method = RequestMethod.GET)
//    @ResponseBody
//    public String getRoles() {
//        return "getRoles success!!!";
//    }


    @RequestMapping(value = "getRole", method = RequestMethod.GET)
    @ResponseBody
    public String getRole() {
        return "getRole success!!!";
    }

    @RequestMapping(value = "getRole1", method = RequestMethod.GET)
    @ResponseBody
    public String getRole1() {
        return "getRole1 success!!!";
    }


    @RequestMapping(value = "getPerms", method = RequestMethod.GET)
    @ResponseBody
    public String getPerms() {
        return "getPerms success!!!";
    }


    @RequestMapping(value = "getPerms1", method = RequestMethod.GET)
    @ResponseBody
    public String getPerms1() {
        return "getPerms1 success!!!";
    }


}

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd">

    <!-- 将新建的spring-dao.xml引入进来 -->
    <import resource="spring-dao.xml"></import>

    <!-- 配置扫描的路径 -->
    <context:component-scan base-package="com.bie"></context:component-scan>

    <!-- 将ShiroFilterFactoryBean注入到spring容器中 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 配置SecurityManager对象 -->
        <property name="securityManager" ref="securityManager"></property>
        <!-- 设置登陆页的url -->
        <property name="loginUrl" value="login.html"></property>
        <!-- 未认证的界面 -->
        <property name="unauthorizedUrl" value="403.html"></property>
        <!-- 过滤器链 -->
        <!-- shiro给我们内置了很多Filter，这里设置过滤器链 -->
        <property name="filterChainDefinitions">
            <!-- authc经过认证之后才可以访问相应的路径、anon不需要任何验证就可以访问 -->
            <!-- 过滤器链是有顺序的，从上到下，需要认证的放到下面 -->
            <!-- 根路径下面的/subLogin也不需要进行认证 -->
            <!-- authc表示需要经过认证之后才可以访问相应数据，anon表示不需要认证，直接可以访问 -->
            <!-- 这个过滤器链是有顺序的，从上往下匹配，匹配到之后就直接返回了，所以匹配到login.jsp不需要认证，/*需要认证，所以放在下面 -->
            <value>
                /login.html = anon
                /subLogin = anon
                /getRole = roles["admin"]
                /getRole1 = roles["admin","user"]
                /getPerms = perms["admin:delete"]
                /getPerms1 = perms["admin:select", "admin:insert", "admin:delete", "admin:update"]
                /* = authc
            </value>
        </property>
    </bean>

    <!-- 第一步，创建SecurityManager对象 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 将自定义的Realm设置到SecurityManager环境中 -->
        <!-- 主体提交请求之后就交给我们自定义Realm来认证和授权 -->
        <property name="realm" ref="customRealm"></property>
    </bean>

    <!-- 第二步，创建自定义Realm -->
    <bean id="customRealm" class="com.bie.realm.CustomRealm">
        <!-- 将加密的设置到自定义的Realm中 -->
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
    </bean>

    <!-- 第三步，加密管理器对象 -->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <!-- 设置加密的算法为md5 -->
        <property name="hashAlgorithmName" value="md5"></property>
        <!-- 设置加密次数 -->
        <property name="hashIterations" value="1"></property>
    </bean>

    <!-- 注入securityManager -->
    <bean id="attributeSourceAdvisor"
          class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <!-- 将securityManager注入 -->
        <property name="securityManager" ref="securityManager"></property>
    </bean>

    <!-- 注入bean对象lifecycleBeanPostProcessor -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

</beans>

7、Shiro自定义过滤器。

package com.bie.filter;

import org.apache.shiro.subject.Subject;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;

import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;

/**
 * 满足任何一个角色就可以进行操作
 * <p>
 * AuthorizationFilter:此类是和授权相关的过滤器Filter
 * <p>
 * AuthenticatingFilter:此类是和认证相关的过滤器Filter
 *
 * @ProjectName: shiro
 * @Package: com.bie.filter
 * @ClassName: ShiroRolesFilter
 * @Author: biehl
 * @Description: ${description}
 * @Date: 2020/8/11 16:23
 * @Version: 1.0
 */
public class ShiroRolesFilter extends AuthorizationFilter {

