org.apache.shiro
            shiro-spring
            1.7.1
        



        
        
            mysql
            mysql-connector-java
            5.1.49
        
        
            com.alibaba
            druid
            1.1.18
        
        
            com.baomidou
            mybatis-plus-boot-starter
            3.4.1
        
        
            org.projectlombok
            lombok
            true
        
        
        
            com.github.theborakompanioni
            thymeleaf-extras-shiro
            2.0.0
        

spring:
  datasource:
#    url: jdbc:mysql://127.0.0.1:3306/blog_3?serverTimezone=UTC
    url: jdbc:mysql://127.0.0.1:3306/mybatisplus?serverTimezone=UTC
    #    username: root
    username: root
    password: 123456
    driver-class-name: com.mysql.jdbc.Driver
#开启mybatis-plus sql日志
mybatis-plus:
  configuration:
    log-impl: org.apache.ibatis.logging.stdout.StdOutImpl #开启sql日志

package cn.hmc.demo.config;

import at.pollux.thymeleaf.shiro.dialect.ShiroDialect;
import org.apache.shiro.mgt.DefaultSecurityManager;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.beans.factory.annotation.Qualifier;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import java.util.linkedHashMap;
import java.util.Map;


@Configuration
public class ShiroConfig {

    //shiro必须要的三大模块
    //ShiroFilterFactoryBean 3
    @Bean
    public ShiroFilterFactoryBean getShiroFilterFactoryBean(
                                            //拿到下面的DefaultWebSecurityManager对象
                                            @Qualifier("getDefaultWebSecurityManager")
                                            DefaultSecurityManager defaultSecurityManager
    ){
        ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();
        //设置安全管理器
        bean.setSecurityManager(defaultSecurityManager);

        //添加shiro内置过滤器

        //拦截访问页面
        Map filterMap = new linkedHashMap<>();

        //拦截规则
        
        filterMap.put("/add","authc");
        filterMap.put("/update","authc");
//        filterMap.put("user
public class UserRealm extends AuthorizingRealm {

    @Autowired
    AdminMapper mapper;

    //授权,根据查询出来的用户权限,开放相关模块
    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        System.out.println("UserRealm=>doGetAuthorizationInfo授权");

        SimpleAuthorizationInfo info = new SimpleAuthorizationInfo();
        //不管谁访问都给个权限
//        info.addStringPermission("admin:add");
        //拿到登录的用户
        Subject subject = SecurityUtils.getSubject();
        //取出认证传递的数据
        Admin o = (Admin) subject.getPrincipal();

        //判断有什么权限,开启什么内容
        //设置用户权限
        if (o.getPerms()!=null){
            info.addStringPermission(o.getPerms());
        }
        return info;
    }

    //认证,就是判断用户名密码是否正确
    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        System.out.println("UserRealm=>doGetAuthorizationInfo认证");

        //模拟查询数据库操作
        
        //连接真实的数据库

        //拿到令牌
        UsernamePasswordToken token = (UsernamePasswordToken)authenticationToken;
        
        Admin admin = mapper.selectOne(new QueryWrapper().eq("username", token.getUsername()));
        if (admin==null){//没有这个人
            return null;
        }

        //登录成功,将用户信息存入session中
        Subject subject = SecurityUtils.getSubject();
        Session session = subject.getSession();
        session.setAttribute("admin",admin);


        //密码认证,shiro自动帮我们做,因为它不相信我们
//        return new SimpleAuthenticationInfo("",password,"");
        return new SimpleAuthenticationInfo(admin,admin.getPassword(),"");
    }
}

5.controller,静态文件

package cn.hmc.demo.controller;

import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.IncorrectCredentialsException;
import org.apache.shiro.authc.UnknownAccountException;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.ui.Model;
import org.springframework.web.bind.annotation.RequestMapping;


@Controller
public class MyController {

    @RequestMapping({"/","/index"})
    public String test(Model model){
        model.addAttribute("msg","你好shrio");
        return "index";
    }

    @RequestMapping("/add")
    public String add(){
        return "user/add";
    }

    @RequestMapping("/update")
    public String update(){
        return "user/update";
    }

    //登录页面
    @RequestMapping("/login")
    public String login(){
        return "login";
    }

    @RequestMapping("/logOut")
    public String logOut(Model model){
        Subject subject = SecurityUtils.getSubject();
        subject.logout();
        model.addAttribute("msg","安全退出!");
        return "index";
    }

    //用户未授权跳转页面
    @RequestMapping("/unauthorized")
    public String Unauthorized(){
        return "unauthorized";
    }

    //登录功能
    @RequestMapping("/loginIn")
    public String loginIn(String name,String password,Model model){

        Subject subject = SecurityUtils.getSubject();
        //将用户名密码传入令牌中
        UsernamePasswordToken token = new UsernamePasswordToken(name,password);
        //执行登录方法,如果没有异常就说明ok
        try {
            subject.login(token);
            return "index";
        } catch (UnknownAccountException e) {//用户名不存在
            model.addAttribute("msg","用户名错误!");
            return "login";
        } catch (IncorrectCredentialsException e) {//密码错误
            model.addAttribute("msg","密码错误!");
            return "login";
        }
    }
}

html文件

    
    



这里是首页




    

        登录
    



    

        注销
    





    add


    update

    
    



登录



    
用户名:
    
密码: