spring boot + shiro + redis 整合（完整）qq45275875的博客-

什么是shiro?

shiro是一个Java平台的开源权限框架，用于认证和访问授权。具体来说，满足对如下元素的支持：

• 用户，角色，权限（仅仅是操作权限，数据权限必须与业务需求紧密结合），资源（url）
• 用户分配角色，角色定义权限
• 访问授权时支持角色或者权限，并且支持多级的权限定义

1.数据库设计

数据库中有分别有6个表，分别是：权限表(permissions)、用户表(users)、用户权限关系表(user_role)、角色表(roles)、角色权限关系表(role_permission)、shiro过滤器表( resource)

数据库下载地址: https://pan.baidu.com/s/1AMKwNfRimPPzqWHY30S1HQ 提取码: r9oh

2.创建springboot项目并在pom加入依赖

 <dependency> <groupId>org.projectlombok</groupId> <artifactId>lombok</artifactId> <optional>true</optional> </dependency> <!-- 导入web支持：SpringMVC开发支持，Servlet相关的程序 --> <!-- web支持，SpringMVC， Servlet支持等  web 启动器--> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency> <!--导入thymeleaf依赖--> <!--thymeleaf启动器--> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-thymeleaf</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId> <scope>test</scope> </dependency> <!-- jstl --> <dependency> <groupId>javax.servlet</groupId> <artifactId>jstl</artifactId> </dependency> <!-- jasper --> <dependency> <groupId>org.apache.tomcat.embed</groupId> <artifactId>tomcat-embed-jasper</artifactId> <scope>provided</scope> </dependency> <!-- fastjson阿里巴巴jSON处理器 --> <dependency> <groupId>com.alibaba</groupId> <artifactId>fastjson</artifactId> <version>1.2.47</version> </dependency> <dependency> <groupId>org.mybatis.spring.boot</groupId> <artifactId>mybatis-spring-boot-starter</artifactId> <version>1.1.1</version> </dependency> <!-- reids --> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-redis</artifactId> </dependency> <!-- shiro+redis缓存插件 --> <dependency> <groupId>org.crazycake</groupId> <artifactId>shiro-redis</artifactId> <version>2.4.6</version> </dependency> <!-- mysql 数据库驱动 --> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> </dependency> <!-- druid 数据库连接池 --> <dependency> <groupId>com.alibaba</groupId> <artifactId>druid</artifactId> <version>1.0.9</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-spring</artifactId> <version>1.4.0</version> </dependency> <dependency> <groupId>redis.clients</groupId> <artifactId>jedis</artifactId> <version>2.8.0</version> </dependency> <!-- thymeleaf整合shiro标签 --> <dependency> <groupId>com.github.theborakompanioni</groupId> <artifactId>thymeleaf-extras-shiro</artifactId> <version>2.0.0</version> </dependency> <dependency> <groupId>org.apache.shiro</groupId> <artifactId>shiro-core</artifactId> <version>1.2.2</version> </dependency> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> </dependency> 

3. 编辑application.yml

#springboot server:   port: 8080  spring:   datasource:     url: jdbc:mysql://localhost:3306/shiro?serverTimezone=GMT%2B8&useUnicode=true&characterEncoding=utf-8     username: root     password: 123456     driver-class-name: com.mysql.jdbc.Driver    redis:     host: localhost     port: 6379     jedis:       pool:         max-idle: 8         min-idle: 0         max-active: 8         max-wait: -1     timeout: 0 mybatis:   mapper-locations: classpath:mapper/*.xml    #*/   type-aliases-package: com.jbl.springboot_redis_shiro.entity  

4.建包搭架子(先把包建完)

4.1创建实体类

/**  * @Author: yfj  * @Description: 资源  * Serializable 要缓存的JavaBean必须实现Serializable接口，因为Spring会将对象先序列化再存入 Redis  */ @Data public class Resources implements Serializable { public Integer id; public String key; public  String val; public Integer order; } 

/**  * @Author: yfj  * @Description: 用户信息  * Serializable 要缓存的JavaBean必须实现Serializable接口，因为Spring会将对象先序列化再存入 Redis  */ @Data public class User implements Serializable { public Integer u_id; public String u_name; public String u_pwd; } 

