springmvc+spring+mybatis+shrio+mysql

shrio的作用已经不用说了，就直接说用吧，当然我们的系统要求没有很高，所以我也学习的比较简单。
第一步：jar

<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-core</artifactId>  
    <version>1.2.2</version>  
</dependency>  

<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-web</artifactId>  
    <version>1.2.2</version>  
</dependency>  

<dependency>  
    <groupId>org.apache.shiro</groupId>  
    <artifactId>shiro-spring</artifactId>  
    <version>1.2.2</version>  
</dependency> 

第二步：配置web.xml

<context-param>
        <param-name>contextConfigLocation</param-name>
        <！--加载springmvc和spring配置文件的位置，添加sprin-          shiro.xml--!>
        <param-value>classpath:spring/applicationContext-*.xml,classpath:spring/spring-shiro.xml</param-value>
</context-param>
<filter>
        <filter-name>shiroFilter</filter-name>
        <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
        <init-param>
            <param-name>targetFilterLifecycle</param-name>
            <param-value>true</param-value>
        </init-param>
</filter>
<filter-mapping>
        <filter-name>shiroFilter</filter-name>
        <url-pattern>/*</url-pattern>
</filter-mapping>

第三步：
spring-shrio.xml配置文件：

<?xml version="1.0" encoding="UTF-8"?>  
<beans xmlns="http://www.springframework.org/schema/beans"  
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"  
    xsi:schemaLocation="http://www.springframework.org/schema/beans   
                        http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"  
    default-lazy-init="true">  

    <description>Shiro Configuration</description>
        <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!--设置自定义realm -->
        <property name="realms" ref="monitorRealm" />
          <!-- 缓存管理器 -->  
        <property name="cacheManager" ref="cacheManager"/> 
    </bean>
      <!-- 会话管理器 -->
    <bean id="sessionManager" class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
        <!-- 设置超时时间 -->
        <property name="globalSessionTimeout" value="18000"/>
        <property name="deleteInvalidSessions" value="true"/>
        <property name="sessionValidationSchedulerEnabled" value="true"/>
        <property name="sessionValidationScheduler" ref="sessionValidationScheduler"/>
        <property name="sessionDAO" ref="sessionDAO"/>
        <property name="sessionIdCookieEnabled" value="true"/>
        <property name="sessionIdCookie" ref="sessionIdCookie"/>
    </bean>
    <!--自定义Realm 继承自AuthorizingRealm -->
    <bean id="monitorRealm" class="com.yzb.loanplatform.manager.util.shrio.ShrioRealm">
      <property name="credentialsMatcher">
           <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
               <property name="hashAlgorithmName" value="MD5"/>
               <!--true means hex encoded, false means base64 encoded -->
               <property name="storedCredentialsHexEncoded" value="true"/>
               <!-- 迭代次数 -->
               <property name="hashIterations" value="1024" />
           </bean>
       </property>   
    </bean>

    <!-- Shiro主过滤器本身功能十分强大,其强大之处就在于它支持任何基于URL路径表达式的、自定义的过滤器的执行 --> 
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
       <property name="securityManager" ref="securityManager" />
        <!-- 要求登录时的链接,非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->  
        <property name="loginUrl" value="/login" />
        <!-- 用户访问未对其授权的资源时,所显示的连接 -->
        <!-- <property name="unauthorizedUrl" value="/error/noperms.jsp" /> -->
        <property name="filterChainDefinitions">
            <value>
                <!-- 
                    Anon：不指定过滤器
                    Authc:验证，这些页面必须验证后才能访问，也就是我们说的登录后才能访问。
                -->
                /login.ftl = anon
                /system/**= authc
                /orderInfo/findOrderInfo= authc
                /orderInfo/ucfRefundCallback= anon
                /static/**=anon
            </value>
        </property>
    </bean>

  <!-- 
    用户授权信息Cache   -->
    <bean id="cacheManager" class="org.apache.shiro.cache.MemoryConstrainedCacheManager" />  

    <!-- 保证实现了Shiro内部lifecycle函数的bean执行   -->
    <bean id="lifecycleBeanPostProcessor" class="org.apache.shiro.spring.LifecycleBeanPostProcessor" />  

   <!--  AOP式方法级权限检查   -->
  <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator"  
        depends-on="lifecycleBeanPostProcessor">  
        <property name="proxyTargetClass" value="true" />  
    </bean>

    <bean class="org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor">  
        <property name="securityManager" ref="securityManager" />  
    </bean>

</beans>  

第四步：springmvc中配置：其作用是在conroller中使用注解方法实现权限拦截

<!-- 为使用AOP注解方式控制权限 -->
    <bean class="org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator" depends-on="lifecycleBeanPostProcessor">
        <property name="proxyTargetClass" value="true" />
    </bean>

以上配置就是所有配置，现在仔细说下spring-shrio.xml中的几个重点：
1，自定义的realm：shrio中核心，有SecurityManager管理，

<bean id="securityManager"class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <!--设置自定义realm -->
        <property name="realms" ref="monitorRealm" />
</bean>

