shiro 加盐认证

      <!--shiro 的web过滤器-->
    <bean id="shiroFilter" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
        <property name="securityManager" ref="securityManager"></property>
        <!--loginUrl认证提交地址 ，如果没有认证将会请求此地址进行认证，
         请求地址由formAuthenticationFilter进行表单认证-->
        <property name="loginUrl" value="/login.action"></property>
        <!--认证成功后，跳转路径 建议不配置，认证成功后自动到上一个请求路径-->
        <!--<property name="successUrl" value="/first.action"></property>-->
        <!--通过unauthorizedUrl指定没有权限操作时跳转页面-->
        <property name="unauthorizedUrl" value="/refuse.jsp"></property>
        <!--过滤器定义，从上到下顺序执行，一般将/** 放在最下面-->
        <property name="filterChainDefinitions">
            <value>
                <!--/**=anon 所有url都可以匿名访问-->
                <!--/**=anon-->
                <!--静态资源进行匿名访问-->
                /images/**=anon
                /js/**=anon
                /styles/**=anon

                <!--logoutFilter 退出自动清除session-->
                /logout.action=logout

                <!-- /** = authc 所有url都必须认证通过才可以访问-->
                /** = authc
                <!-- /** = anon所有url都可以匿名访问 -->
            </value>
        </property>
    </bean>
    <bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
        <property name="realm" ref="customRealm"></property>
    </bean>   

 <bean id="customRealm" class="cn.tencent.shiro.shiro.CustomRealm">
        <property name="credentialsMatcher" ref="credentialsMatcher"></property>
    </bean>

    <!--凭证匹配器-->
    <bean id="credentialsMatcher" class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
        <property name="hashAlgorithmName" value="md5"></property>
        <property name="hashIterations" value="1"></property>
    </bean>

自定义Realm

public class CustomRealm extends AuthorizingRealm {

    //注入service
    @Autowired
    private SysService sysService;

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {

        return null;
    }

    // 设置realm的名称
    @Override
    public void setName(String name) {
        super.setName("customRealm");
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
        //1 从token中取出用户名
        String userCode = (String) token.getPrincipal();

        //2 数据库中获取
        SysUser  sysUser = sysService.findSysUserByUserCode(userCode);

        if (sysUser == null) {
            return null;
        }

        String password = sysUser.getPassword();
        String salt = sysUser.getSalt();


        ActiveUser activeUser = new ActiveUser();
        activeUser.setUserid(sysUser.getId());
        activeUser.setUsercode(sysUser.getUsercode());
        activeUser.setUsername(sysUser.getUsername());

        List<SysPermission> menuLists = null;
        try {
            menuLists = sysService.findMenuListByUserId(sysUser.getId());
        } catch (Exception e) {
            e.printStackTrace();
        }
        activeUser.setMenus(menuLists);

        // password
        // 如果查询到了,返回AuthenticationInfo
        // 如果密码不匹配,抛出IncorrectCredentialsException
        SimpleAuthenticationInfo simpleAuthenticationInfo = new SimpleAuthenticationInfo(activeUser,
                sysUser.getPassword(), ByteSource.Util.bytes(salt), this.getName());

        return simpleAuthenticationInfo;
    }
}

login.action处理

  @RequestMapping(value = "login.action")
    public String login(HttpServletRequest request) throws Exception {

        //登录失败从request中获取认证异常信息  shiroLoginFailure 就是shiro异常类的全限定名
        String exceptionClassName = (String) request.getAttribute("shiroLoginFailure");
        //根据shiro返回的异常类型路径判断，抛出指定异常信息
        if (exceptionClassName != null) {
            if (UnknownAccountException.class.getName().equals(exceptionClassName)) {
                throw new CustomException("账号不存在");
            } else if (IncorrectCredentialsException.class.getName().equals(exceptionClassName)) {
                throw new CustomException("账号密码错误");
            } else {
                throw new Exception();
            }
        }
        ////此方法不处理登陆成功（认证成功），shiro认证成功会自动跳转到上一个请求路径
        //login.jsp界面
        return "login";
    }