我用的lombok插件，简化get、set、ToString等方法想学习的可以点击下面链接：
lombok基本使用和安装

4.2springboot启动类

@SpringBootApplication @MapperScan("com.jbl.springboot_redis_shiro.dao") //这里填的是自己dao层接口的路径 public class SpringbootRedisShiroApplication { public static void main(String[] args) {         SpringApplication.run(SpringbootRedisShiroApplication.class, args); } } 

4.3启动springboot自动跳转到登陆页面

/**  * 启动项目自动跳转到登陆页面  */ @SpringBootConfiguration public class AutoStartProjectInDefaultBrowser implements CommandLineRunner { @Value("${server.port}") private String port; @Override public void run(String ... args) throws Exception { try {             Runtime.getRuntime().exec("cmd /c start https://localhost:" + port + "/shiro/login"); } catch (Exception ex) {             ex.printStackTrace(); } } } 

4.4全局异常类

/**  * @author yfj  * @version 1.0  * @date 2020/04/16 下午 03:11  * @description: 全局异常类  */ @ControllerAdvice public class CtrlExceptionHandler { private static Logger logger = LoggerFactory.getLogger(CtrlExceptionHandler.class); //拦截未授权页面 @ResponseStatus(value = HttpStatus.FORBIDDEN) @ExceptionHandler(UnauthorizedException.class) public String handleException(UnauthorizedException e) {         logger.debug(e.getMessage()); return "403"; } @ResponseStatus(value = HttpStatus.FORBIDDEN) @ExceptionHandler(AuthorizationException.class) public String handleException2(AuthorizationException e) {         logger.debug(e.getMessage()); return "403"; } } 

5.后台代码

5.1 Mapper.xml

<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE mapper         PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "https://mybatis.org/dtd/mybatis-3-mapper.dtd"> <mapper namespace="com.jbl.springboot_redis_shiro.dao.ShiroMapper"> <select id="login" resultType="User" parameterType="String">         SELECT `u_id`,`u_name`,`u_pwd` FROM `users`         WHERE `u_name`= #{name} and `u_pwd` = #{u_pwd} </select> <select id="seRoles" resultType="String" parameterType="String">          SELECT r.`r_name` FROM `user_role` ur         LEFT JOIN `users` u ON(ur.`u_id`=u.`u_id`)         LEFT JOIN `roles` r ON(ur.`r_id`=r.`r_id`)         WHERE u.`u_name`=#{userName} </select> <select id="orders" resultType="Resources">         SELECT * FROM `resource` ORDER BY `orders`     </select> <select id="quanxian" resultType="String" parameterType="String">          SELECT  p.`p_name` FROM  `role_permission` rp         LEFT JOIN `permissions` p ON(rp.`p_id`=p.`p_id`)         LEFT JOIN `roles` r ON(rp.`r_id`=r.`r_id`)         WHERE r.`r_name`IN(SELECT r.`r_name` FROM `user_role` ur         LEFT JOIN `users` u ON(ur.`u_id`=u.`u_id`)         LEFT JOIN `roles` r ON(ur.`r_id`=r.`r_id`)         WHERE u.`u_name`=#{userName}) </select> </mapper> 

5.2 Mapper接口

import com.jbl.springboot_redis_shiro.entity.Resources; import com.jbl.springboot_redis_shiro.entity.User; import org.apache.ibatis.annotations.Param; import org.springframework.stereotype.Repository; import java.util.List; import java.util.Set; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 02:40  * @description:  */ @Repository public interface ShiroMapper { /**      * 登陆      * @param name 用户名      * @param u_pwd 密码      * @return      */     User login(@Param("name")String name,@Param("u_pwd")String u_pwd); /**      * 查询资源      * @return List      */     List<Resources> orders(); /**      * 根据用户查询角色      * @param userName      * @return      */     Set<String> seRoles(@Param("userName")String userName); /**      * 根据名字查询权限      * @param userName      * @return      */     Set<String> quanxian(@Param("userName")String userName); } 

5.3 server接口

import com.jbl.springboot_redis_shiro.entity.Resources; import com.jbl.springboot_redis_shiro.entity.User; import java.util.List; import java.util.Set; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 02:42  * @description:  */ public interface ShiroServer { /**      * 登陆      * @return      */     User login(String name,String u_Pwd); /**      * 查询资源      * @return List      */     List<Resources> orders(); /**      * 根据用户查询角色      * @param userName      * @return      */     Set<String> seRoles(String userName); /**      * 根据名字查询权限      * @param userName      * @return      */     Set<String> quanxian(String userName); } 

server实现类

import com.jbl.springboot_redis_shiro.dao.ShiroMapper; import com.jbl.springboot_redis_shiro.entity.Resources; import com.jbl.springboot_redis_shiro.entity.User; import com.jbl.springboot_redis_shiro.server.ShiroServer; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import java.util.List; import java.util.Set; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 02:43  * @description:  */ @Service("ShiroServerImpl") public class ShiroServerImpl implements ShiroServer{ @Autowired private ShiroMapper shiroMapper; @Override public User login(String name, String u_Pwd) { return shiroMapper.login(name,u_Pwd); } @Override public List<Resources> orders() { return shiroMapper.orders(); } @Override public Set<String> seRoles(String userName) { return shiroMapper.seRoles(userName); } @Override public Set<String> quanxian(String userName) { return shiroMapper.quanxian(userName); } } 

6.创建ShiroConfig类

import at.pollux.thymeleaf.shiro.dialect.ShiroDialect; import com.jbl.springboot_redis_shiro.server.ShiroServer; import org.apache.shiro.mgt.SecurityManager; import org.apache.shiro.spring.LifecycleBeanPostProcessor; import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor; import org.apache.shiro.spring.web.ShiroFilterFactoryBean; import org.apache.shiro.web.mgt.DefaultWebSecurityManager; import org.apache.shiro.web.session.mgt.DefaultWebSessionManager; import org.crazycake.shiro.RedisCacheManager; import org.crazycake.shiro.RedisManager; import org.crazycake.shiro.RedisSessionDAO; import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import javax.servlet.Filter; import java.util.LinkedHashMap; import java.util.Map; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 07:06  * @description: shiro配置  */ @Configuration public class ShiroConfig { @Autowired private ShiroServer shiroServer; @Bean public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {         ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean(); //设置安全管理器         shiroFilterFactoryBean.setSecurityManager(securityManager); // 没有登陆的用户只能访问登陆页面         shiroFilterFactoryBean.setLoginUrl("/shiro/login"); // 登录成功后要跳转的链接         shiroFilterFactoryBean.setSuccessUrl("/shiro/index"); // 未授权界面; ----这个配置了没卵用，具体原因想深入了解的可以自行百度         shiroFilterFactoryBean.setUnauthorizedUrl("/shiro/wuquan"); //自定义拦截器         Map<String, Filter> filtersMap = new LinkedHashMap<String, Filter>(); //限制同一帐号同时在线的个数。         filtersMap.put("kickout", kickoutSessionControlFilter());         shiroFilterFactoryBean.setFilters(filtersMap); // 权限控制map.         Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>(); /*         我加了下面这段代码启动就报错，如果有人知道是为什么请联系我，谢谢         List<Resources> list=shiroServer.orders();         for(Resources itms:list){             filterChainDefinitionMap.put(itms.getKey(),itms.getVal());         }*/ //添加Shiro内置过滤器 /**          * Shiro内置过滤器，可以实现权限相关的拦截器          *    常用的过滤器：          *       anon: 无需认证（登录）可以访问          *       authc: 必须认证才可以访问          *       user: 如果使用rememberMe的功能可以直接访问          *       perms： 该资源必须得到资源权限才可以访问          *       role: 该资源必须得到角色权限才可以访问          */         filterChainDefinitionMap.put("/shiro/kickout", "anon");         filterChainDefinitionMap.put("/shiro/login", "anon");         filterChainDefinitionMap.put("/shiro/submitLogin", "anon");         filterChainDefinitionMap.put("/shiro/index", "authc");         filterChainDefinitionMap.put("/shiro/tianjia", "perms[insert]");         filterChainDefinitionMap.put("/shiro/update", "perms[update]");         shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap); return shiroFilterFactoryBean; } @Bean public SecurityManager securityManager() {         DefaultWebSecurityManager securityManager = new DefaultWebSecurityManager(); // 设置realm.         securityManager.setRealm(myShiroRealm()); // 自定义缓存实现 使用redis         securityManager.setCacheManager(cacheManager()); // 自定义session管理 使用redis         securityManager.setSessionManager(sessionManager()); return securityManager; } /**      * 身份认证realm; (这个需要自己写，账号密码校验；权限等)      * @return      */ @Bean public MyShiroRealm myShiroRealm() {         MyShiroRealm myShiroRealm = new MyShiroRealm(); return myShiroRealm; } /**      * cacheManager 缓存 redis实现      * 使用的是shiro-redis开源插件      *      * @return      */ public RedisCacheManager cacheManager() {         RedisCacheManager redisCacheManager = new RedisCacheManager();         redisCacheManager.setRedisManager(redisManager()); return redisCacheManager; } /**      * 配置shiro redisManager      * 使用的是shiro-redis开源插件      *      * @return      */ public RedisManager redisManager() {         RedisManager redisManager = new RedisManager();         redisManager.setHost("localhost");         redisManager.setPort(6379);         redisManager.setExpire(1800);// 配置缓存过期时间         redisManager.setTimeout(0); // redisManager.setPassword(password); return redisManager; } /**      * Session Manager      * 使用的是shiro-redis开源插件      */ @Bean public DefaultWebSessionManager sessionManager() {         DefaultWebSessionManager sessionManager = new DefaultWebSessionManager();         sessionManager.setSessionDAO(redisSessionDAO()); return sessionManager; } /**      * RedisSessionDAO shiro sessionDao层的实现 通过redis      * 使用的是shiro-redis开源插件      */ @Bean public RedisSessionDAO redisSessionDAO() {         RedisSessionDAO redisSessionDAO = new RedisSessionDAO();         redisSessionDAO.setRedisManager(redisManager()); return redisSessionDAO; } /**      * 限制同一账号登录同时登录人数控制      *      * @return      */ @Bean public KickoutSessionControlFilter kickoutSessionControlFilter() {         KickoutSessionControlFilter kickoutSessionControlFilter = new KickoutSessionControlFilter();         kickoutSessionControlFilter.setCacheManager(cacheManager());         kickoutSessionControlFilter.setSessionManager(sessionManager());         kickoutSessionControlFilter.setKickoutAfter(false);         kickoutSessionControlFilter.setMaxSession(1);         kickoutSessionControlFilter.setKickoutUrl("/shiro/kickout"); return kickoutSessionControlFilter; } /***      * 授权所用配置      *      * @return      */ @Bean public DefaultAdvisorAutoProxyCreator getDefaultAdvisorAutoProxyCreator() {         DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator = new DefaultAdvisorAutoProxyCreator();         defaultAdvisorAutoProxyCreator.setProxyTargetClass(true); return defaultAdvisorAutoProxyCreator; } /***      * 使授权注解起作用不如不想配置可以在pom文件中加入      * <dependency>      *<groupId>org.springframework.boot</groupId>      *<artifactId>spring-boot-starter-aop</artifactId>      *</dependency>      * @param securityManager      * @return      */ @Bean public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){         AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor = new AuthorizationAttributeSourceAdvisor();         authorizationAttributeSourceAdvisor.setSecurityManager(securityManager); return authorizationAttributeSourceAdvisor; } /**      * Shiro生命周期处理器      *      */ @Bean public LifecycleBeanPostProcessor getLifecycleBeanPostProcessor() { return new LifecycleBeanPostProcessor(); } /**      * 配置ShiroDialect,用于thymeleaf和shiro标签配合使用      */ @Bean public ShiroDialect getShiroDialect(){ return new ShiroDialect(); } 

