SSM+Shiro写的一个简单的登录验证

项目结构

web.XML配置

<?xml version="1.0" encoding="UTF-8"?><web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"    id="WebApp_ID" version="2.5">    <display-name>Archetype Created Web Application</display-name>    <!-- 读取spring配置文件 -->    <context-param>        <param-name>contextConfigLocation</param-name>        <param-value>classpath*:config/spring.xml;            classpath*:config/spring-mybatis.xml        </param-value>    </context-param>    <!-- 设计路径变量值 -->    <context-param>        <param-name>webAppRootKey</param-name>        <param-value>springmvc.root</param-value>    </context-param>    <!-- Spring字符集过滤器 -->    <filter>        <filter-name>SpringEncodingFilter</filter-name>        <filter-class>org.springframework.web.filter.CharacterEncodingFilter</filter-class>        <init-param>            <param-name>encoding</param-name>            <param-value>UTF-8</param-value>        </init-param>        <init-param>            <param-name>forceEncoding</param-name>            <param-value>true</param-value>        </init-param>    </filter>    <filter-mapping>        <filter-name>SpringEncodingFilter</filter-name>        <url-pattern>/*</url-pattern>    </filter-mapping> <filter>    <filter-name>shiroFilter</filter-name>    <filter-class>       org.springframework.web.filter.DelegatingFilterProxy    </filter-class>  </filter>  <filter-mapping>    <filter-name>shiroFilter</filter-name>    <url-pattern>/*</url-pattern>  </filter-mapping>    <!-- 日志记录 -->    <context-param>        <!-- 日志配置文件路径 -->        <param-name>log4jConfigLocation</param-name>        <param-value>classpath:config/log4j.properties</param-value>    </context-param>    <context-param>        <!-- 日志页面的刷新间隔 -->        <param-name>log4jRefreshInterval</param-name>        <param-value>6000</param-value>    </context-param>    <listener>        <listener-class>org.springframework.web.util.Log4jConfigListener</listener-class>    </listener>    <listener>        <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>    </listener>    <!-- springMVC核心配置 -->    <servlet>        <servlet-name>spring</servlet-name>        <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class>        <init-param>            <param-name>contextConfigLocation</param-name>            <param-value>classpath*:config/spring-mvc.xml</param-value>        </init-param>        <load-on-startup>2</load-on-startup>    </servlet>    <servlet-mapping>        <servlet-name>spring</servlet-name>        <url-pattern>*.do</url-pattern>    </servlet-mapping>    <!-- 错误跳转页面 -->    <error-page>        <!-- 路径不正确 -->        <error-code>404</error-code>        <location>/WEB-INF/errorpage/404.jsp</location>    </error-page>    <error-page>        <!-- 没有访问权限，访问被禁止 -->        <error-code>405</error-code>        <location>/WEB-INF/errorpage/405.jsp</location>    </error-page>    <error-page>        <!-- 内部错误 -->        <error-code>500</error-code>        <location>/WEB-INF/errorpage/500.jsp</location>    </error-page></web-app>

spring配置

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"    xmlns:context="http://www.springframework.org/schema/context"    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xsi:schemaLocation="http://www.springframework.org/schema/beans      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd      http://www.springframework.org/schema/context      http://www.springframework.org/schema/context/spring-context.xsd">    <import resource="config/spring-mybatis.xml"/>        <import resource="config/shiro-context.xml"/>    <!-- 引入jdbc配置文件 -->    <context:property-placeholder location="classpath:config/jdbc.properties" />    <!-- 扫描文件（自动将servicec层注入） -->    <context:component-scan base-package="com.deng.serviceImp" /></beans>

spring-mvc配置

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"    xmlns:p="http://www.springframework.org/schema/p" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"    xmlns:context="http://www.springframework.org/schema/context"    xmlns:mvc="http://www.springframework.org/schema/mvc"    xsi:schemaLocation="    http://www.springframework.org/schema/beans    http://www.springframework.org/schema/beans/spring-beans-3.2.xsd    http://www.springframework.org/schema/context    http://www.springframework.org/schema/context/spring-context-3.2.xsd    http://www.springframework.org/schema/mvc    http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">    <!-- 扫描controller（controller层注入） -->    <context:component-scan base-package="com.deng.controller" />    <!-- 避免IE在ajax请求时，返回json出现下载 -->    <bean id="jacksonMessageConverter"        class="org.springframework.http.converter.json.MappingJacksonHttpMessageConverter">        <property name="supportedMediaTypes">            <list>                <value>text/html;charset=UTF-8</value>            </list>        </property>    </bean>    <!-- 对模型视图添加前后缀 -->    <bean id="viewResolver"        class="org.springframework.web.servlet.view.InternalResourceViewResolver"        p:prefix="/" p:suffix=".jsp" /></beans>

mybatis-config配置

<?xml version="1.0" encoding="UTF-8" ?><!DOCTYPE configuration PUBLIC "-//mybatis.org//DTD Config 3.0//EN""http://mybatis.org/dtd/mybatis-3-config.dtd"><configuration><!-- 主要目的是 配置 命名空间 -->    <!-- 命名空间，使用别名 -->    <typeAliases >    </typeAliases>    <!-- 映射map mapper下的xml文件 -->    <mappers>        <!-- <mapper resource="mapper/UserMapper.xml"/> -->    </mappers></configuration>

