Shiro完成短信验证码登录的实例

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm">
       <bean class="com.smzc.apps.order.web.auth.OrderAuthorizingRealm" />
    </property>
    <property name="cacheManager">
       <bean class="org.apache.shiro.cache.ehcache.EhCacheManager" />
    </property>
    <property name="sessionManager">
       <bean class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
           <property name="sessionIdCookie">
               <bean class="org.apache.shiro.web.servlet.SimpleCookie">
                   <constructor-arg value="SESSIONID"/>
                   <property name="httpOnly" value="true"/>
                   <property name="maxAge" value="-1"/>
               </bean>
           </property>
       </bean>
    </property>
</bean>

<bean class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
    <property name="staticMethod" value="org.apache.shiro.SecurityUtils.setSecurityManager" />
    <property name="arguments">
        <list>
            <ref bean="securityManager"/>
        </list>
    </property>
</bean>

<!-- shiroFilter -->
<bean id="shiroFilterFactoryBean" class="org.apache.shiro.spring.web.ShiroFilterFactoryBean">
    <!-- Shiro的核心安全接口,这个属性是必须的 -->
    <property name="securityManager" ref="securityManager" />
    <!-- 要求登录时的链接,非必须的属性,默认会自动寻找Web工程根目录下的"/login.jsp"页面 -->
    <property name="loginUrl" value="/views/login" />
    <!-- 登录成功后要跳转的连接 -->
    <property name="successUrl" value="/views/index" />
    <!-- 用户访问未对其授权的资源时,所显示的连接 -->
    <property name="unauthorizedUrl" value="/views/common/unauthorized" />
    <property name="filters">
        <map>
            <entry key="logout">
                <bean class="org.apache.shiro.web.filter.authc.LogoutFilter">
                    <property name="redirectUrl" value="/views/login"/>
                </bean>
            </entry>
        </map>
    </property>
    <!-- 配置Shiro过滤链 -->
    <property name="filterChainDefinitions">
        <value>
            /api/user/login/** = anon
            /api/** = authc
            /logout = logout
            /** = anon
        </value>
    </property>
</bean>

public class OrderAuthorizingRealm extends AuthorizingRealm implements InitializingBean {
    @Resource
    private AuthorizingService authorizingService;
    @Value("${app.role.permissions:}")
    private String rolePermissionsString;
    private Map<String, Set<String>> rolePermissions;

    @Override
    protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principalCollection) {
        final SysUser sysUser = (SysUser)super.getAvailablePrincipal(principalCollection);
        final String role = sysUser.getUserRole().getRole();
        final SimpleAuthorizationInfo authorizationInfo = new SimpleAuthorizationInfo(Sets.newHashSet(role));
        authorizationInfo.setStringPermissions(rolePermissions.get(role));
        return authorizationInfo;
    }

    @Override
    protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken authenticationToken) throws AuthenticationException {
        final UsernamePasswordToken usernamePasswordToken = (UsernamePasswordToken) authenticationToken;
        final String mobile = usernamePasswordToken.getUsername();
        final String validateCode = authorizingService.getCodeByMobile(mobile);
        if (StringUtils.isBlank(validateCode)) {
            throw new ExpiredCredentialsException("验证码已失效#[" + mobile + "]");
        }
        final List<SysUser> sysUserList = authorizingService.getUserByMobile(mobile);
        if (CollectionUtils.isEmpty(sysUserList)) {
            throw new UnknownAccountException("用户账户不存在#[" + mobile + "]");
        }
        if (sysUserList.size() > 1) {
            throw new ConcurrentAccessException("用户存在多个账户#[" + mobile + "]");
        }
        final SysUser sysUser = sysUserList.iterator().next();
        if (!sysUser.getStatus().isAllowLogin()) {
            throw new DisabledAccountException("用户账户不可用#[" + mobile + "]");
        }
        // 注意：SimpleAuthenticationInfo中principal表示验证主体，供后续获取权限标识符和当前登录用户信息使用， credentials表示正确的凭证串，shiro会自动与用户登录时填入的值进行密钥匹配后进行对比。
        // credentials也可以通过setCredentialsSalt设置加密的salt
        return new SimpleAuthenticationInfo(sysUser, validateCode.toCharArray(), super.getName());
    }

    @Override
    public void afterPropertiesSet() throws Exception {
        if (StringUtils.isBlank(rolePermissionsString)) {
            throw new NullPointerException("未初始化权限配置");
        }
        rolePermissions = Maps.newHashMap();
        final JSONObject jsonObject = JSON.parseObject(rolePermissionsString);
        final Iterator<Map.Entry<String, Object>> entryIterator = jsonObject.entrySet().iterator();
        while (entryIterator.hasNext()) {
            final Map.Entry<String, Object> objectEntry = entryIterator.next();
            rolePermissions.put(objectEntry.getKey(), Sets.newHashSet(objectEntry.getValue().toString().split(",")));
        }
    }
}

@RestController
@RequestMapping(value = "/api/user", produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public class UserApiController extends BasicApiController {

    @Resource
    private SysUserService userService;

    /**
    * 用户登录
    */
    @RequestMapping(value = "/login/{mobileNo}/{code}", method = RequestMethod.GET)
    public Output login(@PathVariable String mobileNo, @PathVariable String code) throws ServiceException {
        Subject subject = SecurityUtils.getSubject();
        UsernamePasswordToken token = new UsernamePasswordToken(mobileNo, code);
        subject.login(token);
        token.clear();
        return MapOutput.createSuccess();
    }

    /**
    * 用户登出
    */
    @RequestMapping(value = "/logout/{mobileNo}", method = RequestMethod.GET)
    public Output logout(@PathVariable String mobileNo) throws ServiceException {
        SecurityUtils.getSubject().logout();
        return MapOutput.createSuccess();
    }
}

<bean id="securityManager" class="org.apache.shiro.web.mgt.DefaultWebSecurityManager">
    <property name="realm">
<!--BEGIN: 设置凭证器------------------>
       <bean class="com.smzc.apps.order.web.auth.OrderAuthorizingRealm">
         <property name="credentialsMatcher">
           <bean class="org.apache.shiro.authc.credential.PasswordMatcher" />
         </property>
       </bean>
<!--END: 设置凭证器------------------>
    </property>
    <property name="cacheManager">
       <bean class="org.apache.shiro.cache.ehcache.EhCacheManager" />
    </property>
    <property name="sessionManager">
       <bean class="org.apache.shiro.web.session.mgt.DefaultWebSessionManager">
           <property name="sessionIdCookie">
               <bean class="org.apache.shiro.web.servlet.SimpleCookie">
                   <constructor-arg value="SESSIONID"/>
                   <property name="httpOnly" value="true"/>
                   <property name="maxAge" value="-1"/>
               </bean>
           </property>
       </bean>
    </property>
</bean>