7.Realm(凭证认证、权限获取)

package com.jbl.springboot_redis_shiro.shiroconfig; import com.jbl.springboot_redis_shiro.entity.User; import com.jbl.springboot_redis_shiro.server.ShiroServer; import org.apache.shiro.authc.*; import org.apache.shiro.authz.AuthorizationInfo; import org.apache.shiro.authz.SimpleAuthorizationInfo; import org.apache.shiro.realm.AuthorizingRealm; import org.apache.shiro.subject.PrincipalCollection; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import java.util.*; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 07:16  * @description:  */ public class MyShiroRealm extends AuthorizingRealm { private static org.slf4j.Logger logger = LoggerFactory.getLogger(MyShiroRealm.class); @Autowired private ShiroServer shiroServer; /**      * 认证信息.(身份验证) : Authentication 是用来验证用户身份      *      */ @Override protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authcToken) throws AuthenticationException {         logger.info("---------------- 执行 Shiro 凭证认证 ----------------------");         UsernamePasswordToken token = (UsernamePasswordToken) authcToken;         String name = token.getUsername();         String password = String.valueOf(token.getPassword()); // 从数据库获取对应用户名密码的用户         User userList = shiroServer.login(name,password); if (userList == null) { //用户名不存在 return null; //  shiro底层会抛出UnKnoAccountException 异常 }         logger.info("---------------- Shiro 凭证认证成功 ----------------------"); //判断密码 /**          * 第一个参数是否返回给controller里的login数据          * 第二个参数是数据库的密码          * 第三个参数是名字          */ return new SimpleAuthenticationInfo(userList,userList.getU_pwd(),""); } /**      * 授权      */ @Override protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {         logger.info("---------------- 执行 Shiro 权限获取 ---------------------");         Object principal = principals.getPrimaryPrincipal();         SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(); if (principal instanceof User) {             User userLogin = (User) principal; //根据名字查询角色             Set<String> roles = shiroServer.seRoles(userLogin.getU_name());             authorizationInfo.addRoles(roles); //根据名字查询权限             Set<String> permissions = shiroServer.quanxian(userLogin.getU_name());             authorizationInfo.addStringPermissions(permissions); }         logger.info("---- 获取到以下权限 ----");         logger.info(authorizationInfo.getStringPermissions().toString());         logger.info("---------------- Shiro 权限获取成功 ----------------------"); return authorizationInfo; } } 