spring-mybatis配置

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:p="http://www.springframework.org/schema/p"    xmlns:context="http://www.springframework.org/schema/context"    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"    xmlns:util="http://www.springframework.org/schema/util"    xsi:schemaLocation="http://www.springframework.org/schema/beans    http://www.springframework.org/schema/beans/spring-beans-3.2.xsd    http://www.springframework.org/schema/context    http://www.springframework.org/schema/context/spring-context-3.2.xsd    http://www.springframework.org/schema/tx    http://www.springframework.org/schema/tx/spring-tx-3.2.xsd    http://www.springframework.org/schema/aop    http://www.springframework.org/schema/aop/spring-aop-3.2.xsd    http://www.springframework.org/schema/util     http://www.springframework.org/schema/util/spring-util-3.2.xsd">    <bean id="dataSource" class="com.alibaba.druid.pool.DruidDataSource"        init-method="init" destroy-method="close">        <property name="driverClassName">            <value>${jdbc_driverClassName}</value>        </property>        <property name="url">            <value>${jdbc_url}</value>        </property>        <property name="username">            <value>${jdbc_username}</value>        </property>        <property name="password">            <value>${jdbc_password}</value>        </property>        <!-- 连接池最大使用连接数 -->        <property name="maxActive">            <value>20</value>        </property>        <!-- 初始化连接大小 -->        <property name="initialSize">            <value>1</value>        </property>        <!-- 获取连接最大等待时间 -->        <property name="maxWait">            <value>60000</value>        </property>        <!-- 连接池最大空闲 -->        <property name="maxIdle">            <value>20</value>        </property>        <!-- 连接池最小空闲 -->        <property name="minIdle">            <value>3</value>        </property>        <!-- 自动清除无用连接 -->        <property name="removeAbandoned">            <value>true</value>        </property>        <!-- 清除无用连接的等待时间 -->        <property name="removeAbandonedTimeout">            <value>180</value>        </property>        <!-- 连接属性 -->        <property name="connectionProperties">            <value>clientEncoding=UTF-8</value>        </property>    </bean>    <!-- mybatis文件配置，扫描所有mapper文件 -->    <bean id="sqlSessionFactory" class="org.mybatis.spring.SqlSessionFactoryBean"        p:dataSource-ref="dataSource" p:configLocation="classpath:config/mybatis-config.xml"        p:mapperLocations="classpath:com/deng/mapper/*.xml" /><!-- configLocation为mybatis属性         mapperLocations为所有mapper -->    <!-- spring与mybatis整合配置，扫描所有dao -->    <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer"        p:basePackage="com.deng.dao" p:sqlSessionFactoryBeanName="sqlSessionFactory">    </bean>    <!-- <bean class="org.mybatis.spring.mapper.MapperScannerConfigurer" p:basePackage="com.imt.general.dao"         p:sqlSessionFactoryBeanName="sqlSessionFactory"> </bean> -->    <!-- 对数据源进行事务管理 -->    <bean id="transactionManager"        class="org.springframework.jdbc.datasource.DataSourceTransactionManager"        p:dataSource-ref="dataSource" /></beans>

shiro-context配置

<?xml version="1.0" encoding="UTF-8"?><beans xmlns="http://www.springframework.org/schema/beans"    xmlns:aop="http://www.springframework.org/schema/aop" xmlns:tx="http://www.springframework.org/schema/tx"    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:context="http://www.springframework.org/schema/context"    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.2.xsd                http://www.springframework.org/schema/context                 http://www.springframework.org/schema/context/spring-context-3.2.xsd                http://www.springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-3.2.xsd                 http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd">    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">        <property name="securityManager" ref="securityManager" />        <property name="loginUrl" value="/login.jsp" />        <property name="successUrl" value="/home" />        <property name="unauthorizedUrl" value="/403.do" />        <property name="filterChainDefinitions"><!--/admin/**=anon ：无参，表示可匿名访问/admin/user/**=authc ：无参，表示需要认证才能访问/admin/user/**=authcBasic ：无参，表示需要httpBasic认证才能访问/admin/user/**=ssl ：无参，表示需要安全的URL请求，协议为https/home=user ：表示用户不一定需要通过认证，只要曾被 Shiro 记住过登录状态就可以正常发起 /home 请求/edit=authc,perms[admin:edit]：表示用户必需已通过认证，并拥有 admin:edit 权限才可以正常发起 /edit 请求/admin=authc,roles[admin] ：表示用户必需已通过认证，并拥有 admin 角色才可以正常发起 /admin 请求/admin/user/**=port[8081] ：当请求的URL端口不是8081时，跳转到schemal://serverName:8081?queryString/admin/user/**=rest[user] ：根据请求方式来识别，相当于 /admins/user/**=perms[user:get]或perms[user:post] 等等/admin**=roles["admin,guest"] ：允许多个参数（逗号分隔），此时要全部通过才算通过，相当于hasAllRoles()/admin**=perms["user:add:*,user:del:*"]：允许多个参数（逗号分隔），此时要全部通过才算通过，相当于isPermitedAll()    -->            <value>                /login = anon <!--anon表示不需要认证就可以访问的     -->                /home = authc, perms[/home]  <!--authc 表示需要认证才能访问的页面 perms 表示需要该权限才能访问的页面 -->                /** = authc             </value>        </property>     </bean>    <bean id="myShiroRealm" class="com.deng.shiro.myReam">        <!-- businessManager 用来实现用户名密码的查询 -->        <!-- <property name="userService" ref="accountService" /> -->    </bean>    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">        <property name="realm" ref="myShiroRealm"></property>    </bean>    <!-- <bean id="accountService" class="com.deng.service.userService"></bean> -->    <!-- <bean id="shiroCacheManager" class="org.apache.shiro.cache.ehcache.EhCacheManager">         <property name="cacheManager" ref="cacheManager" /> </bean> --></beans>