<!--自定义Realm 继承自AuthorizingRealm -->
<bean id="monitorRealm" class="**com.yzb.loanplatform.manager.util.shrio.ShrioRealm**">
      <property name="credentialsMatcher">
           <bean class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
               <!-- 密码加密方式 -->
               <property name="hashAlgorithmName" value="MD5"/>
               <property name="storedCredentialsHexEncoded" value="true"/>
               <!-- 次数加密次数 -->
               <property name="hashIterations" value="1024" />
           </bean>
       </property>   
</bean>

重点来了，ShrioRealm.java用来实现登陆身份验证和首选操作；

package com.yzb.loanplatform.manager.util.shrio;

import java.util.ArrayList;
import java.util.List;

import org.apache.commons.lang3.StringUtils;
import org.apache.log4j.Logger;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.LockedAccountException;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationException;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.util.ByteSource;
import org.springframework.beans.factory.annotation.Autowired;

import com.yzb.loanplatform.pojo.Employee;
import com.yzb.loanplatform.pojo.Permission;
import com.yzb.loanplatform.pojo.Role;
import com.yzb.loanplatform.service.EmployeeService;
import com.yzb.loanplatform.vo.EmployeeVo;

/**
 * @ClassName: ShrioRealm
 * @Description: TODO(这里用一句话描述这个类的作用)
 * @author zhaofq
 * @date 2017年8月10日
 */
public class ShrioRealm extends AuthorizingRealm {

    private static Logger loger = Logger.getLogger(ShrioRealm.class.getName());
    @Autowired
    private EmployeeService employeeService;

    /**
     * 授权操作
     */
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
        // 获取当前登录的用户名,等价于(String)principals.fromRealm(this.getName()).iterator().next()
        String account = (String) super.getAvailablePrincipal(principals);
        EmployeeVo employeeVo = new EmployeeVo();
        employeeVo.setPhone(account);
        List<String> roles = new ArrayList<String>();
        List<String> permissions = new ArrayList<String>();
        // //从数据库中获取当前登录用户的详细信息
        Employee employee = employeeService.getEmployeeRoleAanPermissions(employeeVo);
        if (employee != null) {
            // 实体类User中包含有用户角色的实体类信息
            if (employee.getRoleList() != null && employee.getRoleList().size() > 0) {
                // 获取当前登录用户的角色
                for (Role role : employee.getRoleList()) {
                    roles.add(role.getRoleCode());
                    // 实体类Role中包含有角色权限的实体类信息
                    if (role.getPermissionList() != null && role.getPermissionList().size() > 0) {
                        // 获取权限
                        for (Permission pmss : role.getPermissionList()) {
                            if (!StringUtils.isEmpty(pmss.getUrl())) {
                                permissions.add(pmss.getUrl());
                            }
                        }
                    }
                }
            }
        } else {
            throw new AuthorizationException();
        }
        // 为当前用户设置角色和权限
        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        info.addRoles(roles);
        info.addStringPermissions(permissions);
        return info;
    }

    /**
     * 身份验证操作
     */
    @SuppressWarnings("unused")
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken)
            throws AuthenticationException {
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;
        String userName = String.valueOf(token.getPrincipal()); // 得到身份（用户名）
        String passWord = new String((char[]) token.getCredentials()); // 得到认证/凭证（密码）
        // 从数据库中查询用户用信息
        EmployeeVo employeeVo = new EmployeeVo();
        employeeVo.setPhone(userName);
        Employee employee = employeeService.getEmployee(employeeVo);
        Employee employee2 = employeeService.getEmployeeRoleAanPermissions(employeeVo);

        if (employee != null) {
            if ("1".endsWith(employee.getStatus().toString())) { // 判断帐号是否锁定
                throw new LockedAccountException();// 抛出 帐号锁定异常
            }
            // 此处无需比对,比对的逻辑Shiro会做,我们只需返回一个和令牌相关的正确的验证信息
            byte[] myByte = employee.getSalt().getBytes();
            SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(employee.getPhone(),
                    employee.getEmpPassword(), ByteSource.Util.bytes(myByte), this.getName());
            // simpleAuthenticationInfo.setCredentialsSalt(salt);

            return simpleAuthenticationInfo;
        } else {
            // 没有返回登录用户名对应的SimpleAuthenticationInfo对象时,就会在LoginController中抛出UnknownAccountException异常
            return null;
        }
    }

    @Override
    public void clearCachedAuthorizationInfo(PrincipalCollection principals) {
        super.clearCachedAuthorizationInfo(principals);
    }

    @Override
    public void clearCachedAuthenticationInfo(PrincipalCollection principals) {
        super.clearCachedAuthenticationInfo(principals);
    }

    @Override
    public void clearCache(PrincipalCollection principals) {
        super.clearCache(principals);
    }

    public void clearAllCachedAuthorizationInfo() {
        getAuthorizationCache().clear();
    }

    public void clearAllCachedAuthenticationInfo() {
        getAuthenticationCache().clear();
    }

    public void clearAllCache() {
        clearAllCachedAuthenticationInfo();
        clearAllCachedAuthorizationInfo();
    }
}

