1 @Test
 2     public void helloWorldTest(){
 3         IniSecurityManagerFactory factory =
 4                 new IniSecurityManagerFactory("classpath:shiro-jdbc-realm.ini");
 5         SecurityManager manager = factory.getInstance();
 6        //全局设置，一次即可
 7         SecurityUtils.setSecurityManager(manager);
 8         Subject subject = SecurityUtils.getSubject();
 9         UsernamePasswordToken token =
10                 new UsernamePasswordToken("Peter", "123");
11         try{
12                subject.login(token);
13             }catch (AuthenticationException e){
14                 e.printStackTrace();
15             }
16 
17         Assert.assertEquals(true,subject.isAuthenticated());
18         //退出登录
19         subject.logout();

[users]
Peter=123
Tom=321

1 public interface Realm {
2     //获得唯一的名字
3     String getName();
4     //判断此realm是否支持此token
5     boolean supports(AuthenticationToken token);
6     //获取token认证信息
7     AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException;
8 }

 1 public class MyRealm implements Realm{
 2 
 3     public String getName() {
 4         return "myRealm";
 5     }
 6 
 7     public boolean supports(AuthenticationToken authenticationToken) {
 8         //仅支持UsernamePasswordToken类型
 9         return authenticationToken instanceof UsernamePasswordToken;
10     }
11 
12     public AuthenticationInfo getAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
13         //获取用户名
14         String username= (String) token.getPrincipal();
15         //获取密码
16         String password=new String((char[]) token.getCredentials());
17         if(!"Peter".equals(username)){
18             throw new UnknownAccountException();
19         }
20         if(!"123".equals(password)){
21             throw new IncorrectCredentialsException();
22         }
23         return new SimpleAuthenticationInfo(username,password,getName());
24     }
25 }

1 myRealm=com.tang.shirotest.LoginLogoutTest
2 securityManager.realms=$myRealm

1 [main]
2 jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm
3 dataSource=com.alibaba.druid.pool.DruidDataSource
4 dataSource.driverClassName=com.mysql.jdbc.Driver
5 dataSource.url=jdbc:mysql://localhost:3306/shiro
6 dataSource.username=root
7 dataSource.password=jiapi1990
8 jdbcRealm.dataSource=$dataSource
9 securityManager.realms=$jdbcRealm

public interface Authenticator {
    AuthenticationInfo authenticate(AuthenticationToken var1) throws AuthenticationException;
}

 1 #指定 securityManager 的 authenticator 实现
 2 authenticator=org.apache.shiro.authc.pam.ModularRealmAuthenticator
 3 securityManager.authenticator=$authenticator
 4 #指定 securityManager.authenticator 的 authenticationStrategy
 5 allSuccessfulStrategy=org.apache.shiro.authc.pam.AllSuccessfulStrategy
 6 securityManager.authenticator.authenticationStrategy=$allSuccessfulStrategy
 7 myRealm1=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm1
 8 myRealm2=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm2
 9 myRealm3=com.github.zhangkaitao.shiro.chapter2.realm.MyRealm3
10 securityManager.realms=$myRealm1,$myRealm3

 1 public interface AuthenticationStrategy {
 2     //在所有 Realm 验证之前调用
 3     AuthenticationInfo beforeAllAttempts(Collection<? extends Realm> realms, AuthenticationToken token) throws AuthenticationException;
 4     //在每个 Realm 之前调用
 5     AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException;
 6     //在每个 Realm 之后调用
 7     AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo singleRealmInfo, AuthenticationInfo aggregateInfo, Throwable t)
 8             throws AuthenticationException;
 9     ////在所有 Realm 之后调用
10     AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException;
11 }

 1 public class AtLeastTwoAuthenticatorStrategy extends AbstractAuthenticationStrategy {
 2 
 3     @Override
 4     public AuthenticationInfo beforeAllAttempts(Collection<? extends Realm> realms, AuthenticationToken token) throws AuthenticationException {
 5         return new SimpleAuthenticationInfo();//返回一个权限的认证信息
 6     }
 7 
 8     @Override
 9     public AuthenticationInfo beforeAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException {
10         return aggregate;//返回之前合并的
11     }
12 
13     @Override
14     public AuthenticationInfo afterAttempt(Realm realm, AuthenticationToken token, AuthenticationInfo singleRealmInfo, AuthenticationInfo aggregateInfo, Throwable t) throws AuthenticationException {
15         AuthenticationInfo info;
16         if (singleRealmInfo == null) {
17             info = aggregateInfo;
18         } else {
19             if (aggregateInfo == null) {
20                 info = singleRealmInfo;
21             } else {
22                 info = merge(singleRealmInfo, aggregateInfo);
23             }
24         }
25 
26         return info;
27     }
28 
29     @Override
30     public AuthenticationInfo afterAllAttempts(AuthenticationToken token, AuthenticationInfo aggregate) throws AuthenticationException {
31         if (aggregate == null || CollectionUtils.isEmpty(aggregate.getPrincipals()) || aggregate.getPrincipals().getRealmNames().size() < 2) {
32             throw new AuthenticationException("Authentication token of type [" + token.getClass() + "] " +
33                     "could not be authenticated by any configured realms.  Please ensure that at least two realm can " +
34                     "authenticate these tokens.");
35         }
36 
37         return aggregate;
38     }
39 }