    /**
     * @param request
     * @param response
     * @param mappedValue
     * @return
     */
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
        // 获取到相应的主体subject
        Subject subject = getSubject(request, response);
        // 获取到角色数据
        String[] roles = (String[]) mappedValue;
        // 判断如果数组为空，说明可以直接访问，不需要任何角色
        if (roles == null || roles.length == 0) {
            return true;
        }
        // 如果不为空，就开始进行遍历
        for (String role : roles) {
            // 如果包含当前的角色
            if (subject.hasRole(role)) {
                // 直接返回为true
                return true;
            }
        }
        return false;
    }

}

自定义过滤器，需要进行配置才可以生效的，如下所示：

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xsi:schemaLocation="http://www.springframework.org/schema/beans
       http://www.springframework.org/schema/beans/spring-beans.xsd
       http://www.springframework.org/schema/context
       http://www.springframework.org/schema/context/spring-context.xsd
       http://www.springframework.org/schema/util
       http://www.springframework.org/schema/util/spring-util.xsd">

    <!-- 将新建的spring-dao.xml引入进来 -->
    <import resource="spring-dao.xml"></import>

    <!-- 配置扫描的路径 -->
    <context:component-scan base-package="com.bie"></context:component-scan>

    <!-- 将ShiroFilterFactoryBean注入到spring容器中 -->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <!-- 配置SecurityManager对象 -->
        <property name="securityManager" ref="securityManager"></property>
        <!-- 设置登陆页的url -->
        <property name="loginUrl" value="login.html"></property>
        <!-- 未认证的界面 -->
        <property name="unauthorizedUrl" value="403.html"></property>
        <!-- 过滤器链 -->
        <!-- shiro给我们内置了很多Filter，这里设置过滤器链 -->
        <property name="filterChainDefinitions">
            <!-- authc经过认证之后才可以访问相应的路径、anon不需要任何验证就可以访问 -->
            <!-- 过滤器链是有顺序的，从上到下，需要认证的放到下面 -->
            <!-- 根路径下面的/subLogin也不需要进行认证 -->
            <!-- authc表示需要经过认证之后才可以访问相应数据，anon表示不需要认证，直接可以访问 -->
            <!-- 这个过滤器链是有顺序的，从上往下匹配，匹配到之后就直接返回了，所以匹配到login.jsp不需要认证，/*需要认证，所以放在下面 -->
            <value>
                /login.html = anon
                /subLogin = anon
                /getRole = rolesOr["admin","user"]
                /getRole1 = roles["admin","user"]
                /* = authc
            </value>
        </property>
        <!-- 引入自定义的授权过滤器 -->
        <!--<property name="filters">
            <map>
                <entry key="rolesOr" value="rolesOrFilter"></entry>
            </map>
        </property>-->
        <property name="filters">
50             <util:map>
51                 <entry key="rolesOr" value-ref="rolesOrFilter"></entry>
52             </util:map>
53         </property>
    </bean>


    <!-- 创建自定义filter -->
58     <bean  id="rolesOrFilter" class="com.bie.filter.ShiroRolesFilter"></bean>


    <!-- 第一步，创建SecurityManager对象 -->
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!-- 将自定义的Realm设置到SecurityManager环境中 -->
        <!-- 主体提交请求之后就交给我们自定义Realm来认证和授权 -->
        <property name="realm" ref="customRealm"></property>
    </bean>

    <!-- 第二步，创建自定义Realm -->
    <bean id="customRealm" class="com.bie.realm.CustomRealm">
        <!-- 将加密的设置到自定义的Realm中 -->
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
    </bean>

    <!-- 第三步，加密管理器对象 -->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <!-- 设置加密的算法为md5 -->
        <property name="hashAlgorithmName" value="md5"></property>
        <!-- 设置加密次数 -->
        <property name="hashIterations" value="1"></property>
    </bean>

    <!-- 注入securityManager -->
    <bean id="attributeSourceAdvisor"
          class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">
        <!-- 将securityManager注入 -->
        <property name="securityManager" ref="securityManager"></property>
    </bean>

    <!-- 注入bean对象lifecycleBeanPostProcessor -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor"></bean>

</beans>