8.限制并发人数登陆

package com.jbl.springboot_redis_shiro.shiroconfig; import com.alibaba.fastjson.JSON; import com.jbl.springboot_redis_shiro.entity.User; import org.apache.shiro.cache.Cache; import org.apache.shiro.cache.CacheManager; import org.apache.shiro.session.Session; import org.apache.shiro.session.mgt.DefaultSessionKey; import org.apache.shiro.session.mgt.SessionManager; import org.apache.shiro.subject.Subject; import org.apache.shiro.web.filter.AccessControlFilter; import org.apache.shiro.web.util.WebUtils; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import java.io.IOException; import java.io.PrintWriter; import java.io.Serializable; import java.util.Deque; import java.util.HashMap; import java.util.LinkedList; import java.util.Map; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 07:17  * @description: 限制并发人数登陆  */ public class KickoutSessionControlFilter extends AccessControlFilter { private String kickoutUrl; //踢出后到的地址 private boolean kickoutAfter = false; //踢出之前登录的/之后登录的用户 默认踢出之前登录的用户 private int maxSession = 1; //同一个帐号最大会话数 默认1 private SessionManager sessionManager; private Cache<String, Deque<Serializable>> cache; public void setKickoutUrl(String kickoutUrl) { this.kickoutUrl = kickoutUrl; } public void setKickoutAfter(boolean kickoutAfter) { this.kickoutAfter = kickoutAfter; } public void setMaxSession(int maxSession) { this.maxSession = maxSession; } public void setSessionManager(SessionManager sessionManager) { this.sessionManager = sessionManager; } //设置Cache的key的前缀 public void setCacheManager(CacheManager cacheManager) { this.cache = cacheManager.getCache("shiro_redis_cache"); } @Override protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception { return false; } @Override protected boolean onAccessDenied(ServletRequest request, ServletResponse response) throws Exception {         Subject subject = getSubject(request, response); if(!subject.isAuthenticated() && !subject.isRemembered()) { //如果没有登录，直接进行之后的流程 return true; }           Session session = subject.getSession();         User user = (User) subject.getPrincipal();         String username = user.getU_name();         Serializable sessionId = session.getId(); //读取缓存   没有就存入         Deque<Serializable> deque = cache.get(username); //如果此用户没有session队列，也就是还没有登录过，缓存中没有 //就new一个空队列，不然deque对象为空，会报空指针 if(deque==null){             deque = new LinkedList<Serializable>(); } //如果队列里没有此sessionId，且用户没有被踢出；放入队列 if(!deque.contains(sessionId) && session.getAttribute("kickout") == null) { //将sessionId存入队列             deque.push(sessionId); //将用户的sessionId队列缓存             cache.put(username, deque); } //如果队列里的sessionId数超出最大会话数，开始踢人 while(deque.size() > maxSession) {             Serializable kickoutSessionId = null; if(kickoutAfter) { //如果踢出后者                 kickoutSessionId = deque.removeFirst(); //踢出后再更新下缓存队列                 cache.put(username, deque); } else { //否则踢出前者                 kickoutSessionId = deque.removeLast(); //踢出后再更新下缓存队列                 cache.put(username, deque); } try { //获取被踢出的sessionId的session对象                 Session kickoutSession = sessionManager.getSession(new DefaultSessionKey(kickoutSessionId)); if(kickoutSession != null) { //设置会话的kickout属性表示踢出了                     kickoutSession.setAttribute("kickout", true); } } catch (Exception e) {//ignore exception } } //如果被踢出了，直接退出，重定向到踢出后的地址 if (session.getAttribute("kickout") != null) { //会话被踢出了 try { //退出登录                 subject.logout(); } catch (Exception e) { //ignore } saveRequest(request);              Map<String, String> resultMap = new HashMap<String, String>(); //判断是不是Ajax请求 if ("XMLHttpRequest".equalsIgnoreCase(((HttpServletRequest) request).getHeader("X-Requested-With"))) {                 resultMap.put("user_status", "300");                 resultMap.put("message", "您已经在其他地方登录，请重新登录！"); //输出json串 out(response, resultMap); }else{ //重定向                 WebUtils.issueRedirect(request, response, kickoutUrl); } return false; } return true; } private void out(ServletResponse hresponse, Map<String, String> resultMap) throws IOException { try {             hresponse.setCharacterEncoding("UTF-8");             PrintWriter out = hresponse.getWriter();             out.println(JSON.toJSONString(resultMap));             out.flush();             out.close(); } catch (Exception e) {             System.err.println("KickoutSessionFilter.class 输出JSON异常，可以忽略。"); } } } 

