基于spring boot 2和shiro实现身份验证案例

<dependency>
   <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring</artifactId>
      <version>1.4.2</version>
    </dependency>

package com.example.demo.config;

import org.apache.shiro.authc.*;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.subject.PrincipalCollection;

public class MyRealm extends AuthorizingRealm {

  /**权限信息，暂不实现*/
  @Override
  protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
    return null;
  }

  /**身份认证:验证用户输入的账号和密码是否正确。*/
  @Override
  protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
    //获取用户输入的账号
    String userName = (String) token.getPrincipal();
    //验证用户admin和密码123456是否正确
    if (!"admin".equals(userName)) {
      throw new UnknownAccountException("账户不存在!");
    }
    SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(userName, "123456", getName());
    return authenticationInfo;
    //实际项目中，上面账号从数据库中获取用户对象，再判断是否存在
    /*User user = userService.findByUserName(userName);
    if (user == null) {
      throw new UnknownAccountException("账户不存在!");
    }
    SimpleAuthenticationInfo authenticationInfo = new SimpleAuthenticationInfo(user,user.getPassword(), getName());
    return authenticationInfo;
    */
  }
}

package com.example.demo.config;

import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.LinkedHashMap;
import java.util.Map;

@Configuration
public class ShiroConfig {
  @Bean
  MyRealm myRealm() {
    return new MyRealm();
  }

  @Bean
  DefaultWebSecurityManager securityManager() {
    DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
    manager.setRealm(myRealm());
    return manager;
  }

  @Bean
  ShiroFilterFactoryBean shiroFilterFactoryBean() {
    ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
    bean.setSecurityManager(securityManager());
    //如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    bean.setLoginUrl("/login");
    //登录成功后要跳转的链接
    bean.setSuccessUrl("/index");
    //未授权界面
    bean.setUnauthorizedUrl("/403");
    //配置不会被拦截的链接
    Map<String, String> map = new LinkedHashMap<>();
    map.put("/doLogin", "anon");
    map.put("/**", "authc");
    bean.setFilterChainDefinitionMap(map);
    return bean;
  }
}

package com.example.demo.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class LoginController {

  @GetMapping("/login")
  public String login() {
    return "登录页面...";
  }

  @PostMapping("/doLogin")
  public String doLogin(String userName, String password) {
    Subject subject = SecurityUtils.getSubject();
    try {
      subject.login(new UsernamePasswordToken(userName, password));
      return "登录成功!";
    } catch (UnknownAccountException e) {
      return e.getMessage();
    } catch (AuthenticationException e) {
      return "登陆失败，密码错误!";
    }
  }

  //如果没有先登陆，访问会跳到/login
  @GetMapping("/index")
  public String index() {
    return "index";
  }

  @GetMapping("/403")
  public String unauthorizedRole(){
    return "没有权限";
  }
}

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>

    <dependency>
      <groupId>org.apache.shiro</groupId>
      <artifactId>shiro-spring-boot-web-starter</artifactId>
      <version>1.4.2</version>
    </dependency>

package com.example.demo.config;

import org.apache.shiro.spring.web.config.DefaultShiroFilterChainDefinition;
import org.apache.shiro.spring.web.config.ShiroFilterChainDefinition;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ShiroConfig {
  @Bean
  MyRealm myRealm() {
    return new MyRealm();
  }

  @Bean
  DefaultWebSecurityManager securityManager() {
    DefaultWebSecurityManager manager = new DefaultWebSecurityManager();
    manager.setRealm(myRealm());
    return manager;
  }

  @Bean
  ShiroFilterChainDefinition shiroFilterChainDefinition() {
    DefaultShiroFilterChainDefinition definition = new DefaultShiroFilterChainDefinition();
    definition.addPathDefinition("/doLogin", "anon");
    definition.addPathDefinition("/**", "authc");
    return definition;
  }
}

shiro:
 unauthorizedUrl: /403
 successUrl: /index
 loginUrl: /login