<!-- Shiro -->
<dependency>
 <groupId>org.apache.shiro</groupId>
 <artifactId>shiro-spring</artifactId>
 <version>1.4.0</version>
</dependency>

import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;


/**
 * 自定義Realm
 */
public class UserRealm extends AuthorizingRealm {

 @Autowired(required = false)
 private UserService userService;

 private final Logger logger = LoggerFactory.getLogger(UserRealm.class);

 /**
  * 執(zhí)行授權(quán)邏輯
  *
  * @param arg0
  * @return
  */
 @Override
 protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection arg0) {
  System.out.println("執(zhí)行授權(quán)邏輯");
  //給資源進行授權(quán)
  SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
  //不授權(quán)先不寫
  return info;
 }
 
 /**
  * 執(zhí)行認證邏輯
  *
  * @param arg0
  * @return
  * @throws AuthenticationException
  */
 @Override
 protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken arg0) throws AuthenticationException {
  System.out.println("執(zhí)行認證邏輯"); // 編寫shiro判斷邏輯，判斷用戶名和密碼
  UsernamePasswordToken token = (UsernamePasswordToken) arg0; // 判斷用戶名
  User user = userService.findUserByPhone(token.getUsername());
  if (user == null) { // 該用戶不存在
   return null; // shiro底層會拋出UnKnowAccountException
  }
  return new SimpleAuthenticationInfo(user, user.getPassword(), ""); // 判斷密碼
 }

}

filterMap.put("/*", "anon");

import java.util.LinkedHashMap;
import java.util.Map;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;


/**
 * Shiro的配置類
 */
@Configuration
public class ShiroConfig {

 /**
  * 創(chuàng)建ShiroFilterFactoryBean
  *
  * @param securityManager
  * @return
  */
 @Bean
 public ShiroFilterFactoryBean getShiroFilterFactoryBean(@Qualifier("securityManager") DefaultWebSecurityManager securityManager) {
  ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
  //設(shè)置安全管理器
  shiroFilterFactoryBean.setSecurityManager(securityManager);

  //添加Shiro內(nèi)置過濾器
  /**
   * Shiro內(nèi)置過濾器，可以實現(xiàn)權(quán)限相關(guān)的攔截器
   * 常用的過濾器：
   *  anon: 無需認證（登錄）可以訪問
   *  authc: 必須認證才可以訪問
   *  user: 如果使用rememberMe的功能可以直接訪問
   *  perms： 該資源必須得到資源權(quán)限才可以訪問
   *  role: 該資源必須得到角色權(quán)限才可以訪問
   */

  Map<String, String> filterMap = new LinkedHashMap<String, String>();
  // 放行l(wèi)ogin.html頁面
  filterMap.put("/login", "anon"); // 要將登陸的接口放出來，不然沒權(quán)限訪問登陸的接口
  // 授權(quán)過濾器
  // 注意：當前授權(quán)攔截后，shiro會自動跳轉(zhuǎn)到未授權(quán)頁面
  filterMap.put("/*", "anon");
  // TODO 此處我做過修改

  shiroFilterFactoryBean.setLoginUrl("/login"); // 修改調(diào)整的登錄頁面
  shiroFilterFactoryBean.setUnauthorizedUrl("/403"); // 設(shè)置未授權(quán)提示頁面
  shiroFilterFactoryBean.setFilterChainDefinitionMap(filterMap);
  return shiroFilterFactoryBean;
 }

 /**
  * 創(chuàng)建DefaultWebSecurityManager
  *
  * @param userRealm
  * @return
  */
 @Bean(name = "securityManager")
 public DefaultWebSecurityManager getDefaultWebSecurityManager(@Qualifier("userRealm") UserRealm userRealm) {
  DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager();
  securityManager.setRealm(userRealm); // 關(guān)聯(lián)realm
  return securityManager;
 }

 /**
  * 創(chuàng)建Realm
  *
  * @return
  */
 @Bean(name = "userRealm")
 public UserRealm getRealm() {
  return new UserRealm();
 }

}

/**
 * 用戶登錄
 *
 * @param request
 * @return
 */
@PostMapping("/userLogin")
@ResponseBody
public String userLogin(HttpServletRequest request) {
 String phone = request.getParameter("phone");
 String password = request.getParameter("password");
 String result = "";
 Subject subject = SecurityUtils.getSubject();
 UsernamePasswordToken token = new UsernamePasswordToken(phone, password);
 try {
  subject.login(token);
  result = "登陸成功";
 } catch (UnknownAccountException e) {
  result = "用戶名不存在";
 } catch (IncorrectCredentialsException e) {
  result = "密碼錯誤";
 }
 return result;
}

User user = (User) SecurityUtils.getSubject().getPrincipal(); // 獲取當前登錄用戶