9.Controller层

import com.jbl.springboot_redis_shiro.server.ShiroServer; import org.apache.shiro.SecurityUtils; import org.apache.shiro.authc.*; import org.apache.shiro.crypto.hash.SimpleHash; import org.apache.shiro.subject.Subject; import org.apache.shiro.util.ByteSource; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.RequestMapping; /**  * @author yfj  * @version 1.0  * @date 2020/04/15 下午 02:37  * @description: 控制层  */ @RequestMapping("/shiro") @Controller public class ControllerDemo { @Autowired private ShiroServer shiroServer; @RequestMapping("/login") public String login(){ return "login"; } //被踢出后跳转的页面 @RequestMapping("/kickout") public String kickout(){ return "kickout"; } @RequestMapping("/submitLogin") public String submitLogin(String username, String password, Model model) { //加密格式         String hashAlgorithmName="MD5"; //用户输入的密码         String credentials =password; //盐值         Object salt = ByteSource.Util.bytes (username) ; //加密次数 int hashIterations = 1024; //加密         Object result =new SimpleHash(hashAlgorithmName,credentials, salt, hashIterations);         System.out.println(result); try { //使用shiro 编写认证操作             UsernamePasswordToken token = new UsernamePasswordToken(username, String.valueOf(result)); //拿到subject             Subject subject = SecurityUtils.getSubject(); // 执行登陆方法             subject.login(token); // 执行到这里说明用户已登录成功 return "redirect:/shiro/index"; }catch (IncorrectCredentialsException e) {             model.addAttribute("msg", "密码错误"); return "login"; }catch (UnknownAccountException e){ //如果有登陆失败就会跳入这里             model.addAttribute("msg","用户名不存在"); //UnknownAccountException(用户不存在) return "login"; } } @RequestMapping("/tianjia") public String tianjia(){ return "user/tianjai"; } @RequestMapping("/update") public String update(){ return "user/update"; } @RequestMapping("/index") public String index(){ return "user/index"; } @RequestMapping("/wuquan") public String wuquan(){ return "yichang"; } } 

10.页面

1.index.html (主页面)

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <div shiro:hasPermission="insert"> <a href="/shiro/tianjia">进入用户添加功能</a><br/> </div> <div shiro:hasPermission="update"> <a href="/shiro/update">进入用户修改功能</a><br/> </div> <div shiro:hasPermission="select"> <a>显示</a> </div> </body> </html> 

2.tianjii.html（添加页面）

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h1>添加</h1> </body> </html> 

3.update (修改页面)

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h1>修改</h1> </body> </html> 

4.异常页面

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h1>异常页面</h1> </body> </html> 

5.多台设备登陆此账号提醒页面

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h1>多台设备登陆此账号提醒页面</h1> </body> </html> 

6.登陆页面

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>登陆页面</title> </head> <body> <font style="color:red"  th:text="${msg}"></font> <form action="/shiro/submitLogin" method="post">     用户名:<input type="text" name="username"/><br/>     密码:<input type="text" name="password"/><br/> <input type="submit" value="登陆"/> </form> </body> </html> 

7.无权限访问提醒页面

<!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <title>Title</title> </head> <body> <h1>你无权访问这个页面</h1> </body> </html>