Shiro实现用户授权(Authorization)

1.表结构

---

2.Controller

            // 判断是否成功登录              assertEquals(true, subject.isAuthenticated());              System.out.println("登录成功！！");              // 判断用户是否拥有某个角色              assertEquals(true, subject.hasRole("admin"));              // 使用Shiro自带的断言判断用户是否有被授权              subject.checkRole("manager");              subject.checkPermission("create_user1");              // 注销用户              subject.logout(); 

---

3.Spring-dao.xml配置

<bean id="jdbcRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">        <!--<property name="credentialsMatcher" ref="credentialsMatcher"></property>-->        <property name="permissionsLookupEnabled" value="true"></property>        <property name="dataSource" ref="dataSource"></property>        <property name="authenticationQuery"            value="SELECT password FROM users WHERE username = ?"></property>         <property name="userRolesQuery"          value="SELECT permission FROM roles_permissions WHERE role_name = ? " />      </bean>

---

4.web.xml

<!-- Shiro Filter -->      <filter>          <filter-name>shiroFilter</filter-name>          <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>          <init-param>              <param-name>targetFilterLifecycle</param-name>              <param-value>true</param-value>          </init-param>      </filter>      <filter-mapping>          <filter-name>shiroFilter</filter-name>          <url-pattern>/*</url-pattern>      </filter-mapping> 

---

5.总结

之后在应用程序任意地方调用SecurityUtils.getSubject() 都可以获取到当前认证通过的用户实例
这就意味着在判断请求时可以方便的进行操作

博客：
http://www.cnblogs.com/xql4j/
http://kdboy.iteye.com/blog/1155450
http://blog.csdn.net/chris_mao/article/details/49215471