Shiro 快速指南

/* 收集实体+凭据 */
//Example using most common scenario of username/password pair:  
UsernamePasswordToken token = new UsernamePasswordToken(username, password);  
//”Remember Me” built-in:  
token.setRememberMe(true);  
/* 提交实体+凭据 */
Subject currentUser = SecurityUtils.getSubject();  
currentUser.login(token); 
/* 认证处理 */
try {  
    currentUser.login(token);  
} catch ( UnknownAccountException uae ) { ...  
} catch ( IncorrectCredentialsException ice ) { ...  
} catch ( LockedAccountException lae ) { ...  
} catch ( ExcessiveAttemptsException eae ) { ...  
} ... catch your own ...  
} catch ( AuthenticationException ae ) {  
    //unexpected error?  
}  

currentUser.logout(); //removes all identifying information and invalidates their session too.  

/* 编程方式 */
/* 对象 */
Permission printPermission = new PrinterPermission("laserjet4400n", "print");  
Subject currentUser = SecurityUtils.getSubject();  
if (currentUser.isPermitted(printPermission)) {  
    //show the Print button  
} else {  
    //don't show the button?  Grey it out?  
}  
/* 字符串 */
Subject currentUser = SecurityUtils.getSubject();  
if (currentUser.isPermitted("printer:print:laserjet4400n")) {  
    //show the Print button  
} else {  
    //don't show the button?  Grey it out?  
}  
/* 断言：对象 */
Subject currentUser = SecurityUtils.getSubject();  
//guarantee that the current user is permitted  
//to open a bank account:  
Permission p = new AccountPermission("open");  
currentUser.checkPermission(p);  
openBankAccount();  
/* 断言：字符串 */
Subject currentUser = SecurityUtils.getSubject();  
//guarantee that the current user is permitted  
//to open a bank account:  
currentUser.checkPermission("account:open");  
openBankAccount();  

/* 注解方式 */
@RequiresAuthentication  
public void updateAccount(Account userAccount) {  
    //this method will only be invoked by a   
    //Subject that is guaranteed authenticated  
    ...  
}  
@RequiresPermissions("account:create")  
public void createAccount(Account account) {  
    //this method will only be invoked by a Subject  
    //that is permitted to create an account  
    ...  
}  

protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {  
        UsernamePasswordToken token = (UsernamePasswordToken) authcToken;  
        User user = accountManager.findUserByUserName(token.getUsername());  
        if (user != null) {  
            return new SimpleAuthenticationInfo(user.getUserName(), user.getPassword(), getName());  
        } else {  
            return null;  
        }  
}

protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {  
        String userName = (String) principals.fromRealm(getName()).iterator().next();  
        User user = accountManager.findUserByUserName(userName);  
        if (user != null) {  
            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();  
            for (Group group : user.getGroupList()) {  
                info.addStringPermissions(group.getPermissionList());  
            }  
            return info;  
        } else {  
            return null;  
        }  
}  

<bean id="securityManager" class="org.apache.shiro.mgt.DefaultSecurityManager">  
        <property name="cacheManager" ref="cacheManager"/>  
        <property name="sessionMode" value="native"/>  
        <!-- Single realm app.  If you have multiple realms, use the 'realms' property instead. -->  
        <property name="realm" ref="myRealm"/>  
        <property name="sessionManager" ref="sessionManager"/>   
</bean>  

<bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">  
    <property name="securityManager" ref="securityManager"/>  
    <property name="loginUrl" value="/login.jsp"/>  
    <property name="successUrl" value="/home.jsp"/>  
    <property name="unauthorizedUrl" value="/unauthorized.jsp"/> -->  
    <property name="filterChainDefinitions">  
        <value>  
            /admin/** = authc, roles[admin]  
            /docs/** = authc, perms[document:read]  
            /** = authc  
        </value>  
    </property>  
</bean>