有两个重要的方法：
1，doGetAuthenticationInfo：用来做身份认证，当用户输入用户名密码后在登陆的controller中通过：

UsernamePasswordToken token = new UsernamePasswordToken(username,password);
            Subject currentUser = SecurityUtils.getSubject();  
            token.setRememberMe(true);  
            currentUser.login(token);

实现对doGetAuthenticationInfo的调用，具体作用就是把页面发送过来的用户名和密码传入到doGetAuthenticationInfo方法中，
使用用户名去重是否有对应的用户，如果找到就调用shrio内部的密码校验方法，

// 此处无需比对,比对的逻辑Shiro会做,我们只需返回一个和令牌相关的正确的验证信息
            byte[] myByte = employee.getSalt().getBytes();
            SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(employee.getPhone(),
                    employee.getEmpPassword(), ByteSource.Util.bytes(myByte), this.getName());
            // simpleAuthenticationInfo.setCredentialsSalt(salt);

            return simpleAuthenticationInfo;

这里你只需要把你你查询数据获取到的用户名，密码，言放到SimpleAuthenticationInfo就可以了，可以看看看看源码是怎么实现的校验的，不再多说，
根据返回校验结果就会提示是否校验通过。
2，授权方法：doGetAuthorizationInfo：就是查看操作用户拥有的资源权限，
主要是根据用户名获取对应角色，权限的资源。
次方法调用时在controller总通过注解的方式：
@RequiresRoles(logical=Logical.OR,value={“admin”,”adminEmp”})
页面时通过shrio标签。

<shiro:hasAnyRoles name="admin,adminEmp" ><li><a href="${request.contextPath}/employee/employeePage">员工管理</a></li></shiro:hasAnyRoles>

当然我这里是把菜单写死了，所以不能控制菜单是否显示，而是在操作时提示没有权限，
原理大概是党操作菜单之后就会通过@RequiresRoles查看当强用户是否用户此角色，角色是否用户权限。
当也有直接控制按钮的方式我就不在说了，

public class BaseController {
    /**
     * 登录认证异常
     */
    @ExceptionHandler({ UnauthenticatedException.class, AuthenticationException.class })
    public String authenticationException(HttpServletRequest request, HttpServletResponse response) {
        if (WebUtilsPro.isAjaxRequest(request)) {
            // 输出JSON
            Map<String,Object> map = new HashMap<>();
            map.put("code", "-999");
            map.put("message", "未登录");
            return null;
        } else {
            return "redirect:/system/login";
        }
    }

    /**
     * 权限异常
     */
    @ExceptionHandler({ UnauthorizedException.class, AuthorizationException.class,ServletException.class })
    public String authorizationException(HttpServletRequest request, HttpServletResponse response) {
        DataResponse data = new DataResponse();
            // 输出JSON
            Map<String,Object> map = new HashMap<>();
            map.put("code", "-999");
            map.put("msg", "无权限");
            data.setCode(200);
            data.setData(map);
            return "/notPermission";
    }

}

登陆异常和无权限时提示，让每个使用权限的controller继承此controler就可以了，
最后角色权限表：

DROP TABLE IF EXISTS `MTB_ROLE`;
CREATE TABLE `MTB_ROLE` (
  `Id` int(11) NOT NULL AUTO_INCREMENT,
  `name` varchar(10) DEFAULT NULL,
  `description` varchar(50) DEFAULT NULL,
  `roleCode` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`Id`)
) ENGINE=InnoDB AUTO_INCREMENT=6 DEFAULT CHARSET=utf8mb4;

DROP TABLE IF EXISTS `MTB_PERMISSION`;
CREATE TABLE `MTB_PERMISSION` (
  `Id` int(11) NOT NULL AUTO_INCREMENT,
  `name` varchar(50) DEFAULT NULL,
  `description` varchar(200) DEFAULT NULL,
  `url` varchar(255) DEFAULT NULL,
  PRIMARY KEY (`Id`)
) ENGINE=InnoDB AUTO_INCREMENT=12 DEFAULT CHARSET=utf8mb4;

DROP TABLE IF EXISTS `MTB_ROLE_PERMISSION`;
CREATE TABLE `MTB_ROLE_PERMISSION` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `role_Id` int(36) DEFAULT NULL,
  `permission_Id` int(36) DEFAULT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=100 DEFAULT CHARSET=utf8mb4;

DROP TABLE IF EXISTS `MTB_EMPLOYEE_ROLE`;
CREATE TABLE `MTB_EMPLOYEE_ROLE` (
  `Id` int(11) NOT NULL AUTO_INCREMENT,
  `employee_Id` int(36) DEFAULT NULL,
  `role_Id` int(36) DEFAULT NULL,
  PRIMARY KEY (`Id`)
) ENGINE=InnoDB AUTO_INCREMENT=29 DEFAULT CHARSET=utf8mb4;

还有一个就是员工表了，就
补充1： 登陆之后显示用户名字，在页面用<@shiro.principal/>就可以获得当强登陆用户名，当然也可以用${username}单这个是用了controller返回的对象的mv.addObject(“username”, username);推荐用<@shiro.principal/>