shiro验证登录验证类

package com.deng.shiro;import java.util.List;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.AuthenticationInfo;import org.apache.shiro.authc.AuthenticationToken;import org.apache.shiro.authc.IncorrectCredentialsException;import org.apache.shiro.authc.SimpleAuthenticationInfo;import org.apache.shiro.authc.UnknownAccountException;import org.apache.shiro.authc.UsernamePasswordToken;import org.apache.shiro.authz.AuthorizationInfo;import org.apache.shiro.authz.SimpleAuthorizationInfo;import org.apache.shiro.realm.AuthorizingRealm;import org.apache.shiro.subject.PrincipalCollection;import org.springframework.beans.factory.annotation.Autowired;import com.deng.entity.User;import com.deng.entity.UserRole;import com.deng.service.userService;public class myReam extends AuthorizingRealm{    /** 用户的业务类 **/    @Autowired    private userService ser;    //授权    @Override    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection pri) {        // TODO Auto-generated method stub        System.out.println("this  is  权限~~~~~~~");        User user=(User) pri.getPrimaryPrincipal();        Integer id = user.getId();        if(id==1){            System.out.println("this is   id====1");            List<UserRole> qRole = ser.queryUserRole(id);            SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();            //获取能够访问的URL列表            List<String> qu = ser.queryPermission(qRole.get(0).getRoleId());            for(String r:qu){                System.out.println("r==="+r);                info.addStringPermission(r);            }            return info;        }        return null;    }    //登录    @Override    protected AuthenticationInfo doGetAuthenticationInfo(            AuthenticationToken token1) throws AuthenticationException {        // TODO Auto-generated method stub        System.out.println("this is  登录shiro 验证·~~~~~~~~~~~~" );        UsernamePasswordToken token=(UsernamePasswordToken)token1;        String username = token.getUsername();        char[] password = token.getPassword();        String pass=new String(password);        System.out.println(username);        System.out.println(pass);        System.out.println(22222222);        if(username!=null){            User user = ser.queryUserByUsername(username);            System.out.println("user====="+user);            //账号不存在            if(user == null) {                System.out.println("1账号或密码不正确");                throw new UnknownAccountException("账号或密码不正确");            }            if(user!=null){                //密码错误                if(!pass.equals(user.getPassword())) {                    System.out.println("2账号或密码不正确");                    throw new IncorrectCredentialsException("账号或密码不正确");                }                System.out.println(user);                return new SimpleAuthenticationInfo(user, user.getPassword(),getName());            }        }        return null;    }}

logincontroller类

package com.deng.controller;import javax.annotation.Resource;import javax.servlet.http.HttpServletRequest;import org.apache.shiro.SecurityUtils;import org.apache.shiro.authc.AuthenticationException;import org.apache.shiro.authc.UnknownAccountException;import org.apache.shiro.authc.UsernamePasswordToken;import org.apache.shiro.subject.Subject;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Controller;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestMethod;import com.deng.entity.User;import com.deng.service.userService;/**** * 用户登录Controller *  * @author deng *  */@Controllerpublic class LoginController {    @Autowired    private userService ser;    /***     * 实现用户登录     *      * @param username     * @param password     * @return     */    @RequestMapping(value = "/login", method = RequestMethod.POST)    public String Login(String username, String password,HttpServletRequest req) {          try {                UsernamePasswordToken token = new UsernamePasswordToken(username,password);                Subject subject = SecurityUtils.getSubject();                subject.login(token);            } catch (UnknownAccountException e) {                e.printStackTrace();             req.getSession().setAttribute("errorMessage", "用户名或密码错误");                return "login";            } catch (AuthenticationException e) {                e.printStackTrace();                req.getSession().setAttribute("errorMessage", "用户名或密码错误");                return "login";            }            // 登录后存放进shiro token            return "home";    }}

login.jsp

    <form action="login.do" method="post">            username:<input type="text" name="username"><p>            password:<input type="password" name="password">            <input type="submit">            <p>            <span>${sessionScope.errorMessage}</span>    </form>

密码错误

登录成功