1. shiro.ini

[main]
#创建一个HashedCrededtialsMatcher对象
cm = org.apache.shiro.authc.credential.HashedCredentialsMatcher
#调用cm的setHashAlgorithm(...)方法
cm.hashAlgorithm = SHA-512
cm.hashIterations = 1024
# Base64 encoding (less text):
cm.storedCredentialsHexEncoded = false
 
# $cm，引用上面定义的cm对象
# 指定密码编码方式
iniRealm.credentialsMatcher = $cm
 
#设置某个filter启用状态
ssl.enabled = false
 
#设置缓存机制
#Shiro 的SecurityManager 实现及所有AuthorizingRealm实现都实现了CacheManagerAware，设置会改变这些类的缓存机制
cacheManager = my.implementation.of.CacheManager
 
[users] 
##username = password, roleName1, roleName2, …, roleNameN
jdoe = TWFuIGlzIGRpc3Rpbmd1aXNoZWQsIG5vdCBvbmx5IGJpcyByZWFzb2 
asmith = IHNpbmd1bGFyIHBhc3Npb24gZnJvbSBvdGhlciBhbXNoZWQsIG5vdCB
 
[roles]
#rolename = permissionDefinition1, permissionDefinition2, … , permissionDefinitionN
#permissionDefinition 是一个任意的字符串，但大多数人将会使用符合
#org.apache.shiro.authz.permission.WildcardPermission 格式的字符串
admin = *
master = winnebago:drive:eagle5
guest = "printer:5thFloor:print,info"
[urls]
#格式为：URL_Ant_Path_Expression = Path_Specific_Filter_Chain
#右边为用逗号隔开的过滤器列表，格式为：filter1[optional_config1], ..., filterN[optional_configN]
/assets/** = anon
#第一个匹配的url会短路之后匹配的url 即FIRST MATCH WINS原则
/user/signup = anon
/user/** = user
/rpc/rest/** = perms[rpc:invoke], authc
/** = authc

2. 加载配置文件

//1.装入INI配置 
Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini");
 
//2. 创建SecurityManager 
SecurityManager securityManager = factory.getInstance();
 
//3. 使其可访问 
SecurityUtils.setSecurityManager(securityManager);

3. Subject登录

//1. 接受提交的当事人和证书：
AuthenticationToken token = new UsernamePasswordToken(username, password);
//2. 获取当前Subject：
Subject currentUser = SecurityUtils.getSubject();
//3. 登录： 
currentUser.login(token);
 
//退出
subject.logout();
//可设置“记住我”
token.setRememberMe(true);

验证步骤：

1. 控制失败的登录

//3. 登录：
try {
    currentUser.login(token);
} catch (IncorrectCredentialsException ice) {
    …
} catch (LockedAccountException lae) {
    …
}
…
catch (AuthenticationException ae) {…
} 

2. 验证是否登录

subject.isAuthenticated();

3. 角色检查

if ( subject.hasRole(“administrator”) ) {
    //显示‘Create User’按钮
} else {
    //按钮置灰
} 

4. 权限检查

if ( subject.isPermitted(“user:create”) ) {
    //显示‘Create User’按钮
} else {
    //按钮置灰?
} 

5. 实例级别的权限检查

if ( subject.isPermitted(“user:delete:jsmith”) ) {
    //删除‘jsmith’用户
} else {
    //不删除‘jsmith’
}

6. 获取会话

Session session = subject.getSession();
Session session = subject.getSession(boolean create);

7. session的一些方法

Session session = subject.getSession();
session.getAttribute("key", someValue); 
Date start = session.getStartTimestamp();
Date timestamp = session.getLastAccessTime(); 
session.setTimeout(millis); ...

8. 加密－哈希

//使用MD5哈希一个文件，并确定该哈希的十六进制值
String hex = new Md5Hash(myFile).toHex();
//SHA-512哈希和密码的Base64编码
String encodedPassword = new Sha512Hash(password, salt, count).toBase64();

9. web

<filter>
    <filter-name>ShiroFilter</filter-name>
    <filter-class>
         org.apache.shiro.web.servlet.IniShiroFilter
    </filter-class>
    <!-- 没有init-param属性就表示从classpath:shiro.ini装入INI配置 --> 
</filter>
<filter-mapping>
    <filter-name>ShiroFilter</filter-name>
    <url-pattern>/*</url-pattern> 
</filter-mapping>

10. jsp标签库 

<%@ taglib prefix="shiro" uri="http://shiro.apache.org/tags" %>
<shiro:user> 
    <shiro:principal/>
</shiro:user>
<shiro:guest> 
    ! <a href=”register.jsp”>Register today!</a>
</shiro:guest>
 
<!--是否成功通过了验证，比user更为严格-->
<shiro:authenticated>
<a href="updateAccount.jsp">Update your contact information</a>.
</shiro:authenticated>
<shiro:notAuthenticated>
Please <a href="login.jsp">login</a> in order to update your credit card information.
</shiro:notAuthenticated>
 
<!--输出subject.getPrincipal()的值-->
Hello, <shiro:principal/>, how are you today?
<!--你想输出一个不是主要principal的值，而是属于另一个Subject 的principal collection，
      你可以通过类型来获取该principal 并输出该值。可设置principal的值类型-->
User ID: <shiro:principal type="java.lang.Integer"/>
<!-- 若principal为一个对象，则可用property取它某一属性 -->
Hello, <shiro:principal property="firstName"/>, how are you today?
<shiro:principal type="com.foo.User" property="firstName"/>,
 
<!--检查是否具有权限-->
<shiro:hasRole name="administrator">
<a href="admin.jsp">Administer the system</a>
</shiro:hasRole>
<shiro:lacksRole name="administrator">
Sorry, you are not allowed to administer the system.
</shiro:lacksRole>
 
<!--具有任一权限-->
<shiro:hasAnyRole name="developer, project manager, administrator">
You are either a developer, project manager, or administrater.
</shiro:hasAnyRole>
 
<!--检查是否蕴含特定权限-->
<shiro:hasPermission name="user:create">
<a href="createUser.jsp">Create a new User</a>
</shiro:hasPermission>
<shiro:lacksPermission name="user:delete">
Sorry, you are not allowed to deleted user accounts.
</shiro:hasPermission>

【下载地址】

百度网盘链接：https://pan.baidu.com/s/1TNoeYEX1gboGR7IlQTPmjw

提取码：qivu